Separation kernel with memory allocation, remote procedure call and exception handling mechanisms

Abstract

A computer-implemented system ( 90 ) is provided that supports a high degree of separation between processing elements. The computer-implemented system ( 90 ) comprises a plurality of cells ( 92 ) residing on the computer-implemented system, where each cell ( 92 ) includes a domain of execution ( 94 ) and at least one processing element ( 96 ); a separation specification ( 99 ) that governs communication between the processing elements ( 96 ); and a kernel ( 98 ) of an operating system that facilitates execution of the processing elements ( 96 ) and administers the communication between the processing elements ( 96 ) in accordance with the separation specification ( 99 ), such that one processing element ( 96 ) can influence the operation of another processing element ( 96 ) only as set forth by the separation specification ( 99 ). In particular, the separation specification provides memory allocation, remote procedure calls and exception handling mechanisms.

1 . A method for performing a remote procedure call from a source task residing in a source cell to a target task residing in a target cell, the source task having a memory space accessible during execution of the source task, comprising the steps of:
 sending an input message from the source task to the target task, where the input message is a portion of the memory space associated with the source task and the portion of the memory space is inaccessible to the source task during the execution of the target task;   initiating execution of the target task in the target cell in response to receiving the input message from the source task;   providing access to the portion of the memory space during execution of the target task;   releasing the portion of the memory space such that the portion of the memory space is accessible to the source task; and   providing a return message from the target task to the source task upon completing execution of the target task.   
   
   
       2 . The method of  claim 1 , further comprising the step of prohibiting the target strand from sending a second input message, where the second input message corresponds to the portion of the memory space received from the source task. 
   
   
       3 . The method of  claim 1 , further comprising the steps of:
 limiting access of the target task to a plurality of input transient segments and a plurality of permanent segments of the target cell; and   providing a sufficient resource to execute the remote procedure call based at least in part on the limiting access of the target task to a plurality of input transient segments and a plurality of permanent segments of the target cell.   
   
   
       4 . The method of  claim 3 , further comprising the step of prohibiting a resource exhaustion covert channel based at least in part on the providing the sufficient resource to execute the remote procedure call. 
   
   
       5 . The method of  claim 1 , further comprising the step of prohibiting a call to a task in a cell that is already a part of a stack of the remote procedure call. 
   
   
       6 . The method of  claim 1 , further comprising the step of prohibiting a call to a target cell having an executing task.