diff options
Diffstat (limited to 'misc/frm_jailhouse.tex')
| -rw-r--r-- | misc/frm_jailhouse.tex | 443 |
1 files changed, 443 insertions, 0 deletions
diff --git a/misc/frm_jailhouse.tex b/misc/frm_jailhouse.tex new file mode 100644 index 0000000..6718925 --- /dev/null +++ b/misc/frm_jailhouse.tex @@ -0,0 +1,443 @@ +\section{Introduction} +\subsection{Jailhouse - yet another hypervisor?} + +\begin{frame} +\frametitle{Hypervisors and security} +\begin{itemize} +\item Partition resources (CPU, memory, interfaces, \dots) +\pause +\item Isolate such resources +\pause +\item Make unauthorized access more difficult due to logical and physical separation +\pause +\item Prevent one guest OS from injecting malicious code into another +\pause +\item Decrease threat conditions caused by excessive resource consumption, e.g. DoS attacks +\pause +\item Become the central security layer +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{The desktop and server world} +\begin{itemize} +\item Type 1 (bare metal) hypervisors +\begin{itemize} +\item Linux KVM +\item Xvisor +\item VMware vSphere / ESXi +\item Xen +\item \dots +\end{itemize} +\pause +\item Type 2 (hosted) hypervisors +\begin{itemize} +\item VirtualBox +\item Lguest +\item VMware Workstation Player +\item \dots +\end{itemize} +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{Virtualization in Embedded Systems} +\begin{itemize} +\item \dots wasn't very popular in the past due to +\begin{itemize} +\item introduction of increased latencies and cycle times +\item high system complexity +\end{itemize} +\pause +\item \dots was realized by microkernel based hypervisors +\begin{itemize} +\item L4re +\item TOPPERS SafeG +\item QNX +\item \dots +\end{itemize} +\pause +\item can be realized by Jailhouse to run real-time/security or safety critical tasks on multicore platforms +\end{itemize} +\end{frame} + +\subsection{Jailhouse principles and features} + +\begin{frame} +\frametitle{Jailhouse is \dots} +\begin{minipage}{0.6\textwidth} +\begin{itemize} +\item a bare metal partitioning hypervisor +\item assisted by Linux +\item running on multicore platforms +\item open source (GPLv2) +\item maintained by Jan Kiszka / Siemens +\end{itemize} +\end{minipage} +\begin{minipage}{0.3\textwidth} +\includegraphics[width=\linewidth]{images/tux_in_jail.png} +\end{minipage} +\end{frame} + +\begin{frame} +\frametitle{Jailhouse uses \dots} +\begin{itemize} +\item hardware virtualization extensions for isolation + \begin{itemize} + \item Intel x86 support -> 64Bit, VMX, VT-d + \item AMD x86 support -> 64Bit, AMD-V + \item ARM support -> ARMv7 with virtualization extensions or ARMv8 + \end{itemize} +\item Linux infrastructure for housekeeping +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{Jailhouse doesn't \dots} +\begin{itemize} +\item emulate resources we do not have +\item have a scheduler +\item boot Linux in the root-cell +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{Asymmetric multiprocessing} +\begin{block}{Isolated cores can run something else than Linux} +\begin{itemize} +\item RTOS (RTEMS, FreeRTOS, ...) +\item bare-metal applications +\item Windows +\item QNX +\item VxWorks +\item \dots +\end{itemize} +\end{block} +\end{frame} + +\begin{frame} +\frametitle{Block diagram} +\begin{center} +\includegraphics[height=0.8\textheight]{images/jailhouse_blockdiagram.png} +\end{center} +\end{frame} + +\begin{frame} +\frametitle{Booting} +\begin{center} +\includegraphics[height=0.8\textheight]{images/jailhouse_partitioning1.png} +\end{center} +\end{frame} + +\begin{frame} +\frametitle{Partitioning} +\begin{center} +\includegraphics[height=0.8\textheight]{images/jailhouse_partitioning2.png} +\end{center} +\end{frame} + +\begin{frame} +\frametitle{Operating} +\begin{center} +\includegraphics[height=0.8\textheight]{images/jailhouse_partitioning3.png} +\end{center} +\end{frame} + +\section{System Partitioning with Jailhouse on ZYNQ Ultrascale+} +\subsection{System configuration} + +\begin{frame} +\frametitle{Xilinx ZYNQ Ultrascale+ MPSoC overview} +\begin{center} +\includegraphics[height=0.7\textheight]{images/zynq-ev-block.png} +\end{center} +\end{frame} + +\begin{frame} +\frametitle{Surveillance application} +\begin{center} +\includegraphics[height=0.7\textheight]{images/jailhouse_surveil_diagram.png} +\end{center} +\end{frame} + +\begin{frame} +\frametitle{Surveillance application} +\begin{center} +\includegraphics[height=0.7\textheight]{images/jailhouse_surveil_diagram1.png} +\end{center} +\end{frame} + +\subsection{Partitioning example} + +\begin{frame} +\frametitle{Partitioned surveillance application} +\begin{center} +\includegraphics[height=0.7\textheight]{images/jailhouse_surveil_partitioned_with_rt.png} +\end{center} +\end{frame} + +\begin{frame} +\frametitle{Security improvements} +\begin{itemize} +\item Cascading is easy (it's done in software) +\item Reduce the attack surface +\item TCB can be minimized +\item Reduce inter-cell communication to a minimum +\item Securing and authenticating communication channels +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{Realtime latency measurements} +\begin{figure} + \centering + \subfloat[Native RT Linux 4.9.20-rt16]{{\includegraphics[width=5cm]{images/plot_rt_nohyp_4.9.20-rt16-isolcpus1-3.png} }} + \qquad + \subfloat[Jailhouse guest RT Linux 4.9.20-rt16]{{\includegraphics[width=5cm]{images/plot_rt_inmate_2threads_4.9.20-rt16_isolcpu1.png} }} + \caption{cyclictest latency plots} + \label{fig:latencyplots} +\end{figure} +\end{frame} + +\subsection{Setup and run Jailhouse} + +\begin{frame} +\frametitle{Creating a system config} +\begin{itemize} +\item Config generator for x86 is available (jailhouse-config-create) +\item No tooling for ARM at the moment +\item Create c-File in jailhouse/configs +\item Fill the C-structures to describe your hardware +\item Adapt the cell device tree when running Linux +\end{itemize} +\end{frame} + +\begin{frame}[fragile] +\frametitle{Root-cell configuration} +\begin{lstlisting} +struct { + struct jailhouse_system header; + __u64 cpus[1]; + struct jailhouse_memory mem_regions[5]; + struct jailhouse_irqchip irqchips[1]; + struct jailhouse_pci_device pci_devices[2]; +} __attribute__((packed)) config = { + .header = { + .signature = JAILHOUSE_SYSTEM_SIGNATURE, + .revision = JAILHOUSE_CONFIG_REVISION, + .hypervisor_memory = { + .phys_start = 0x800000000, + .size = 0x000400000, + }, + .cpus = { + 0xf, + }, +\end{lstlisting} +\end{frame} + +\begin{frame}[fragile] +\frametitle{Root-cell configuration continued} +\begin{lstlisting} + .mem_regions = { + /* MMIO (permissive) */ { + .phys_start = 0xfd000000, + .virt_start = 0xfd000000, + .size = 0x03000000, + .flags = JAILHOUSE_MEM_READ | JAILHOUSE_MEM_WRITE | JAILHOUSE_MEM_IO, + }, + /* RAM */ { + .phys_start = 0x0, + .virt_start = 0x0, + .size = 0x80000000, + .flags = JAILHOUSE_MEM_READ | JAILHOUSE_MEM_WRITE | JAILHOUSE_MEM_EXECUTE, + }, + } + .irqchips = { + /* GIC */ { + .address = 0xf9010000, + .pin_base = 32, + .pin_bitmap = { + 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, + }, + }, + }, +\end{lstlisting} +\end{frame} + +\begin{frame}[fragile] +\frametitle{Inmate configuration} +\begin{lstlisting} +struct { + struct jailhouse_cell_desc cell; + __u64 cpus[1]; + struct jailhouse_memory mem_regions[6]; + struct jailhouse_irqchip irqchips[1]; + struct jailhouse_pci_device pci_devices[2]; +} __attribute__((packed)) config = { + .cell = { + .signature = JAILHOUSE_CELL_DESC_SIGNATURE, + .revision = JAILHOUSE_CONFIG_REVISION, + .name = "ZynqMP-linux-demo", + .flags = JAILHOUSE_CELL_PASSIVE_COMMREG, + + .cpu_set_size = sizeof(config.cpus), + .num_memory_regions = ARRAY_SIZE(config.mem_regions), + .num_irqchips = ARRAY_SIZE(config.irqchips), + .num_pci_devices = ARRAY_SIZE(config.pci_devices), + + .vpci_irq_base = 140-32, + }, +} +\end{lstlisting} +\end{frame} + +\begin{frame}[fragile] +\frametitle{Inmate configuration continued} +\begin{lstlisting} + .cpus = { + 0xc, + }, + + .mem_regions = { + /* UART */ { + .phys_start = 0xff010000, + .virt_start = 0xff010000, + .size = 0x1000, + .flags = JAILHOUSE_MEM_READ | JAILHOUSE_MEM_WRITE | + JAILHOUSE_MEM_IO | JAILHOUSE_MEM_ROOTSHARED, + }, + /* RAM */ { + .phys_start = 0x800600000, + .virt_start = 0, + .size = 0x10000, + .flags = JAILHOUSE_MEM_READ | JAILHOUSE_MEM_WRITE | + JAILHOUSE_MEM_EXECUTE | JAILHOUSE_MEM_LOADABLE, + }, + + ... +\end{lstlisting} +\end{frame} + +\lstset{language=bash, + basicstyle=\ttfamily, + keywordstyle=\color{blue}\ttfamily, + stringstyle=\color{red}\ttfamily, + commentstyle=\color{magenta}\ttfamily, + morecomment=[l][\color{grey}]{\#} + tabsize=8, + keepspaces, + extendedchars=true, + aboveskip=5pt, + upquote=true, + columns=fixed, + rulecolor=\color{black}, + basicstyle=\footnotesize, + showstringspaces=false, + extendedchars=true, + breaklines=true, + frame=single, + showtabs=true, + showspaces=false, + showstringspaces=false, +} + +\begin{frame}[fragile] +\frametitle{Building Jailhouse} +\begin{lstlisting} +# Get the Jailhouse sources: +git clone https://github.com/siemens/jailhouse.git +# Get a linux tree +git clone git://git.kiszka.org/linux.git +# setup environment +export ARCH=arm64 +export CROSS_COMPILE=<path-to-crosscompiler> +# Configure and build the linux tree +make O=<kernel-builddir> xilinx_zynqmp_defconfig +make O=<kernel-builddir> +# Build Jailhouse +make KDIR=<kernel-builddir> +# Deploy Jailhouse +make KDIR=<kernel-builddir> DESTDIR=<rfs-path> install +\end{lstlisting} +\end{frame} + +\begin{frame}[fragile] +\frametitle{Starting Jailhouse} +\begin{lstlisting} +# load the jailhouse kernel driver +modprobe jailhouse +# enable the hypervisor +jailhouse enable zynqmp-zcu102.cell +# create inmate cell +jailhouse cell create zynqmp-zcu102-linux-demo.cell +# load and start linux inmate +jailhouse cell linux \ + zynqmp-zcu102-linux-demo.cell \ + Image \ + --dtb inmate-zynqmp-zcu102.dtb \ + --initrd initramfs.cpio.gz \ + --cmdline "console=ttyPS0,115200" \ + --arch arm64 +\end{lstlisting} +\end{frame} + +\begin{frame} +\frametitle{Debugging Jailhouse} +\begin{itemize} +\item Debug/console prints on UARTs +\item Hypervisor console via sysfs +\item Inmates can use the hypervisor's debug channel +\item Inmates can specify their own debug UART +\item Cell statistics via 'jailhouse cell stats' command +\end{itemize} +\end{frame} + +\subsection{Inter-cell communication} + +\begin{frame} +\begin{itemize} +\item Shared memory and signaling between cells +\item Device model similar to Qemu-ivshmem +\item 1:1 communication relationship per channel +\item Modeled as a virtual PCI device +\item MSI-X support for signaling (one IRQ per virtual device) +\item ivshmem-net -> virtual network device for linux available +\item ivshmem demos for bare metal / rtos usage +\end{itemize} +\end{frame} + +\section{Conclusion} + +\begin{frame} +\begin{block}{Jailhouse is great to \dots} +\begin{itemize} +\item partition your system +\item run security/safety and realtime critical tasks +\item divide and simplify your security system design +\item give additional levels of security +\item get nearly baremetal performance +\end{itemize} +\end{block} +\begin{block}{but \dots} +\begin{itemize} +\item you have to get a deep understanding of your multicore platform +\item you have to get familiar with your CPU architecture +\end{itemize} +\end{block} +\end{frame} + +\section*{} +\subsection*{} + +\begin{frame} +\frametitle{References} +\begin{itemize} +\item \url{http://events.linuxfoundation.org/sites/events/files/slides/ELCE2016-Jailhouse-Tutorial.pdf} +\item \url{https://github.com/siemens/jailhouse.git} +\item \url{git://git.kiszka.org/linux.git} +\item \url{https://lwn.net/Articles/578295/} +\item \url{https://lwn.net/Articles/578852/} +\item \url{http://www.linuxjournal.com/content/jailhouse} +\item \url{https://www.xilinx.com/content/dam/xilinx/imgs/products/zynq/zynq-ev-block.PNG} +\end{itemize} +\end{frame} |