CRI: CRD: A Compiler-Based Virtual Machine Infrastructure for System Software

建议#：CNS07-09122PI(S)：Adve，Vikram S.机构：伊利诺伊大学厄巴纳-香槟分校，IL 61820-7406标题：CRD：一个基于编译器的系统软件基础设施项目建议：这个项目，为系统软件构建和分发一个基于编译器的虚拟监控机，结合了虚拟化和编译器技术。该基础设施支持高级应用程序和低级系统代码的安全性和可验证性，并包括基于编译器的虚拟机(LIVA)，它可以托管整个OS及其所有应用程序、Linux内核(移植到LIVA架构)以及用于编译和使用LIVA代码的开发工具。在SAFECode内部项目中开发的技术的基础上，该虚拟机将为应用程序甚至为遗留系统加强安全的执行环境。基础设施的灵活性允许单独使用各个组件，并将其集成到其他系统中。重要组件包括LIVA指令集、实现内核支持函数的运行时库、编译器模块、开发工具、用于管理JIT编译和缓存的即时(JIT)引擎，以及用于加强C程序和内核的内存安全的SAFECode编译器。该基础设施还包括预先打包的课程项目示例，供教师使用。从原型开始，主要的开发包括修改编译器和JIT引擎，使其能够在没有系统服务的情况下运行，将组件组装成一个完整的可用系统，提高健壮性和性能，并添加文档、自动配置、自动测试、错误跟踪和预打包课程项目等可用性功能。该基础设施旨在实现入侵检测和防御、跨程序信息流、编译认证和系统软件正式验证的方法。广泛影响：这项工作使研究小组能够进行极其困难的研究，提供新的解决方案，以解决内部威胁、构建可扩展的安全系统、信息来源以及安全和隐私等难题。此外，除了帮助培训该领域的学生外，基础设施还有助于开发新的和/或更雄心勃勃的课程项目和操作系统、编译器、体系结构、嵌入式和分布式系统方面的教育主题

Proposal #: CNS 07-09122PI(s): Adve, Vikram S.Institution: University of Illinois - Urbana-Champaign Champaign, IL 61820-7406Title: CRD:A Compiler-Based Virtual Machine Infrastructure for System Software Project Proposed:This project, building and distributing a compiler-based virtual monitor machine (VMM) for system software, combines virtualization and compiler techniques. This infrastructure supports safety and verifiability for both high-level applications and low-level system code and includes a compiler-based virtual machine (LLVA) that can host an entire OS and all its applications, the Linux kernel (ported to the LLVA architecture), and development tools to compile and work with LLVA code. Building on techniques developed in the SAFECode in-house project, this virtual machine will enforce a safe execution environment for applications and even for legacy systems. The flexibility of the infrastructure permits individual components to be used separately and to be integrated into other systems. Important components include the LLVA instruction set, a run-time library implementing the kernel support functions, compiler modules, development tools, a Just-in-Time (JIT) engine for managing JIT compilation and caching, and the SAFECode compiler for enforcing memory safety for C programs and the kernel. The infrastructure also includes examples of course projects pre-packaged for instructor to use. Beginning with the prototype, major developments consist of modifying the compiler and JIT engine to be able to run without system services, assembling the components into a complete usable system, improving the robustness and performance, and adding usability features such as documentation, auto-configuration, automatic testing, bug tracking, and pre-packaged course projects. The infrastructure aims to enable approaches to intrusion detection and prevention, cross-program information flow, compilation certification, and formal verification of system software.Broader Impacts: This work enables research groups to undertake prohibitively difficult research providing new solutions that tackle hard problems such as insider threats, building scalable secure systems, information provenance, and security and privacy. Moreover, in addition to contributing to train students in the area, the infrastructure facilitates development of new and/or more ambitious course projects and education topics in OS, compiler, architecture, embedded and distributed systems