DOCSLIB.ORG

Memory Protection File B [RWX] File D [RW] File F [R] OS GUEST LECTURE

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Memory Protection File B [RWX] File D [RW] File F [R] OS GUEST LECTURE 11/17/2018 Operating Systems Protection Goal: Ensure data confidentiality + data integrity + systems availability Protection domain = the set of accessible objects + access rights File A [RW] File C [R] Printer 1 [W] File E [RX] Memory Protection File B [RWX] File D [RW] File F [R] OS GUEST LECTURE XIAOWAN DONG Domain 1 Domain 2 Domain 3 11/15/2018 1 2 Private Virtual Address Space Challenges of Sharing Memory Most common memory protection Difficult to share pointer-based data Process A virtual Process B virtual Private Virtual addr space mechanism in current OS structures addr space addr space Private Page table Physical addr space ◦ Data may map to different virtual addresses Each process has a private virtual in different address spaces Physical address space Physical Access addr space ◦ Set of accessible objects: virtual pages frame no Rights Segment 3 mapped … … Segment 2 ◦ Access rights: access permissions to P1 RW each virtual page Segment 1 P2 RW Segment 1 Recorded in per-process page table P3 RW ◦ Virtual-to-physical translation + P4 RW Segment 2 access permissions … … 3 4 1 11/17/2018 Challenges of Sharing Memory Challenges for Memory Sharing Potential duplicate virtual-to-physical Potential duplicate virtual-to-physical translation information for shared Process A page Physical Process B page translation information for shared memory table addr space table memory Processor ◦ Page table is per-process at page ◦ Single copy of the physical memory, multiple granularity copies of the mapping info (even if identical) TLB L1 cache ◦ Single copy of the physical memory, multiple ◦ Duplication in Translation Lookaside Buffer copies of the mapping info (even if identical) (TLB) and memory hierarchy (caches, main memory) L2 cache Last-level cache Page Memory Table 5 6 Challenges for Changing Access Permissions of Memory Regions Changing access permissions of Process A page Physical Process B page Are there any other memory protection mechanisms an entire memory region is table table expensive addr space besides private virtual address space? ◦ E.g., disabling writes to a memory Physical Access Physical Access region across processes frame Rights frame Rights no no Page table is at page granularity P1 R P1 RWX on per-process basis Seg 1 P2 R P2 RWX Required to traverse each page P3 R P3 RWX table entry of each virtual … … address space 7 8 2 11/17/2018 Outline Outline Single address space Single address space ◦ Domain-page model ◦ Domain-page model ◦ Page-group model ◦ Page-group model State-of-art memory protection mechanisms State-of-art memory protection mechanisms ◦ ARM protection domains ◦ ARM protection domains ◦ Intel Memory Protection Keys ◦ Intel Memory Protection Keys 9 10 Single Address Space Single Address Space One single virtual address space shared Process A’s view of Process B’s view of Can we use page table like in private Process A’s Physical Process B’s across processes virtual addr space virtual addr space virtual address space page table addr space page table ◦ Recorded at page granularity per One virtual address is mapped to a unique process Physical Access Physical Access Physical ◦ Virtual-to-physical translation information frame Rights frame Rights physical address addr space ◦ Access permissions no no Simplifies memory sharing compared to P1 R P1 RWX private virtual address space RX RWX Duplicate translation information Seg 1 ◦ Translation of a virtual page is unique P2 R P2 RWX across processes Proposed in the 90s Seg 1 P3 R P3 RWX ◦ Emerging 64-bit address space Other protection domain models … … ◦ Domain-page model Seg 2 ◦ Page-group model 11 12 3 11/17/2018 Single Address Space: Domain-Page Outline Model Single address space Protection domain = set of accessible pages + access permissions ◦ Domain-page model Capability list ◦ Page-group model Each (domain, page) pair is unique State-of-art memory protection mechanisms ◦ Access rights associated with (domain, page) ◦ ARM protection domains ◦ Intel Memory Protection Keys Page 1 Page 2 Page 3 Page 4 Page 5 Page 6 Domain A R RW RWX Domain B R-X R R R Domain C RWX R-X RW 13 14 Protection Lookaside Buffer Protection Lookaside Buffer (PLB) One implementation of domain-page Virtual page Physical page Access rights model Processor Translation lookaside buffer (TLB) ◦ On-chip cache of page table ◦ Virtual-to-physical translation information + TLB L1 cache access permissions Protection Lookaside buffer (PLB) L2 cache ◦ Only records access permissions Last-level cache ◦ Translation information is saved separately Page Memory Table Image Source: ASPLOS , “Architecture support for single address space operating systems”,1992. 15 16 4 11/17/2018 PLB Advantages Outline No duplicate translation information Single address space ◦ Each page has a single translation entry in TLB and memory hierarchy ◦ Domain-page model ◦ Page-group model Changing access permission of a memory region is cheaper ◦ Use a single PLB entry for the entire memory region (stack, code segment and etc.) State-of-art memory protection mechanisms ◦ Only required to modify one PLB entry ◦ ARM protection domains ◦ Intel Memory Protection Keys 17 18 Single Address Space: Page-Group Model PA-RISC Page group is a set of pages An architecture of page-group model designed by HP ◦ Each page belongs to a single page group Each process has 4 page-group registers (PID) for accessible page group IDs Access permissions associated with each page ◦ One additional write-disable bit that disables writes to the entire page group ◦ As opposed to (domain, page) pair in the domain-page group Each process runs in one of the 4 privilege levels Protection domain = set of accessible page groups + access permissions ◦ 0 (the highest) to 3 Privilege level PID1 PID2 PID3 PID4 Page 1 Page 4 Page 6 Group A Group B Group C Page 2 Page 5 Page 7 Process I √ √ Process I 0 3 11 6 9 Page 3 Page 8 Process II √ √ Process II 3 11 12 13 14 Page Group A Page Group B Page Group C Process III √ Process III 2 3 6 9 5 19 20 5 11/17/2018 PA-RISC PA-RISC Each page has unique translation information and access permissions Whether accessible ◦ Recorded in page table/TLB ◦ Determined by PID ◦ Access permission = read, write, execute and the corresponding privilege levels registers ◦ E.g., writable from privilege level 0, readable from level 0, 1 and 2, and inaccessible from level 3 Access permission = ◦ No duplicate translation information Rights in TLB based on privilege level + write-disable bit Image source: ASPLOS , “Architecture support for single address space operating systems”,1992. 21 22 Outline State-of-Art Memory Protection Single address space Modern architectures use private virtual address spaces ◦ Domain-page model ◦ As supported in modern OSs such as Linux and FreeBSD ◦ Page-group model However, they also provide other memory protection models State-of-art memory protection mechanisms ◦ Like ARM and Intel ◦ ARM protection domains ◦ Intel Memory Protection Keys 23 24 6 11/17/2018 Outline ARM Protection Domain Single address space Domain = set of accessible pages Domain 1 Domain 2 ◦ Domain-page model 32-bit ARM supports 16 domains ◦ Page-group model Kernel User Space Domain access control register (DACR) Space State-of-art memory protection mechanisms ◦ Defines the access permissions of current ◦ ARM protection domains process to 16 domains (2 bits per domain) ◦ Saved in process control block when the current ◦ Intel Memory Protection Keys process is context switched off DACR 00 01 01 … 10 Each page belongs to a domain ◦ Identified by the domain field in page table entry 16 domains 00: No access permission 01: Based on permission bits listed in page table 10: RWX permissions 25 26 ARM Protection Model ARM Protection Domain 16 domains TLB lookup A legacy feature that is not in use in reality (By VPN and ASID) ◦ Only domain 1 (user space) and 2 (kernel space) are in use 00 01 01 … 10 DACR ◦ Removed from 64-bit ARM architecture TLB hit Any other use cases Access permission ◦ Alleviate duplicate translation information on Android check based on TLB VPN ASID 0 0010 Permission TLB bits and domain Address Space Identifier Domain ID Domain permission check fails 00: No access permission 01: Based on permission bits listed in page table Abort 10: RWX permissions exception 27 28 7 11/17/2018 Duplicate Translation info on Android Android uses Linux kernel and thus uses private virtual address space 58% duplicate page table pages for ARM Protection Domain: shared libraries on Android All android applications share the A Use Case on Android same virtual and physical addresses for the preloaded shared libraries ◦ Due to Android process creation model 29 30 Android Application Instruction Footprint Android Application Instruction Footprint Most of the instructions accessed are % of inst fetched Considerable overlap in the shared 98% from shared libraries preloaded 100% library code accessed across different 80% applications Laya Music Number of shared libraries per 72% Player application: 60% 40% ◦ 46% of total inst pages accessed are in ◦ Loaded: 88 to 107 (zygote-preloaded: 88) common for each pair of applications 91% 85% 20% ◦ Invoked: 24 to 68 (zygote-preloaded: 21 to ◦ Zygote-preloaded: 38% 46) 0% MX 72% Adobe Player Reader WPS Email Chrome Average MX Player MX Angrybirds Adobe Reader Adobe Google Calendar Google AndroidBrowser Chrome Chrome Privilege Chrome Chrome Sandbox The % of inst footprint overlapped Laya Music Player Laya zygote-preloaded shared lib other shared lib 31 32 8 11/17/2018 Sharing TLB for Shared Libraries Sharing
Load more

Recommended publications
  • The Case for Compressed Caching in Virtual Memory Systems
    THE ADVANCED COMPUTING SYSTEMS ASSOCIATION The following paper was originally published in the Proceedings of the USENIX Annual Technical Conference Monterey, California, USA, June 6-11, 1999 The Case for Compressed Caching in Virtual Memory Systems _ Paul R. Wilson, Scott F. Kaplan, and Yannis Smaragdakis aUniversity of Texas at Austin © 1999 by The USENIX Association All Rights Reserved Rights to individual papers remain with the author or the author's employer. Permission is granted for noncommercial reproduction of the work for educational or research purposes. This copyright notice must be included in the reproduced paper. USENIX acknowledges all trademarks herein. For more information about the USENIX Association: Phone: 1 510 528 8649 FAX: 1 510 548 5738 Email: [email protected] WWW: http://www.usenix.org The Case for Compressed Caching in Virtual Memory Systems Paul R. Wilson, Scott F. Kaplan, and Yannis Smaragdakis Dept. of Computer Sciences University of Texas at Austin Austin, Texas 78751-1182 g fwilson|sfkaplan|smaragd @cs.utexas.edu http://www.cs.utexas.edu/users/oops/ Abstract In [Wil90, Wil91b] we proposed compressed caching for virtual memory—storing pages in compressed form Compressed caching uses part of the available RAM to in a main memory compression cache to reduce disk pag- hold pages in compressed form, effectively adding a new ing. Appel also promoted this idea [AL91], and it was level to the virtual memory hierarchy. This level attempts evaluated empirically by Douglis [Dou93] and by Russi- to bridge the huge performance gap between normal (un- novich and Cogswell [RC96]. Unfortunately Douglis’s compressed) RAM and disk.
    [Show full text]
  • Extracting Compressed Pages from the Windows 10 Virtual Store WHITE PAPER | EXTRACTING COMPRESSED PAGES from the WINDOWS 10 VIRTUAL STORE 2
    white paper Extracting Compressed Pages from the Windows 10 Virtual Store WHITE PAPER | EXTRACTING COMPRESSED PAGES FROM THE WINDOWS 10 VIRTUAL STORE 2 Abstract Windows 8.1 introduced memory compression in August 2013. By the end of 2013 Linux 3.11 and OS X Mavericks leveraged compressed memory as well. Disk I/O continues to be orders of magnitude slower than RAM, whereas reading and decompressing data in RAM is fast and highly parallelizable across the system’s CPU cores, yielding a significant performance increase. However, this came at the cost of increased complexity of process memory reconstruction and thus reduced the power of popular tools such as Volatility, Rekall, and Redline. In this document we introduce a method to retrieve compressed pages from the Windows 10 Memory Manager Virtual Store, thus providing forensics and auditing tools with a way to retrieve, examine, and reconstruct memory artifacts regardless of their storage location. Introduction Windows 10 moves pages between physical memory and the hard disk or the Store Manager’s virtual store when memory is constrained. Universal Windows Platform (UWP) applications leverage the Virtual Store any time they are suspended (as is the case when minimized). When a given page is no longer in the process’s working set, the corresponding Page Table Entry (PTE) is used by the OS to specify the storage location as well as additional data that allows it to start the retrieval process. In the case of a page file, the retrieval is straightforward because both the page file index and the location of the page within the page file can be directly retrieved.
    [Show full text]
  • Paging: Smaller Tables
    20 Paging: Smaller Tables We now tackle the second problem that paging introduces: page tables are too big and thus consume too much memory. Let’s start out with a linear page table. As you might recall1, linear page tables get pretty 32 12 big. Assume again a 32-bit address space (2 bytes), with 4KB (2 byte) pages and a 4-byte page-table entry. An address space thus has roughly 232 one million virtual pages in it ( 212 ); multiply by the page-table entry size and you see that our page table is 4MB in size. Recall also: we usually have one page table for every process in the system! With a hundred active processes (not uncommon on a modern system), we will be allocating hundreds of megabytes of memory just for page tables! As a result, we are in search of some techniques to reduce this heavy burden. There are a lot of them, so let’s get going. But not before our crux: CRUX: HOW TO MAKE PAGE TABLES SMALLER? Simple array-based page tables (usually called linear page tables) are too big, taking up far too much memory on typical systems. How can we make page tables smaller? What are the key ideas? What inefficiencies arise as a result of these new data structures? 20.1 Simple Solution: Bigger Pages We could reduce the size of the page table in one simple way: use bigger pages. Take our 32-bit address space again, but this time assume 16KB pages. We would thus have an 18-bit VPN plus a 14-bit offset.
    [Show full text]
  • Unikernel Monitors: Extending Minimalism Outside of the Box
    Unikernel Monitors: Extending Minimalism Outside of the Box Dan Williams Ricardo Koller IBM T.J. Watson Research Center Abstract Recently, unikernels have emerged as an exploration of minimalist software stacks to improve the security of ap- plications in the cloud. In this paper, we propose ex- tending the notion of minimalism beyond an individual virtual machine to include the underlying monitor and the interface it exposes. We propose unikernel monitors. Each unikernel is bundled with a tiny, specialized mon- itor that only contains what the unikernel needs both in terms of interface and implementation. Unikernel mon- itors improve isolation through minimal interfaces, re- Figure 1: The unit of execution in the cloud as (a) a duce complexity, and boot unikernels quickly. Our ini- unikernel, built from only what it needs, running on a tial prototype, ukvm, is less than 5% the code size of a VM abstraction; or (b) a unikernel running on a spe- traditional monitor, and boots MirageOS unikernels in as cialized unikernel monitor implementing only what the little as 10ms (8× faster than a traditional monitor). unikernel needs. 1 Introduction the application (unikernel) and the rest of the system, as defined by the virtual hardware abstraction, minimal? Minimal software stacks are changing the way we think Can application dependencies be tracked through the in- about assembling applications for the cloud. A minimal terface and even define a minimal virtual machine mon- amount of software implies a reduced attack surface and itor (or in this case a unikernel monitor) for the applica- a better understanding of the system, leading to increased tion, thus producing a maximally isolated, minimal exe- security.
    [Show full text]
  • X86 Memory Protection and Translation
    2/5/20 COMP 790: OS Implementation COMP 790: OS Implementation Logical Diagram Binary Memory x86 Memory Protection and Threads Formats Allocators Translation User System Calls Kernel Don Porter RCU File System Networking Sync Memory Device CPU Today’s Management Drivers Scheduler Lecture Hardware Interrupts Disk Net Consistency 1 Today’s Lecture: Focus on Hardware ABI 2 1 2 COMP 790: OS Implementation COMP 790: OS Implementation Lecture Goal Undergrad Review • Understand the hardware tools available on a • What is: modern x86 processor for manipulating and – Virtual memory? protecting memory – Segmentation? • Lab 2: You will program this hardware – Paging? • Apologies: Material can be a bit dry, but important – Plus, slides will be good reference • But, cool tech tricks: – How does thread-local storage (TLS) work? – An actual (and tough) Microsoft interview question 3 4 3 4 COMP 790: OS Implementation COMP 790: OS Implementation Memory Mapping Two System Goals 1) Provide an abstraction of contiguous, isolated virtual Process 1 Process 2 memory to a program Virtual Memory Virtual Memory 2) Prevent illegal operations // Program expects (*x) – Prevent access to other application or OS memory 0x1000 Only one physical 0x1000 address 0x1000!! // to always be at – Detect failures early (e.g., segfault on address 0) // address 0x1000 – More recently, prevent exploits that try to execute int *x = 0x1000; program data 0x1000 Physical Memory 5 6 5 6 1 2/5/20 COMP 790: OS Implementation COMP 790: OS Implementation Outline x86 Processor Modes • x86
    [Show full text]
  • An Evolutionary Study of Linux Memory Management for Fun and Profit Jian Huang, Moinuddin K
    An Evolutionary Study of Linux Memory Management for Fun and Profit Jian Huang, Moinuddin K. Qureshi, and Karsten Schwan, Georgia Institute of Technology https://www.usenix.org/conference/atc16/technical-sessions/presentation/huang This paper is included in the Proceedings of the 2016 USENIX Annual Technical Conference (USENIX ATC ’16). June 22–24, 2016 • Denver, CO, USA 978-1-931971-30-0 Open access to the Proceedings of the 2016 USENIX Annual Technical Conference (USENIX ATC ’16) is sponsored by USENIX. An Evolutionary Study of inu emory anagement for Fun and rofit Jian Huang, Moinuddin K. ureshi, Karsten Schwan Georgia Institute of Technology Astract the patches committed over the last five years from 2009 to 2015. The study covers 4587 patches across Linux We present a comprehensive and uantitative study on versions from 2.6.32.1 to 4.0-rc4. We manually label the development of the Linux memory manager. The each patch after carefully checking the patch, its descrip- study examines 4587 committed patches over the last tions, and follow-up discussions posted by developers. five years (2009-2015) since Linux version 2.6.32. In- To further understand patch distribution over memory se- sights derived from this study concern the development mantics, we build a tool called MChecker to identify the process of the virtual memory system, including its patch changes to the key functions in mm. MChecker matches distribution and patterns, and techniues for memory op- the patches with the source code to track the hot func- timizations and semantics. Specifically, we find that tions that have been updated intensively.
    [Show full text]
  • Address Translation
    CS 152 Computer Architecture and Engineering Lecture 8 - Address Translation John Wawrzynek Electrical Engineering and Computer Sciences University of California at Berkeley http://www.eecs.berkeley.edu/~johnw http://inst.eecs.berkeley.edu/~cs152 9/27/2016 CS152, Fall 2016 CS152 Administrivia § Lab 2 due Friday § PS 2 due Tuesday § Quiz 2 next Thursday! 9/27/2016 CS152, Fall 2016 2 Last time in Lecture 7 § 3 C’s of cache misses – Compulsory, Capacity, Conflict § Write policies – Write back, write-through, write-allocate, no write allocate § Multi-level cache hierarchies reduce miss penalty – 3 levels common in modern systems (some have 4!) – Can change design tradeoffs of L1 cache if known to have L2 § Prefetching: retrieve memory data before CPU request – Prefetching can waste bandwidth and cause cache pollution – Software vs hardware prefetching § Software memory hierarchy optimizations – Loop interchange, loop fusion, cache tiling 9/27/2016 CS152, Fall 2016 3 Bare Machine Physical Physical Address Inst. Address Data Decode PC Cache D E + M Cache W Physical Memory Controller Physical Address Address Physical Address Main Memory (DRAM) § In a bare machine, the only kind of address is a physical address 9/27/2016 CS152, Fall 2016 4 Absolute Addresses EDSAC, early 50’s § Only one program ran at a time, with unrestricted access to entire machine (RAM + I/O devices) § Addresses in a program depended upon where the program was to be loaded in memory § But it was more convenient for programmers to write location-independent subroutines How
    [Show full text]
  • Lecture 12: Virtual Memory Finale and Interrupts/Exceptions 1 Review And
    EE360N: Computer Architecture Lecture #12 Department of Electical and Computer Engineering The University of Texas at Austin October 9, 2008 Disclaimer: The contents of this document are scribe notes for The University of Texas at Austin EE360N Fall 2008, Computer Architecture.∗ The notes capture the class discussion and may contain erroneous and unverified information and comments. Lecture 12: Virtual Memory Finale and Interrupts/Exceptions Lecture #12: October 8, 2008 Lecturer: Derek Chiou Scribe: Michael Sullivan and Peter Tran Lecture 12 of EE360N: Computer Architecture summarizes the significance of virtual memory and introduces the concept of interrupts and exceptions. As such, this document is divided into two sections. Section 1 details the key points from the discussion in class on virtual memory. Section 2 goes on to introduce interrupts and exceptions, and shows why they are necessary. 1 Review and Summation of Virtual Memory The beginning of this lecture wraps up the review of virtual memory. A broad summary of virtual memory systems is given first, in Subsection 1.1. Next, the individual components of the hardware and OS that are required for virtual memory support are covered in 1.2. Finally, the addressing of caches and the interface between the cache and virtual memory are described in 1.3. 1.1 Summary of Virtual Memory Systems Virtual memory automatically provides the illusion of a large, private, uniform storage space for each process, even on a limited amount of physically addressed memory. The virtual memory space available to every process looks the same every time the process is run, irrespective of the amount of memory available, or the program’s actual placement in main memory.
    [Show full text]
  • Chapter 3 Protected-Mode Memory Management
    CHAPTER 3 PROTECTED-MODE MEMORY MANAGEMENT This chapter describes the Intel 64 and IA-32 architecture’s protected-mode memory management facilities, including the physical memory requirements, segmentation mechanism, and paging mechanism. See also: Chapter 5, “Protection” (for a description of the processor’s protection mechanism) and Chapter 20, “8086 Emulation” (for a description of memory addressing protection in real-address and virtual-8086 modes). 3.1 MEMORY MANAGEMENT OVERVIEW The memory management facilities of the IA-32 architecture are divided into two parts: segmentation and paging. Segmentation provides a mechanism of isolating individual code, data, and stack modules so that multiple programs (or tasks) can run on the same processor without interfering with one another. Paging provides a mech- anism for implementing a conventional demand-paged, virtual-memory system where sections of a program’s execution environment are mapped into physical memory as needed. Paging can also be used to provide isolation between multiple tasks. When operating in protected mode, some form of segmentation must be used. There is no mode bit to disable segmentation. The use of paging, however, is optional. These two mechanisms (segmentation and paging) can be configured to support simple single-program (or single- task) systems, multitasking systems, or multiple-processor systems that used shared memory. As shown in Figure 3-1, segmentation provides a mechanism for dividing the processor’s addressable memory space (called the linear address space) into smaller protected address spaces called segments. Segments can be used to hold the code, data, and stack for a program or to hold system data structures (such as a TSS or LDT).
    [Show full text]
  • Kernel Architectures
    A short history of kernels n Early kernel: a library of device drivers, support for threads (QNX) Operating System Kernels n Monolithic kernels: Unix, VMS, OS 360… n Unstructured but fast… n Over time, became very large Ken Birman n Eventually, DLLs helped on size n Pure microkernels: Mach, Amoeba, Chorus… (borrowing some content from n OS as a kind of application Peter Sirokman) n Impure microkernels: Modern Windows OS n Microkernel optimized to support a single OS n VMM support for Unix on Windows and vice versa The great m-kernel debate Summary of First Paper n How big does it need to be? n The Performance of µ-Kernel-Based Systems (Hartig et al. 16th SOSP, Oct 1997) n With a m-kernel protection-boundary crossing forces us to n Evaluates the L4 microkernel as a basis for a full operating system n Change memory -map n Ports Linux to run on top of L4 and compares n Flush TLB (unless tagged) performance to native Linux and Linux running on n With a macro-kernel we lose structural the Mach microkernel protection benefits and fault-containment n Explores the extensibility of the L4 microkernel n Debate raged during early 1980’s Summary of Second Paper In perspective? n The Flux OSKit: A Substrate for Kernel and n L4 seeks to validate idea that a m-kernel Language Research (Ford et al. 16th SOSP, can support a full OS without terrible 1997) cost penalty n Describes a set of OS components designed to be used to build custom operating systems n Opened the door to architectures like the n Includes existing code simply using “glue code” Windows
    [Show full text]
  • Hierarchical and Inverted Page Tables
    Main Memory: Address Translation CS 4410 Operating Systems Address Translation • Paged Translation • Efficient Address Translation • Multi-Level Page Tables • Inverted Page Tables • TLBs 2 Downsides to Paging Memory Consumption: • Internal Fragmentation • Make pages smaller? But then… • Page Table Space: consider 32-bit address space, 4KB page size, each PTE 8 bytes • How big is this page table? • How many pages in memory does it need? Performance: every data/instruction access requires two memory accesses: • One for the page table • One for the data/instruction 3 Internal Fragmentation Example Virtual Physical Virtual Physical Memory Memory Memory Memory stack STACK 0 stack STACK 0 HEAP 0 HEAP 0 TEXT 1 TEXT 1 malloc heap heap HEAP 1 HEAP 1 DATA 0 DATA 0 data data TEXT 0 TEXT 0 Mostly text text HEAP 2 empty STACK 1 STACK 1 4 Multi-Level Page Tables to the Rescue! index 1 | index 2 | offset Frame + Allocate only PTEs in use Frame | Access + Can use smaller pages + Simple memory allocation − more lookups per memory reference 5 Two-Level Paging Example 32-bit machine, 1KB page size • Logical address is divided into: – a page offset of 10 bits (1024 = 2^10) – a page number of 22 bits (32-10) • Since the page table is paged, the page number is further divided into: – a 12-bit first index – a 10-bit second index • Thus, a logical address is as follows: page number page offset index 1 index 2 offset 12 10 10 6 This one goes to three! + First Level requires less contiguous memory − even more lookups per memory reference 7 Complete Page Table
    [Show full text]
  • Assessing Unikernel Security April 2, 2019 – Version 1.0
    NCC Group Whitepaper Assessing Unikernel Security April 2, 2019 – Version 1.0 Prepared by Spencer Michaels Jeff Dileo Abstract Unikernels are small, specialized, single-address-space machine images constructed by treating component applications and drivers like libraries and compiling them, along with a kernel and a thin OS layer, into a single binary blob. Proponents of unikernels claim that their smaller codebase and lack of excess services make them more efficient and secure than full-OS virtual machines and containers. We surveyed two major unikernels, Rumprun and IncludeOS, and found that this was decidedly not the case: unikernels, which in many ways resemble embedded systems, appear to have a similarly minimal level of security. Features like ASLR, W^X, stack canaries, heap integrity checks and more are either completely absent or seriously flawed. If an application running on such a system contains a memory corruption vulnerability, it is often possible for attackers to gain code execution, even in cases where the applica- tion’s source and binary are unknown. Furthermore, because the application and the kernel run together as a single process, an attacker who compromises a unikernel can immediately exploit functionality that would require privilege escalation on a regular OS, e.g. arbitrary packet I/O. We demonstrate such attacks on both Rumprun and IncludeOS unikernels, and recommend measures to mitigate them. Table of Contents 1 Introduction to Unikernels . 4 2 Threat Model Considerations . 5 2.1 Unikernel Capabilities ................................................................ 5 2.2 Unikernels Versus Containers .......................................................... 5 3 Hypothesis . 6 4 Testing Methodology . 7 4.1 ASLR ................................................................................ 7 4.2 Page Protections ....................................................................
    [Show full text]