22 ms·
Kernel: Introduce Multikernel Architecture Support
- andutu 1y agoPretty cool, sound similar to what Barrelfish OS enabled (https://barrelfish.org/ https://barrelfish.org/).
- intermerda 1y agoTim Roscoe gave an interesting Keynote at OSDI '21 titled "It's Time for Operating Systems to Rediscover Hardware" - https://www.youtube.com/watch?v=36myc8wQhLo https://www.youtube.com/watch?v=36myc8wQhLo. He was involved with the Barrelfish project.
- mensi 1y agoThat just reminded me that he's always insisted on not being called Tim: https://people.inf.ethz.ch/troscoe/ https://people.inf.ethz.ch/troscoe/
- intermerda 1y agoHuh I did not know that. I’m usually on careful about not using well-known nicknames unless the person goes by them.
- perching_aix 1y agoDoes this mean resiliency against kernel panics?
- sedatk 1y ago> - Improved fault isolation between different workloads Yes.
- ATechGuy 1y agoThat's what the author is claiming. Practically, VM-level strong fault isolation cannot be achieved without isolation support from the hardware aka virtualization.
- eqvinox 1y agoHardware without something like SR-IOV is straight up going to be unshareable for the foreseeable future; things like ring buffers would need a whole bunch of coordination between kernels to share. SR-IOV (or equivalent) makes it workable, an IOMMU (or equivalent) then provides isolation.
- skissane 1y agoYou could have a “nanokernel” which owns the ring buffers and the other kernels act as its clients… or for a “primary kernel” which owns the ring buffers and exposes an API the other kernels could call. If different devices have different ring buffers, the “primary kernel” could be different for each one.
- yencabulator 1y agoThat sounds like the Exokernel project. Notably different from a "multikernel"/"replicated kernel" design.
- rwmj 1y agoSounds similar to CoLinux where you could run a "cooperative Linux" alongside Windows http://www.colinux.org/ http://www.colinux.org/
- brcmthrowaway 1y agoThis was underrated!
- joseph2024 1y agoHP printers are similar. They run Linux on two cores and an RTOS on the other.
- lpribis 1y agoRelatively common in more powerful embedded systems. See for example https://www.openampproject.org/ https://www.openampproject.org/ which is a framework for running multiple cores of Linux, baremtal, or an RTOS together.
- p_l 1y agoOpenAMP focuses on RTOS running on "subordinate" coprocessors. This is more of a good old classic partitioning, which was rare outside of hardware with special support for it. Most RTOS + non-RTOS combinations use RTOS doubling as hypervisor, with RT tasks running at guaranteed timeframes and non-RTOS guest running in more relaxed form.
- lpribis 1y agoYou can also use it in a "SMP" processor. For example I use it on Zynqs which are dual or quad ARMs symmetrical ARM SoCs. Linux or the bare code can be the master or subordinate.
- cout 1y agoIIRC, colinux is similar to user mode Linux, which boots a kernel in userland. That is, the kernel runs under windows as an application rather than alongside it.
- vaastav 1y agoHow is this different from/similar to Barrelfish?
- exe34 1y agomainline vs abandoned.
- zokier 1y agoInterestingly the author has a startup revolving around this technology. Their webpage has some info: https://multikernel.io/ https://multikernel.io/
- sargun 1y agoThe author (Cong Wang) is building all sorts of neat stuff. Recently, they built kernelscript: https://github.com/multikernel/kernelscript https://github.com/multikernel/kernelscript -- another DSL for BPF that's much more powerful than the C alternatives, without the complexity of C BPF. Previously, they were at Bytedance, so there's a lot of hope that they understand the complexities of "production".
- rurban 1y agoI see. Even better than Xen, but needs much more memory than all the kvm instances. And as I heard memory is the real deal for mass hosters, not speed. So I am sceptical. I also don't understand how it handles concurrent writes and states of shared hardware. Seems like a lot of overhead compared to kvm or Xen.
- 9cb14c1ec0 1y agoIt would be interesting to see a detailed security assessment of this. Would it provide security improvements over docker?
- eqvinox 1y agoDocker is the wrong thing to compare against, especially considering it is an application and not a technology; the technology would be containerization. This competes against hardware virtualization support, if anything.
- esseph 1y agoIf you want some security improvements, move from docker to podman rootless + distroless containers. If you need more security/isolation, go to a VM or bare metal.
- messe 1y agoReminds me of exokernel architectures[0.5][1.5][2.5]. How is non-CPU resource multiplexing handled, or planned to be handled? [0.5]: https://en.wikipedia.org/wiki/Exokernel https://en.wikipedia.org/wiki/Exokernel [1.5]: https://wiki.osdev.org/Exokernel https://wiki.osdev.org/Exokernel [2.5]: "Should array indices start at 0 or 1? My compromise of 0.5 was rejected without, I thought, proper consideration." — Stan Kelly-Bootle
- yencabulator 1y agoMore like Barrelfish or NRKernel. https://barrelfish.org/ https://barrelfish.org/ https://nrkernel.systems/ https://nrkernel.systems/
- duendefm 1y agowould this allow running both linux and bsd kernels?
- tremon 1y agoIt should be possible in theory, as long as both use the same communication interface. In practice, I think getting it to work on just one kernel is already a huge amount of work.
- viraptor 1y agoIt's been done with more crazy setups already though: http://www.colinux.org/ http://www.colinux.org/ win+lin
- ch_123 1y agoReminds me of OpenVMS Galaxy on DEC Alpha systems, which allowed multiple instances of the OS to run side by side on the same hardware without virtualization. https://www.digiater.nl/openvms/doc/alpha-v8.3/83final/aa_rezqe_te/aa_rezqe_te.pdf https://www.digiater.nl/openvms/doc/alpha-v8.3/83final/aa_re...
- skissane 1y agoIBM mainframes and Power servers have “partitions” (LPARs). My understanding of how they work, is they actually are software-based virtualisation, but the hypervisor is in the system firmware, not the OS. And some of the firmware is loaded from disk at boot-up, making it even closer to something like Xen-labelling it as “hardware” not “software” is more about marketing (and which internal teams own it within IBM) than than technical reality. Their mainframe partitioning system, PR/SM, apparently began life as a stripped-down version of VM/CMS, although I’m not sure how close the relationship between PR/SM and z/VM is in current releases. This sounds like running multiple kernels in a shared security domain, which reduces the performance cost of transitions and sharing, but you lose the reliability and security advantages that a proper VM gives you. It reminds me of coLinux (essentially, a Linux kernel as a Windows NT device driver) Does anyone have more details on how OpenVMS Galaxy was actually implemented? I believe it was available for both Alpha and Itanium, but not yet x86-64 (and probably never…)
- octotoad 1y agoAFAIK, Galaxy was exclusive to Alpha, with no equivalent on Itanium, or any other platform.
- p_l 1y agoGalaxy depended on carefully coded cooperation between kernels plus firmware support, but otherwise was operating exactly like the proposed Multikernel Architecture. The firmware support was mainly there to provide booting of separate partitions, but otherwise no virtualisation was involved - all resources were exclusively owned.
- tremon 1y ago"while sharing the underlying hardware resources"? At the risk of sounding too positive, my guess is that hell will freeze over before that will work reliably. Alternating access between the running kernels is probably the "easy" part (DMA and command queues solve a lot of this for free), but I'm thinking more of all the hardware that relies on state-keeping and serialization in the driver. There's no way that e.g. the average usb or bluetooth vendor has "multiple interleaved command sequences" in their test setup. I think Linux will have to move to a microkernel architecture before this can work. Once you have separate "processes" for hardware drivers, running two userlands side-by-side should be a piece of cookie (at least compared to the earlier task of converting the rest of the kernel). Will be interesting to see where this goes. I like the idea, but if I were to go in that direction, I would choose something like a Genode kernel to supervise multiple Linux kernels.
- elteto 1y agoYou just don't share certain devices, like Bluetooth. The "main" kernel will probably own the boot process and manage some devices exclusively. I think the real advantage is running certain applications isolated within a CPU subset, protected/contained behind a dedicated kernel. You don't have the slowdown of VMs, or have to fight against the isolation sieve that is docker.
- yjftsjthsd-h 1y agoThat's fine for - Enhanced security through kernel-level separation - Better resource utilization than traditional VM (KVM, Xen etc.) but I don't think it works for - Improved fault isolation between different workloads - Potential zero-down kernel update with KHO (Kernel Hand Over) since if the "main" kernel crashes or is supposed to get upgraded then you have to hand hardware back to it.
- raron 1y ago> since if the "main" kernel crashes or is supposed to get upgraded then you have to hand hardware back to it. Isn't that similar to starting up from hibernate to disk? Basically all of your peripherals are powered off and so probably can not keep their state. Also you can actually stop a disk (member of a RAID device), remove the PCIe-SATA HBA card it is attached to, replace it with a different one, connect all back together without any user-space application noticing it.
- IAmLiterallyAB 1y agoWhat's preventing a compromised kernel on one core from hijacking the other cores? This doesn't seem like much of a security boundary
- viraptor 1y agoNothing prevents it if you achieve code execution. But where it helps is scenarios like syscall / memory mapping exploits where a user process can only affect resources attached to their current kernel. For example https://dirtycow.ninja/ https://dirtycow.ninja/ would have a limited scope.
- deleted 1y ago[deleted]
- loeg 1y agoInsane idea, but very cool.
- yalogin 1y agoIt’s not clear to me but do these kernels run directly on the hardware? If so how are they able to talk to each other, DMA? That could open up some security flaws, hopefully they thought through that
- agentkilo 1y agoIIUC, yes, all the kernels involved run directly on the hardware, in a "cooperative" way, i.e. they must agree on not touching others' memory regions. I think the architecture assumes all loaded kernels are trusted, and imposes no isolation other than having them running on different CPUs. Given the (relative) simplicity of the PoC, it could be really performant.
- yalogin 1y agoWonder what the use cases are. Doesn’t feel like the kernels are hotswappable, so why is it preferred over VMs?
- yxhuvud 1y agoIf nothing else, it is a path to making them hotswappable.
- yjftsjthsd-h 1y agoCan't the kernel set up hardware-backed memory maps to partially blind itself to other memory regions? (Only "partially" because even then I expect it could just change the mappings, but it's still a protection against accidental corruption)
- p_l 1y agoThat's standard part of setups like that, the cooperative aspect is that they have to set the memory map so they don't overlap.
- josemanuel 1y agoHow are IOMMUs managed?
- pabs3 1y agoYou used to also be able to get the opposite; one Linux kernel with a unified userspace distributed across a cluster. https://sourceforge.net/projects/kerrighed/ https://sourceforge.net/projects/kerrighed/
- rwmj 1y agoThat's cool! Similar is the idea of running a single large VM across multiple hosts. There have been several iterations of that idea, the latest being a presentation at this year's KVM Forum: GiantVM: A Many-to-one Virtualization System Built Atop the QEMU/KVM Hypervisor - Songtao Xue, Xiong Tianlei, Muliang Shou https://kvm-forum.qemu.org/2025/ https://kvm-forum.qemu.org/2025/
- PhilipRoman 1y agoI wonder if modern numa-aware software could take advantage of this if the Linux APIs report the correct topology.
- samus 1y agoThis could open up ways to run Linux as a guest kernel of proper microkernel operating systems to aid with hardware compatibility.
- da-x 1y agoThere are various hardware singletons that need to be managed for this to work properly. This raises many questions. Which of the kernel does the PCI enumeration, for instance, and how it is determined which kernel gets ownership over a PCI device? How about ACPI? Serial ports? How does this architecture transfers ownership over RAM between each kernel, or is it a fixed configuration? How about NUMA-awareness? (Likely you would want to partition systems so that RAM is along with the CPUs of the same NUMA node). Looks to me that one kernel would need to be have 'hypervisor'-like behavior in order to divvy up resources to other kernels. I think PVM (https://lwn.net/Articles/963718/ https://lwn.net/Articles/963718/) would be a preferred solution in this case, because the software stack of managing hypervisor resources can already be reused with it.
- ncr100 1y agoCould this be used to compile a new kernel? (Which could then be executed by the compiling kernel?) Could the new kernel be genetically scored for effectiveness (security, performance, etc), and iterated upon automatically, by e.g. an AI?
- rse287 1y agoFrom a complete isolation perspective, this seems very similar to Jailhouse: https://github.com/siemens/jailhouse https://github.com/siemens/jailhouse