Dune: Safe User-level Access to Privledged CPU Features
Authors: Adam Belay, Andrea Bittau, Ali Mashtizadeh, David Terei, David Mazieres, Christos Kozyrakis Venue: OSDI 2012 Dune uses virtualization hardware to provide the abstraction of a userspace process, but with safe access to hardware features. The Dune process runs as VMX non-root (aka guest ring 0). This enables virtual access to hardware features, such as exception handling and virtual memory. Because the system is built utilizing hardware support, performance is maintained (e.g. normal system call invocations do not cause a VM exit). Furthermore, a Dune process in guest ring 0 can run untrusted code in guest ring 3, and intercept any unwanted behavior, such as unauthorized systems calls. Without getting into more details, what is important is that Dune effectively enables kernel bypass, and sets the stage future work such as Shinjuku.