This paper presents svc-hook, a system call hook mechanism for the ARM64 CPU architecture. To apply system call hooks to a program, svc-hook performs binary rewriting, and specifically, it replaces svc that is a CPU instruction invoking a system call.

This paper explores Exit-Less, Isolated, and Shared Access (ELISA), a novel in-memory object sharing scheme for Virtual Machines (VMs). ELISA has the isolation advantage over the shared memory directly exposed to guest VMs while its overhead is smaller than that of host-interposition relying on the costly exit from the VM context. In a nutshell, ELISA isolates shared in-memory objects by Extended Page Table (EPT) separation, and a guest VM accesses them by switching the EPT context using VMFUNC, a low-overhead CPU instruction of Intel CPUs. Our experiment shows that the overhead of ELISA is 3.5 times smaller than that of VMCALL-oriented host-interposition. We demonstrate the benefits of ELISA through two use cases; by replacing VMCALL with ELISA, a VM networking system and an in-memory key-value store exhibit 163% and 64% higher performance respectively.

Container engines with operating-system virtualization have been widely used and now offer extensions to replace core functionalities that are derived from the host kernel. Because such extensions with an alternate kernel, which is often implemented in a library operating system (libOS), can be designed to have free choice, developers are tempted to take a clean-slate approach, i.e., implement the kernels from scratch. However, this design decision makes it difficult to cover broad features of the original Linux kernel, and some application programs may not work on such kernels. Precise emulation of the huge codebase and rich feature set of the Linux kernel is not easily possible. In this paper, we have tried to improve the level of compatibility in a libOS by using the source code of the Linux kernel as the container kernel. We present µKontainer, an alternate container kernel based on a libOS by extending the existing open-source software, Linux Kernel Library, while preserving the lightweight property of conventional containers. We have studied the level of compatibility with the conformance tests of network protocol implementation of nine different libOSs, and µKontainer performs identically like the Linux kernel. The network-related benchmark shows mostly comparable results with a conventional container and a native Linux host; in the best case, the goodput of the short-sized packet is up to 84% faster than that of a native Linux host. This paper sheds light on the design space of the libOS when we introduced the extended container kernel.

This paper proposes a novel approach for fast container networking that enables applications in containers to utilize host network stacks directly with proper access control. Our approach, called socket-grafting, offers a new socket-layer communication channel by grafting sockets in containers onto sockets in host network stacks. In contrast to recent approaches that make network stacks faster by using high-speed packet I/O techniques, socket-grafting makes container networking faster by bypassing a container's network stack and virtual interfaces. As a concrete implementation of socket-grafting, we designed AF_GRAFT, which is a new address family for the socket layer. AF_GRAFT performs interconnection between the two socket layers in the container and host network stacks. In this paper, we describe socket-grafting, AF_GRAFT design, and its implementation on Linux. Our evaluation results demonstrate that the proposed method doubled throughput and reduced latency by 23% compared with traditional NAT-based container networking, and improved the network performance of containerized HTTP servers and message queues.

We propose to demonstrate Direct Code Execution (DCE), a framework that enables to execute nearly unmodified applications and Linux Kernel code jointly with the ns-3 simulator. DCE allows therefore fully deterministic reproducibility of network experiments. DCE also supports larger scale scenarios than real-time emulators by using simulation time dilatation. In this demonstration, we will showcase two main scenarios: (1) a basic example describing how to integrate in DCE the Data Center TCP (DCTCP) Linux kernel patch, and then how to customize this protocol and run it on different scenarios; (2) a more advanced use case demonstrating how to benefit from DCE to build a rich and realistic evaluation environment for Software Defined Wireless Networks based on Open vSwitch and the NOX SDN controller.

We describe the first capability, to our knowledge, to execute nearly unmodified applications and Linux kernel code in the context of a widely-used open source discrete event networking simulator (ns-3). We propose Direct Code Execution (DCE), a framework that dramatically increases the number of available protocol models and realism available for ns-3 simulations. DCE meets the goals recently proposed for fully reproducible networking research and runnable papers, with the added benefits of 1) the ability of completely deterministic reproducibility, 2) the scalability that simulation time dilation offers, 3) capabilities supporting automated code coverage analysis, and 4) improved debuggability via execution within a single address space. In this paper, we describe in detail DCE, report on packet processing benchmarks and showcase key features of the framework with different use cases. We reproduce a previously published Multipath TCP (MPTCP) experiment and highlight how code coverage testing can be automated by showing results achieving 55-86% coverage of the MPTCP implementation. Then we demonstrate how network stack debugging can be easily performed and reproduced across a distributed system. Our first benchmarks are promising and we believe this framework can benefit the network community by enabling realistic, reproducible experiments and runnable papers.

We propose the Floating Ground Architecture (FGA) for network mobility and ad hoc network convergence. Various factors, including excessive dependence on intelligence in the fixed network, result in the Internet having a de facto logical boundary one hop from the fixed network. To reduce these dependencies, FGA introduces a new logical layer, called Floating Ground, between the fixed network infrastructure and the mobile network, aiming to bridge these different types of network systems. Thanks to the effect of this buffer layer, the architecture: 1) optimizes routes in a deeply nested mobile router arrangement, 2) simplifies mobility event handling under frequent movement of the nodes, and 3) transparently introduces additional functionality with no additional intelligence on the infrastructure side. Through evaluation of our proposed architecture using an actual software implementation running via Direct Code Execution simulation, optimized routes are confirmed with three possible mobility scenarios, demonstrating the handoff duration is dramatically reduced in the short-distance movement scenario, which happens in 78.4%, at maximum, of the handoff events under actual taxi cabs movement in real world. Qualitative analysis of FGA shows it minimizes modification of the network components and existing standardized protocols, and is therefore more suitable for self-organized, distributed network extension than competitive approaches.