OSIRIS: Efficient and Consistent Recovery of Compartmentalized Operating Systems

Abstract

Much research has gone into making operating systems more amenable to recovery and more resilient to crashes. Traditional solutions rely on partitioning the operating system (OS) to contain the effects of crashes within compartments and facilitate modular recovery. However, state dependencies among the compartments hinder recovery that is globally consistent. Such recovery typically requires expensive runtime dependency tracking which results in high performance overhead, high complexity and a large Reliable Computing Base (RCB). We propose a lightweight strategy that limits recovery to cases where we can statically and conservatively prove that compartment recovery leads to a globally consistent statetrading recoverable surface for a simpler and smaller RCB with lower performance overhead and maintenance cost. We present OSIRIS, a research OS design prototype that demonstrates efficient and consistent crash recovery. Our evaluation shows that OSIRIS effectively recovers from important classes of real-world software bugs with a modest RCB and low overheads.

iScanU: A Portable Scanner for Undocumented Instructions on RISC Processors

“…We found that, compared to other platforms, QEMU is marking more instructions as valid that are also considered as valid by the disassem-bler. This concerns optional instruction set extensions that are not implemented by other platforms 1 . Single unimplemented instructions with large immediate fields cause many thousands of values to be marked as disassembler faults, this causes the large difference of disassembler faults between QEMU and the other systems and also the large difference in undocumented instructions between the systems.…”

“…Correct and secure operation of computer systems depends on both software and hardware. Many efforts to improve the operation of computer systems focus mainly on the software stack, such as for instance development of operating system crash recovery methods [1] and hardening of the software system's security [2]. Hardware, and in particular processors, are treated as trusted black boxes.…”

“…Such undocumented instructions impact reliability. For example, crash recovery methods [1] often rely on fail-stop semantics in case an incorrect instruction is executed, as arbitrary operations performed by undocumented instructions are far harder to detect. Undocumented instructions can even affect security if those operations allow CPUbased isolation boundaries to be crossed.…”

Behind the Last Line of Defense -- Surviving SoC Faults and Intrusions

“…Furthermore, the complexity of these recovery kernels is comparable to that of a small hypervisor. For example, OSIRIS [57] directs OS recovery to a 29 KLOC reliable computing base (RCB) [60], roughly twice the size of modern microkernels [12], [22], [35], [61]. Again, this makes the likelihood of residual faults or vulnerabilities non-negligible.…”