The operating system kernel as a secure programmable machine

ABSTRACT

Operating systems should provide only minimal embedded kernel functionality. Exokernels achieve this minimalist goal by presenting to applications the features supported by the underlying hardware resources. Applications customize the operating system by extending the exokernel interface. Code inspection, inlined cross-domain procedure calls, and secure languages are used to allow programmable yet safe additions to the supervisor-mode execution environment. These additions enable applications to benefit from full hardware functionality and performance. To test and evaluate exokernels and their customization techniques a prototype system, Aegis, is being developed.

REFERENCES

• 1: M. Accetta, R. Baron, W. Bolosky, D. Golub, R. Rashid, A. Tevanian, and M. Young. Mach: a new kernel foundation for UNIX development. Proe. Summer 1986 USENIX Conference, pages 93-112, July 1986.
• 2: T.E. Anderson. The case for application-specific operating systems. In Third Workshop on Workstation Operating Systems, pages 92-94, 1992.
• 3: Thomas E. Anderson , Henry M. Levy , Brian N. Bershad , Edward D. Lazowska, The interaction of architecture and operating system design, Proceedings of the fourth international conference on Architectural support for programming languages and operating systems, p.108-120, April 08-11, 1991, Santa Clara, California, United States
• 4: B.N. Bershad, C. Chambers, S. Eggers, C. Maeda, D. McNamee, P. Pardyak, S. Savage, and E. Sirer. SPIN -an extensible microkernel for application-specific operating system services. Technical Report TR94-03-03, University of Washington, February 1994,
• 5: M. A. Blumrich , K. Li , R. Alpert , C. Dubnicki , E. W. Felten , J. Sandberg, Virtual memory mapped network interface for the SHRIMP multicomputer, Proceedings of the 21ST annual international symposium on Computer architecture, p.142-153, April 18-21, 1994, Chicago, Illinois, United States
• 6: J. Bradley Chen , Brian N. Bershad, The impact of operating system structure on memory system performance, Proceedings of the fourteenth ACM symposium on Operating systems principles, p.120-133, December 05-08, 1993, Asheville, North Carolina, United States
• 7: Helen Custer, Inside Windows NT, Microcomputer Applications, Suisun City, CA, 1992
• 8: P. Deutsch and C.A. Grant. A flexible measurement tool for software systems. Information Processing 71, 1971.
• 9: R. Draves. The case for run-time replaceable kernel modules. In Fourth Workshop on Workstation Operating Sys'tems, pages 160-165, October 1993,
• 10: Dawson R. Engler , Todd A. Proebsting, DCG: an efficient, retargetable dynamic code generation system, Proceedings of the sixth international conference on Architectural support for programming languages and operating systems, p.263-272, October 05-07, 1994, San Jose, California, United States
• 11: Per Brinch Hansen, The nucleus of a multiprogramming system, Communications of the ACM, v.13 n.4, p.238-241, April 1970 [doi>10.1145/362258.362278]
• 12: M. C. Harrison , J. T. Schwartz, SHARER, a time sharing system for the CDC 6600, Communications of the ACM, v.10 n.10, p.659-665, Oct. 1967 [doi>10.1145/363717.363778]
• 13: Kieran Harty , David R. Cheriton, Application-controlled physical memory using external page-cache management, Proceedings of the fifth international conference on Architectural support for programming languages and operating systems, p.187-197, October 12-15, 1992, Boston, Massachusetts, United States
• 14: Dan Hildebrand, An Architectural Overview of QNX, Proceedings of the Workshop on Micro-kernels and Other Kernel Architectures, p.113-126, April 27-28, 1992
• 15: D. H. R. Huxtable , M. T. Warwick, Dynamic Supervisors - their design and construction, Proceedings of the first ACM symposium on Operating System Principles, p.11.1-11.17, January 1967 [doi>10.1145/800001.811675]
• 16: G. Kiczales, J. Lamping, C. Maeda, D. Keppel, and D. McNamee. The need for customizable operating systems. In Fourth Workshop on Workstation Operating Systems, pages 165-170, October 1993.
• 17: J. Kuskin , D. Ofelt , M. Heinrich , J. Heinlein , R. Simoni , K. Gharachorloo , J. Chapin , D. Nakahira , J. Baxter , M. Horowitz , A. Gupta , M. Rosenblum , J. Hennessy, The Stanford FLASH multiprocessor, Proceedings of the 21ST annual international symposium on Computer architecture, p.302-313, April 18-21, 1994, Chicago, Illinois, United States
• 18: B.W. Lampson. On reliable and extendable operating systems. State of the Art Report, 1, 1971.
• 19: Butler W. Lampson , Robert F. Sproull, An open operating system for a single-user machine, Proceedings of the seventh ACM symposium on Operating systems principles, p.98-105, December 10-12, 1979, Pacific Grove, California, United States [doi>10.1145/800215.806575]
• 20: Butler W. Lampson , Howard E. Sturgis, Reflections on an operating system design, Communications of the ACM, v.19 n.5, p.251-265, May 1976 [doi>10.1145/360051.360074]
• 21: Jay Lepreau , Mike Hibler , Bryan Ford , Jeffrey Law , Douglas B. Orr, In-Kernel Servers on Mach 3.0: Implementation and Performance, USENIX MACH III Symposium, p.39-56, April 19-21, 1993
• 22: R. Levin , E. Cohen , W. Corwin , F. Pollack , W. Wulf, Policy/mechanism separation in Hydra, Proceedings of the fifth ACM symposium on Operating systems principles, p.132-140, November 19-21, 1975, Austin, Texas, United States
• 23: Henry Massalin, Synthesis: an efficient implementation of fundamental operating system services, Columbia University, New York, NY, 1992
• 24: J. Mogul , R. Rashid , M. Accetta, The packer filter: an efficient mechanism for user-level network code, Proceedings of the eleventh ACM Symposium on Operating systems principles, p.39-51, November 08-11, 1987, Austin, Texas, United States
• 25: Sape J. Mullender , Guido van Rossum , Andrew S. Tanenbaum , Robbert van Renesse , Hans van Staveren, Amoeba: A Distributed Operating System for the 1990s, Computer, v.23 n.5, p.44-53, May 1990 [doi>10.1109/2.53354]
• 26: A.C. Myers. Resolving the integrity/performance conflict. In Fourth Workshop on Workstation Operating Systems, pages 156-160, October 1993.
• 27: David Nagle , Richard Uhlig , Tim Stanley , Stuart Sechrest , Trevor Mudge , Richard Brown, Design tradeoffs for software-managed TLBs, Proceedings of the 20th annual international symposium on Computer architecture, p.27-38, May 16-19, 1993, San Diego, California, United States
• 28: Richard F. Rashid , George G. Robertson, Accent: A communication oriented network operating system kernel, Proceedings of the eighth ACM symposium on Operating systems principles, p.64-75, December 14-16, 1981, Pacific Grove, California, United States
• 29: David D. Redell , Yogen K. Dalal , Thomas R. Horsley , Hugh C. Lauer , William C. Lynch , Paul R. McJones , Hal G. Murray , Stephen C. Purcell, Pilot: an operating system for a personal computer, Communications of the ACM, v.23 n.2, p.81-92, Feb. 1980 [doi>10.1145/358818.358822]
• 30: M. Rozier, V. Abrossimov, F. Armand, I. Boule, M. Glen, M. Guillemont, F. Herrmann, C. Kaiser, S. Langlois, P. Leonard, and W. Neuhauser. Chorus distributed operating system. Computing Systems, 1(4):305-370, 1988.
• 31: Andrew S. Tanenbaum , Robbert van Renesse , Hans van Staveren , Gregory J. Sharp , Sape J. Mullender, Experiences with the Amoeba distributed operating system, Communications of the ACM, v.33 n.12, p.46-63, Dec. 1990 [doi>10.1145/96267.96281]
• 32: Robert Wahbe , Steven Lucco , Thomas E. Anderson , Susan L. Graham, Efficient software-based fault isolation, Proceedings of the fourteenth ACM symposium on Operating systems principles, p.203-216, December 05-08, 1993, Asheville, North Carolina, United States
• 33: B.A. Wichmann. A modular operating system. Proc. IFIP Cong. 1968, 1968.
• 34: W. Wulf , E. Cohen , W. Corwin , A. Jones , R. Levin , C. Pierson , F. Pollack, HYDRA: the kernel of a multiprocessor operating system, Communications of the ACM, v.17 n.6, p.337-345, June 1974 [doi>10.1145/355616.364017]