For discussion, the Linux kernel developers have proposed a series of patches developed by the Multikernel project, which has recently been transitioned to open-source software and will now be developed collaboratively with the community. Multikernel allows multiple independent instances of the Linux kernel to run on a single physical computer, granting direct access to hardware resources and enabling the launch of several isolated system environments. The project was founded by Multikernel Technologies, led by Cong Wang, who oversees the Traffic Control (TC) subsystem in the Linux kernel.
An advanced kexec call has been proposed for launching and managing kernels, which, unlike the traditional kexec, is not limited to replacing an active kernel and allows additional kernel instances to run in parallel. A ‘/proc/multikernel’ interface has been implemented for monitoring and debugging running kernel instances, and a communication framework called Multikernel IPI has been proposed for inter-kernel messaging and coordination.
Multikernel is presented as a new isolation architecture, occupying a niche between virtualization via a hypervisor and container isolation based on a shared kernel. Unlike virtualization, Multikernel does not require a hypervisor, simplifies the creation of environments for the isolated execution of individual applications, and achieves high performance without the overhead of virtualization. In contrast to containers, Multikernel provides a high level of isolation and allows for separate kernels to be used in each isolated environment.
Performance using Multikernel is assessed to be close to that of execution on separate hardware. This has been achieved by eliminating the overhead typically associated with virtualization, which arises from control transfer handlers between virtual machines (VM exit), IOMMU translation, and hypervisor intervention in the execution of privileged operations. Dynamic resource allocation for the launched environments is supported, ensuring predictable performance.
Samtidig kørsel af flere kerner foregår uden virtualisering, ved hjælp af SMP-behandleren, der fordeler de tilgængelige CPU'er mellem instanser af Linux-kerner. Hver instans af Linux-kernerne er knyttet til en eller flere CPU-kerner, der er tildelt til dens kørsel, mens de øvrige hardware-ressourcer deles.
De vigtigste fordele ved Multikernel:
- Forbedret isolation mod fejl i de kørende miljøer.
- Øget sikkerhed ved opdeling på kerne-niveau.
- Mere effektiv ressourceudnyttelse sammenlignet med traditionelle virtuelle maskiner baseret på hypervisorer, såsom KVM og Xen.
- Muligheden for at opgradere kernen uden at stoppe driften ved hjælp af KHO (Kernel Hand Over) mekanismen.
- Support for integration med standard cloud-infrastrukturer og muligheden for gennemsigtig overgang fra traditionelle virtualiseringssystemer og container-isolering.
- Fuld kompatibilitet med eksisterende applikationer og systemgrænseflader i Linux. Multikernel ændrer kun kernen punktvis, hvilket bevarer fuld kompatibilitet på API-niveau.
Kilde: opennet.ru
