Safe user-level sharing of memory-mapped resources
summary
Hodor implements Intel PKU (protection keys / PKRU) to give user‑level libraries exclusive access to memory‑mapped device and data regions, with a trusted loader that scans binaries for WRPKRU sequences and uses debug registers plus a page‑fault multiplexing fallback. Protection adds under <100 cycles to a library call; measured throughput is within 90–98% of unprotected code, sustaining over 3M IO ops/s (silo >2M tx/s/core). Proof‑of‑concept memcached shows ~2× throughput and up to 50× latency reduction while enforcing cross‑application QoS.
AI-written summary · about
chapters (13)
- 0:00Start
- 0:50The University of Rochester
- 2:00A Bit of OS History
- 9:24Overview
- 10:05Protected Library
- 12:39Possible isolation strategies ate address spaces
- 19:46Hodor: Memory Isolation
- 21:31Hodor: Vetting WRPKRUS
- 26:57Alternative Memory Isolation
- 27:31Evaluation: Applications
- 41:37Memcached results
- 45:43Caveats
- 49:32Conclusion
related talks
22mHodor: Intra-Process Isolation for High-Throughput Data Plane Libraries
38mKernel Hardening: Protecting the Protection Mechanisms
16mPatronus: High-Performance and Protective Remote Memory
30mKernel Hardening With Protection Keys
17mHarness: Transparent and Lightweight Protection of Vehicle Control on...
40mWinter is Coming Back
19mSupporting Trusted Virtual Machines with Hardware-based Secure Remote Memory
26mEnabling Hardware-Assisted Shields for Linux Security Subsystems