1. 1. Virtualiza)oninGeneral SartakovA.Vasily ksyslabs OineTestDay/2013-06-01Virtualiza)on
2. 2. Structure Intro Virtualiza)on::Theory VT-x ARMTrustZone Microkernels L4microkernelfamily Paravirtualiza)on:L4Linux BaremetalmicrohypervisorNOVA Conclusion
3. 3. About TechnischeUniversitt Braunschweig ~8EE&CS RnDbootstrapping@ksyslabs
4. 4. Virtualiza)on::Theory All problems in computer science can be solved by another level of indirection" Butler Lampson, 1972"
5. 5. CPU main memory I/O devices Kernel MC bash WM apache Browser FLV PIDN PIDK PID6 PID10
6. 6. , CPU:ARM main memory I/O devices LinuxKernel X86 Proprietarysovware MC bash PID1 FLV Apache WM
7. 7. CPU main memory I/O devices Linuxkernel MC bash IE9Q3Browser CS WindowsKernel Hypervisor(VirtualMachineMonitor) CPU Mem IO CPU Mem IO
8. 8. (IntelVT,ARMTZ) VMM
9. 9. FLV FLV FLV FLV FLV CPU main memory I/O devices HostKernel GuestABI HostAPI Browser FLV PID1 WM MC bash PID1 FLV Apache WM
10. 10.
11. 11. CPU main memory I/O devices LinuxKernel MC bash Browser FLV PID1 WM MC bash PID1 FLV Apache WM
12. 12. Unixkernelinterfaceasservice write,read stat,lstat,fstat,fcntlioctl open,close,lseekdirent getcwd,fchdir select execve,fork,wait4 getpid pipe dup2 unlink,rename,mkdir networking socket getsockopt,setsockoptaccept bind listen send,sendto recv,recvfromgetpeername shutdown connect getaddrinfo Linux300
13. 13. Genode CPU:ARM main memory I/O devices Fiasco.OC RecompiledUnixProgram NOUX Core Init FreeBSDlibc libcplugin VFS IO
14. 14. CPU main memory I/O devices Linuxkernel MC bash IE9Q3Browser CS WindowsKernel Hypervisor(VirtualMachineMonitor) CPU Mem IO CPU Mem IO
15. 15. Linuxkernel MC bash Q3Browser Baremetalhypervisor CPU Mem IO hypervisor CPU Mem IO Kernel
16. 16. Structure Intro Virtualiza)on::Theory VT-x ARMTrustZone Microkernels L4microkernelfamily Paravirtualiza)on:L4Linux BaremetalmicrohypervisorNOVA Conclusion
17. 17. CPU main memory I/O devices Linuxkernel MC bash Q3Browser Hypervisor(VirtualMachineMonitor) CPU Mem IO Ring3 Ring2 Ring1 Ring0 Ring?? x86
18. 18. VT-x x86 : VMXrootmode(VM-manager) VMXnon-rootmode(VM-guests)
19. 19. VMM Host VM1 Guest VM2 Guest VMXON VMXOFF VMEntry VMExit VMEntry VMExit VT-x
20. 20. CPU Mem IO Linuxkernel MC bash Q3Browser Ring3 Ring0 Ring3 VT-x VMM Ring0 Non-rootmoderootmode
21. 21. ? ExtendedPageTabes AddressTransla)on Page-tableshadowing I/OVirtualiza)on DMA IOMMU
22. 22. Structure Intro Virtualiza)on::Theory VT-x ARMTrustZone Microkernels L4microkernelfamily Paravirtualiza)on:L4Linux BaremetalmicrohypervisorNOVA Conclusion
23. 23. ArmTrustZone ARM1176JZ(F)-Sprocessor Cortex-A8processor Cortex-A9processor Cortex-A9MPCoreprocessor
24. 24. CPU main memory I/O devices Kernel MC bash VPN Trusted screen DRM FLV crypto PIDK PID6 PID10 Kernel SecureworldNormalworld Monitor
25. 25. ArmTrustZone MonitorMode MMU NSbitCPU
26. 26. TZExample Source:ARMSecurityTechnologyBuildingaSecureSystemusingTrustZoneTechnology
27. 27. ArmTrustZone PowerOn ROMboot Firstloader Secondloader SecureWorld OSboot NormalWorld OSboot SystemRunning
28. 28.
29. 29. Structure Intro Virtualiza)on::Theory VT-x ARMTrustZone Microkernels L4microkernelfamily Paravirtualiza)on:L4Linux BaremetalmicrohypervisorNOVA Conclusion
30. 30. Microkernel L4 L4Linux NOVAbare-metal hypervisor
31. 31. CPU main memory I/O devices Kernel MC bash WM apache Browser FLV PIDN PIDK PID6 PID10
32. 32. - CPU main memory I/O devices MC bash WM apache FLV PIDNPID6 PID10 HAL System-Callinterface FS IPC NET Drivers Scheduler Mem Swap
33. 33. Linux
34. 34.
35. 35. CPU main memory I/O devices MC bash WM apache Hardwareaccess System-Callinterface FS IPC NET Drivers Scheduler MemSwap ASIsola)on
36. 36. :Mach,CMU(1985-1994) Minix3(Andrew Tanenbaum,VUAmtrerdam) L4
37. 37.
38. 38. L4 ,: ()
39. 39. FLV FLV FLV FLV FLV ::L4Linux CPU main memory I/O devices L4 L4Linux Browser X11 PID15 WM Ned TCP/IP Sigma0 tg3 Apache Moe L4Re
40. 40. L4Reashardwarearchitecture L4IPC FS IPC NET Drivers Scheduler Mem Swap L4Linux L4Re Applica)on
41. 41. #1: Genode+2xL4Linux+Fiasco.OC FLV FLV FLV CPU main memory I/O devices Fiasco.OC L4Linux bashinit Nitpicker Qt FB FLV FLV FLVL4Linux bashinit
42. 42. Fiasco.OC+GenodeFW+2xL4Linux
43. 43. NOVA NOVA (baremetal) x86 TUDresden .NOVA-
44. 44. CPU Mem IO Linuxkernel Linuxuser-space VMM R3 R0 R3 NOVAR0 Non-rootmoderootmode Linuxkernel Linuxuser-space VMM DRV Sigma0 NOVA
45. 45. hp://ksyslabs.ru(.org,.com) hp://hypervisor.org hp://genode.org hp://os.inf.tu-dresden.de/L4Re/ hp://os.inf.tu-dresden.de/asco/
46. 46. 2013 5-62013, : BjoernDoebel(TUDresden) NormanFeske(ex.TUDresden,GenodeLabs) UdoSteinberg(ex.TUDresden,IntelLabs) SartakovA.Vasily(ksyslabs) // hp://sss.ksyslabs.org
47. 47. SartakovA.Vasily sartakov@ksyslabs.org