I'm blogging about low-level topics and my operating system projects on x86 and RISC-V.
Recently a colleague mentioned building NixOS images that run unchanged on multiple architectures. Given the past adventures on this blog with systemd-repart and cross-compiling NixOS , I decide to give this a go. tl;dr You can find a quick’n’dirty implementation here . Check the repo for details on how to build and run it. So do we want to do: We want to build one disk image that boots on x86_64,…
Let’s say, you need to monitor a website for changes and you really don’t have a lot of time to set things up. Also solving the problem with money using services, such as changedetection.io or visualping.io , have failed you, because their accesses are probably filtered out. I’ve come up with the following scrappy solution. First, I want to get push notifications to my phone. So I installed…
It’s FOSDEM time! I have fond memories of the Microkernel and Component-based OS devroom in particular. It’s a fun meetup of extremely skilled low-level software engineers. This year I cannot attend, so it’s a good time to ramble reflect on it. Some Background The community around this devroom has one epicenter in Dresden, where many of us met at the Operating Systems Group at the university.…
This post shows you how to use CET user shadow stacks on Linux. CET is a hardening technology that mitigates typical memory unsafety issues on x86. This post will not explain this security feature. If you don’t know what CET is, this post is probably not for you. For general advice on hardening C/C++, check out these guidelines . Back to CET shadow stacks. Recent distros, such as NixOS 24.05 and…
In my last post , we built whole disk images for embedded systems using Nix . This approach is well suited for RISC-V or ARM systems, but you probably don’t have a powerful build box for this architecture. You wouldn’t want to build a Linux kernel for hours on a RISC-V single-board computer praying that you don’t run out of RAM… In this blog post, we will use the same NixOS configuration to…
When you build software for embedded devices (your Wi-Fi router or home automation setup on your Raspberry Pi), there is always the question how to build these images and how to update them. What I want is: A mostly immutable system with few moving parts. A disk image that can be written to disk without a complicated installation procedure. A simple mechanism to securely download updates from the…
This blog post is a continuation of my previous posts about Confidential Computing . tl;dr Complexity frequently leads to security issues. Adding support for a bunch of confidential computing technologies to KVM increases its complexity and thus softens its security stance. Longer Version While scrolling through KVM security vulnerabilities, it’s hard not to notice an uptick of vulnerabilities…
In the RISC-V architecture, you have excellent support for embedding information into code by choosing compressed or uncompressed instructions. While being a typical RISC with fixed 32-bit instruction length, RISC-V allows certain common instructions to be encoded as compressed 16-bit instructions to improve code density. Each compressed instruction has a functionally identical 32-bit cousin. If…
Recently, I’ve noticed strange hangs of KVM VMs on a custom VMM. As it fits the topic of this blog, I thought I make the issue more googleable. Until we dive into the issue, we have to set the scene a bit. The Scene Consider that we want to run a KVM vCPU on Linux, but we want it to unconditionally exit after 1ms regardless of what the guest does. To achieve this, we can create a CLOCK_MONOTONIC…
This post is a continuation of my previous post about Intel TDX . It’s worth a read before reading this post. As before, I’m not going to introduce TDX itself. If you need a refresher, Intel has good overview material available. tl;dr While Intel TDX does make some attacks by the cloud vendor harder, you still have to trust the cloud vendor unless you go to extreme lengths. We need to build…