path: root/misc/frm_jailhouse.tex

\section{Introduction}
\subsection{Jailhouse - yet another hypervisor?}

\begin{frame}
\frametitle{Hypervisors and security}
\begin{itemize}
\item Partition resources (CPU, memory, interfaces, \dots)
\pause
\item Isolate such resources
\pause
\item Make unauthorized access more difficult due to logical and physical separation
\pause
\item Prevent one guest OS from injecting malicious code into another
\pause
\item Decrease threat conditions caused by excessive resource consumption, e.g. DoS attacks
\pause
\item Become the central security layer
\end{itemize}
\end{frame}

\begin{frame}
\frametitle{The desktop and server world}
\begin{itemize}
\item Type 1 (bare metal) hypervisors
\begin{itemize}
\item Linux KVM
\item Xvisor
\item VMware vSphere / ESXi
\item Xen
\item \dots
\end{itemize}
\pause
\item Type 2 (hosted) hypervisors
\begin{itemize}
\item VirtualBox
\item Lguest
\item VMware Workstation Player
\item \dots
\end{itemize}
\end{itemize}
\end{frame}

\begin{frame}
\frametitle{Virtualization in Embedded Systems}
\begin{itemize}
\item \dots wasn't very popular in the past due to
\begin{itemize}
\item introduction of increased latencies and cycle times
\item high system complexity
\end{itemize}
\pause
\item \dots was realized by microkernel based hypervisors
\begin{itemize}
\item L4re
\item TOPPERS SafeG
\item QNX
\item \dots
\end{itemize}
\pause
\item can be realized by Jailhouse to run real-time/security or safety critical tasks on multicore platforms
\end{itemize}
\end{frame}

\subsection{Jailhouse principles and features}

\begin{frame}
\frametitle{Jailhouse is \dots}
\begin{minipage}{0.6\textwidth}
\begin{itemize}
\item a bare metal partitioning hypervisor
\item assisted by Linux
\item running on multicore platforms
\item open source (GPLv2)
\item maintained by Jan Kiszka / Siemens 
\end{itemize}
\end{minipage}
\begin{minipage}{0.3\textwidth}
\includegraphics[width=\linewidth]{images/tux_in_jail.png}
\end{minipage}
\end{frame}

\begin{frame}
\frametitle{Jailhouse uses \dots}
\begin{itemize}
\item hardware virtualization extensions for isolation
  \begin{itemize}
  \item Intel x86 support -> 64Bit, VMX, VT-d
  \item AMD x86 support -> 64Bit, AMD-V
  \item ARM support -> ARMv7 with virtualization extensions or ARMv8
  \end{itemize}  
\item Linux infrastructure for housekeeping
\end{itemize}
\end{frame}

\begin{frame}
\frametitle{Jailhouse doesn't \dots}
\begin{itemize}
\item emulate resources we do not have
\item have a scheduler
\item boot Linux in the root-cell
\end{itemize}
\end{frame}

\begin{frame}
\frametitle{Asymmetric multiprocessing}
\begin{block}{Isolated cores can run something else than Linux}
\begin{itemize}
\item RTOS (RTEMS, FreeRTOS, ...)
\item bare-metal applications
\item Windows
\item QNX
\item VxWorks
\item \dots
\end{itemize}
\end{block}
\end{frame}

\begin{frame}
\frametitle{Block diagram}
\begin{center}
\includegraphics[height=0.8\textheight]{images/jailhouse_blockdiagram.png}
\end{center}
\end{frame}

\begin{frame}
\frametitle{Booting}
\begin{center}
\includegraphics[height=0.8\textheight]{images/jailhouse_partitioning1.png}
\end{center}
\end{frame}

\begin{frame}
\frametitle{Partitioning}
\begin{center}
\includegraphics[height=0.8\textheight]{images/jailhouse_partitioning2.png}
\end{center}
\end{frame}

\begin{frame}
\frametitle{Operating}
\begin{center}
\includegraphics[height=0.8\textheight]{images/jailhouse_partitioning3.png}
\end{center}
\end{frame}

\section{System Partitioning with Jailhouse on ZYNQ Ultrascale+}
\subsection{System configuration}

\begin{frame}
\frametitle{Xilinx ZYNQ Ultrascale+ MPSoC overview}
\begin{center}
\includegraphics[height=0.7\textheight]{images/zynq-ev-block.png}
\end{center}
\end{frame}

\begin{frame}
\frametitle{Surveillance application}
\begin{center}
\includegraphics[height=0.7\textheight]{images/jailhouse_surveil_diagram.png}
\end{center}
\end{frame}

\begin{frame}
\frametitle{Surveillance application}
\begin{center}
\includegraphics[height=0.7\textheight]{images/jailhouse_surveil_diagram1.png}
\end{center}
\end{frame}

\subsection{Partitioning example}

\begin{frame}
\frametitle{Partitioned surveillance application}
\begin{center}
\includegraphics[height=0.7\textheight]{images/jailhouse_surveil_partitioned_with_rt.png}
\end{center}
\end{frame}

\begin{frame}
\frametitle{Security improvements}
\begin{itemize}
\item Cascading is easy (it's done in software)
\item Reduce the attack surface
\item TCB can be minimized
\item Reduce inter-cell communication to a minimum
\item Securing and authenticating communication channels
\end{itemize}
\end{frame}

\begin{frame}
\frametitle{Realtime latency measurements}
\begin{figure}
    \centering
    \subfloat[Native RT Linux 4.9.20-rt16]{{\includegraphics[width=5cm]{images/plot_rt_nohyp_4.9.20-rt16-isolcpus1-3.png} }}
    \qquad
    \subfloat[Jailhouse guest RT Linux 4.9.20-rt16]{{\includegraphics[width=5cm]{images/plot_rt_inmate_2threads_4.9.20-rt16_isolcpu1.png} }}
    \caption{cyclictest latency plots}
    \label{fig:latencyplots}
\end{figure}
\end{frame}

\subsection{Setup and run Jailhouse}

\begin{frame}
\frametitle{Creating a system config}
\begin{itemize}
\item Config generator for x86 is available (jailhouse-config-create)
\item No tooling for ARM at the moment
\item Create c-File in jailhouse/configs
\item Fill the C-structures to describe your hardware
\item Adapt the cell device tree when running Linux
\end{itemize}
\end{frame}

\begin{frame}[fragile]
\frametitle{Root-cell configuration}
\begin{lstlisting}
struct {
    struct jailhouse_system header;
    __u64 cpus[1];
    struct jailhouse_memory mem_regions[5];
    struct jailhouse_irqchip irqchips[1];
    struct jailhouse_pci_device pci_devices[2];
} __attribute__((packed)) config = {
    .header = {
        .signature = JAILHOUSE_SYSTEM_SIGNATURE,
        .revision = JAILHOUSE_CONFIG_REVISION,
        .hypervisor_memory = {
            .phys_start = 0x800000000,
            .size =       0x000400000,
    },
    .cpus = {
            0xf,
    },
\end{lstlisting}
\end{frame}

\begin{frame}[fragile]
\frametitle{Root-cell configuration continued}
\begin{lstlisting}
    .mem_regions = {
        /* MMIO (permissive) */ {
            .phys_start = 0xfd000000,
            .virt_start = 0xfd000000,
            .size =       0x03000000,
            .flags = JAILHOUSE_MEM_READ | JAILHOUSE_MEM_WRITE | JAILHOUSE_MEM_IO,
        },
        /* RAM */ {
            .phys_start = 0x0,
            .virt_start = 0x0,
            .size = 0x80000000,
            .flags = JAILHOUSE_MEM_READ | JAILHOUSE_MEM_WRITE | JAILHOUSE_MEM_EXECUTE,
        },
    }
    .irqchips = {
        /* GIC */ {
            .address = 0xf9010000,
            .pin_base = 32,
            .pin_bitmap = {
               0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff,
            },
        },
    },
\end{lstlisting}
\end{frame}

\begin{frame}[fragile]
\frametitle{Inmate configuration}
\begin{lstlisting}
struct {
    struct jailhouse_cell_desc cell;
    __u64 cpus[1];
    struct jailhouse_memory mem_regions[6];
    struct jailhouse_irqchip irqchips[1];
    struct jailhouse_pci_device pci_devices[2];
} __attribute__((packed)) config = {
    .cell = {
        .signature = JAILHOUSE_CELL_DESC_SIGNATURE,
        .revision = JAILHOUSE_CONFIG_REVISION,
        .name = "ZynqMP-linux-demo",
        .flags = JAILHOUSE_CELL_PASSIVE_COMMREG,

        .cpu_set_size = sizeof(config.cpus),
        .num_memory_regions = ARRAY_SIZE(config.mem_regions),
        .num_irqchips = ARRAY_SIZE(config.irqchips),
        .num_pci_devices = ARRAY_SIZE(config.pci_devices),

        .vpci_irq_base = 140-32,
    },
}
\end{lstlisting}
\end{frame}

\begin{frame}[fragile]
\frametitle{Inmate configuration continued}
\begin{lstlisting}
    .cpus = {
            0xc,
    },

    .mem_regions = {
        /* UART */ {
            .phys_start = 0xff010000,
            .virt_start = 0xff010000,
            .size = 0x1000,
            .flags = JAILHOUSE_MEM_READ | JAILHOUSE_MEM_WRITE |
                     JAILHOUSE_MEM_IO   | JAILHOUSE_MEM_ROOTSHARED,
        },
        /* RAM */ {
            .phys_start = 0x800600000,
            .virt_start = 0,
            .size = 0x10000,
            .flags = JAILHOUSE_MEM_READ    | JAILHOUSE_MEM_WRITE |
                     JAILHOUSE_MEM_EXECUTE | JAILHOUSE_MEM_LOADABLE,
        },

            ...
\end{lstlisting}
\end{frame}

\lstset{language=bash,
                basicstyle=\ttfamily,
                keywordstyle=\color{blue}\ttfamily,
                stringstyle=\color{red}\ttfamily,
                commentstyle=\color{magenta}\ttfamily,
                morecomment=[l][\color{grey}]{\#}
    tabsize=8,
    keepspaces,
    extendedchars=true,
    aboveskip=5pt,
    upquote=true,
    columns=fixed,
    rulecolor=\color{black},
    basicstyle=\footnotesize,
    showstringspaces=false,
    extendedchars=true,
    breaklines=true,
    frame=single,
    showtabs=true,
    showspaces=false,
    showstringspaces=false,
}

\begin{frame}[fragile]
\frametitle{Building Jailhouse}
\begin{lstlisting}
# Get the Jailhouse sources:
git clone https://github.com/siemens/jailhouse.git
# Get a linux tree
git clone git://git.kiszka.org/linux.git
# setup environment
export ARCH=arm64
export CROSS_COMPILE=<path-to-crosscompiler>
# Configure and build the linux tree
make O=<kernel-builddir> xilinx_zynqmp_defconfig
make O=<kernel-builddir>
# Build Jailhouse
make KDIR=<kernel-builddir>
# Deploy Jailhouse
make KDIR=<kernel-builddir> DESTDIR=<rfs-path> install
\end{lstlisting}
\end{frame}

\begin{frame}[fragile]
\frametitle{Starting Jailhouse}
\begin{lstlisting}
# load the jailhouse kernel driver
modprobe jailhouse
# enable the hypervisor
jailhouse enable zynqmp-zcu102.cell
# create inmate cell
jailhouse cell create zynqmp-zcu102-linux-demo.cell
# load and start linux inmate
jailhouse cell linux \
          zynqmp-zcu102-linux-demo.cell \
          Image \
          --dtb inmate-zynqmp-zcu102.dtb \
          --initrd initramfs.cpio.gz \
          --cmdline "console=ttyPS0,115200" \
          --arch arm64
\end{lstlisting}
\end{frame}

\begin{frame}
\frametitle{Debugging Jailhouse}
\begin{itemize}
\item Debug/console prints on UARTs
\item Hypervisor console via sysfs
\item Inmates can use the hypervisor's debug channel
\item Inmates can specify their own debug UART
\item Cell statistics via 'jailhouse cell stats' command
\end{itemize}
\end{frame}

\subsection{Inter-cell communication}

\begin{frame}
\begin{itemize}
\item Shared memory and signaling between cells
\item Device model similar to Qemu-ivshmem
\item 1:1 communication relationship per channel
\item Modeled as a virtual PCI device
\item MSI-X support for signaling (one IRQ per virtual device)
\item ivshmem-net -> virtual network device for linux available
\item ivshmem demos for bare metal / rtos usage 
\end{itemize}
\end{frame}

\section{Conclusion}

\begin{frame}
\begin{block}{Jailhouse is great to \dots}
\begin{itemize}
\item partition your system
\item run security/safety and realtime critical tasks
\item divide and simplify your security system design
\item give additional levels of security
\item get nearly baremetal performance
\end{itemize}
\end{block}
\begin{block}{but \dots}
\begin{itemize}
\item you have to get a deep understanding of your multicore platform
\item you have to get familiar with your CPU architecture
\end{itemize}
\end{block}
\end{frame}

\section*{}
\subsection*{}

\begin{frame}
\frametitle{References}
\begin{itemize}
\item \url{http://events.linuxfoundation.org/sites/events/files/slides/ELCE2016-Jailhouse-Tutorial.pdf}
\item \url{https://github.com/siemens/jailhouse.git}
\item \url{git://git.kiszka.org/linux.git}
\item \url{https://lwn.net/Articles/578295/}
\item \url{https://lwn.net/Articles/578852/}
\item \url{http://www.linuxjournal.com/content/jailhouse}
\item \url{https://www.xilinx.com/content/dam/xilinx/imgs/products/zynq/zynq-ev-block.PNG}
\end{itemize}
\end{frame}