Transplantation of VirtualBox to the NOVA microhypervisor Norman - PowerPoint PPT Presentation

Transplantation of VirtualBox to the NOVA microhypervisor Norman Feske < norman.feske@genode-labs.com >

Outline 1. VirtualBox 2. NOVA microhypervisor and Genode 3. Steps 4. Demo + Outlook 5. War stories Transplantation of VirtualBox to the NOVA microhypervisor 2

Outline 1. VirtualBox 2. NOVA microhypervisor and Genode 3. Steps 4. Demo + Outlook 5. War stories Transplantation of VirtualBox to the NOVA microhypervisor 3

Architecture overview config, status SVC VM VM xpcom xpcom process process IPCD xpcom xpcom VirtualBox VBoxManage Application /dev/vboxdrv /dev/vboxdrv Transplantation of VirtualBox to the NOVA microhypervisor 4

Starting up a VM process VM process open /dev/vboxdrv kernel vboxdrv.ko Transplantation of VirtualBox to the NOVA microhypervisor 5

VM process running root mode non-root mode VM process load VMMR0 /dev/vboxdrv kernel vboxdrv.ko VMMR0 / Hypervisor Transplantation of VirtualBox to the NOVA microhypervisor 6

Entering the Guest OS root mode non-root mode VM process ioctrl VM RUN Guest OS /dev/vboxdrv kernel vboxdrv.ko world switch Transplantation of VirtualBox to the NOVA microhypervisor 7

Flow of a virtualization event non-root mode root mode VM process VM RUN returns Guest OS /dev/vboxdrv kernel vboxdrv.ko no yes VMMR0 ? world switch Transplantation of VirtualBox to the NOVA microhypervisor 8

Risks for desktop virtualization root mode non-root mode VM process Guest OS /dev/vboxdrv kernel highly complex vboxdrv.ko VMMR0 / Hypervisor Transplantation of VirtualBox to the NOVA microhypervisor 9

Risks for desktop virtualization root mode non-root mode VM process access control? Guest OS /dev/vboxdrv kernel highly complex vboxdrv.ko VMMR0 / Hypervisor Transplantation of VirtualBox to the NOVA microhypervisor 10

Risks for desktop virtualization root mode non-root mode authorized to change the kernel VM process highly complex access control? Guest OS /dev/vboxdrv kernel highly complex vboxdrv.ko VMMR0 / Hypervisor Transplantation of VirtualBox to the NOVA microhypervisor 11

Outline 1. VirtualBox 2. NOVA microhypervisor and Genode 3. Steps 4. Demo + Outlook 5. War stories Transplantation of VirtualBox to the NOVA microhypervisor 12

NOVA architecture Guest OS Guest OS Guest OS non-root mode root mode VMM VMM VMM Resource management Apps Drivers 9,000 SLOC kernel NOVA Microhypervisor Transplantation of VirtualBox to the NOVA microhypervisor 13

Flow of a virtualization event User-level VMM Guest OS � UTCB VMCS copy UTCB world switch NOVA Transplantation of VirtualBox to the NOVA microhypervisor 14

Genode OS architecture → Application-specific TCB Transplantation of VirtualBox to the NOVA microhypervisor 15

Genode OS framework Transplantation of VirtualBox to the NOVA microhypervisor 16

Genode combined with virtualization Transplantation of VirtualBox to the NOVA microhypervisor 17

Seoul VMM on top of Genode/NOVA Unmodified Guest OS Kernel virtual virtual virtual CPU RAM device Resource Device VMM Multiplexer Driver Init Core User Mode NOVA Hypervisor Privileged Mode Transplantation of VirtualBox to the NOVA microhypervisor 18

Idea Device models and features of VirtualBox + Security of the Genode/NOVA architecture Transplantation of VirtualBox to the NOVA microhypervisor 19

Outline 1. VirtualBox 2. NOVA microhypervisor and Genode 3. Steps 4. Demo + Outlook 5. War stories Transplantation of VirtualBox to the NOVA microhypervisor 20

Identify the interesting parts Entire VirtualBox code base > 4 million lines of code (sloccount) Narrowed to the interesting parts > 2 million lines of code src/VBox/VMM src/recompiler src/VBox/Main src/libs/liblzf-3.4 src/VBox/Runtime src/libs/liblzf-3.4/cs src/VBox/Devices src/libs/libxml2-2.6.31 src/VBox/Storage src/libs/zlib-1.2.6 src/VBox/GuestHost include/VBox src/VBox/Disassembler include/iprt src/VBox/HostServices Transplantation of VirtualBox to the NOVA microhypervisor 21

Porting the VirtualBox Runtime to Genode Facilitate Genode’s existing infrastructure ◮ 3rd-party software management tools ◮ FreeBSD libc ◮ Standard C++ library ◮ POSIX threads → Most parts of the POSIX runtime could be reused Transplantation of VirtualBox to the NOVA microhypervisor 22

VM process initialization Enable subsystems one by one Guest memory (accessed by recompiler and device models) RAM, MMIO I/O-port handling PGM, HWACCM, TM Device models, PDM, BIOS Host drivers ◮ Using the “Basic front end” ◮ Reimplement SDLConsole interface Transplantation of VirtualBox to the NOVA microhypervisor 23

A look inside a VM process Recompiler Hardware Acceleration Execution Manager VM VM Exit Enter Instruction Emulator Transplantation of VirtualBox to the NOVA microhypervisor 24

Start with executing the recompiler only Recompiler Hardware Acceleration Execution Manager Instruction Emulator Transplantation of VirtualBox to the NOVA microhypervisor 25

Simple test scenario FB SDL VirtualBox Input Framebuffer ISO image Init ROM Core kernel Linux Transplantation of VirtualBox to the NOVA microhypervisor 26

Increasing guest complexity 1. Custom-made Genode OS scenarios 2. Small Linux-based images (Tinycore, GRML) 3. Windows XP Transplantation of VirtualBox to the NOVA microhypervisor 27

Windows XP as a guest FB SDL LX Proxy FS VirtualBox Input File system Framebuffer VDI image Init Core Core kernel Linux Transplantation of VirtualBox to the NOVA microhypervisor 28

Move scenario to NOVA VESA driver Rump FS AHCI driver PS/2 driver VirtualBox Input File system Framebuffer Block VDI image Init Core kernel NOVA Transplantation of VirtualBox to the NOVA microhypervisor 29

Entering non-root mode Recompiler Hardware Acceleration Execution Manager IRQs VM VM Exit Enter Instruction Emulator Transplantation of VirtualBox to the NOVA microhypervisor 30

Entering non-root mode VBox VM state ↔ NOVA UTCB state Virtualization of guest memory (EPT faults) Enter VT-x conservatively (if protected mode and paging enabled) Inject IRQs into recompiler Later: IRQ injection via NOVA into VT-X Transplantation of VirtualBox to the NOVA microhypervisor 31

Adding features Additional drivers Networking Guest tools Shared folders Host clock Mouse-pointer synchronization Transplantation of VirtualBox to the NOVA microhypervisor 32

Update to VirtualBox 4.3 Basic front end no longer supported Use of main front end code to NOVA port ◮ Custom console implementation ◮ Shortcut XPCOM middleware → Support for using .vbox files Transplantation of VirtualBox to the NOVA microhypervisor 33

Outline 1. VirtualBox 2. NOVA microhypervisor and Genode 3. Steps 4. Demo + Outlook 5. War stories Transplantation of VirtualBox to the NOVA microhypervisor 34

Demo Windows 7 running in VirtualBox directly on top of NOVA Transplantation of VirtualBox to the NOVA microhypervisor 35

Adaptation of VirtualBox to Genode/NOVA Ported code 400,000 lines of code (sloccount) New code 6,200 lines (sloccount) hm, iommio, ioport, mm, pdm, pgm, sup Modifications of the original code 510 lines added 120 lines removed Transplantation of VirtualBox to the NOVA microhypervisor 36

Current state and outlook Usable performance, optimization ongoing Focused on VT-X, SVM not regularly tested Reduces TCB complexity to two orders of magnitude Useful for building appliances in high-security computing Stepping stone for using Genode as a general-purpose OS Transplantation of VirtualBox to the NOVA microhypervisor 37

Outline 1. VirtualBox 2. NOVA microhypervisor and Genode 3. Steps 4. Demo + Outlook 5. War stories Transplantation of VirtualBox to the NOVA microhypervisor 38

War stories Invalid guest state TLB consistency Interrupt handling Large files in shared folders Transplantation of VirtualBox to the NOVA microhypervisor 39

Thank you Genode OS Framework http://genode.org Genode Labs GmbH http://www.genode-labs.com Source code at GitHub http://github.com/genodelabs/genode Transplantation of VirtualBox to the NOVA microhypervisor 40