Using registers to optimize cross-domain call performance

Reviewer: Earl C. Van Horn

Some methods for discretionary access control in secure computer systems are based on sealed pointers called capabilities [1]. This paper addresses the performance of calls between domains in capability-based systems, where a domain is a computation holding a fixed set of capabilities in addition to any passed to it by a calling domain. The optimization techniques discussed are not strongly tied to the capability paradigm, however, and so could be adapted for other kinds of systems. The approach to optimization is based on analysis of actual usage patterns both in capability systems and in conventional systems organized according to domain-like layers. For example, a typical cross-domain call might pass or obtain several relatively small values and a single capability. Passing the values in registers is clearly faster than constructing capabilities for each, as is done in some systems. The use of registers, however, may require that sensitive information be cleared from registers not involved in the call. Karger describes several approaches for speeding up cross-domain calls, all of which are based on trusted compilers and linkers generating the information needed to automatically save, restore, and clear specific registers for each call. The author's analysis of saving, restoring, and clearing in terms of the kind of trust between domains is itself a valuable reference for system designers. In this analysis, the term “security” is used for what is often called “secrecy” [2]. The information generated by the trusted linker can be used by trusted call mechanisms to do just what is needed and no more. One approach involves the generation of protected linkage tables to be used by microcode. Another involves the generation of kernol-mode instructions to perform the saves, restores, clears needed by each call. The latter approach is consistent with the RISC design philosophy. Other performance enhancements are discussed, such as the use of address space numbers to avoid flushing the address translation buffer. Many performance experiments were run to indicate the gains to be expected in various circumstances. The most optimized cross-domain call is still somewhat slower than a conventional complex call such as the VAX CALLS, but is estimated to be significantly faster than other cross-domain call designs. The paper is a condensation of the author's Ph.D. thesis. It describes previous work thoroughly and provides an extensive reference list. Experimental results are used well to motivate the design and evaluate its effectiveness. The treatment of such a wide range of issues in a paper of limited size can frustrate the reader, however; for example, the description of the data structures used by the microcode is very terse. I encourage the reader to refer to the Ph.D. thesis, cited in the paper, for a fuller description of all aspects of this work.