Hodor: Intra-Process Isolation for High-Throughput Data Plane Libraries
summary
Introduces protected libraries as an OS abstraction that isolates services inside one address space, implemented with a loader, trampolines, and a kernel change and using Intel protection keys (PKU) plus hardware watchpoints to prevent unauthorized pkey writes. Prototype protects in-memory databases and user‑space stacks (Redis + F‑stack, Musl/silo variants) and achieves up to 2.3 million entrances/sec per core, within 90–98% of unprotected performance and faster than kernel protection, syscall-based, and VMFUNC alternatives.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:31Conventionalized Stack Design
- 1:20Data Plane Libraries
- 3:06Outline
- 3:54Protected Library
- 7:26Memory Protection Keys
- 8:07PeekARu
- 11:31Hardware Watchpoints
- 13:01Cost
- 14:40Hodor Alternatives
- 15:20Evaluation
- 16:31Evaluation Results
related talks
01h 14mSafe user-level sharing of memory-mapped resources
20mLimitations and Opportunities of Modern Hardware Isolation Mechanisms
21mHarmonizing Performance and Isolation in Microkernels with Efficient Intra-kernel
24mShielding Software From Privileged Side-Channel Attacks
15mOsprey: Transparent and Efficient Virtual Memory for Secure Computation
21mEmbedded solution for multiprocess application
38mKernel Hardening: Protecting the Protection Mechanisms
15mIsolation Mechanisms for High-Speed Packet-Processing Pipelines