Dune: Safe User-level Access to Privledged CPU Features

Authors: Adam Belay, Andrea Bittau, Ali Mashtizadeh, David Terei, David Mazieres, Christos Kozyrakis
Venue: OSDI 2012

Dune uses virtualization hardware to provide the abstraction of a userspace process, but with safe access to hardware features. The Dune process runs as VMX non-root (aka guest ring 0). This enables virtual access to hardware features, such as exception handling and virtual memory. Because the system is built utilizing hardware support, performance is maintained (e.g. normal system call invocations do not cause a VM exit). Furthermore, a Dune process in guest ring 0 can run untrusted code in guest ring 3, and intercept any unwanted behavior, such as unauthorized systems calls. Without getting into more details, what is important is that Dune effectively enables kernel bypass, and sets the stage future work such as Shinjuku.


Comments

Popular posts from this blog

Fundamental Latency Trade-offs in Architecting DRAM Caches (Alloy Cache)

ZCOMP: Reducing DNN Cross-Layer Memory Footprint Using Vector Extensions

AutoFDO: Automatic Feedback-Directed Optimization for Warehouse-Scale Applications