CNS Core: Medium: Operating System Modularity for Safety and Performance on Existing Commodity Hardware

University Of Rochester, Rochester NY

Investigators

Abstract

The operating systems that control most modern computers are built around a monolithic kernel -- a single program comprising hundreds of thousands or millions of lines of code, typically written in the C programming language. A bug or security breach anywhere in that code jeopardizes the integrity of the entire system. This project is developing mechanisms that can be used to modularize the kernel incrementally, allowing pieces to be safely and efficiently isolated from the rest in order to enhance security, reduce the impact of bugs, and allow developers to install updates more easily, safely, and frequently. Specifically, the project makes two key technical contributions. First, it uses newly available hardware features (memory protection keys) on commodity processors to implement protected libraries. These allow a user application to execute operating system functions safely without actually entering the kernel, and to share state safely with library instances in other applications. Second, the project uses hardware, language, and compiler technology to implement protection boundaries between modules of the kernel itself, allowing those modules to be incrementally rewritten in a type-safe language. Research performed as part of the project promises to significantly increase the safety and modularity of both commodity and specialty operating systems -- making them more dependable and easier to modify, upgrade, and customize -- while preserving or enhancing performance for a wide range of applications, in government, industry, science, the arts, and entertainment. Research and training activities will target a diverse group of undergraduate and graduate students. Technology transfer will be facilitated through contacts with multiple commercial partners. Experimental results, raw data, and source code will be freely and publicly available, the latter via open-source license. Technical reports and data sets will be hosted in the University of Rochester's archival repository (http://urresearch.rochester.edu/). Code will be hosted at GitHub or similar sites. Pointers to all resources will be maintained at http://www.cs.rochester.edu/research/os/modularity/ This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.