FlexCap: Exploring Hardware Capabilities in Unikernels and Flexible Isolation OSes

在这个名为FlexCap的项目中，我们建议研究如何使用Morello的硬件功能在操作系统(OS)中提供安全和隔离。我们建议在两个操作系统中启用功能支持并评估其效率：FlexOS是一个库操作系统，提供高度可配置的隔离配置文件，可以在构建时针对特定用例进行定制；以及Unikraft，一个高性能/低延迟的统一内核。FlexOS允许用户在构建时无缝地专门化操作系统的隔离/安全策略。有几个基本参数是可定制的，包括内核组件隔离的粒度以及用于实施该隔离的硬件机制。FlexOS目前支持英特尔内存保护密钥和扩展页表机制。将操作系统移植到Morello将使其能够受益于功能带来的高效划分。特别是，与操作系统当前支持的其他机制相比，使用硬件功能所产生的细粒度内存保护和高度可伸缩性应该会提高FlexOS的性能和安全性，并减少内存占用。FlexOS本身是Unikraft统一内核的扩展，因此将FlexOS移植到Morello将首先需要将Unikraft移植到该平台。Unikraft是一款面向云应用的高性能/低延迟单内核。它提供的高度性能是通过在单个完全不受保护的地址空间内运行应用程序和内核代码来实现的。这显然引起了安全问题，将Unikraft移植到Morello将允许探索将安全性带回高性能统一内核，利用功能提供传统编程语言的安全版本(即纯/混合功能)所带来的安全优势。最后，我们还建议通过研究1)将Unikraft增量迁移到纯功能的可能性和2)FlexOS组件的水平划分来探索FlexOS和Unikraft中功能的高级使用。这两个操作系统，FlexOS和Unikraft，是应用Morello硬件功能的独特用例，从未在这种情况下进行过探索。这些用例与Cheri/Morello的软件生态系统中已有的两个操作系统(CheriBSD和CheriOS)有很大不同。CheriBSD是一个通用的单片操作系统，不太可能达到Unikraft的高性能水平。它也不适合像FlexOS那样的灵活隔离。此外，CheriOS不太可能提供与Unikraft/FlexOS相同的性能和与现有应用程序的兼容性。

In this project, entitled FlexCap, we propose to study the use of Morello's hardware capabilities to provide safety and isolation in Operating Systems (OSes). We propose to enable capability support and evaluate its efficiency in two OSes: FlexOS, a library OS offering a highly-configurable isolation profile that can be customised at build time towards specific use cases; as well as Unikraft, a high-performance/low latency unikernel.FlexOS allows the user to specialise the isolation/safety strategy of the operating system seamlessly at build time. Several fundamental parameters are customisable, including the granularity of kernel components isolation as well as the hardware mechanism used to enforce that isolation. FlexOS currently supports the Intel Memory Protection Keys and Extended Page Table mechanisms. Porting the OS to Morello would enable to benefit from the efficient compartmentalization brought by capabilities. In particular, the fine-grained memory protection and high degree of scalability resulting from the use of hardware capabilities should increase performance as well as security security, and decrease memory footprint in FlexOS, compared to the other mechanisms currently supported by the OS.FlexOS is itself an extension of the Unikraft unikernel, so porting FlexOS to Morello will first require porting Unikraft to the platform. Unikraft is a high-performance/low-latency unikernel targeting cloud applications. The high degree of performance it provides is achieved by running the application and the kernel code inside a single, completely unprotected address space. This obviously raises security concerns and porting Unikraft to Morello will allow to explore bringing back safety into high-performance unikernels, leveraging the security benefits brought by the capabilities' ability to provide safe versions of legacy programming languages (i.e. pure/hybrid capabilities).Finally, we also propose to explore advanced use of capabilities in FlexOS and Unikraft by studying 1) the possibility of incremental porting of Unikraft to pure capabilities and 2) horizontal compartmentalization of FlexOS components.These two OSes, FlexOS and Unikraft, are unique use cases for the application of Morello's hardware capabilities, and have never been explored in this context. These use cases differ significantly from the two OSes already available in the CHERI/Morello's software ecosystem (CheriBSD and CheriOS). CheriBSD is a general purpose monolithic OS and is unlikely to achieve the high level of performance of Unikraft. It also does not lend itself to flexible isolation like FlexOS. Further, CheriOS is unlikely to offer the same performance and compatibility with existing applications as Unikraft/FlexOS.