6 ms·

I don't think that word means what you think it means. Microkernel = move all the code OUT OF the kernel. These slides are about moving all the code INTO the

• rurban 6y ago
  No, it's similar to what Microsoft did. Put all the attack vectors into the kernel, because it's so much faster and we rather redo it again, we don't want to take a proven and secure existing solution. Just play the rust game and call it secure. People believe everything if you constantly repeat it.
  • saagarjha 6y ago
    It's disingenuous to call this the same as putting "attack vectors into the kernel", as BPF programs are sandboxed, unlike Windows kernel components. I don't know of any existing proven and secure solutions to this besides BPF, by the way.
    • rurban 6y ago
      As we saw with CPU's and VM's those sandboxing schemes are never secure. Eg eBPF arrays can be abused for cache attacks. The white paper and security guarantees never thought of that. The secure solution is to disable it, as well as hyperthreading. And use a secure, non-backdoored CPU.
• naasking 6y ago
  > Microkernel = move all the code OUT OF the kernel. Move it out of the kernel to isolate and protect. If you can isolate and protect code within the kernel's memory protection boundary, I'm not sure that that should disqualify it as a microkernel. In other words, I'm not sure that the microkernel design depends on memory protection boundaries specifically, it's a more general philosophy, akin to, "a microkernel is an operating system design which runs the minimum amount of code needed for an OS with full trust".
  • MisterTea 6y ago
    This is what I understand a Microkernel: it handles the bare minimum of system duties: process creation/management, memory management, IPC mechanism, I/O access. This is where you implement your security layer in order to isolate and protect hardware, processes, and memory. You can even implement namespacing and isolation to make each process look like it's running in a container or VM so to speak. All of your drivers and user programs live in user space and secured via the kernel. E.g. a USB host controller is a process which talks to the hardware and provides some sort of interface which USB device drivers can talk to to implement their respective device interfaces. A file system on a disk is handled by a file system process speaking e.g. ext4 to a disk and then a socket is provided to mount and access the files. It's a very nice setup because if your IPC mechanism is how everything talks then you can think of the kernel as a microservice host and IPC router which your processes talk through. They can provide or consume resources. Now if you can push that IPC mechanism over the network transparently then you have a distributed system. Then you eliminate a lot of code and protocol nonsense talking over networks.
    • shawnz 6y ago
      OP's definition is the same as yours, except instead of "user space" it's "a virtualized sandbox, but still running in ring 0". What's the difference besides technicalities of the implementation? Everything else you are saying about using IPC interfaces and isolating the kernel code still applies in both cases.
  • yellowapple 6y ago
    What you're talking about (I think) is a "hybrid" design, akin to Windows NT: like a microkernel, there are a bunch of different services ostensibly isolated from one another, but like a monolithic kernel, those services are all in kernel-space and interacting via function calls or somesuch rather than a full-blown communications protocol.
• barrkel 6y ago
  I don't think that's the right way to think about it. We believe our code to be functionally decomposed when it's in separate functions that we can reason about and test in isolation, but when compiled, the functions may be inlined, may have constant propagation, may even be evaluated at compile time. If the kernel, at its core, is just an execution environment for sandboxed programs that are sent into it, the source-level decomposition is solid, and the kernel is micro, relatively speaking, to the total amount of functionality. Drivers etc. can still be developed outside the kernel and need only interact with the sandbox API. Drivers may be upgraded live if the sandboxed programs can be replaced. The point of sandboxing is to ensure (ideally prove) that there can be no crashes due to violations of memory safety, or busy loops.
  • SquishyPanda23 6y ago
    Microkernels are about reducing the amount of code run in kernel space. Is this project moving things from user space to kernel space? If so it's the opposite of a microkernel. E.g. if the Linux kernel becomes aware of the application layer, that really does sound like stuff that used to run in user space is now running in kernel space.
    • __s 6y ago
      Depends what you call kernel space For example, nebulet https://github.com/nebulet/nebulet https://github.com/nebulet/nebulet wanted to run everything in ring 0, but "userspace" was WebAssembly code that had been compiled by "kernelspace" to run sandboxed in ring 0 If a CPU architecture was implemented to only offer ring 0, would a microkernel be impossible? Or would we accept this concept of kernelspace/userspace being implemented in software?
    • barrkel 6y ago
      I don't quite agree. I think they're about reducing the size of your kernel, and moving the complexity of operating system service details into separate processes, where they can crash, restart, be upgraded, etc. in isolation, in their own terms. The analogy is like microservices vs monolith, but with kernels, not big applications.
• twic 6y ago
  Linux is now doing what SPIN did 25 years ago, and the creators of SPIN called in an "extensible microkernel" [1]. Although i think the SPIN base system was a lot smaller than the Linux kernel - for example [2]: > The Web server application, as well as the file system interface, entire network protocol stack, and device infrastructure are all linked into the system after it boots. [1] http://www.cs.cornell.edu/people/egs/papers/spin-tr94-03-03.pdf http://www.cs.cornell.edu/people/egs/papers/spin-tr94-03-03.... [2] http://www-spin.cs.washington.edu/ http://www-spin.cs.washington.edu/
• jerf 6y ago
  It seems to me this pattern recurs over and over. The pragmatics roll up their sleeves and get the job done today, in some messy format (real kernels). The academics decry them as making a mess and doing terrible things, and declare that some solution is obviously correct and the practicals should be doing this instead (microkernels). Ten to thirty years later, what happens is that both of them turn out to be correct in ways that neither of them could have foreseen at the beginning. It is true that what the practicals were doing was messy and it did blow up, and they did end up taking academic ideas into their code, but not quite as the academics would have thought at the beginning either. Yeah, this is not a "real" microkernel. But if this process continues as described, you'll have a small hardcoded inner kernel, a whole bunch of sandboxed kernel code running in the kernel level of privilege but still essentially like "microkernel" components, suitably modified for the modern world, and a sane and safe sandbox to add more. And it'll be better than the original concept of "microkernels" were, and might as well co-opt the name, because we won't be going back to those ideas. The difference is that if we're getting to the point we can write sandboxes that actually work, the microkernel idea should be updated to account for that. The original microkernel ideas didn't expect that was a reasonable possibility, because at the time it wasn't. (Whether it is yet, we'll have to see, but we're at least getting closer.)
  • bityard 6y ago
    Ever heard the phrase, "don't let perfect be the enemy of good?" I tend to think of Linux as "good" and GNU Hurd as "perfect".
    • arpa 6y ago
      I believe that 2020 is the year of windows server, linux desktop and GNU Hurd 1.0
      • znpy 6y ago
        Considering how 2020 has gone so far...
      • yellowapple 6y ago
• jbn 6y ago
  To me, it sounds like it brings code synthesis into the kernel, sort of a realization of Massalin's Synthesis kernel ideas.