Exokernel : An Operating System Architecture for Application-Level Resource Management. Joong Won Roh

Transcription

1 Exokernel : An Operating System Architecture for Application-Level Resource Management Joong Won Roh

2 Goal of Exokernel The goal of an exokernel is to give efficient control of resources to untrusted applications in a secure, multiuser system (Kaashoek, Engler, et. al., 1997)

3 Motivations Traditional Operating System Traditional operating systems have the characteristics : Applications run on the Virtual Memory. Fixed high-level abstraction 1. Hurt app performance (generalization e.g. LRU) 2. Hide information (e.g. page fault) 3. Limit functionality These OS have the problems as follows : Low performance, Low flexibility, Low functionality

4 Motivations Exokernel The kernel that the abstractions on the traditional high-level application is designed to be implemented at application by untrusted software. (For instance, Virtual Memory and Interprocess Communication)

5 Motivations OS Component Layout Multiple User Address Spaces Multiple User Address Spaces User Process User Process User Process File System Network Stack Kernel Address Space IPC Process Management <Monolithic Kernel> File System Network Stack Synchronization Kernel Address Space <Micro Kernel> IPC Process Management

6 Motivations End-to-end Argument The exokernel is composed of the low level interfaces and multiplexes. Mosaic WWW POSIX TCP Barnes- Hut DSM IPC/VM /Traps The exokernel includes the untrusted library OS, which implements higher OS. Library operating systems Secure Bindings Frame Buffer TLB Newtork Memory Disk

7 Designs Things to do Tracking ownership of resources Ensuring protection by guarding all resources usage or binding Revoking access to resources Techniques Secure Binding Visible Revocation Abort Protocol

8 Designs The performance tasks of exokernel Tracking ownership of resources Ensuring protection by guarding all resource usage or binding Revoking access to resources

9 Designs Design Principles Securely expose hardware : An exokernel should provide secure low-level primitives that allow all hardware resources Expose allocation : An exokernel should allow library operating systems to request specific physical resources Expose names : An exokernel should export physical names. Expose revocation : An exokernel should utilize a visible resource revocation protocol

10 Design Techniques Things to do Tracking ownership of resources Ensuring protection by guarding all resources usage or binding Revoking access to resources Techniques Secure Binding Visible Revocation Abort Protocol

11 Design Techniques Secure Binding Protection mechanism that decouples authorization from the actual use of resource 1. Expressed in terms of simple operation 2. Performs authorization only at bind time There exists three basic techniques to implement secure bindings. hardware mechanism, software caching downloading application code

12 Design Techniques Visible Resource Revocation Visible Revocation : The processor is explicitly revoked at the end of a time slice. Therefore library operating system can react by saving only the required processor state. Invisible Revocation : Most operating systems deallocate physical memory without informing applications Invisible is better when revocations are frequent, however, its disadvantanges are that library operating system cannot guide deallocation and have no knowledge that resources are scarce.

13 Design Techniques Abort Protocol If a library operating system fails to respond quickly, the secure bindings need to be broken by force. The actions taken when a library operating system in recalcitrant are defined by the abort protocol

14 Experiment Used exokernel architecture Aegis : exokernel ExOS : library operating system Hypothesis for the test Exokernels can be very efficient Low-level, secure multiplexing if hardware resources can be implemented efficiently Traditional operating system abstractions can be implemented efficiently at application level Applications can create special-purpose implement -ations of these abstractions

15 Experiment Aegis Machines OS Procedure call Syscall DEC2100 DEC2100 Ultrix Aegis /4.7 DEC3100 DEC3100 Ultrix Aegis /3.5 DEC5000 DEC5000 Ultrix Aegis /2.3 Machines OS unalign Overflow Coproc Prot DEC2100 DEC2100 Ultrix Aegis DEC3100 DEC3100 Ultrix Aegis DEC5000 DEC5000 Ultrix Aegis

16 Experiment Key to Aegis Performance Easy Keeping track of ownership It is small because kernel provides very little functionality Most hardware misses can be handled efficiently

17 Experiment ExOS(1/2) ExOS is a library operating system which manages fundamental operating system abstractions. The space Constraint is focused on IPC, virtual memory, remote Communication. IPC Abstraction Machines OS pipe Pipe shm Irpc DEC2100 DEC2100 Ultrix ExOS DEC3100 DEC3100 Ultrix ExOS DEC5000 DEC5000 Ultrix ExOS

18 Experiment ExOS(2/2) Application-Specific Safe Handlers(ASH) Machine OS Roundtrip latency DEC5000/125 ExOS/ASH 259 DEC5000/125 ExOS 320 DEC5000/125 Ultrix 3400 DEC5000/200 Ultrix/FRPC 340

19 Goal of Exokernel The goal of an exokernel is to give efficient control of resources to untrusted applications in a secure, multiuser system (Kaashoek, Engler, et. al., 1997)

20 Summary Minimal Kernel Secure multiplexing of resources Bind time Authorization Portability OS Abstractions in user space(library OS) Virtual Memory, Interprocessing Communication Applications link with OS of their choice

21 Thank you