Today’s announcement by IBM that they are acquiring Neocleus Development Partner, BigFix, will rock the PC market in a way that surpasses any other acquisition in the past decade. 

Immediate Impact

First off, this will dramatically change the PC Lifecycle Management and PC Security markets by combining the award-winning BigFix management and security technology with IBM’s vast sales, service and partner networks.  As we’ve spoken to customers, analysts and other experts in the PC management market over the past 3 to 4 years, it has become apparent that BigFix’ approach, centered around an intelligent client technology and super-scalable architecture, is far superior to the existing oligopoly of Microsoft System Center,  Symantec Altiris Client Management Suite, and LANDesk.   In the best estimate of market share in the PCLM space, Microsoft System Center currently accounts for about 60-65% of the market.   This position has been secured not by technological superiority, but because Microsoft had a stronger sales & marketing channel than some of the smaller competitors, such as BigFix.   Growing organically, BigFix has been able to get to a relatively strong market size of about 10 million managed endpoints.  By combining with IBM’s sales and global services teams, that number could easily grow to 100 million within the next few years – and much of that could come at the expense of Microsoft, especially if IBM builds a Global Services practice around migrating customers to the new offering.

The Future?  IBM becomes a Relevant PC Platform Vendor Again

A secondary benefit that will occur by this merger is probably not so evident but could have an even broader impact on Microsoft, VMware and others.  It revolves around IBM getting into the virtualization market.  As announced earlier this year, BigFix and Neocleus have been collaborating on a partnership where client virtualization is merged with systems management and security technologies to create a new type of model, whereby the sytems & security agents reside OUTSIDE the core operating system instance, in a completely secure and protected operating system “stub”.   When you couple this with the work that Intel is doing with vPro and Active Management Techology (AMT) , you end up with a completely new PC operating platform where Intel vPro is the base, AMT becomes a malleable management platform and IBM virtualization and management technologies sit on top, taking advantage of the underlying Intel paltform.   In this architecture, the PC is no longer bound to the single OS instance.  Windows becomes just a guest operating system – used only for the few legacy applications that require Win32 support.  Over time, as more and more apps move to a web or other model, the importance of this Windows instance becomes diminshed.

Congratulations to Dave, Amrit, Philippe, Dennis, Greg and the rest of the BigFix team.  It should be a very fun period for them, and great for customers, as this plays out.

I was invited to sit in on a Podcast with Dana Gardner of E-Commerce Times as well as a few industry luminaries to discuss the future of the client.  We discussed a lot of the trends in client computing out there right now, and client virtualization was one that seemed poised to disrupt the status quo within the next few years.  The discussion was quite spirited and I came away even more excited that Neocleus and client virtualization will change the way computing is done in the near future.

Here’s a copy of the article, transcript and a link to the podcast.

http://www.ecommercetimes.com/story/Time-for-Some-Client-Side-Disruption-70145.html?wlc=1275854769

Remember, virtually, ANYTHING is possible!

The concept of Bring your Own PC (BYOPC) has been picking up steam over the last year or so inside of the Enterprise community.  The ability to utilize an employee’s personally owned computer as both a work environment in parallel with the personal space is seen as a way to lower the TCO for the business in both CAPEX and OPEX.  Client hypervisors offer the promise of fulfilling the BYOPC vision since a user’s personal environment can now be a separate entity from a secondary virtual machine that provides the locked down and  IT controlled work environment.

However, there are specific areas where issues can arise that the normal approach to adding a hypervisor makes the BYOPC model difficult without the proper approach.  Neocleus has thought through these issues and made sure that NeoSphere has addressed them in a unique and pragmatic way.  (Click here to see a NeoSphere enabled BYOPC scenario).

• Enable Existing Personal Windows PCs – A personal environment is just that, personal.  It must be enabled without destroying state or the user experience.  In order for realistic deployment to happen, the system must be upgraded in-place.  The NeoSphere installer allows a hypervisor, Virtual Runtime Environment and secondary VM to be placed under an existing Windows installation, even if the drive is software encrypted.  It does so without requiring the P2V conversion of the file system to a VHD or VMDK format.  NTFS remains intact.  NeoSphere provides the ability to run VHDs and VMDKs, however it is not a requirement.
• Support Device Diversity – Typically in a VM environment, you need specialized drivers (emulated or paravirtualized) that work with the hypervisor layer to empower devices.  However, there are over 5 million devices in the client world and most don’t even come with as much as a Linux driver, let alone a hypervisor capable driver.  The user needs to be able to plug in any of these devices including random devices like that Wal-Mart USB picture frame they got for Christmas from crazy Aunt Jenny who hears you like “technology”.  Neocleus is the only company to productize the pass-through device model, allowing native Windows drivers to pass-through the hypervisor and control the device directly, providing the greatest range of diverse devices.  Neocleus also supports emulation and PV for flexibility.
• Maintain the Rich User Experience – Because NeoSphere pass-through takes out the software context switch associated with emulation and paravirtualized drivers, critical elements such as graphics performance are maintained at native PC levels.  Windows Aero and glass as well as video performance, etc. are the same, maintaining the rich user experience that Windows provides.  Pass-through also guarantees that devices will have a driver that will allow them to operate without having to search for a special driver.
• Preserve OEM Support – Windows OS, applications and devices must retain the ability to be serviced from the manufacturer without voiding the support agreement.  Through NeoSphere pass-through and keeping the NTFS file system intact with our minimally invasive P2V process; IT professionals and OEM support personnel can troubleshoot Windows OS, application and device issues as they normally would if the NeoSphere platform wasn’t present.

Neocleus NeoSphere is the only pragmatic solution to enable a BYOPC environment!

Remember, VIRTUALLY anything is possible!

Hello everyone.  It’s been pretty crazy since our announcement of the OEM with BigFix and we have been inundated with requests for overviews of the NeoSphere platform.  In order to help shortcut the fulfillment of these requests (not to mention take the load off of some of us), we have created a new “Learn More” section (found here) as part of our web site.   You’ll find white papers and other resources to help you better understand the NeoSphere platform. 

I have also posted a couple of new videos.  One is the “Neocleus Platform Overview Presentation and Demo” which offers a presentation overview of the NeoSphere basics as well as a demo of the platform including VRE installation, the pass-through device model, and an anti-virus executing outside of Windows in the NeoSphere environment, capturing and quarantining a virus inside of Windows.  The second video is titled “Neocleus NeoSphere Platform Demo Only” where you get the same demo, minus the presentation.

Keep a look out for additional videos and white papers in the near future. 

Remember, VIRTUALLY, anything is possible!

An article came across my email the other day titled “VMware, Citrix struggle with bare metal hypervisor”. (Article can be seen here: http://ow.ly/1rbAp).  The biggest issue that was hampering the efforts was the device driver model, and I can understand why this is a big issue.

One of the biggest misunderstandings in the market is that a client hypervisor is simply a server hypervisor that is running on a client PC with some bells and whistles for distributed management.  This misperception comes from many places but mainly because you can, in fact, run Hyper-V, XEN Server or ESXi right on your laptop with a single Windows client instance and have it essentially work.  However, when we look at the practical requirements of Enterprise computing, there are a wide range of use cases that require specifically tailored configurations for local client computing, which a client hypervisor is specifically designed to handle and a server hypervisor is not.  This is most clearly personified in the device driver model.

Server hypervisors interact with a finite and known set of devices.  Typically, servers have no requirement for a rich UI experience or multimedia capabilities, let alone a monitor in its lid like a laptop.  It also does not have batteries and the power management concerns that accompany portable computing, nor does a server typically sleep.  Most importantly, the server doesn’t have a random set of USB devices that connect to it and are expected to simply work without special IT intervention.  Device diversity and performance are very big concerns when it comes to maintaining the rich user experience of client computing.  In most client hypervisors (as in server hypervisors), there are typically two device driver models: emulation and paravirtualization.  However, Neocleus has productized a third model, known as pass-through, which utilizes the native Windows device driver in conjunction with the client hypervisor.  This model is critical for reaching the broadest set of client computing use cases in the Enterprise.   

I put together a comparison white paper on the three device driver models and how they can work independently or together so IT can reach their desktop goals.  It’s entitled “Client Hypervisor Device Driver Overview” and can be found here.

In the blog post entitled “Client Hypervisor Management: Evolution NOT Revolution”, I went through a bit of the history of the server hypervisor and management.  When we looked deeper into the rise of the hypervisor in the data center, it really wasn’t until the central management capabilities came to being that the true management potential of hypervisors could be realized.  However there was an additional dimension to this story.  Once an API was made available to the hypervisor, a whole new realm of start-up companies came into being.

It was at this point that the next wave of innovation came to bear through a number of start-up and established companies. Through these companies’ expression of their own management logic on top of the hypervisor, the hypervisor platform benefits moved from hardware consolidation with a management trade-off to a truly transformative management paradigm, despite being based on a closed source hypervisor.  The result was a tremendous rising tide that floated many boats.

This unlikely “Band of Brothers”, although in competition for customer dollars, produced and continues to produce an innovative wave in how the data center is designed and managed.  Now, with Microsoft pushing the hypervisor to commoditization and Citrix XEN Server being open source, the benefit to IT in the form of downward price pressure, with ever increasing capabilities, continues to be a huge win for the customer. 

When looking at the client PC, the industry is at the same inflection point.  There is tremendous management and security TCO reduction potential in separating the management environment from the user application environment and is the next logical progression for PC architectures.  There are currently only a handful of companies that are working on changing the fundamental architecture of a PC through a client hypervisor.  This new virtualization “Band of Brothers” includes Neocleus, VMware, Citrix and Virtual Computer.   If we dig a little deeper though, you’ll find that VMware has been working on CVP (which still remains to be seen), while Neocleus and Virtual Computer both use XEN, which is an open source project managed by Citrix.  Citrix also has their own XEN based open and closed source client hypervisor projects called the XCI project.  The availability of the XEN hypervisor as an open source project has further accelerated the ability for third parties to innovate on the PC Hypervisor and more rapidly bring the next evolution in PC architecture to market in unprecedented time when compared to their server counterparts.   This innovation path is already stretching to a party beyond the direct players with the visionary BigFix, OEM’ing Neocleus NeoSphere (announcement seen here). 

While each company might have a different vision for how management and security logic is expressed, we all share this common vision that the client based hypervisor will be the driving force that transforms PC architecture to the next logical architectural evolution and will drive client side innovation in a whole new dimension.  It will be the combined ideas, perspectives and approaches of these innovative companies, working together to build a strong XEN client hypervisor foundation, which will drive this next great PC evolution.  In the end, a rising tide floats all boats and the customer will be the real winner.

Virtualization has forever changed the server room and it’s about to do the same on the desktop.  Whether it is virtualization in a macro context (servers, storage, networks, desktops (VDI), Server Based Computing (SBC), etc.) or in the microcosm of a single machine (user settings, registry, files, applications (which has a fond place in this author’s heart)), virtualization now plays a first order and indispensible role in providing the necessary flexibility for next generation computing stacks.  In the Enterprise data center today, the question of “will I deploy a physical or virtual server?” is almost non-existent.  How else would a cloud be pragmatically possible except through the coalescing of multiple virtualization technologies?

If we look back just 10 years ago, the data center was an immobile collection of rack mounted servers, each with a specific purpose, chugging along at 10% utilization.  Then along came the hypervisor, forever changing the way IT utilized servers.  Dozens of physical servers could be consolidated to a few boxes, but all was not bliss.  Instead of looking at 25 pizza boxes and knowing you had 25 servers, all of a sudden it was a black box where dozens of inactive servers with a few active servers lived, all with unknown patch levels that required an admin to touch a reduced number of physical boxes but actually touch more servers due to the sprawl.

Yes, consolidated servers held tremendous benefit, however it wasn’t until the central management capabilities and exposed API came to being around the hypervisor that the true management potential of hypervisors could be realized.  Now, with Microsoft pushing the hypervisor to commoditization and Citrix XEN Server being open source, the benefit to IT in the form of downward price pressure, with ever increasing capabilities, continues to be a huge win for the customer. 

When looking at the client PC, the industry is at the same inflection point.  Although PC lifecycle management (PCLM) systems have reached an evolved state, they are limited by the reliance on Windows to be managed from within itself, either through a client or network available API (WSMAN, WMI, PowerShell etc.); and rely on a mini-OS to be deployed before Windows itself can be delivered.  Due to these challenges, the Windows OS is being forced into unnatural architectures, such as VDI, in hopes of alleviating some of the challenges with deployment and management.  However, VDI is falling into niche status since the TCO results in OPEX and CAPEX are not materializing for a broad set of desktop replacement use cases, despite many innovations and improvements.

This means the timing is right to replay the hypervisor movie at the client level.  There is tremendous management and security TCO reduction potential in separating the management environment from the user application environment by applying virtualization directly to the client, and is the next logical progression for PC architectures.  However, client hypervisors alone, just like their server counterparts, will not provide the management capabilities needed to truly transform the desktop.  The benefits in essentially extending VDI principles to distributed clients (simplifying device driver models, “golden image” OS deployment, disaster recovery, out of band management of Windows, etc.) only occurs when the hypervisor is managed by a robust centralized management system.  The good news is that the majority of Enterprises already have these in place in the form of the PCLM system.  Instead of reinventing the wheel, the future of PC management is bringing together the client hypervisor with the existing PCLM system.  This will drive a new level of management capabilities.   Neocleus has built the platform to manifest this vision and we are already seeing adopters embrace it such as BigFix (check out this Podcast with Amrit Williams, CTO of BigFix).

Just as the hypervisor is a standard on the server side and has moved to commoditization, the client side hypervisor will most certainly follow the same path in the future, but it will be the evolution of the existing PCLM that will drive it.  What if the PC came with a client hypervisor built in and ready for subscription to the existing management system?  The possibilities could be endless…

The podcast is posted to Amrit’s security blog, “Beyond the Preimeter“, here:

http://blogs.bigfix.com/beyondtheperimeter/2010/03/12/episode-80-finding-the-so-what-of-virtualization/

Also, Business Week picked up this story in this article.  Cool!

As astute analysts such as Fred Broussard, Rachel Chalmers, Doug Brown and Brian Madden have pointed out; this is a HUGE step forward for the industry.  I don’t think it’s hyperbolic to say that managing and securing your PC will never be the same because of it.  Why?  Simple.  This addresses the number one reason for instability on the current PC - the operating system and the fact that you are forced to manage it from within the OS itself.  In Windows today, there are anywhere from 8-50 software agents running all the time trying to manage and secure the OS, applications, user state, etc.  as depicted in the diagram below.  This creates problems for your security and management systems because they are forced to compete for resources at the hardware, OS and state levels.  They are also vulnerable to any attack or failure within Windows itself.  

Current Windows Architecture, with Agents embedded in the OS

In a terrific post today, Amrit Williams, the BigFix CTO, explains why moving the PC management and security system OUTSIDE of the core OS (in most cases Windows) into a protected layer creates the next-generation “enlightened” systems management and security tools.  We couldn’t agree more and have created the NeoSphere platform to allow ISVs such as BigFix a way to easily snap client virtualization into their broader offerings.  Our stance is that we are good at client virtualization and have the strongest platform on the market.  We understand that others, such as BigFix, have excellent products that customers have spent years deploying.  So, the goal was to create distruptive Type 1 Client Virtualization technology that didn’t disrupt IT.  The BigFix licensing deal and subsequent partnerships will help make this a reality. 

The "Enlightened" PC - Security, Management and Help Desk Agents running outside the OS

Type 2 (hosted) virtualization usually comes with an easy solution. But type 1 (bare metal) virtualization, like Xen, complicates matters. Debugging must be offloaded to a remote Windows machine. The common solution, it seems, is to tunnel the hosted machine’s serial connection over TCP to another Windows machine where WinDBG is running, waiting anxiously for a bug check. There are many websites describing this setup in various component combinations. I have gathered here all the tricks I could find plus some more of my own to streamline the process and get rid of commercial software.

Lets dive into the nitty gritty little details, shall we?

Hosted Windows

Kernel debugging requires some boot parameters. Windows XP includes a utility called bootcfg.exe that makes this easy.

bootcfg /copy /id 1 /d "kernel debug"
bootcfg /raw "/DEBUG /DEBUGPORT=COM1" /id 2 /a
bootcfg /raw "/BAUDRATE=115200" /id 2 /a
bootcfg /copy /id 2 /d "kernel debug w/ break"
bootcfg /raw "/BREAK" /id 3 /a

This assumes you have only one operation system configured in Windows boot loader. If the boot loader menu shows up when Windows boots, you might need to add the flags on your own to C:\boot.ini.

Xen Host

Windows will now try to access the serial port in search of a debugger. Xen’s domain configuration file can be used to forward the serial port over TCP. Locate your domain configuration file and add the following line. The configuration files are usually located under /etc/xen.

serial='tcp::4444,server,nowait'

Debugger Machine

The server side is set and it’s time to move on to the client. As previously mentioned, WinDBG doesn’t care for TCP. Instead of the usual TCP to RS-232 solution, named pipes are used here. I wrote a little application called tcp2pipe (download available on the bottom) which simply pumps data between a TCP socket and a named pipe. It takes three parameters – IP, port and named pipe path. The IP address is the address of the Xen host and the port is 4444. For named pipe path, use \\.\pipe\XYZ, where XYZ can be anything.

tcp2pipe.exe 192.168.0.5 4444 \\.\pipe\XYZ

All that is left now is to fire up WinDBG and connect it to \\.\pipe\XYZ. This can be done from the menus, or from command line.

windbg -k com:pipe,port=\\.\pipe\XYZ

To make this even simpler, you can use kdbg.bat and pass it just the IP. It assumes WinDBG.exe is installed in c:\progra~1\debugg~1. If that’s not the case, you’ll have to modify it and point it to the right path.

tcp2pipe

Source code is included in zip file under public domain.

Download tcp2pipe.zip (mirror).

Happy debugging!