[PPT] - Architectures, Architectures, Microkernels, IPC, Microkernels, PowerPoint Presentation

SLIDE 1 http://d3s.mff.cuni.cz http://d3s.mff.cuni.cz/aosy

Jakub Jermář

jakub.jermar@kernkonzept.com

Architectures, Microkernels, IPC, Capabilities Architectures, Microkernels, IPC, Capabilities

SLIDE 2 2 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Agenda Agenda

Kernel architectures Microkernels IPC Capabilitjes

SLIDE 3 3 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Recall: Common OS Taxonomy Recall: Common OS Taxonomy

Special-purpose operatjng systems Real-tjme operatjng systems Hypervisors (type 1) ... General-purpose operatjng systems Monolithic kernel Single-server microkernel Multjserver microkernel Hybrid kernel (?)

SLIDE 4 4 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Monolithic Kernel Monolithic Kernel

hardware monolithic kernel applicatjon applicatjon applicatjon privileged mode unprivileged mode memory mgmt scheduler IPC device drivers fjle system drivers user mgmt network stack ...

SLIDE 5 5 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Some Obvious Issues Some Obvious Issues

Security Applicatjons trust all kernel components Kernel components trust all other kernel components Reliability Kernel components are a single point of failure Availability Kernel components cannot be updated independently Justjfjability Who says fjle systems, networking, device drivers, etc. belong to the kernel?

SLIDE 6 6 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Some Obvious Issues (2) Some Obvious Issues (2)

Extensibility

How to extend the system without modifying the kernel Too many communicatjon mechanisms Unix: pipes, fjles, shared memory, sockets, signals, System V IPC, System V shared memory, System V semaphores… Kernel has many built-in policies

Sofuware design principles

Interfaces between kernel components are usually implicit, not well-defjned

SLIDE 7 7 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Single-server Microkernel Single-server Microkernel

hardware microkernel applicatjon applicatjon applicatjon privileged mode unprivileged mode memory mgmt scheduler IPC system server device drivers fjle system drivers user mgmt network stack ...

SLIDE 8 8 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures fjle system driver server

Multjserver Microkernel Multjserver Microkernel

hardware microkernel applicatjon applicatjon applicatjon privileged mode unprivileged mode memory mgmt scheduler IPC naming server locatjon server device driver server device driver server device driver server fjle system driver server fjle system driver server device multjplexer fjle system multjplexer network stack security server ...

SLIDE 9 9 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Examples Examples

Monolithic kernel Linux, Solaris (UTS), Windows, FreeBSD, NetBSD, OpenBSD, OpenVMS, MS-DOS, RISC OS Microkernel (the microkernel on its own) CMU Mach, GNU Mach, L4::Pistachio, Fiasco.OC, seL4 Single-server microkernel CMU Mach (with 4.3BSD server), MkLinux, L4Linux Multjserver microkernel L4Re, HelenOS, MINIX 3, Genode, GNU/Hurd

SLIDE 10 10 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures fjle system driver server

Multjserver Microkernel (reprise) Multjserver Microkernel (reprise)

hardware microkernel applicatjon applicatjon applicatjon privileged mode unprivileged mode memory mgmt scheduler IPC naming server locatjon server device driver server device driver server device driver server fjle system driver server fjle system driver server device multjplexer fjle system multjplexer network stack security server ...

SLIDE 11 11 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Hypervisor (Type 1) Hypervisor (Type 1)

hardware hypervisor hyper-privileged mode memory mgmt scheduler comm privileged mode

peratjng system

kernel privileged mode unprivileged mode app app app app

peratjng system

kernel privileged mode unprivileged mode app app app app

peratjng system

kernel privileged mode unprivileged mode app app app app

SLIDE 12 12 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Common Cloud Deployment Common Cloud Deployment

hardware hypervisor hyper-privileged mode memory mgmt scheduler comm privileged mode

peratjng system

kernel privileged mode unprivileged mode app

peratjng system

kernel privileged mode unprivileged mode app

peratjng system

kernel privileged mode unprivileged mode app

SLIDE 13 13 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Unikernel Unikernel

hardware hypervisor hyper-privileged mode memory mgmt scheduler comm privileged mode unikernel kernel component app component unikernel kernel component app component unikernel kernel component app component

SLIDE 14 14 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Unikernel (2) Unikernel (2)

Library operatjng system

Approach to building operatjng systems

Unikernel

Architecture Binary artjfact

SLIDE 15 15 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Unikernel (3) Unikernel (3)

Library operatjng system

Payload (applicatjon) merged with the kernel Kernel component acts as a library providing access to the hardware, threading, fjle systems, etc. Only necessary functjonality Mostly statjc (single image), but there are dynamic variants Code runs in privileged (less privileged) mode and single address space No mode switches, address space switches Syscalls can be replaced by functjon calls Isolatjon/security provided by the underlying hypervisor (more privileged mode)

SLIDE 16 16 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Unikernel (4) Unikernel (4)

Madhavapeddy, A., Scotu, D., J.: Unikernels: Rise of the Virtual Library Operatjng System, ACM Queue, 2013

MirageOS University of Cambridge, Docker Clean-slate components writuen in OCaml Used in Docker for Mac, VPNKit

SLIDE 17 17 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Unikernel (5) Unikernel (5)

Porter, D., E., et al.: Rethinking the library OS from the top down, ASPLOS, 2011

Drawbridge Microsofu Research (2011– ?) Librarifjed Windows Used in MSSQL Server for Linux (2016)

Kantee, A.: The Rise and Fall of the Operatjng System, ;login:, October 2015, Vol. 40, No. 5

Rumpkernel Librarifjed NetBSD Popular source of components for any kernels (NetBSD, rumprun, Hurd, Genode, …)

SLIDE 18 18 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Future Hardware Predictjons Future Hardware Predictjons

More of Complex interconnects & cache hierarchies Cache-coherency protocols even more expensive Diversity Difgerent cores together → same optjmizatjons won’t work anymore Heterogeneity Multjple ISAs → can’t have a single-image OS Less of / lack of Cache coherency Shared memory

SLIDE 19 19 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Optjons for general purpose OS’s Optjons for general purpose OS’s

Resign

Make it easy to build specialized OS’s Unikernels

Redesign

Atuack the problem from difgerent angle Multjkernels

SLIDE 20 20 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Implicit Message Passing in Hardware Implicit Message Passing in Hardware

Memory Memory Shared data L2 Cache CPU CPU CPU CPU L1 Cache L1 Cache L2 Cache L1 Cache L1 Cache write L2 Cache CPU CPU CPU CPU L1 Cache L1 Cache L2 Cache L1 Cache L1 Cache write read

SLIDE 21 21 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Multjkernel Paradigm Shifu Multjkernel Paradigm Shifu

Inside the OS layer

Do not assume coherent shared-memory SMP If available, use to optjmize message passing No implicit inter-core state sharing Simple, single-threaded, event-driven code Explicit inter-core communicatjon via message passing Global state replica maintained by distributed algorithms

SLIDE 22 22 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Multjkernel Multjkernel

CPU kernel applicatjon privileged mode unprivileged mode server server applicatjon CPU kernel server server applicatjon CPU kernel server server applicatjon applicatjon State replica State replica State replica

SLIDE 23 23 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Multjkernel (2) Multjkernel (2)

Kernel-userspace boundary not characteristjc

f multjkernels

Baumann, A., et al.: The Multjkernel: A new OS architecture for scalable multjcore systems, SOSP ‘09

Barrelfjsh ETH Zürich, Microsofu Research

SLIDE 24 24 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Inter-Process Communicatjon Inter-Process Communicatjon

Sharing data between processes (tasks)

Crossing the process isolatjon in a managed and predictable way Technically, any means of sharing data can be considered IPC (e.g. fjles, networking, middleware) In monolithic systems, this usually works without using a dedicated IPC mechanism Crucial for microkernel systems In microkernel systems, even fjles and networking cannot be implemented without an IPC mechanism

SLIDE 25 25 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Classical IPC Classical IPC

POSIX signals Anonymous pipes Named pipes Sockets POSIX shared memory System V shared memory, IPC, semaphores

SLIDE 26 26 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Capabilitjes Capabilitjes

Capability

Object identjfying an OS resource Logical objects (open fjles, connectjons), typed memory areas (physical memory regions) Capability reference Local user space identjfjcatjon of a capability (fjle handles, virtual memory regions) Operatjons with capabilitjes Invoking a method with a capability reference Permissible methods defjned by the capability itself Give a capability to someone else Revoke a previously given capability

SLIDE 27 27 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Trivial Capability Example Trivial Capability Example

kernel space user space read(0, ...); 1 2 3 fjle descriptor table (capabilitjes) fjle descriptor (capability reference) vfs_file_t

peratjng system resource

(open fjle)

SLIDE 28 28 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Trivial Capability Example (2) Trivial Capability Example (2)

kernel space user space struct msghdr msg; struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg); // ... memmove(CMSG_DATA(cmsg), &fd, sizeof(fd)); sendmsg(socket, &msg, 0); 1 2 3 vfs_file_t 1 2 3

SLIDE 29 29 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Trivial Capability Example (2) Trivial Capability Example (2)

kernel space user space struct msghdr msg; struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg); // ... memmove(CMSG_DATA(cmsg), &fd, sizeof(fd)); sendmsg(socket, &msg, 0); 1 2 3 vfs_file_t struct msghdr msg; struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg); // ... recvmsg(socket, &msg, 0); int fd; memmove(&fd, CMSG_DATA(cmsg), sizeof(fd)); 1 2 3 4

SLIDE 30 30 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

L4 IPC Before Capabilitjes L4 IPC Before Capabilitjes

L4::Pistachio

L 4 _ M s g _ t m s g ; L 4 _ M s g C l e a r ( & m s g ) ; L 4 _ S e t _ M s g L a b e l ( & m s g , L A B E L ) ; / / s e t u s e r

d

e f i n e d l a b e l a n d f l a g s L 4 _ M s g _ A p p e n d W

r

d ( & m s g , 1 ) ; / / a p p e n d s

m

e d a t a L 4 _ M s g _ A p p e n d W

r

d ( & m s g , 2 ) ; / / a p p e n d s

m

e d a t a L 4 _ M s g L

a

d ( & m s g ) ; / / l

a

d i n t

m

e s s a g e r e g i s t e r s L 4 _ T h r e a d I d _ t d e s t _ t i d ; L 4 _ M s g T a g _ t t a g ; … t a g = L 4 _ S e n d ( d e s t _ i d ) ; / / s e n d t h e l

a

d e d m e s s a g e t

d

e s t _ i d global ID

SLIDE 31 31 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Issues with Global IDs Issues with Global IDs

Prevent unauthorized clients Global ID can be guessed, even if offjcially unknown Example: MINIX 3 communicatjon control Ordinary user processes allowed to communicate only with POSIX servers Services and driver use policy confjgured in a fjle Example: L4 v2 Chiefs and Clans Threads can communicate with all threads in their own clan Inter-clan communicatjon must go through the chief threads Permission checks Failed checks can stjll DoS the server Decide who can do what Diffjcult to interpose The global ID identjfjes the communicatjon partjes

SLIDE 32 32 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Capabilitjes Trump Global IDs Capabilitjes Trump Global IDs

Prevent unauthorized clients

Only authorized clients have the capability

Permission checks

Possession of the capability is the authorizatjon to access the resource Can have difgerent capabilitjes for difgerent access modes to the same resource

Easy to interpose

All names are local Communicatjng partjes don’t know each other

SLIDE 33 33 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

L4 IPC with capabilitjes L4 IPC with capabilitjes

Fiasco.OC

l 4 _ m s g _ r e g s _ t * m r = l 4 _ u t c b _ m r ( ) ; m r

>

m r [ ] = 1 ; m r

>

m r [ 1 ] = 2 ; l 4 _ c a p _ i d x _ t d e s t _ c a p ; / / d e s t i n a t i

n
b

j e c t l 4 _ m s g t a g _ t t a g ; … t a g = l 4 _ i p c _ s e n d ( d e s t _ c a p , l 4 _ u t c b ( ) , l 4 _ m s g t a g ( L A B E L , 2 , , ) , L 4 _ I P C _ N E V E R ) ; local ID

SLIDE 34 34 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Fiasco.OC IPC Fiasco.OC IPC

l4_msgtag_t l4_ipc(l4_cap_idx_t dest, l4_utcb_t *utcb, l4_umword_t fmags, l4_umword_t slabel, l4_msgtag_t tag, l4_umword_t *rlabel, l4_tjmeout_t tjmeout); SEND – Send to the specifjed destjnatjon RECV – Receive from the specifjed destjnatjon CALL (SEND | RECV) – Send, create reply capability and receive WAIT (OPEN_WAIT | RECV) – Receive from any possible sender SEND_AND_WAIT (SEND | OPEN_WAIT | RECV) REPLY | SEND – Send to the reply capability REPLY | SEND | RECV – Send to the reply capability and receive REPLY_AND_WAIT (REPLY | SEND | OPEN_WAIT | RECV)

SLIDE 35 35 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Fiasco.OC Client/Server IPC Example Fiasco.OC Client/Server IPC Example

l 4 _ m s g _ r e g s _ t * m r = l 4 _ u t c b _ m r ( ) ; i n t a = 1 ; i n t b = 1 ; f

r

( ; ; ) { m r

>

m r [ ] = a ; m r

>

m r [ 1 ] = b ; l 4 _ m s g t a g _ t t a g ; t a g = l 4 _ i p c _ c a l l ( s e r v e r _ c a p , l 4 _ u t c b ( ) , l 4 _ m s g t a g ( , 2 , , ) , L 4 _ I P C _ N E V E R ) ; … a = b ; b = ( i n t ) m r

>

m r [ ] ; } l 4 _ m s g t a g _ t t a g ; l 4 _ u m w

r

d _ t l a b e l ; l 4 _ m s g _ r e g s _ t * m r = l 4 _ u t c b _ m r ( ) ; t a g = l 4 _ i p c _ w a i t ( l 4 _ u t c b ( ) , & l a b e l , L 4 _ I P C _ N E V E R ) ; f

r

( ; ; ) { … i n t a = m r

>

m r [ ] ; i n t b = m r

>

m r [ 1 ] ; m r

>

m r [ ] = ( i n t ) ( a + b ) ; t a g = l 4 _ i p c _ r e p l y _ a n d _ w a i t ( l 4 _ u t c b ( ) , l 4 _ m s g t a g ( , 1 , , ) , & l a b e l , L 4 _ I P C _ N E V E R ) ; } kernel space user space mr0 mr1 UTCB clnt … mr0 mr1 UTCB srv …

SLIDE 36 36 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Fiasco.OC IPC (2) Fiasco.OC IPC (2)

l4_msgtag(label, words, items, fmags)

Label User-defjned label, e.g. protocol number, error code Words Number of untyped words stored in the UTCB Items Number of typed items stored in the UTCB Capabilitjes, mappings Flags

SLIDE 37 37 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Fiasco.OC IPC (3) Fiasco.OC IPC (3)

l4_umword_t slabel, *rlabel

Send label User-defjned label copied to the recipient Used to hold sender thread ID before capabilitjes Mostly zero these days Receive label User-defjned label copied from the sender Usually zero Bound IPC Gates and atuached IRQ objects modify the label Can be used e.g. to store a pointer to the server object

SLIDE 38 38 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

IPC Marshalling IPC Marshalling

By hand Interface Defjnitjon Language

IDL compiler generates client and server stubs from the interface descriptjon in IDL Overkill for microkernels Need just one language, one architecture Advanced constructs not used in microkernels IDL compiler ofuen bigger than the microkernel

SLIDE 39 39 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

IPC Marshalling IPC Marshalling

Stream-based IPC

t e m p l a t e < t y p e n a m e T > I p c _ c l i e n t &

p

e r a t

r

< < ( T v a l u e ) ; I p c _ c l i e n t c l i e n t ( f

,

& s n d _ b u f , & r c v _ b u f ) ; i n t r e s u l t ; c l i e n t < < O P C O D E _ B A R < < 1 < < I P C _ C A L L > > r e s u l t ;

C++11 IDL (parameter packs, ...)

s t r u c t F

:

… { L 4 _ I N L I N E _ R P C ( l

n

g , b a r , ( i n t , i n t & ) ) ; } ; L 4 : : C a p < F

>

f

;

i n t r e s u l t ; f

>

b a r ( 1 , & r e s u l t ) ;

SLIDE 40 40 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

L4Re Client/Server RPC Example L4Re Client/Server RPC Example

L 4 : : C a p < F

>

f

;

… i n t a ; L 4 R e : c h k s y s ( f

>

b a r ( 4 2 , a ) ) ; p r i n t f ( “ % d \ n ” , a ) ; s t r u c t F

_

s r v : L 4 : : E p i f a c e _ t < F

_

s r v , F

>

{ l

n

g

p

_ b a r ( F

:

: R i g h t s , i n t v a l u e , i n t & a ) { a = 2 * v a l u e ; r e t u r n L 4 _ E O K ; } } ; L 4 R e : : U t i l : : R e g i s t r y _ s e r v e r < … > s e r v e r ; F

_

s r v f

;

L 4 R e : : c h k c a p ( s e r v e r . r e g i s t r y ( )

>

r e g i s t e r _

b

j ( & f

,

“ n a m e ” ) ) ) ; s e r v e r . l

p

( ) ; kernel space user space s t r u c t F

:

L 4 : : K

b

j e c t _ t < F

,

L 4 : : K

b

j e c t , x f > { L 4 _ I N L I N E _ R P C ( l

n

g , b a r , ( i n t , i n t & ) ) ; t y p e d e f L 4 : : T y p e i d : : R p c s < b a r _ t > R p c s ; } ; 1 2 3 L4::Ipc_gate l4_ipc_call(0x3000) label: &foo server loop bind_thread(…, &foo) foo 1 2 mr0 mr1 UTCB clnt … mr0 mr1 UTCB srv … client client server

SLIDE 41 41 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Fiasco.OC Object Model Fiasco.OC Object Model

Kernel objects

L4::Thread L4::Task L4::Ipc_gate Object for implementjng userspace objects L4::Irq L4::Semaphore L4::Scheduler L4::Factory Creates new kernel objects subject to factory quota L4::Vcon

SLIDE 42 42 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Fiasco.OC Object Model (2) Fiasco.OC Object Model (2)

Capabilitjes

Typed by kernel/user object Capability selectors / slots allocated in userspace Like in seL4 Unlike in HelenOS, Mach, fjle descriptors Mapped to kernel object upon object creatjon Can be sent via IPC as a typed item Can be mapped to a task via its capability

Syscall

Invocatjon of capability via IPC

SLIDE 43 43 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

New Object Creatjon in L4Re / Fiasco.OC New Object Creatjon in L4Re / Fiasco.OC

kernel space user space L4::Factory 1 2 3 Task’s object space 4 factory 1

SLIDE 44 44 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

New Object Creatjon in L4Re / Fiasco.OC New Object Creatjon in L4Re / Fiasco.OC

a u t

s

e m = L 4 R e : : c h k c a p ( L 4 R e : : U t i l : : m a k e _ u n i q u e _ c a p < L 4 : : S e m a p h

r

e > ( ) ) ; kernel space user space L4::Factory 1 2 3 Task’s object space 4 Sem 4 factory 1

SLIDE 45 45 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

New Object Creatjon in L4Re / Fiasco.OC New Object Creatjon in L4Re / Fiasco.OC

a u t

s

e m = L 4 R e : : c h k c a p ( L 4 R e : : U t i l : : m a k e _ u n i q u e _ c a p < L 4 : : S e m a p h

r

e > ( ) ) ; kernel space user space L4::Factory L 4 R e : : c h k s y s ( L 4 R e : : E n v : : e n v ( )

>

f a c t

r

y ( )

>

c r e a t e ( s e m . g e t ( ) ) ) ; L4::Semaphore 1 2 3 Task’s object space 4 Sem 4 factory 1

SLIDE 46 46 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

New Object Creatjon in L4Re / Fiasco.OC New Object Creatjon in L4Re / Fiasco.OC

a u t

s

e m = L 4 R e : : c h k c a p ( L 4 R e : : U t i l : : m a k e _ u n i q u e _ c a p < L 4 : : S e m a p h

r

e > ( ) ) ; kernel space user space L4::Factory s e m

>

u p ( ) ; L 4 R e : : c h k s y s ( L 4 R e : : E n v : : e n v ( )

>

f a c t

r

y ( )

>

c r e a t e ( s e m . g e t ( ) ) ) ; L4::Semaphore 1 2 3 Task’s object space 4 Sem 4 factory 1

SLIDE 47 47 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

Q&A

SLIDE 48 48 Jakub Jermář, Advanced Operatjng Systems, February 28th 2019 Architectures

References References

Madhavapeddy, A., Scotu, D., J.: Unikernels: Rise of the Virtual Library Operatjng System, ACM Queue,

2013

Porter, D., E., et al.: Rethinking the library OS from the top down, ASPLOS, 2011
Kantee, A.: The Rise and Fall of the Operatjng System, ;login:, October 2015, Vol. 40, No. 5
Baumann, A., et al.: The Multjkernel: A new OS architecture for scalable multjcore systems, SOSP ‘09
L4hq.org: Kernel APIs, htup://l4hq.org/kernels/
Kuz, I.: L4 User Manual, API Version X.2, NICTA 2004
L4Re Documentatjon: htup://l4re.org/doc/
Herder, J., N., et al.: Countering IPC Threats in Multjserver Operatjng Systems, IEEE PRDC 2008
Heiser, G.,: From L3 to seL4: What have we learnt in 20 years of L4 microkernels?, Proceedings of the

Twenty-Fourth ACM Symposium on Operatjng Systems Principles, 2013

Feske, N.,: A Case Study on the Cost and Benefjt of Dynamic RPC Marshalling for Low-Level System

Components, SIGOPS OSR Special Issue on Secure Small-Kernel Systems, July 2007

Hartjg, H., Hohmuth, M., Liedtke, J., Schoenberg, S., Wolter, J.,: The Performance of µ-Kernel-Based
Systems. ACM SIGOPS Operatjng Systems Review. 31. 10.1145/269005.266660, 1997
Golub, D., et. al.: Unix as an Applicatjon Program, USENIX 1990 Summer Conference