SEARCH · Searcharxiv

Results for “cs.OS”

Search indexed arXiv papers on artificial intelligence, large language models, computer vision and robotics. Read source abstracts and follow links to arXiv.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 307 records · Page 17Linked to original sources

arXiv2018

Regulating Access to System Sensors in Cooperating Programs

Modern operating systems such as Android, iOS, Windows Phone, and Chrome OS support a cooperating program abstraction. Instead of placing all functionality into a single program, programs cooperate to complete tasks requested by users. However, untrusted programs may exploit interactions with other programs to obtain unauthorized access to system sensors either directly or through privileged services. Researchers have proposed that programs should only be authorized to access system sensors on a user-approved input event, but these methods do not account for possible delegation done by the program receiving the user input event. Furthermore, proposed delegation methods do not enable users to control the use of their input events accurately. In this paper, we propose ENTRUST, a system that enables users to authorize sensor operations that follow their input events, even if the sensor operation is performed by a program different from the program receiving the input event. ENTRUST tracks user input as well as delegation events and restricts the execution of such events to compute unambiguous delegation paths to enable accurate and reusable authorization of sensor operations. To demonstrate this approach, we implement the ENTRUST authorization system for Android. We find, via a laboratory user study, that attacks can be prevented at a much higher rate (54-64% improvement); and via a field user study, that ENTRUST requires no more than three additional authorizations per program with respect to the first-use approach, while incurring modest performance (<1%) and memory overheads (5.5 KB per program).

cs.CR↗

arXiv2018

Runtime Analysis of Whole-System Provenance

Identifying the root cause and impact of a system intrusion remains a foundational challenge in computer security. Digital provenance provides a detailed history of the flow of information within a computing system, connecting suspicious events to their root causes. Although existing provenance-based auditing techniques provide value in forensic analysis, they assume that such analysis takes place only retrospectively. Such post-hoc analysis is insufficient for realtime security applications, moreover, even for forensic tasks, prior provenance collection systems exhibited poor performance and scalability, jeopardizing the timeliness of query responses. We present CamQuery, which provides inline, realtime provenance analysis, making it suitable for implementing security applications. CamQuery is a Linux Security Module that offers support for both userspace and in-kernel execution of analysis applications. We demonstrate the applicability of CamQuery to a variety of runtime security applications including data loss prevention, intrusion detection, and regulatory compliance. In evaluation, we demonstrate that CamQuery reduces the latency of realtime query mechanisms, while imposing minimal overheads on system execution. CamQuery thus enables the further deployment of provenance-based technologies to address central challenges in computer security.

cs.CR↗

arXiv2018

User Manual for the Apple CoreCapture Framework

CoreCapture is Apple's primary logging and tracing framework for IEEE 802.11 on iOS and macOS. It allows users and developers to create comprehensive debug output for analysis by Apple. In this manual, we provide an overview into the concepts, show in detail how CoreCapture logs can be created on iOS and macOS, and introduce the first CoreCapture dissector for Wireshark.

cs.NI↗

arXiv2023

Comparative Study of Virtual Machines and Containers for DevOps Developers

This paper presents a comparative study of virtual machines (VMs) and containers for DevOps developers. The study explores the benefits and drawbacks of each technology in terms of their functionality, performance, security, and resource utilization. The paper examines the underlying architecture of VMs and containers, and how they differ from each other. The study includes a series of experiments that compare the performance and resource utilization of VMs and containers in different scenarios. The experiments evaluate factors such as startup time, memory usage, disk I/O, network latency, scalability, and administrative overhead. Finally, the paper provides recommendations for DevOps developers on which technology to choose based on their specific requirements and use cases. Overall, the study aims to provide a comprehensive understanding of the strengths and limitations of VMs and containers, helping developers to make informed decisions when choosing between them.

cs.OS↗

arXiv2019

Profiling and Improving the Duty-Cycling Performance of Linux-based IoT Devices

Minimizing the energy consumption of Linux-based devices is an essential step towards their wide deployment in various IoT scenarios. Energy saving methods such as duty-cycling aim to address this constraint by limiting the amount of time the device is powered on. In this work we study and improve the amount of time a Linux-based IoT device is powered on to accomplish its tasks. We analyze the processes of system boot up and shutdown on two platforms, the Raspberry Pi 3 and Raspberry Pi Zero Wireless, and enhance duty-cycling performance by identifying and disabling time-consuming or unnecessary units initialized in the userspace. We also study whether SD card speed and SD card capacity utilization affect boot up duration and energy consumption. In addition, we propose 'Pallex', a parallel execution framework built on top of the 'systemd init' system to run a user application concurrently with userspace initialization. We validate the performance impact of Pallex when applied to various IoT application scenarios: (i) capturing an image, (ii) capturing and encrypting an image, (iii) capturing and classifying an image using the the k-nearest neighbor algorithm, and (iv) capturing images and sending them to a cloud server. Our results show that system lifetime is increased by 18.3%, 16.8%, 13.9% and 30.2%, for these application scenarios, respectively.

cs.OS↗

arXiv2018

Real-time Linux communications: an evaluation of the Linux communication stack for real-time robotic applications

As robotics systems become more distributed, the communications between different robot modules play a key role for the reliability of the overall robot control. In this paper, we present a study of the Linux communication stack meant for real-time robotic applications. We evaluate the real-time performance of UDP based communications in Linux on multi-core embedded devices as test platforms. We prove that, under an appropriate configuration, the Linux kernel greatly enhances the determinism of communications using the UDP protocol. Furthermore, we demonstrate that concurrent traffic disrupts the bounded latencies and propose a solution by separating the real-time application and the corresponding interrupt in a CPU.

cs.OS↗

arXiv2018

A Review of Software-Defined WLANs: Architectures and Central Control Mechanisms

The significant growth in the number of WiFi-enabled devices as well as the increase in the traffic conveyed through wireless local area networks (WLANs) necessitate the adoption of new network control mechanisms. Specifically, dense deployment of access points, client mobility, and emerging QoS demands bring about challenges that cannot be effectively addressed by distributed mechanisms. Recent studies show that software-defined WLANs (SDWLANs) simplify network control, improve QoS provisioning, and lower the deployment cost of new network control mechanisms. In this paper, we present an overview of SDWLAN architectures and provide a qualitative comparison in terms of features such as programmability and virtualization. In addition, we classify and investigate the two important classes of centralized network control mechanisms: (i) association control (AsC) and (ii) channel assignment (ChA). We study the basic ideas employed by these mechanisms, and in particular, we focus on the metrics utilized and the problem formulation techniques proposed. We present a comparison of these mechanisms and identify open research problems.

cs.NI↗

arXiv2018

Dependency Graph Approach for Multiprocessor Real-Time Synchronization

Over the years, many multiprocessor locking protocols have been designed and analyzed. However, the performance of these protocols highly depends on how the tasks are partitioned and prioritized and how the resources are shared locally and globally. This paper answers a few fundamental questions when real-time tasks share resources in multiprocessor systems. We explore the fundamental difficulty of the multiprocessor synchronization problem and show that a very simplified version of this problem is ${\mathcal NP}$-hard in the strong sense regardless of the number of processors and the underlying scheduling paradigm. Therefore, the allowance of preemption or migration does not reduce the computational complexity. For the positive side, we develop a dependency-graph approach, that is specifically useful for frame-based real-time tasks, in which all tasks have the same period and release their jobs always at the same time. We present a series of algorithms with speedup factors between $2$ and $3$ under semi-partitioned scheduling. We further explore methodologies and tradeoffs of preemptive against non-preemptive scheduling algorithms and partitioned against semi-partitioned scheduling algorithms. The approach is extended to periodic tasks under certain conditions.

cs.OS↗

arXiv2018

On the Fly Orchestration of Unikernels: Tuning and Performance Evaluation of Virtual Infrastructure Managers

Network operators are facing significant challenges meeting the demand for more bandwidth, agile infrastructures, innovative services, while keeping costs low. Network Functions Virtualization (NFV) and Cloud Computing are emerging as key trends of 5G network architectures, providing flexibility, fast instantiation times, support of Commercial Off The Shelf hardware and significant cost savings. NFV leverages Cloud Computing principles to move the data-plane network functions from expensive, closed and proprietary hardware to the so-called Virtual Network Functions (VNFs). In this paper we deal with the management of virtual computing resources (Unikernels) for the execution of VNFs. This functionality is performed by the Virtual Infrastructure Manager (VIM) in the NFV MANagement and Orchestration (MANO) reference architecture. We discuss the instantiation process of virtual resources and propose a generic reference model, starting from the analysis of three open source VIMs, namely OpenStack, Nomad and OpenVIM. We improve the aforementioned VIMs introducing the support for special-purpose Unikernels and aiming at reducing the duration of the instantiation process. We evaluate some performance aspects of the VIMs, considering both stock and tuned versions. The VIM extensions and performance evaluation tools are available under a liberal open source licence.

cs.DC↗

arXiv2018

Platform-Agnostic Steal-Time Measurement in a Guest Operating System

Steal time is a key performance metric for applications executed in a virtualized environment. Steal time measures the amount of time the processor is preempted by code outside the virtualized environment. This, in turn, allows to compute accurately the execution time of an application inside a virtual machine (i.e. it eliminates the time the virtual machine is suspended). Unfortunately, this metric is only available in particular scenarios in which the host and the guest OS are tightly coupled. Typical examples are the Xen hypervisor and Linux-based guest OSes. In contrast, in scenarios where the steal time is not available inside the virtualized environment, performance measurements are, most often, incorrect. In this paper, we introduce a novel and platform agnostic approach to calculate this steal time within the virtualized environment and without the cooperation of the host OS. The theoretical execution time of a deterministic microbenchmark is compared to its execution time in a virtualized environment. When factoring in the virtual machine load, this solution -as simple as it is- can compute the steal time. The preliminary results show that we are able to compute the load of the physical processor within the virtual machine with high accuracy.

cs.OS↗

arXiv2019

BRAVO -- Biased Locking for Reader-Writer Locks

Designers of modern reader-writer locks confront a difficult trade-off related to reader scalability. Locks that have a compact memory representation for active readers will typically suffer under high intensity read-dominated workloads when the "reader indicator"' state is updated frequently by a diverse set of threads, causing cache invalidation and coherence traffic. Other designs, such as cohort reader-writer locks, use distributed reader indicators, one per NUMA node. This improves reader-reader scalability, but also increases the size of each lock instance. We propose a simple transformation BRAVO, that augments any existing reader-writer lock, adding just two integer fields to the lock instance. Readers make their presence known to writers by hashing their thread's identity with the lock address, forming an index into a visible readers table. Readers attempt to install the lock address into that element in the table, making their existence known to potential writers. All locks and threads in an address space can share the visible readers table. Updates by readers tend to be diffused over the table, resulting in a NUMA-friendly design. Crucially, readers of the same lock tend to write to different locations in the array, reducing coherence traffic. Specifically, BRAVO allows a simple compact lock to be augmented so as to provide scalable concurrent reading but with only a modest increase in footprint.

cs.OS↗

arXiv2019

TWA -- Ticket Locks Augmented with a Waiting Array

The classic ticket lock consists of ticket and grant fields. Arriving threads atomically fetch-and-increment ticket and then wait for grant to become equal to the value returned by the fetch-and-increment primitive, at which point the thread holds the lock. The corresponding unlock operation simply increments grant. This simple design has short code paths and fast handover (transfer of ownership) under light contention, but may suffer degraded scalability under high contention when multiple threads busy wait on the grant field -- so-called global spinning. We propose a variation on ticket locks where long-term waiting threads wait on locations in a waiting array instead of busy waiting on the grant field. The single waiting array is shared among all locks. Short-term waiting is accomplished in the usual manner on the grant field. The resulting algorithm, TWA, improves on ticket locks by limiting the number of threads spinning on the grant field at any given time, reducing the number of remote caches requiring invalidation from the store that releases the lock. In turn, this accelerates handover, and since the lock is held throughout the handover operation, scalability improves. Under light or no contention, TWA yields performance comparable to the classic ticket lock, avoiding the complexity and extra accesses incurred by MCS locks in the handover path, but providing performance above or beyond that of MCS at high contention.

cs.OS↗

arXiv2018

Finding Crash-Consistency Bugs with Bounded Black-Box Crash Testing

We present a new approach to testing file-system crash consistency: bounded black-box crash testing (B3). B3 tests the file system in a black-box manner using workloads of file-system operations. Since the space of possible workloads is infinite, B3 bounds this space based on parameters such as the number of file-system operations or which operations to include, and exhaustively generates workloads within this bounded space. Each workload is tested on the target file system by simulating power-loss crashes while the workload is being executed, and checking if the file system recovers to a correct state after each crash. B3 builds upon insights derived from our study of crash-consistency bugs reported in Linux file systems in the last five years. We observed that most reported bugs can be reproduced using small workloads of three or fewer file-system operations on a newly-created file system, and that all reported bugs result from crashes after fsync() related system calls. We build two tools, CrashMonkey and ACE, to demonstrate the effectiveness of this approach. Our tools are able to find 24 out of the 26 crash-consistency bugs reported in the last five years. Our tools also revealed 10 new crash-consistency bugs in widely-used, mature Linux file systems, seven of which existed in the kernel since 2014. Our tools also found a crash-consistency bug in a verified file system, FSCQ. The new bugs result in severe consequences like broken rename atomicity and loss of persisted files.

cs.OS↗

arXiv2018

Revitalizing Copybacks in Modern SSDs: Why and How

For modern flash-based SSDs, the performance overhead of internal data migrations is dominated by the data transfer time, not by the flash program time as in old SSDs. In order to mitigate the performance impact of data migrations, we propose rCopyback, a restricted version of copyback. Rcopyback works like the original copyback except that only n consecutive copybacks are allowed. By limiting the number of successive copybacks, it guarantees that no data reliability problem occurs when data is internally migrated using rCopyback. In order to take a full advantage of rCopyback, we developed a rCopyback-aware FTL, rcFTL, which intelligently decides whether rCopyback should be used or not by exploiting varying host workloads. Our evaluation results show that rcFTL can improve the overall I/O throughput by 54% on average over an existing FTL which does not use copybacks.

cs.OS↗

arXiv2018

T-Visor: A Hypervisor for Mixed Criticality Embedded Real-time System with Hardware Virtualization Support

Recently, embedded systems have not only requirements for hard real-time behavior and reliability, but also diversified functional demands, such as network functions. To satisfy these requirements, virtualization using hypervisors is promising for embedded systems. However, as most of existing hypervisors are designed for general-purpose information processing systems, they rely on large system stacks, so that they are not suitable for mixed criticality embedded real-time systems. Even in hypervisors designed for embedded systems, their schedulers do not consider the diversity of real-time requirements and rapid change in scheduling theory. We present the design and implementation of T-Visor, a hypervisor specialized for mixed criticality embedded real-time systems. T-Visor supports ARM architecture and realizes full virtualization using ARM Virtualization Extensions. To guarantee real-time behavior, T-Visor provides a flexible scheduling framework so that developers can select the most suitable scheduling algorithm for their systems. Our evaluation showed that it performed better compared to Xen/ARM. From these results, we conclude that our design and implementation are more suitable for embedded real-time systems than the existing hypervisors.

cs.OS↗

arXiv2018

Time Protection: the Missing OS Abstraction

Timing channels enable data leakage that threatens the security of computer systems, from cloud platforms to smartphones and browsers executing untrusted third-party code. Preventing unauthorised information flow is a core duty of the operating system, however, present OSes are unable to prevent timing channels. We argue that OSes must provide time protection in addition to the established memory protection. We examine the requirements of time protection, present a design and its implementation in the seL4 microkernel, and evaluate its efficacy as well as performance overhead on Arm and x86 processors.

cs.OS↗

arXiv2019

Compact NUMA-Aware Locks

Modern multi-socket architectures exhibit non-uniform memory access (NUMA) behavior, where access by a core to data cached locally on a socket is much faster than access to data cached on a remote socket. Prior work offers several efficient NUMA-aware locks that exploit this behavior by keeping the lock ownership on the same socket, thus reducing remote cache misses and inter-socket communication. Virtually all those locks, however, are hierarchical in their nature, thus requiring space proportional to the number of sockets. The increased memory cost renders NUMA-aware locks unsuitable for systems that are conscious to space requirements of their synchronization constructs, with the Linux kernel being the chief example. In this work, we present a compact NUMA-aware lock that requires only one word of memory, regardless of the number of sockets in the underlying machine. The new lock is a variant of an efficient (NUMA-oblivious) MCS lock, and inherits its performant features, such as local spinning and a single atomic instruction in the acquisition path. Unlike MCS, the new lock organizes waiting threads in two queues, one composed of threads running on the same socket as the current lock holder, and another composed of threads running on a different socket(s). We integrated the new lock in the Linux kernel's qspinlock, one of the major synchronization constructs in the kernel. Our evaluation using both user-space and kernel benchmarks shows that the new lock has a single-thread performance of MCS, but significantly outperforms the latter under contention, achieving a similar level of performance when compared to other, state-of-the-art NUMA-aware locks that require substantially more space.

cs.OS↗

arXiv2018

DurableFS: A File System for Persistent Memory

With the availability of hybrid DRAM-NVRAM memory on the memory bus of CPUs, a number of file systems on NVRAM have been designed and implemented. In this paper we present the design and implementation of a file system on NVRAM called DurableFS, which provides atomicity and durability of file operations to applications. Due to the byte level random accessibility of memory, it is possible to provide these guarantees without much overhead. We use standard techniques like copy on write for data, and a redo log for metadata changes to build an efficient file system which provides durability and atomicity guarantees at the time a file is closed. Benchmarks on the implementation shows that there is only a 7 %degradation in performance due to providing these guarantees.

cs.OS↗