Meta tags:

Headings (most frequently used words):

muen, hardware, building, arm64, sk, overview, features, resources, tested, deployment, testing, references, license, kernel, tau0, components, toolchain, documentation, mailing, list, intel, x86, prerequisites, emulation,

Text of the page (most frequently used words):
the (76), muen (56), and (23), for (22), #kernel (19), https (18), bob (18), system (16), git (15), dev (14), hardware (13), intel (12), x86 (12), linux (12), written (12), subject (12), arm64 (11), build (11), qemu (11), codelabs (10), 2014 (10), spark (9), project (8), list (8), debug (8), run (8), minimal (7), command (7), following (7), with (6), components (6), tau0 (6), this (6), are (6), subjects (6), lenovo (6), all (6), using (6), pdf (6), under (5), mugenhwcfg (5), com (5), systems (5), lake (5), high (5), specification (5), support (5), bit (5), license (4), building (4), documentation (4), use (4), virtual (4), live (4), module (4), mirageos (4), tool (4), execute (4), t430s (4), which (4), output (4), development (4), thinkpad (4), separation (4), spec (4), component (4), based (4), ada (4), that (4), source (4), security (4), licensed (3), emulation (3), testing (3), mailing (3), resources (3), toolchain (3), features (3), your (3), any (3), specific (3), user (3), config (3), muennet (3), muenfs (3), muenevents (3), muenblock (3), xilinx (3), zcu104 (3), demo (3), mpsoc (3), not (3), available (3), given (3), contrib (3), runqemu (3), zcu102 (3), root (3), install (3), ivy (3), bridge (3), technology (3), nuc (3), skylake (3), google (3), googlegroups (3), articles (3), running (3), platform (3), inter (3), memory (3), channels (3), 2012 (3), driver (3), static (3), mode (3), while (3), mechanism (3), assurance (3), native (3), pci (3), vmx (3), code (3), discussions (2), references (2), deployment (2), prerequisites (2), tested (2), overview (2), otherwise (2), its (2), sub (2), provide (2), flexibility (2), furthermore (2), machines (2), file (2), each (2), github (2), bobbuildtool (2), suitable (2), board (2), will (2), desired (2), yaml (2), bootable (2), see (2), test (2), emulated (2), directory (2), also (2), via (2), terminal (2), timing (2), kvm (2), cpu (2), console (2), ssh (2), serial (2), instructions (2), how (2), out (2), issue (2), nested (2), virtualization (2), recipes (2), clone (2), layers (2), update (2), number (2), environment (2), sandbox (2), here (2), html (2), pipx (2), amd (2), haswell (2), apollo (2), xeon (2), used (2), there (2), has (2), groups (2), interface (2), message (2), email (2), subscribe (2), regarding (2), presentation (2), his (2), slides (2), block (2), current (2), provides (2), new (2), image (2), from (2), includes (2), application (2), event (2), device (2), level (2), more (2), vms (2), passthrough (2), assignment (2), according (2), policy (2), runtime (2), errors (2), architecture (2), verification (2), enables (2), other (2), covert (2), platforms (2), composed, asciidoctor, 2026, content, download, mailinglist, table, contents, unless, noted, projects, gnu, general, public, gplv3, option, later, version, libraries, bsd, additional, commercial, interfaces, between, programs, constitute, gpl, boundaries, authoritative, information, please, consult, headers, copying, files, within, releases, generator, mirage, then, copy, card, power, dist, workspace, boot, bin, can, dumped, usb, stick, already, present, when, executing, add, recipe, accordingly, entry, template, iso, options, automatically, writing, artifacts, put, possible, virtualized, scenarios, continuous, integration, package, query, over, curses, sensitive, cannot, guarantee, correct, due, differences, host, load, etc, just, emergency, interact, booted, follow, screen, connect, vnc, session, into, nic, guest, start, ease, makes, provided, pick, one, recipe_name, recurse, submodules, once, ready, replace, example, job, count, cores, machine, setting, instructs, containerized, jobs, recommend, configuration, default, further, variants, installing, described, readthedocs, latest, installation, built, arm, cortex, a53, armv8, zcu106, 3610qe, kontron, ktqm77, mitx, 3520m, 4600u, t440s, 4765t, cirrus7, nimbus, 5300u, broadwell, 5i5myhe, celeron, j3455, 6cayh, atom, e3950, maker, 6770hq, 6i7kyk, 6500u, x260, gold, 6130, hpe, dl380, gen10, server, 8650u, kaby, t480s, 2176m, coffee, ibase, mi995vf, x27, 125000, alder, asus, prime, z690, good, chance, similar, works, box, microarchitecture, newer, web, group, post, write, send, blank, mail, note, account, required, address, should, work, announcements, technical, integrity, software, conference, http, www, slideshare, net, adacore, 2014secunethsr, original, master, thesis, report, bootloader, signed, stream, commands, bsbsc, detailed, branch, preliminary, zynq, ultrascale, evaluation, boards, below, automated, description, generation, simplifies, addition, target, debian, persistence, simplify, collection, configurations, targets, versatile, facilitates, construction, different, domains, modules, filesystem, network, drivers, debugserver, timeserver, lifecycle, controller, loader, monitor, manager, nvme, experimental, ahci, sata, usable, implement, common, services, composer, operation, task, compose, making, sure, certain, invariants, violated, concept, gradually, increase, top, keeping, correctness, isolation, enforcement, read, about, unikernels, smp, crash, audit, shared, communication, zero, footprint, time, rts, signaled, interrupts, msi, space, dmar, fixed, cyclic, scheduling, preemption, timer, paging, ept, typing, pat, multicore, proof, absence, full, availability, outlines, most, prominent, active, properties, ongoing, uses, assisted, core, separate, executes, called, non, realized, dma, interrupt, remapping, secure, devices, specialized, microkernel, execution, exclusively, communicate, strictly, isolated, channel, problem, largely, ignored, addressed, explicitly, these, kernels, sks, generally, smaller, than, dynamic, microkernels, minimizes, possibility, failure, formal, techniques, mitigation, open, been, formally, proven, contain, developed, switzerland, was, designed, specifically, meet, challenging, requirements, ensure, highly, critical, advanced, national, closely, cooperates, specialist, secunet, networks, germany, gmbh, page, served, unikernel, solo5, checkout, perfcharts,

Text of the page (random words):
muen sk for x86 64 muen sk τ0 articles perfcharts git codelabs github muen an x86 64 separation kernel for high assurance checkout source code this page is served by a mirageos solo5 unikernel running on muen overview muen is an open source separation kernel sk for the intel x86 64 architecture that has been formally proven to contain no runtime errors at the source code level it is developed in switzerland by codelabs gmbh muen was designed specifically to meet the challenging requirements of high assurance systems on the intel x86 64 platform to ensure muen is suitable for highly critical systems and advanced national security platforms codelabs closely cooperates with the high security specialist secunet security networks ag in germany a separation kernel is a specialized microkernel that provides an execution environment for components that exclusively communicate according to a given security policy and are otherwise strictly isolated from each other the covert channel problem largely ignored by other platforms is addressed explicitly by these kernels sks are generally more static and smaller than dynamic microkernels which minimizes the possibility of kernel failure enables the application of formal verification techniques and the mitigation of covert channels muen uses intel s hardware assisted virtualization technology vt x as core mechanism to separate components the kernel executes in vmx root mode while user components so called subjects run in vmx non root mode hardware passthrough is realized using intel s vt d dma and interrupt remapping technology this enables the secure assignment of pci devices to subjects muen is under active development and verification of kernel properties is ongoing features kernel the following list outlines the most prominent features of the muen kernel minimal sk for the intel x86 64 architecture written in spark 2014 full availability of source code and documentation proof of absence of runtime errors multicore support nested paging ept and memory typing pat fixed cyclic scheduling using intel vmx preemption timer static assignment of resources according to system policy pci device passthrough using intel vt d dmar and ir pci config space emulation support for message signaled interrupts msi minimal zero footprint run time rts event mechanism shared memory channels for inter subject communication crash audit support for 64 bit native and 32 64 bit vm subjects native 64 bit ada subjects native 64 bit spark 2014 subjects linux 32 64 bit vms smp for linux vms mirageos unikernels mirageos tau0 tau0 τ is the muen system composer in its current static mode of operation the task of tau0 is to compose a system image while making sure that certain invariants are not violated the tau0 concept is a mechanism to gradually increase the flexibility of component based systems running on top of muen while keeping a high level of assurance regarding the correctness of isolation enforcement read more about tau0 here components the muen platform includes re usable components which implement common services ahci sata driver subject written in spark 2014 nvme driver subject written in spark 2014 experimental device manager dm written in spark 2014 subject monitor sm written in spark 2014 subject loader sl written in spark 2014 subject lifecycle controller written in spark 2014 timeserver subject written in spark 2014 debugserver subject written in ada 2012 ps 2 driver subject written in ada 2012 virtual terminal vt subject written in ada 2012 furthermore the muenblock muenevents muenfs and muennet linux kernel modules provide block i o inter subject event virtual filesystem and network interface drivers based on inter subject memory channels toolchain the muen platform includes a versatile toolchain which facilitates the specification and construction of component based systems in different application domains the mugenhwcfg tool for automated hardware description generation simplifies the addition of support for new target machines there is also a debian live based bootable image mugenhwcfg live with persistence to simplify the collection of hardware configurations from new targets arm64 the current development branch of muen provides preliminary support for running muen on amd zynq ultrascale mpsoc evaluation boards see the instructions below resources documentation the following detailed project documentation is available muen system specification https muen sk muen system spec pdf muen kernel specification https muen sk muen kernel spec pdf muen component specification https muen sk muen component spec pdf bootloader signed block stream of commands specification https muen sk bsbsc spec pdf original muen master thesis https muen sk muen report pdf muen project presentation https muen sk muen slides pdf presentation given at high integrity software conference his 2014 http www slideshare net adacore slides his 2014secunethsr technical articles on muen https muen sk articles html mailing list the muen dev googlegroups com mailing list is used for project announcements and discussions regarding the muen separation kernel to subscribe to the list send a blank mail to muen dev subscribe googlegroups com note a google account is not required any email address should work to post a message to the list write an email to muen dev googlegroups com the list has a google groups web interface https groups google com group muen dev tested hardware the following hardware is used for the development of muen there is a good chance similar hardware works out of the box if the microarchitecture is ivy bridge or newer intel x86 asus prime z690 p d4 alder lake i5 125000 ibase mi995vf x27 coffee lake xeon e 2176m lenovo thinkpad t480s kaby lake i7 8650u hpe dl380 gen10 server skylake xeon gold 6130 lenovo thinkpad x260 skylake i7 6500u intel nuc 6i7kyk skylake i7 6770hq up 2 maker board apollo lake atom e3950 intel nuc 6cayh apollo lake celeron j3455 intel nuc 5i5myhe broadwell i5 5300u cirrus7 nimbus haswell i7 4765t lenovo thinkpad t440s haswell i7 4600u lenovo thinkpad t430s ivy bridge i7 3520m kontron technology ktqm77 mitx ivy bridge i7 3610qe arm64 amd mpsoc zcu104 zcu106 armv8 1 arm cortex a53 building muen prerequisites muen is built using the bob build tool bob install it via pipx pipx install bobbuildtool further variants of installing bob are described here https bob build tool readthedocs io en latest installation html install we recommend using the following bob user configuration in config bob default yaml command dev jobs 32 sandbox dev replace the example number 32 with your desired job count e g number of cpu cores of your build machine the sandbox dev setting instructs bob to build in a containerized environment once bob is ready clone the muen recipes and update all layers git clone recurse submodules https git codelabs ch bob muen git cd muen bob layers update building execute the bob ls command to list all available root recipes pick one and build it using the bob dev recipe_name command e g bob dev x86 qemu debug to build an arm64 demo system for the qemu emulated zcu102 issue the following command bob dev arm64 qemu zcu102 minimal debug deployment testing emulation to ease kernel development and testing the muen project makes use of nested virtualization provided by qemu kvm issue the following command in the project directory to start the muen system in qemu contrib runqemu py q x86 qemu debug the system serial output is written to run serial out follow the on screen instructions on how to connect to the qemu vnc session or how to ssh into the nic linux guest vm of the demo system as the virtual terminal vt over curses is timing sensitive and qemu kvm cannot guarantee correct timing due to differences in host cpu system load etc this console is just an emergency console use ssh to interact with the booted muen system to run an arm64 system execute contrib runqemu py with an arm64 specific package query contrib runqemu py q arm64 qemu zcu102 minimal debug it s also possible to run all virtualized scenarios via the continuous integration ci system ci run sh a output this will build and test all qemu emulated systems automatically writing all artifacts to the given output directory to put a specific system under test ci run sh a output r x86 qemu debug see ci run sh h for all available options hardware to build a bootable iso file execute the following command bob dev x86 t430s debug this will build a system for the lenovo t430s hardware which can be dumped on a usb stick if the desired system is not already present when executing the bob ls command add it to the x86 yaml recipe accordingly use the entry for the lenovo t430s hardware as a template to build the minimal demo for the xilinx mpsoc execute bob dev arm64 xilinx zcu104 minimal debug then copy dev dist arm64 xilinx zcu104 minimal debug 1 workspace boot bin to a suitable sd card and power on the board references bob build tool https bobbuildtool dev mirageos https mirage io muenblock linux kernel module https git codelabs ch p muen linux muenblock git muenevents linux kernel module https git codelabs ch p muen linux muenevents git muenfs linux kernel module https git codelabs ch p muen linux muenfs git muennet linux kernel module https git codelabs ch p muen linux muennet git muen hardware config generator https git codelabs ch p muen mugenhwcfg git mugenhwcfg live https github com codelabs ch mugenhwcfg live releases license unless otherwise noted this project and its sub projects are licensed under the gnu general public license v3 0 gplv3 or at your option any later version specific libraries are licensed under the bsd license to provide additional flexibility for commercial use furthermore the interfaces between the kernel and subjects virtual machines user programs constitute gpl boundaries for authoritative information please consult the file headers and any copying files within each sub project table of contents overview features kernel tau0 components toolchain arm64 resources documentation mailing list tested hardware intel x86 arm64 building muen prerequisites building deployment testing emulation hardware references license download git discussions mailinglist composed with asciidoctor muen project 2026 content licensed under cc by 3 0