Verified programs can party: optimizing kernel extensions via post-verification merging
Verified programs can party: optimizing kernel extensions via post-verification merging
复制标题
DOI：
10.1145/3492321.3519562
复制
发表时间：
2022-03
期刊：
影响因子：
--
通讯作者：
H. Kuo;Kaiyu Chen;Yicheng Lu;Daniel W. Williams;Sibin Mohan;Tianyi Xu
中科院分区：
文献类型：
--
作者：
H. Kuo;Kaiyu Chen;Yicheng Lu;Daniel W. Williams;Sibin Mohan;Tianyi Xu
操作系统（OS）扩展比以往任何时候都更受欢迎。例如，Linux BPF被销售为“超级大国”，允许将用户程序下载到内核中，并在内核挂钩点被证明是安全的并执行的。因此，BPF扩展具有高性能，并且通常位于跟踪和过滤的性能至关重要路径上。但是，尽管BPF扩展程序在共享内核环境中执行并且已经进行了单独验证，但它们通常是在链条中独立执行的。我们观察到，由于安全缓解（例如，幽灵），循环和内存访问的间接跳跃，链式模式的性能大开销。在本文中，我们主张分离关注点。我们建议将BPF扩展的执行与其验证要求的执行--- BPF扩展程序可以集体优化，在每个BPF扩展程序单独验证并加载到共享内核之后。我们提出KFUSE，这是一个框架，该框架通过将间接跳跃转换为直接跳跃，展开的循环和保存内存访问而不会损失安全性或灵活性，从而动态自动地自动合并BPF程序的链条。 KFUSE可以合并（1）由多个主体安装的BPF程序，（2）保持为模块化和分开，（3）在不同的时间点安装，（4）通过BPF尾巴调用分为较小的可验证程序。 KFUSE证明了BPF链执行的85％性能提高，而现有BPF用例（SystemD的Seccomp BPF过滤器）的应用程序性能提高了7％。它可以为更长的连锁店带来更大的好处。
Operating system (OS) extensions are more popular than ever. For example, Linux BPF is marketed as a "superpower" that allows user programs to be downloaded into the kernel, verified to be safe and executed at kernel hook points. So, BPF extensions have high performance and are often placed at performance-critical paths for tracing and filtering. However, although BPF extension programs execute in a shared kernel environment and are already individually verified, they are often executed independently in chains. We observe that the chain pattern has large performance overhead, due to indirect jumps penalized by security mitigations (e.g., Spectre), loops, and memory accesses. In this paper, we argue for a separation of concerns. We propose to decouple the execution of BPF extensions from their verification requirements---BPF extension programs can be collectively optimized, after each BPF extension program is individually verified and loaded into the shared kernel. We present KFuse, a framework that dynamically and automatically merges chains of BPF programs by transforming indirect jumps into direct jumps, unrolling loops, and saving memory accesses, without loss of security or flexibility. KFuse can merge BPF programs that are (1) installed by multiple principals, (2) maintained to be modular and separate, (3) installed at different points of time, and (4) split into smaller, verifiable programs via BPF tail calls. KFuse demonstrates 85% performance improvement of BPF chain execution and 7% of application performance improvement over existing BPF use cases (systemd's Seccomp BPF filters). It achieves more significant benefits for longer chains.