From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=unavailable autolearn_force=no version=3.4.4 Path: border1.nntp.dca3.giganews.com!backlog3.nntp.dca3.giganews.com!border3.nntp.dca.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!newspeer1.nac.net!us.feeder.erje.net!feeder.erje.net!eu.feeder.erje.net!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail From: Alexander Senier Newsgroups: comp.lang.ada Subject: Re: [ANN] Muen - An x86/64 Separation Kernel for High Assurance Date: Sat, 14 Dec 2013 00:30:54 +0100 Organization: A noiseless patient Spider Message-ID: <20131214003054.2565a031@t400> References: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Injection-Info: mx05.eternal-september.org; posting-host="ea1cb8d971dfd7ad2665d5c8a19ce5df"; logging-data="18135"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/MIXjdfCOqCpIN7PrIS7Eg" X-Newsreader: Claws Mail 3.8.1 (GTK+ 2.24.13; x86_64-pc-linux-gnu) Cancel-Lock: sha1:wnjaPTG+gjuLqKwNVJ4uBtdRY2w= X-Original-Bytes: 2915 Xref: number.nntp.dca.giganews.com comp.lang.ada:184259 Date: 2013-12-14T00:30:54+01:00 List-Id: On Fri, 13 Dec 2013 13:41:38 -0800 (PST) Diogenes wrote: > Will this kernel function on any AMD based systems or any embedded > systems (Gumstix, Rasberry Pi)? Muen purposely is a relatively small layer on top Intel VT as this keeps the kernel complexity low. Supporting AMD-based systems should be possible, though, with reasonable effort and a minor increase in complexity as AMD's hardware virtualization features are comparable. When it comes to embedded targets the closest match seems to be the Intel Atom CPU. While versions with VT-x exist, there are currently no Atom CPUs with EPT or VT-d. EPT (aka. nested paging) is an important feature to reduce the complexity (and performance) of virtual machines. VT-d is essential if untrusted virtual machines have direct access to PCIe devices and especially if you want to build a system that uses untrusted device drivers / devices in conjunction with trusted applications (think of an untrusted Linux VM that drives the network card and a trusted application that enforces encryption of all traffic). Should Intel ever build VT-d (and EPT) into Atom CPUs, a Muen port to these CPUs is thinkable. > Are there plans to port this kernel? While a port to a suitable AMD CPU seems doable, it is not planned at the moment as there is no demand. Given the size of the kernel, a port to completely different architectures like ARM would probably be more complex than a rewrite. > Are you looking for contributors? Sure. Note, that Muen is meant to be the foundation for trustworthy *systems* - in a component-based system there are many other interesting areas outside the kernel. Someone asked for a (trusted?) TCP/IP stack earlier, other trusted components (input, graphics, crypto=E2=80=A6) are necessary to make up a complete system. Regards Alex