Guest post by NICTA, Australia’s Information and Communications Technology Research Centre, has published a paper on the lessons learned by 20 years of work around the L4 microkernel.
Some of you may remember that NICTA has developped the seL4 microkernel, one of the first – if not the first – microkernel formally verified, an important stepstone in securing computing systems against whole classes of bugs and attacks.
The L4 microkernel has undergone 20 years of use and evolution. It has an active user and developer community, and there are commercial versions that are deployed on a large scale and in safety-critical systems. In this article we examine the lessons learnt in those 20 years about microkernel design and implementation. We revisit the L4 design papers, and examine the evolution of design and implementation from the original L4 to the latest generation of L4 kernels. We specifically look at seL4, which has pushed the L4 model furthest and was the first OS kernel to undergo a complete formal verification of its implementation as well as a sound analysis of worst-case execution times. We demonstrate that while much has changed, the fundamental principles of minimality, generality and high inter-process communication (IPC) performance remain the main drivers of design and implementation decisions.
Some time ago. Serious work. Shouldn’t be dismissed at these relevant times focused on security.
http://www.sigops.org/sosp/sosp09/papers/klein-sosp09.pdf
With a highly traceable version.
… that L4 and derivatives are pure microkernels, they try to avoid any kind of policy in the kernel itself leaving that to the user-mode operating system.
Great if one want to do something uncommon like a single address space capability system (e.g. MUNGI) but it leads to some inherent overheads if one, like most L4 based systems, uses it as a virtualization layer for Linux.