Logo des Repositoriums

Auflistung nach Schlagwort "operating systems"

1 - 2 von 2
  • Konferenzbeitrag
    Case Study: Securing MMU-less Linux Using CHERI
    (SE 2024 - Companion, 2024) Almatary, Hesham; Mazzinghi, Alfredo; Watson, Robert N. M.
    MMU-less Linux variant lacks security because it does not have protection or isolation mechanisms. It also does not use MPUs as they do not fit with its software model because of the design drawbacks of MPUs (i. e. coarse-grained protection with fixed number of protected regions). We secure the existing MMU-less Linux version of the RISC-V port using CHERI. CHERI is a hardware-software capability-based system that extends the ISA, toolchain, programming languages, operating systems, and applications in order to provide complete pointer and memory safety. We believe that CHERI could provide significant security guarantees for high-end dynamic MMU-less embedded systems at lower costs, compared to MMUs and MPUs, by: 1) building the entire software stack in pure-capability CHERI C mode which provides complete spatial memory safety at the kernel and user-level, 2) isolating user programs as separate ELFs, each with its own CHERI-based capability table; this provides spatial memory safety similar to what the MMU offers (i. e. user programs cannot access each other’s memory), 3) isolating user programs from the kernel as the kernel has its own capability table from the users and vice versa, and 4) compartmentalising kernel modules using CompartOS’ linkage-based compartmentalisation. This offers a new security front that is not possible using the current MMU-based Linux, where vulnerable/malicious kernel modules (e. g. device drivers) executing in the kernel space would not compromise or take down the entire system. These are the four main contributions of this paper, presenting novel CHERI-based mechanisms to secure MMU-less embedded Linux.
  • Textdokument
    Remote AVX Overhead: Detection and Mitigation
    (Tagungsband des FG-BS Frühjahrstreffens 2021, 2021) Gottschlag, Mathias
    Due to power constraints, recent Intel CPUs reduce their frequency when executing AVX2 and AVX-512 instructions. Often, this frequency reduction affects other applications as well, which reduces overall performance and prevents contemporary operating systems from fairly distributing system resources. In our work, we show that these problems are fundamental problems of power-limited computing. We analyze the problems and show a method to quantify the underlying AVX overhead. Based on our analysis, we then describe a set of operating system techniques to improve performance and scheduler fairness. Our results show the importance of active management of hardware-controlled frequency scaling by the OS. Based on this observation, we sketch improved hardware-software interfaces which could further reduce AVX overhead and improve the efficacy of our approach.