VirtuOS

Abstract

Most operating systems provide protection and isolation to user processes, but not to critical system components such as device drivers or other system code. Consequently, failures in these components often lead to system failures. VirtuOS is an operating system that exploits a new method of decomposition to protect against such failures. VirtuOS exploits virtualization to isolate and protect vertical slices of existing OS kernels in separate service domains. Each service domain represents a partition of an existing kernel, which implements a subset of that kernel's functionality. Unlike competing solutions that merely isolate device drivers, or cannot protect from malicious and vulnerable code, VirtuOS provides full protection of isolated system components. VirtuOS's user library dispatches system calls directly to service domains using an exceptionless system call model, avoiding the cost of a system call trap in many cases. We have implemented a prototype based on the Linux kernel and Xen hypervisor. We demonstrate the viability of our approach by creating and evaluating a network and a storage service domain. Our prototype can survive the failure of individual service domains while outperforming alternative approaches such as isolated driver domains and even exceeding the performance of native Linux for some multithreaded workloads. Thus, Vir-tuOS may provide a suitable basis for kernel decomposition while retaining compatibility with existing applications and good performance.

FlexOS

“…VM-based Backend. Many works use virtualization to support isolation within a kernel [33,40,41,56]. VM-based isolation provides strong security guarantees and is widely supported, at the cost of higher overhead.…”

Dancing with Giants: Wimpy Kernels for On-Demand Isolated I/O

“…Device Virtualization and Passthrough. During the past decade, advances in device virtualization have decreased the trusted code base for isolated I/O channels, gradually evolving from the monolithic hypervisors/VMMs to hypervisors with privileged device management domains [11], then to hypervisors with disengaged privileged domains [18], and finally to hypervisors with isolated driver domains [22,51]. However, applications in their guest domains still communicate with virtualized devices via the untrusted guest OS on which they run, which still implies that a huge code base has to be trusted for on-demand, isolated I/O.…”

“…Several approaches [12,23,42,43,51,63,68] exist to isolate device drivers from the OS kernel, and/or move them to user-space, primarily for the purpose of improving driver reliability and fault isolation. Swift et al propose using hardware memory protection domains to isolate the drivers of a monolithic kernel [63].…”

Localización y seguimiento de servicios replicados en un sistema de virtualización distribuido

“…Un DVS ofrece entornos de ejecución virtuales distribuidos en los cuales se permite ejecutar múltiples instancias aisladas de Sistemas Operativos Virtuales (VOS) [2]. Un VOS ofrece abstracciones y servicios a las aplicaciones de usuario, pero no gestiona hardware físico, sino dispositivos virtuales proporcionados por un Sistema Operativo (OS) real.…”