Masanori Misono

This paper introduces MorphOS, a novel, extensible networked operating system that addresses the runtime inflexibility of unikernels for dynamic, stateful network-intensive applications like Virtual Network Functions (VNFs). While unikernels offer superior performance and minimal resource overheads, their traditional update mechanisms require costly rebuilds and restarts, leading to service disruption and state loss. MorphOS addresses this by integrating eBPF to enable dynamic, verified code execution for seamless updates to packet processing logic. It employs an out-of-band verification service to offload computationally intensive verification tasks and utilizes hardware-assisted memory isolation (Memory Protection Keys) for enhanced execution hardening. Our evaluation of MorphOS with four VNF implementations demonstrates significant benefits: MorphOS drastically reduces reconfiguration time, effectively amortizes verification costs, and achieves up to 3× better performance compared to Linux-based VNF deployments, all while preserving the inherent lightweightness of unikernels. MorphOS thus paves the way for adaptable, efficient, and state-preserving networked applications in cloud environments.

Confidential Virtual Machines (CVMs) strive to alleviate the programmability and usability challenges of the previously proposed enclave-based trusted computing technologies, promoting easier deployment in cloud infrastructures. However, differing microarchitectural features, interfaces, and security properties among vendors complicate the evaluation of CVMs for different use cases. Understanding the performance implications, functional limitations, and security guarantees of CVMs is a crucial step toward their adoption. This work presents a detailed empirical analysis of two leading CVM technologies: AMD Secure Encrypted Virtualization--Secure Nested Paging (SEV-SNP) and Intel Trust Domain Extensions (TDX). We review their microarchitectural components and conduct a thorough performance evaluation across various aspects, including memory management, computational and I/O performance, and attestation primitives. We further present a security analysis through a trusted computing base (TCB) evaluation and Common Vulnerabilities and Exposures (CVE) analysis. Our key findings demonstrate, among others, the effect of CVMs on boot time, memory management and I/O, and identify inefficiencies in their context switch mechanisms. We further provide insights into the performance implications of CVMs and highlight potential room for improvement.

Confidential computing is gaining traction in the cloud, driven by the increasing security and privacy concerns across various industries. Recent trusted hardware advancements introduce Confidential Virtual Machines (CVMs) to alleviate the programmability and usability challenges of the previously proposed enclave-based trusted computing technologies. CVM hardware extensions facilitate secure, hardware-isolated encrypted VMs, promoting programmability and easier deployment in cloud infrastructures. However, differing microarchitectural features, interfaces, and security properties among hardware vendors complicate the evaluation of CVMs for different use cases. Understanding the performance implications, functional limitations, and security guarantees of CVMs is a crucial step toward their adoption. This paper presents a detailed empirical analysis of two leading CVM technologies: AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) and Intel Trust Domain Extensions (TDX). We review their microarchitectural components and conduct a thorough performance evaluation across various aspects, including memory management, computational performance, storage and network stacks, and attestation primitives. We further present a security analysis through a trusted computing base (TCB) evaluation and Common Vulnerabilities and Exposures (CVE) analysis. Our key findings demonstrate, among others, the effect of CVMs on boot time, memory management and I/O, and identify inefficiencies in their context switch mechanisms. We further provide insights into the performance implications of CVMs and highlight potential room for improvement.

Unikernels specialize operating systems by tailoring the kernel for a specific application at compile time. While the specialized library OS approach provides a smaller OS image-thus improving the bootup process, performance, migration costs, and reliable/trusted computing base---at the same time, unikernels lack run-time extensibility, which is imperative to support "on-demand" auxiliary tasks and tools, e.g., debugging, monitoring, re-configuration, and system management and deployment in a typical cloud environment. Consequently, unikernels present a fundamental trade-off between slimness of the OS image size at the compile time vs. flexibility of supported auxiliary functionality at the run-time. This work strives to balance this trade-off by keeping the unikernel system image as minimal as possible to solely support the application functionality in the "common case", while providing "on-demand" extensibility for auxiliary tasks at run-time. The key challenge is to support run-time extensibility through a generic interface in a safe manner. To this end, the paper presents uIO---a "safe overlay" abstraction to provide runtime extensibility in unikernels, while maintaining the unikernel benefits. In particular, uIO leverages a generic VirtIO-based interface to provide an overlay for auxiliary programs, i.e., users can load external programs into the unikernels' address space and run them, i.e., "on-demand" extensibility through a generic file system interface. To provide safe execution within an overlay, uIO provides isolation mechanisms leveraging hardware-assisted memory isolation (MPK) and language-runtime-based execution (eBPF). We implement a prototype of uIO based on Unikraft and demonstrate its applicability to support a range of auxiliary use cases. uIO incurs negligible performance overheads for application execution in the common case while providing run-time extensibility to support auxiliary use cases.