The following paper was originally published in theProceedings of the USENIX 2nd Symposium onOperating Systems Design and Implementation

Seattle, Washington, October 1996

For more information about USENIX Association contact:1. Phone: 510 528-86492. FAX: 510 548-57383. Email: office@usenix.org4. WWW URL: http://www.usenix.org

Safe Kernel Extensions Without Run-Time Checking

George C. Necula and Peter LeeCarnegie Mellon University

CPU

CODE PRODUCERUSER PROCESSUNTRUSTED CLIENT

CODE CONSUMEROS KERNELNETWORK SERVER

SAFETYPOLICY

PROOFENABLE VALIDATION

SOURCE PROGRAM

COMPILATION&

CODE

SAFETYBINARY

SCC

NATIVE

CERTIFICATION

PROOF

SECTION

NATIVE CODESECTION

220

RELOCATION

PROOF

45

0

340

SECTION

2.0

1.5

PCC

1.0

0.5

Filter 1 Filter 2 Filter 3 Filter 4

us

0.78

1.92

0.11 0.08

1.46

0.18 0.150.24

0.170.23

0.17

1.71

0.20 0.250.31 0.33

BPF

SFIM3-VIEW

0

5

10

15

20

0 5 10 15 20 25 30 35 40 45 50

ms

thousands of packets

BPFM3-VIEW

SFIPCC