microkernel tidbits - d3sd3s.mff.cuni.cz/.../slides/11_microkernel_tidbits.pdf · microkernel...
Post on 09-Sep-2018
221 Views
Preview:
TRANSCRIPT
http://d3s.mff.cuni.czhttp://d3s.mff.cuni.cz/aosy
Martin Děcký
decky@d3s.mff.cuni.cz
Microkernel TidbitsMicrokernel Tidbits
2Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
GenodeGenode
Operating system component framework
[1] Feske N.: Introducing kernel-agnostic Genode executables, Genode Labs, FOSDEM 2017,https://fosdem.org/2017/schedule/event/microkernel_kernel_agnostic_genode_executables/
3Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
Genode/seL4 DemoGenode/seL4 Demo
git clone -b sel4_screenshot https://github.com/alex-ab/genode.gitgit clone https://github.com/genodelabs/genode.git
cd genode/
./tool/create_builddir sel4_x86_32 BUILD_DIR=genode.sel4vi genode.sel4/etc/build.conf
wget http://ftp.fau.de/qtproject/archive/qt/5.1/5.1.0/single/qt-everywhere-opensource-src-5.1.0.tar.gzmkdir contrib/qt5-8c8f232dcaa82e015b4f25f4fa99e7c7eeecc128.incompletemv qt-everywhere-opensource-src-5.1.0.tar.gz \ contrib/qt5-8c8f232dcaa82e015b4f25f4fa99e7c7eeecc128.incomplete/
./tool/ports/prepare_port qt5 dde_linux ffat freetype icu jpeg libc \ libpng lwip mesa sel4 stdcxx x86emu zlib qoost coreutils ncurses \ vim bash diffutils less
make -C genode.sel4 run/nouxmake -C genode.sel4 run/noux_bashmake -C genode.sel4 run/sel4
4Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
User Space-managed Capability SpaceUser Space-managed Capability Space
Microkernel provides capability mechanisms
User space is responsible for managing the capability space by deriving capabilities from the untyped memory capability
untyped
untyped untypeduntypeduntyped
untyped untyped
capabilitytable TCB
pagetable
pagedirectory
untyped
frame
5Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
Operations with CapabilitiesOperations with Capabilities
Cloning
Creating a new capability pointing to the same resource as the original capability
Minting
Creating a new capability with a subset of permissions to the original resource
Deriving
Creating a new capability based on a hierarchy of capability types
Untyped memory (representing a region of physical memory)Can be split into several untyped memory regions
Can be retyped to a different capability (thus creating a different type of kernel object)
6Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
seL4 CapabilitiesseL4 Capabilities
Kernel objects
UntypedObject (physical memory range)
TCBObject (thread)
EndpointObject (IPC calls destionation)
AsyncEndpointObject (signal recipient)
CapTableObject (array of capabilities)
X86_4K (4 KB frame)
X86_4M (4 MB frame)
X86_PageTableObject (2nd level page table)
X86_PageDirectoryObject (1st level page table)
7Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
seL4 Capabilities Memory ManagementseL4 Capabilities Memory Management
seL4_X86_Untyped_Retype(cnode_selector(phys_addr), seL4_X86_4K, ..., ..., ..., ..., phys_addr >> FRAME_WIDTH, 1);
seL4_X86_Untyped_Retype(cnode_selector(pt_phys_addr), seL4_X86_PageTableObject, ..., ..., ..., ..., pt_phys_addr >> FRAME_WIDTH, 1);
seL4_X86_Untyped_Retype(cnode_selector(pd_phys_addr), seL4_X86_PageDirectoryObject, ..., ..., ..., ..., pd_phys_addr >> FRAME_WIDTH, 1);
seL4_X86_PageTable_Map(cnode_selector(pt_phys_addr), cnode_selector(pd_phys_addr), virt_addr, seL4_X86_Default_VMAttributes);
seL4_X86_Page_Map(cnode_selector(phys_addr), cnode_selector(pd_phys_addr), virt_addr, seL4_AllRights, seL4_X86_Default_VMAttributes);
8Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
Genode Resource ManagementGenode Resource Management
application-specific TCB
explicit resources assignment
resources attached to sessions
[2] Feske N.: Genode as general-purpose OS progress report and demonstration, Genode Labs, FOSDEM 2014, https://archive.fosdem.org/2014/schedule/event/02_uk_genode_as_gp_os/
9Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
Hypervisor (Type 1)Hypervisor (Type 1)
hardware
hypervisor
hyper-privilegedmodememory
mgmt scheduler comm
privileged mode
operating system
kernel
privileged mode
unprivileged mode
app app
app app
operating system
kernel
privileged mode
unprivileged mode
app app
app app
operating system
kernel
privileged mode
unprivileged mode
app app
app app
10Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
MicrohypervisorMicrohypervisor
hardware
microhypervisor
hyper-privilegedmodememory
mgmt scheduler IPC
unprivileged mode
file systemdriver server
application application application
namingserver
locationserver
device driverserver
device driverserver
device driverserver
file systemdriver serverfile system
driver server
devicemultiplexer
file systemmultiplexer
networkstack
securityserver
...
11Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
NOVA MicrohypervisorNOVA Microhypervisor
[3] http://hypervisor.org
12Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
NOVA MicrohypervisorNOVA Microhypervisor
x86-64
Multiprocessor support
Mandatory Intel VT-x and optional Intel VT-d (IOMMU) for isolation
IPC derived from traditional L4
Synchronous, rendez-vous style
Capability-based
Support for running unmodified guest OSes via a VMM
VirtualBox in Genode/NOVA
13Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
Separation KernelSeparation Kernel
Hypervisor eliminating covert channels
Concept by John Rushby (1981)
Creating an environment indistinguishable from a physically distributed system
Each protection domain acts as a separate, isolated machine
Information can only flow from one machine to another along known external communication lines
Supporting mixed-criticality protection domains
INTEGRITY-178B
First separation kernel certified by NSA for safety-critical applications (e.g. aircraft avionics consolidation)
14Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
Muen Separation KernelMuen Separation Kernel
x86-64
Written in SPARK 2014 (2500 lines + 300 lines of assembler)
Formally defined subset of Ada with contract specification
Multiprocessor support
Mandatory both Intel VT-x and Intel VT-d (IOMMU) for isolation
Fixed cyclic scheduling
Static assignment of resources
Subjects
Native 64bit Ada / SPARK 2014
Genode/base-hwGNU/Linux, Windows VM via VirtualBox in Genode
IPC
Shared memory buffers
Virtual interrupts (events)
15Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
User Space Pagers in HelenOSUser Space Pagers in HelenOS
HelenOS memory management
Traditional kernel architecture (frame allocator, kernel heap allocator, virtual address space areas manager)
Mostly mechanisms, but also unavoidable minimal policies (single point of failure)
Originally three address space area backendsbackend_phys
backend_anon
backend_elf
New address space area backendbackend_user
16Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
User Space Pagers in HelenOSUser Space Pagers in HelenOS
PageePageePagerPager
KernelKernel
17Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
User Space Pagers in HelenOSUser Space Pagers in HelenOS
PageePageePagerPager
KernelKernel
as_area_create(..., pager_info) IPC connection
memory object
18Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
User Space Pagers in HelenOSUser Space Pagers in HelenOS
PageePageePagerPager
KernelKernel
~~
blocked in page fault handler
IPC_M_PAGE_IN(offset, memory object)
19Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
User Space Pagers in HelenOSUser Space Pagers in HelenOS
PageePageePagerPager
KernelKernel
~~
ipc_answer_1(EOK, virtual address)
find physical address
wake up and map page to physical address
20Martin Děcký, Advanced Operating Systems, May 12th 2017 Microkernel Tidbits
User Space Pagers in HelenOSUser Space Pagers in HelenOS
PageePageePagerPager
KernelKernel
top related