In many instances of virtual machine deployments today, virtual machine
instances are created to support a single application. Traditional operating systems provide an extensive framework for protecting one process from
another. In such deployments, this protection layer becomes an additional
source of overhead as isolation between services is provided at an operating
system level and each instance of an operating system supports only one
service. This makes the operating system the equivalent of a process from
the traditional operating system perspective. Isolation between these operating systems and indirectly the services they support, is ensured by the
virtual machine monitor in these deployments. In these scenarios the process protection provided by the operating system becomes redundant and a
source of additional overhead. We propose a new model for these scenarios
with operating systems that bypass this redundant protection offered by the
traditional operating systems. We prototyped such an operating system by
executing parts of the operating system in the same protection ring as user
applications. This gives processes more power and access to kernel memory
bypassing the need to copy data from user to kernel and vice versa as is
required when the traditional ring protection layer is enforced. This allows
us to save the system call trap overhead and allows application program
mers to directly call kernel functions exposing the rich kernel library. This
does not compromise security on the other virtual machines running on the
same physical machine, as they are protected by the VMM. We illustrate
the design and implementation of such a system with the Xen hypervisor
and the XenoLinux kernel.
| Identifer | oai:union.ndltd.org:LACETR/oai:collectionscanada.gc.ca:BVAU./2858 |
| Date | 11 1900 |
| Creators | George, Sharath |
| Publisher | University of British Columbia |
| Source Sets | Library and Archives Canada ETDs Repository / Centre d'archives des thèses électroniques de Bibliothèque et Archives Canada |
| Language | English |
| Detected Language | English |
| Type | Electronic Thesis or Dissertation |
| Format | 728415 bytes, application/pdf |
Page generated in 0.0019 seconds