LXDs: Towards Isolation of Kernel Subsystems
Talkat USENIX ATC '19 · on Wednesday, 2019-07-10· at 16:50· USENIX ATC Track II: Grand Ballroom VII–IX·
summary
A framework called lightweight execution domains isolates legacy kernel subsystems by auto-generating glue from a new IDL and projections, running isolated code on separate cores with an asynchronous IPC and a lightweight async runtime. Cross-core RPC costs about 380 cycles and per-packet isolation adds ~710 cycles; a dummy network driver reaches 76% of native single‑thread throughput and ~70% with many threads, while an Intel 82599 10GbE driver is within 6–13% of native bandwidth; design works but requires extra cores and manual IDL for complex drivers.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:06Why are kernels vulnerable
- 4:04Challenges
- 6:26Ideal
- 8:35Asynchronous
- 9:41Asynchronous Runtime
- 10:54Device Drivers
- 12:56Hardware Drivers
- 14:15Limitations
related talks
21mHarmonizing Performance and Isolation in Microkernels with Efficient Intra-kernel
50mMultikernel Architecture: Kernel-to-Kernel Isolation and Resource Management
20mLimitations and Opportunities of Modern Hardware Isolation Mechanisms
18mLITESHIELD: Secure Containers via Lightweight, Composable Userspace μKernel...
39mCPU isolation vs jailbreaking IPIs
16mXkernel: Principled Performance Tunability of Operating System Kernels
29mIsolation without Containers
44mReal-Time Linux on Embedded Multicore Processors