5 ms·

A few months ago I created/worked on a project that involved separating PNaCl (the portable native client) from the Chromium project, rewriting parts of it for

A few months ago I created/worked on a project that involved separating PNaCl (the portable native client) from the Chromium project, rewriting parts of it for use as a generic JIT compiler, and building a small PoC distro around it where all of userspace were PNaCl binaries except for the loader/JIT (which was a regular old architecture-specific ELF that existed read-only in memory and loaded by a slightly-patched Linux kernel) Only PNaCl executables were allowed to run in userspace, which allowed for secure execution of user binaries thanks to the sandboxing features of the modified portable native client. However, another benefit of the PNaCl is that binaries are compiled to a performant architecture-agnostic IL (similar to LLVM's IL) and then quickly finalized by the PNaCl loader into a regular architecture-specific binary and loaded into secure memory when they are started. This meant, in a nutshell, I could have a completely architecture-agnostic root filesystem, with the only architecture-specific binaries being the kernel and PNaCl runtime, which sat in the initial ramdisk.

green7ea 9y ago
That work sounds really cool. Is it publicly available?
pjmlp 9y ago
So basically you recreated IBM's AS/400 mainframe. Had you researched it for your work? I would be interested in some kind of comparison.
- joshumax 9y ago
  Wow! I actually wasn't aware that TIMI existed until just now! All I've ever really known is ARM's work on the Jazelle hardware subsystem. I'll have to check this out more in the morning though!
andreiw 9y ago
Will you ever put it up? Did you tackle dynamic linking? How did you abstract the syscall interface (i.e. how did you choose syscall numbers...take the x64 ones or the new "standard" ones shared by all modern ports?)
- joshumax 9y ago
  Based on interest here I'm planning on cleaning it up this weekend and shoving it on my GitHub (http://github.com/joshumax http://github.com/joshumax) by the end of this week or earlier... Unfortunately getting dynamic linking working is a WIP and so far everything has to be statically linked (yeah it's terrible I need to get dynamic linking working; I have some ideas). As for abstracting the syscall interface between architectures...afaik the PNaCl handled that for me based on how process isolation works...
  - andreiw 9y ago
    Sweet, thanks dude.
simcop2387 9y ago
If you're willing to accept some slightly more amount of native code for booting, you should be able to setup the loader to work entirely as a bimfmt_misc setup. This'd also let it be distributed to other distros easier. https://en.wikipedia.org/wiki/Binfmt_misc https://en.wikipedia.org/wiki/Binfmt_misc

green7ea 9y ago

That work sounds really cool. Is it publicly available?

pjmlp 9y ago

So basically you recreated IBM's AS/400 mainframe. Had you researched it for your work? I would be interested in some kind of comparison.

joshumax 9y ago
Wow! I actually wasn't aware that TIMI existed until just now! All I've ever really known is ARM's work on the Jazelle hardware subsystem. I'll have to check this out more in the morning though!

andreiw 9y ago

Will you ever put it up? Did you tackle dynamic linking? How did you abstract the syscall interface (i.e. how did you choose syscall numbers...take the x64 ones or the new "standard" ones shared by all modern ports?)

joshumax 9y ago
Based on interest here I'm planning on cleaning it up this weekend and shoving it on my GitHub (http://github.com/joshumax http://github.com/joshumax) by the end of this week or earlier... Unfortunately getting dynamic linking working is a WIP and so far everything has to be statically linked (yeah it's terrible I need to get dynamic linking working; I have some ideas). As for abstracting the syscall interface between architectures...afaik the PNaCl handled that for me based on how process isolation works...
- andreiw 9y ago
  Sweet, thanks dude.

simcop2387 9y ago

If you're willing to accept some slightly more amount of native code for booting, you should be able to setup the loader to work entirely as a bimfmt_misc setup. This'd also let it be distributed to other distros easier. https://en.wikipedia.org/wiki/Binfmt_misc https://en.wikipedia.org/wiki/Binfmt_misc