6.828 2017 Lecture 5: Isolation mechanisms
Today:
user/kernel isolation
xv6 system call as case study
* How to choose overall form for a kernel?
many possible answers!
one extreme:
just a library of device drivers, linked w/ app
run application directly on hardware
fast and flexible for single-purpose devices
but usually multiple tasks on a computer
* Multiple tasks drive the key requirements:
multiplexing
isolation
interaction
* helpful approach: abstract resources rather than raw hardware
File system, not raw disk
Processes, not raw CPU/memory
TCP connections, not ethernet packets
abstractions are often easier to isolate and share
e.g. programs see a private CPU, needn't think about multiplexing
also more convenient and portable
* Isolation is often the most constraining requirement.
* What is isolation?
enforced separation to contain effects of failures
the process is the usual unit of isolation
prevent process X from wrecking or spying on process Y
r/w memory, use 100% of CPU, change FDs, &c
prevent a process from interfering with the operating system
in the face of malice as well as bugs
a bad process may try to trick the h/w or kernel
* the kernel uses hardware mechanisms as part of process isolation:
user/kernel mode flag
address spaces
timeslicing
system call interface
* the hardware user/kernel mode flag
controls whether instructions can access privileged h/w
called CPL on the x86, bottom two bits of %cs register
CPL=0 -- kernel mode -- privileged
CPL=3 -- user mode -- no privilege
x86 CPL protects many processor registers relevant to isolation
I/O port accesses
control register accesses (eflags, %cs4, ...)
including %cs itself
affects memory access permissions, but indirectly
the kernel must set all this up correctly
every serious microprocessor has some kind of user/kernel flag
* how to do a system call -- switching CPL
Q: would this be an OK design for user programs to make a system call:
set CPL=0
jmp sys_open
bad: user-specified instructions with CPL=0
Q: how about a combined instruction that sets CPL=0,
but *requires* an immediate jump to someplace in the kernel?
bad: user might jump somewhere awkward in the kernel
the x86 answer:
there are only a few permissible kernel entry points ("vectors")
INT instruction sets CPL=0 and jumps to an entry point
but user code can't otherwise modify CPL or jump anywhere else in kernel