In traditional operating systems, only privileged servers and the kernel can manage system resources. Untrusted applications are restricted to the interfaces and implementations of this privileged software. This organization is flawed because application demands vary widely. An interface designed to accommodate every application must anticipate all possible needs. The implementation of such an interface would need to resolve all tradeoffs and anticipate all ways the interface could be used. The exokernel architecture solves this problem by giving untrusted applications as much control over resources as possible.
https://i.imgur.com/qGREjSc.png
Exokernel Principles:
- Separate protection and management
- Expose allocation (applications allocate resources explicitly)
- Expose names (physical names, reduce costly translations)
- Reduce revocation (each application has control over its set of physical resources)
- Expose information
The exokernel architecture:
- Kernel support for protected abstraction (Xok)
- performs access control on all resources in the same manner
- provides software abstractions to bind ahrdware resources together
- some of Xok's abstractions allow applications to download code
- Protected sharing with 4 mechanisms when meeting 3 levels of trust including Mutual trust, Unidirectional trust and Defensive programming for mutual distrust
XN:
- Disk-block-level multiplexing
- Self-descriptive metadata
- Template-based description
XN provides access to stable storage at the level of disk blocks.
XN’s novel solution employs UDFs
- Ordered disk writes
- The buffer cache registry
- C-FFS: a library file system
the novel design of untrusted deterministic functions.
How is the design evaluated, what are the key results?
using Xok/ExOS.
To implement a range of file systems (log-structured file systems, RAID, and memory-based file systems), thus testing if the XN interface is powerful enough to support concurrent use by radically different file systems.
To investigate using lightweight protected methods like UDFs to implement the simple protection checks required by higher-level abstractions.