CSE 551

Hyperkernel

Question

Some system calls traditionally require loops, such as loading an executable file or killing/freeing a process. What changes does the Hyperkernel interface make to avoid such “loopy” operations? Do you think such changes are necessary? Briefly explain using one example.

Question

Compare Figure 10 from the Hyperkernel paper to Tables 2 and 3 from the Dune paper (“getpid”, “trap”, “appel1”, and “appel2”). Why do you think Dune performs much better on “appel1” and “appel2” than Hyperkernel?

Question

Hyperkernel’s declarative specification describes several properties that the state-machine specification must maintain, such as memory isolation. Compare them to seL4’s abstract and executable specification. What are the main differences between their guarantees?

Question

Provide a list of questions you would like to discuss in class. Feel free to provide any comments on the paper and related topics (e.g., which parts you like and which parts you find confusing). For example, you may wish to comment on the bugs Hyperkernel was able to find in xv6. Do you think catching these bugs earlier in xv6’s development would have been useful?

background

Yggdrasil (OSDI’16)
- push-button verification of file systems
- can we extend this to kernel code?
(failed) efforts
- writing the kernel in Rust
  - hoped to get rid of low-level bugs through the type system
  - very tricky to model the semantics
  - the ownership model doesn’t seem a good match for Hyperkernel
- virtual memory
  - what about a traditional address space plan
    - not injective
    - need to verify kernel code correctly manipulates the page table
    - what if the code itself is also running under the page table?
  - how to bootstrap?
- seL4-like interfaces
concurrency
- assume a single core
  - interrupts
  - DMA
  - how to deal with them?
- multicore
  - think about three cases: kernel-kernel, user-user, kernel-user
  - TLB shootdown
  - memory consistency model

isolation

what does Hyperkernel guarantee?
is memory isolation sufficient?
other approaches for specifying isolation
- ideal model (e.g., separate machines)
- shared matrix methodology
- noninterference
  - trace-based
  - two-safety (“unwinding conditions”)

what system designs can be verified in a push-button way

assume “self-finitizing” symbolic execution
what are the requirements for the interface, implementation, and spec
what can be expressed and decided by a solver (within a reasonable amount of time)
what about modularity - does the complexity of SMT expressions grow with the system size?