What is HW isolation?

[sid-agrawal]

We need to nail down this definition of what we mean by hardware isolation.

HW isolation can mean one of two things depending on the person you are talking to or the paper you are reading.

1. A particular hardware resource is not shared between two PDs. Examples of this could be:
   a. Two PDs never get scheduled on the same core, i.e., core partitioning.
   b. A memory bus is never shared between two PDs.

OR

2. A hardware failure in a particular PD will not affect other PDs. A classic example is the Celular Disco paper, where they say that DRAM corruption of the RAM given to one VM will not impact other VMs. They achieve this by having multiple copies of the kernel.
   • 

I believe (1) can be achieved by policy on top of the OSmosis model. In other words, if the same kernel promises to assign mutually exclusive cores to two PDs, it is a policy inside the kernel. Both PDs are still the same number of edges away from the kernel.
This is what we said in the paper, too.

However, I am not quite sure how to talk about (2).

Seeking comments from: @astevins @p-linh

[sid-agrawal]

@achreto

[achreto]

We need to think about how we express failures in the model:

1. PD failures: fail stop, vs. stray writes due to bugs etc.
2. Hardware failures: fail stop vs. corruption.

Fail stops are "easy" in the sense that we simply drop a bunch of nodes and edges in the model.

The corruption cases are more subtle.

[shauryapatel1995]

I do feel that without CPU modes (ARM el levels) or simple user and supervisor mode talking about hw isolation is incomplete

[sid-agrawal]

My hunch tells me that we should be able to model this in our current model.

(and we should do this exercise)

[achreto]

Arm ELs / Rings etc, should show up as different protection domains.

Now, one thing that we may need to think about is the notion of executing stuff, i.e., exercising the "use" permissions. In particular, switching between two PDs. Potentially, this means another edge type, e.g., a process has a switch edge to the kernel, but not other processes, whereas the kernel has switch edges to all processes, for example.

[p-linh]

In (2), is having multiple copies of a kernel sort of like a policy in a way? Since it seems like something that's decided upon by the developer.

[achreto]

I don't think it's policy, but something that should show up in the model. It brings up an interesting question: how do we model hardware faults?

Multiple copies of the kernel would correspond to multiple PDs for the kernel that may have most of the resources shared, but some of the resources are distinct. Now I think that brings up another important point: It may be OK if some resources a PD as rights over simply go away, but for some it may be not. Maybe this is another property of the hold edge?