Open Kernel Labs (OK Labs) has upgraded its microkernel operating system
(OS) and Linux-friendly virtual machine environment for embedded devices.
OKL4 version 2.0 adds technology aimed at protecting a phone's call-making
capabilities despite attacks, malware, or faults within OSes,
applications, and drivers.

OKLabs claims its OKL4 microkernel to be the top embedded virtualization
environment in the mobile phone market, in terms of units deployed. Now
shipping in "millions of units per month," according to company claims,
the product has seen use in multiple Linux-based handset models from
Toshiba, and in multiple Windows CE-based devices from Taiwanese
manufacturing giant HTC. The microkernel's thin hardware abstraction layer
also supports Symbian as a guest OS, CEO Steve Subar (pictured below) told
LinuxDevices in a recent interview.

Version 2.0 of the OKL4 kernel aims to bolster a mobile device's
protection against malware and destructive hackers, says OK Labs, while
also insulating mobile phone software from the effects of poorly-behaved
code like flaky drivers. According to the company, all these mobile
software security threats will grow as carriers begin to open up to
out-of-network handsets.

The main new security feature in OKL4 v2 is a "Secure HyperCell"
technology aimed at encapsulating and protecting critical software
components from the rest of the system. The unspoken goal here is probably
to ensure that a phone can still make and take calls even if there is a
fault in a complex OS such as Linux, in a device driver needed for some
new peripheral, or in a new application rolled out around some data
service. No call means no income for the operators.


OKLabs OKL4 v.2
(Click to enlarge)


Each "Secure HyperCell" can cloister away a guest OS, an application, or
an individual device driver, OKLabs says. With each component segregated
into its own HyperCell, engineers can use IPC keys (depicted in the
diagram above) to control which components can communicate, and when. The
net payoff for handset makers is the ability to add functionality
incrementally, while keeping devices secure, says OKLabs. Subar observes
that another intriguing benefit could be sharing device drivers between
multiple OS instances.

Unlike Linux and other "monolithic" operating systems, OKL4 is a
microkernel operating system (OS) that runs only the bare essentials in
kernel mode. This results in the smallest possible "trusted security
base," the company says. Non-essentials like device drivers run in user
mode, affording some protection from misbehaving drivers, one of the most
common causes of OS freezes, Subar notes.


Fluffy Spider FancyPants screen
Despite its microkernel architecture, OKL4 does have a tiny, native,
POSIX-compliant real-time execution environment, which is said to allow
for the implementation of services that would be impossible or impractical
to implement outside the kernel. OKL4's native application environment can
also be used for the UI software on low-end phones, Subar suggested. In
fact, at least one lightweight graphics framework has been ported to the
environment -- Fluffy Spider FancyPants, a GUI stack claimed to require
less that 3MB of disk space, while offering sophisticated special effects
like overlain on-screen elements, images, and playing videos.

The OKL4 microkernel implements a lightweight hardware abstraction layer
on top of which one or more virtual machines can be configured to run a
guest OS. Subar describes this approach as "true virtualization,"
contrasting it with "OS co-location" capabilities offered by competing
products.

Asked about performance penalties associated with hardware abstraction,
Subar acknowledged a slowdown in the low single-digit percentage range,
while suggesting that OKL4 offers faster interprocess communications (IPC)
than competing products that use the hardware abstraction layer approach.
"We have very high performance IPC. We claim to have the fastest embedded
IPC on ARM, MIPS, and Itanium, and so far [that claim] has been
unchallenged."

Asked about OKL4's support for MIPS64 and Itanium -- architectures popular
on the other side of the wire, in telecom infrastructure -- Subar
suggested it was a market the company hoped to move into. "We think that
moving from a medium-paranoia segment to a high-paranoia segment is a good
growth path," he said.

Meanwhile, competitor VirtualLogix has been trying to do the reverse, with
the "Mobile Handset" version of its VLX stack. VirtualLogix evolved from
Jaluna which in turn evolved from ChorusOS, a nano-kernel originally
developed by Sun Microsystems for telecom applications. VirtualLogix
recently received an equity investment by Motorola, which sells both
infrastructure equipment and mobile handsets. VirtualLogix has also had
considerable success on DSPs used in set-top boxes, and is also partly
funded by TI.

A third horse in the embedded virtualization products is Trango, which
offers a pure hypervisor product that eschews the native POSIX
environments built into the products of its competitors. Trango's recent
focus has been on adding support both for MIPS64 and ARM9 based
processors, suggesting it also divides it attention between the
infrastructure and mobile device markets.

It's tempting to wonder whether the future will bring continued
competition, or possibly some consolidation to the embedded virtualization
market. Subar noted that according to VDC figures, the two largest
"embedded" software market verticals are mobile wireless and consumer
electronics, together accounting for 55 percent. Networking infrastructure
comes third, at 15 percent of the $1.9 billion market, or about $285
million.


Toshiba W47T
(Click for details)
OK Labs launched a year ago in April as a Chicago-based spin-off of NICTA
(National Information/Communication Technology, Australia), an Australian
government-sponsored thinktank. NICTA previously supplied an "L4"
microkernel to phone chip giant Qualcomm, and Qualcomm customer Toshiba is
said to have used the stack in its W47T phone (pictured at right). Subar
said OKLabs maintains a very close working relationship with NICTA,
something he felt might be an advantage, in the long term. "Everyone
claims to have a big R&D budget, but for most it's a big 'D' and little
'r'."

In a statement, Subar said, "OKL4's capability-based security can prevent
data leakage by untrusted code. With increasing amounts of personal
information on handsets, preventing identity theft through mobile viruses
is paramount."

Availability

OKL4 2.0 is shipping now, says OK Labs, available under an open source or
a commercial license. In addition, OK Labs offers customization services,
processor architecture porting, and training.

--
http://www.mrbrklyn.com - Interesting Stuff
http://www.nylxs.com - Leadership Development in Free Software

So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998

http://fairuse.nylxs.com DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002

"Yeah - I write Free Software...so SUE ME"

"The tremendous problem we face is that we are becoming sharecroppers to our own cultural heritage -- we need the ability to participate in our own society."

"> I'm an engineer. I choose the best tool for the job, politics be damned.<
You must be a stupid engineer then, because politcs and technology have been attached at the hip since the 1st dynasty in Ancient Egypt. I guess you missed that one."

© Copyright for the Digital Millennium