Presentation
SIGN IN TO VIEW THIS PRESENTATION Sign In
CARAT KOP: Toward Protecting the Core HPC Kernel from Linux Kernel Modules
DescriptionExtending Linux through kernel modules offers immense potential benefits and capabilities for HPC. Deployment is also more likely since Linux is typically the only supported vendor OS. However, because Linux is monolithic, kernel modules are free to access any address with maximum permissions. A poorly written---or untrustworthy---module can wreak havoc. This makes it hard to justify including custom kernel modules in production HPC systems. We address this limitation using the previously developed compiler- and runtime-based address translation (CARAT) model and toolchain, which injects guards around memory accesses. The accesses are then allowed/disallowed according to a policy. We share our results regarding the guard injection and address validation process. Our CARAT-based Kernel Object Protection (CARAT KOP) prototype is able to transform a substantial production kernel module from the kernel tree (a NIC driver comprising ~19,000 lines of code). The transformed module runs with minimal effect on its performance.
Event Type
Workshop
TimeSunday, 12 November 202311:18am - 11:42am MST
Location704-706
Middleware and System Software
Programming Frameworks and System Software
Runtime Systems
W