Microkerneldude

Keep in mind Xen is bloated beyond belief, and all of this bloat is running in supervisor mode. It being an actual type 1 hypervisor makes it significantly better than approaches such as Linux KVM or freebsd bhyve, but the TCB is still too big. A better approach is to run the VMM (which handles VM exceptions) as a normal user process under a microkernel. seL4 implements such an approach, with the added benefits of capabilities; the VMM doesn't get any more privileges than it actually needs, thus a successful attack against the VMM from within the VM could not actually provide anything beyond what supervisor mode execution within the VM would. A lot more on this to be found here: https://ts.data61.csiro.au/projects/TS/virtualisation/ More papers (not restricted to virtualization): https://ts.data61.csiro.au/projects/TS/publications.pml And, while at it, I also recommend reading Gernot Heiser's blog, which has plenty on this. https://microkerneldude.wordpress.com/

>That's not what I said. I said that merely creating a verified formal specification of a language is not in itself a good path to increasing correctness, and I wouldn't focus on that as a significant cause for concern given all others. This seems to be poorly considered. Isn't it easier for an OS and a language to be verified once even at great cost than hoping future billions of lines of developer code already produced at lesser cost per line are actually correct? https://microkerneldude.wordpress.com/2016/06/16/verified-software-can…

seL4 just celebrated its 10th anniversary. seL4 isn't widespread in COTS systems but rather in high assurance government systems as explained in this blog post: https://microkerneldude.wordpress.com/2019/08/06/10-years-sel4-still-t…

Common hypervisors like ESX and Xen definitely aren't like microkernels, though they'd be more secure if they actually were. ESX and Xen are more like monolithic kernels. The problem is that in practice they've become mini-kernels with their own driver systems and increasingly large code surfaces, recapitulating the mistake of monolithic kernels. seL4 actually can act as a hypervisor, and their build framework comes with support for building Linux guests into the bootable system image. I don't know if there are proofs of security wrt to the hypervisor, nor what the worth would be considering how complex the CPUs are these days, but I'd have much more trust in seL4 as a hypervisor and driver framework than in something using FreeBSD or Linux as the critical guarantor of system security. If you're stuck with commodity x86 or ARM hardware and really want a strong architecture, seL4 is the best option unless you want to build from scratch. Apple uses another L4 derivative as the OS for its security chips; an in-house derivative that predates the seL4 project.[1][2] [1] https://microkerneldude.wordpress.com/2016/04/14/so-the-fbi-cracked-th… [2] https://www.blackhat.com/docs/us-16/materials/us-16-Mandt-Demystifying…

This was presented in 2020-01, where proof was “due Q1’20”. FYI, Proof got finished in 2020-06: https://microkerneldude.wordpress.com/2020/06/09/sel4-is-verified-on-r…

OKL4 was both a microkernel and hypervisor. They coined term microhypervisor to differentiate that. https://microkerneldude.wordpress.com/2008/04/03/microkernels-vs-hyper… NOVA is an open-source micro-hypervisor available in GenodeOS that similarly combines hypervisor functionality with a microkernel-like design: http://hypervisor.org The Xen hypervisor also got many of its design elements from the Nemesis OS, which had a lightweight kernel. There's plenty of overlap possible. A number of research and production systems are also both hypervisors and microkernel-like, too. So, it's more an existing concept than a bizarre, hypothetical connection. For OKL4, also deployed in over a billion phones they claim.

You (like Linus) are right in that microkernels don't provide much of a security benefit in-and-of themselves. But taking full advantage of other advances in information security research requires a new OS architecture. The financial consequences of poor security are becoming more severe and the cost of developing high-assurance code is dropping rapidly [1]. If we haven't crossed the cost/benefit ratio yet, we are very close. Microkernels are already the preferred architecture in niches that don't require legacy software. Monolithic kernels (and the Linux development process) can't catch up to the state-of-the-art. [1]: https://microkerneldude.wordpress.com/2016/06/16/verified-software-can…

Yes. https://microkerneldude.wordpress.com/2016/06/16/verified-software-can…

Gernot Heiser, the leader behind seL4, thinks so: https://microkerneldude.wordpress.com/2016/06/16/verified-software-can… They built infrastructure to build verified OS stuff faster/cheaper. For example, they reimplemented ext2fs for Linux.