Login
Phase 13: Summary, real hardware and interchangeability
Login

xv6 §13, "Summary". "Some code lines embody the essence of the main ideas (e.g., context switching, user/kernel boundary, locks, etc.) and each line is important; other code lines provide an illustration of how to implement a particular operating system idea and could easily be done in different ways."

Phase 13 first reviews Glint against that distinction. Every part that could easily be done another way should sit behind a seam with a swappable provider. The phase then takes the Phase 6 demonstration, an unmodified Linux booting on Glint, from QEMU to real machines with no board-specific code. It starts from everything Phases 1–12 built. The order runs from the catalogue of seams, to the two Beagle boards, to x86 hardware, to Intel's virtualization extensions, to pass-through on a Beagle board, and finally to a security review of the whole.

Provisional slices. Each is refined, with its quoted sentence, when the phase starts.

Slices

13.1 The interchangeability review. This slice writes docs/interchangeability.md, a catalogue of every component Phases 1–12 built. Each component is marked as essence (in xv6's sense, a line that embodies the idea) or could be done differently. Each of the latter names the seam it sits behind and any alternative provider, and any gap becomes a new slice. It opens the phase because the hardware slices (13.2–13.6) need the catalogue to know which provider each machine will use, and the security review (13.7) needs it to know where the boundaries are. The review is Loose Coupling made checkable, and writing it down is Clarity.

13.2 BeaglePlay. This slice boots Glint on a BeaglePlay (TI AM625) from the board's stock U-Boot with no board-specific code, finding its hardware only through the devicetree that U-Boot passes (as 2.4 does under QEMU). It then runs the Phase 6 Linux demonstration. Any shortfall in the firmware is fixed upstream in U-Boot, never by adding board code to Glint, which keeps plan principle 6 (No BSPs). It comes first among the hardware slices because aarch64 leads in each phase (plan rule 6), and because BeaglePlay's U-Boot is the firmware Track T's QEMU setup imitates. It is Demonstrability on real hardware, and the absence of board code is Parsimony.

13.3 BeagleY-AI. This slice runs the same demonstration, from the same images, on a BeagleY-AI (TI AM67A). Nothing is added for this board. It follows 13.2 because it is a second aarch64 board with a different SoC (system-on-chip), so any fix found on the first board is already in place. If it passes with no new code, that is the strongest evidence that the image is board-independent. That is Loose Coupling between Glint and the hardware it runs on.

13.4 An x86_64 PC. This slice runs the same demonstration on an AMD x86 PC, using the SVM hypervisor path built in Phases 4–6, and ACPI tables in place of a devicetree. It follows the Arm boards because aarch64 leads in every phase, and because an AMD machine uses SVM, the same path QEMU already tested. Only real hardware and firmware differ from what QEMU exercised. Passing on a PC is Demonstrability for the second architecture.

13.5 Intel VMX. This slice adds a second x86 virtualization backend, for Intel's VMX, behind the same vCPU interface that SVM uses. It is brought to parity with the Phase 6 demonstration and tested under nested KVM on an Intel host or on Intel hardware. It is held until here because QEMU's emulator models SVM but not VMX, so it could not be tested earlier. Adding a second backend without changing anything above the vCPU interface is Loose Coupling.

13.6 Pass-through on Beagle hardware. This slice runs Phase 10's driver domain (10.6–10.8) on a real Beagle peripheral, so that Linux drives a device Glint has no driver for and serves it back to Glint. Neither the AM62x nor the AM67A has an IOMMU, so the slice first tests whether their DDR firewalls, which check each bus initiator's privilege ID, can confine the device's DMA to the guest's memory. Where they cannot, it uses the opt-in from 10.6. It comes after 13.2–13.3 because it needs those boards already running Glint. Running unprotected DMA only by recorded choice is Clarity.

13.7 Security review. This slice checks Glint against the threat model from 2.8, Hailperin ch. 11 and MOS4/5 ch. 9. It walks every seam in 13.1's catalogue and asks what a hostile guest could do through it. Findings become slices. It comes last because it reviews the whole system, including the hardware paths 13.2–13.6 added. It is Clarity, because the claim that Glint isolates its guests is checked against a stated boundary rather than assumed.

Phase demo: the Phase 6 Linux demonstration on BeaglePlay and on an x86_64 PC, from the same images with no board code.

References