  Quest-V is a system we have been developing from the ground up, with
objectives focusing on safety, predictability and efficiency. It is designed to
work on emerging multicore processors with hardware virtualization support.
Quest-V is implemented as a "distributed system on a chip" and comprises
multiple sandbox kernels. Sandbox kernels are isolated from one another in
separate regions of physical memory, having access to a subset of processing
cores and I/O devices. This partitioning prevents system failures in one
sandbox affecting the operation of other sandboxes. Shared memory channels
managed by system monitors enable inter-sandbox communication.
  The distributed nature of Quest-V means each sandbox has a separate physical
clock, with all event timings being managed by per-core local timers. Each
sandbox is responsible for its own scheduling and I/O management, without
requiring intervention of a hypervisor.
  In this paper, we formulate bounds on inter-sandbox communication in the
absence of a global scheduler or global system clock. We also describe how
address space migration between sandboxes can be guaranteed without violating
service constraints. Experimental results on a working system show the
conditions under which Quest-V performs real-time communication and migration.
