Facing the Reality: Virtualization in a Microkernelbased Operating System Matthias Lange, MOS, January 26th, 2016 matthias.lange@kernkonzept.com
Today's take aways Microkernel systems are used to build real-world systems being deployed to customers Understand what's beyond CPU and memory virtualization Sharply distinguish between Nanovisor, Microvisor, Microhypervisor, Secuvisor, Trustvisor and Budweiser.
Short Recap Hypervisor vs. VMM Virtualization "styles" L4Linux
Virtualization Objectives Reuse existing/legacy software Security Consolidation
Microkernel as Hypervisor Less code, less errors Improvements over monolithic kernels Fault isolation Improved access control Flexibility Needs runtime environment
Fiasco.OC + L4Re 3rd gen. microkernel + runtime environment x86, ARM (and MIPS), SMP support, 64bit support SVM, VT-x, ARM VE, (MIPS VM) L4Re provides basic services Virtual Machines are just a special type of task State Page table
VM Non-root mode Root mode... Driver Service VMM (e.g. Karma) L4Re Runtime Environment L4Re Microkernel SVM / VT-x Support Ring 3 Ring 0 x86-style Virtualization
ARM Hardware Assisted Virtualization Non-secure World Secure World PL0 User Trusted Services PL1 Kernel Trusted OS Monitor
ARM Hardware Assisted Virtualization Non-secure World Secure World PL0 User User Trusted Services PL1 Kernel Kernel Trusted OS PL2 Hypervisor PL3 Monitor
ARM Hardware Assisted Virtualization Non-secure World Secure World PL0 User L4Re App Trusted Services PL1 Kernel VMM Trusted OS PL2 L4Re Microkernel PL3 Monitor
Virtualization: L4Linux Applicable to non-virtualizable platforms Binary compatible to native Firefox Gimp Up-to-date Linux L4Linux kernel Secure App Native App Infrastructure Microkernel Hardware (CPU, Memory, Devices)
Taming the Robots
Device Accumulation Private Business Development You name it
Security Emerging threats Existing OS not secure Future applications ehealth Mobile payment (NFC) Encrypted voice and text
Security cont. "Everybody" wants its own secure smartphone Governments Businesses
What can we do? picture www.norebbo.com
Patch OS? Bad update record Fragmentation
Add security layer?* Change middleware Improve permission model cf. Butler Lampson, 1972
L4Android Framework Make L4Linux run Android
Applications Browser VPN Secure Voice Phone Home Contacts Calendar Email Application Framework Notification Manager Activity Manager Window Manager Resource Manager Package Manager Telephony Manager Location Manager Media Manager Surface Manager Crypto Manager User Linux Kernel Kernel Display Driver Camera Driver Flash Driver NFC Driver Power Mgmt Audio Driver... Keypad Driver Wifi Driver Smartcard Instead of this...
Applications Browser VPN Secure Voice Phone Home Contacts Calendar Email Application Framework Notification Manager Activity Manager Window Manager Resource Manager Package Manager Telephony Manager Location Manager Media Manager Surface Manager Crypto Manager Glue / HAL Platform support Display Driver Camera Driver Flash Driver NFC Driver Power Mgmt Audio Driver... Keypad Driver Wifi Driver Smartcard User Microkernel Kernel... we want this
Steps and Building Blocks picture www.norebbo.com
Prototype Architecture VM (private) VM Android userlevel software stack (unmodified) Busybox L4Android Kernel L4Android Kernel Platform support & device drivers mag fb-drv L4Linux (GPIO, Touch, Display, ) Runtime Environment sigma0 io moe Fiasco.OC
Cebit 2011 Intel Moorestown prototype Virtualized Android + 2nd Linux + driver Linux No direct hardware access Only touchscreen and display No sensors No network
Implementation Steps Patch L4Linux with Android binder, wakelocks, ashmem, GPIO subsystem Required for touchscreen and display fb-drv: MMIO replay from Linux driver
Towards the L4Android Framework Support for ARM and x86 Android Generic hardware interface for both architectures Require no hardware modifications or extensions
Screenshot
VM (private) VM (dev) VM (business) Android! (unmodified) Android HAL L4Android Kernel Paravirt Drivers Android! (unmodified) Android HAL L4Android Kernel Paravirt Drivers Android! (unmodified) Android HAL L4Android Kernel Paravirt Drivers Platform support & device drivers Display Touch Sensors Power Source Low level busses Clocks GPIO Timer L4Linux (Fileserver, ) Runtime Environment Memory Mgr IO Mgr Roottask Microkernel User Kernel L4Android Architecture
Applications picture www.norebbo.com
Easy to use!
Usability vs. Security Security == bad usability
SiMKo
SiMKo3 Requirements Open Source Solution Emphasis on security (MAC, small TCB) Reuse legacy software with existing VS-NfD approval Commodity OS
VM (private) VM (business) Android! (unmodified) Android HAL L4Android Kernel Paravirt Drivers Simple Userland, no UI!! VPN, Multiplexing Driver L4Linux!! (Modem, Storage, Smartcard, Audio) Android! (unmodified) Android HAL L4Android Kernel Paravirt Drivers Platform support & device drivers Display Touch Sensors Power Source Power Mgmt I2C SPI GPIO Timer Clocks Runtime Environment Memory Mgr IO Mgr Roottask Microkernel User Kernel SiMKo3 Architecture Multi-server OS
Life & Work picture www.telekom.de
Ultimate Goal
How? L4Windows? No source code (well, ReactOS) Port Wine to L4Re? Compatibility Develop VMM? Implement legacy devices Port existing VMM? KVM
L4KVM Feature-rich VMM (read: runs Windows) x86, requires CPU with hardware assisted virtualization Use KVM from within L4Linux Modify KVM to use Fiasco.OC's virtualization API Configure VMCS Handle guest memory Helpful test case
VM Non-root mode Qemu Root mode L4Linux KVM-L4 L4Re Runtime Environment L4Re Microkernel SVM / VT-x Support L4KVM Architecture
L4KVM Status Linux guests 32bit 64bit AMD SVM Intel Vt-x
Genua Security Laptop
Internet Corporate LAN
VM L4Linux KVM Userland, no UI!! VPN, Firewall L4OpenBSD Runtime Environment Memory Mgr IO Mgr Roottask Microkernel User Kernel Under the Hood
Challenges picture www.norebbo.com
How to boot for fast development cycles? Custom bootloader with USB and fastboot support.
Is there a serial interface? Multiplexed via micro USB port or audio jack.
How to develop native drivers? Read TRMs with 5000+ pages. Read Linux drivers.
Reuse proprietary binary blobs? 3G baseband Audio! Use L4Linux as driver
Power management? Frequency scaling Shutdown idle cores
Today's take aways Microkernel systems are used to build real-world systems being deployed to customers Understand what's beyond CPU and memory virtualization Sharply distinguish between Nanovisor, Microvisor, Microhypervisor, Secuvisor, Trustvisor and Budweiser.
*visor nomenclature
VM VM VMM VMM Nanovisor Nanovisor
VM VM VMM VMM Microvisor Microvisor
VM VM VMM VMM Microhypervisor Microhypervisor
VM VM VMM VMM Trustvisor Trustvisor
VM VM VMM VMM Secuvisor Secuvisor
Budweiser