TWC: TTP Option: Small: A Linux ARM Hypervisor for System Security

移动设备和嵌入式系统在我们的社会中已经无处不在。这种系统使用ARM处理器，与大型计算设备中使用的传统x86处理器有很大不同。随着设备变得越来越小，对虚拟化的需求也在不断增长，虚拟化提供了诸如能源效率和在多种操作模式下使用设备的能力等好处。虚拟化在系统安全上下文中尤其重要，因为许多安全机制都利用虚拟化作为核心技术来进行故障控制和隔离、入侵检测、恶意软件分析以及软件漏洞的检测、诊断和修复。为了解决ARM虚拟化的挑战，本项目设计、实现和部署KVM/ARM，一个Linux操作系统上的开源ARM管理程序。由于传统的x86架构与ARM有很大的不同，过去在x86硬件支持虚拟化方面的工作不能转移到ARM上。此外，ARM处理器差异很大，因为ARM技术的每个许可方都可以调整和更改系统软件以满足他们的需求。成功地创建一个可适应各种ARM实现的ARM管理程序，为将安全性集成到硬件本身提供了丰富的机会。将这项研究应用到主流Linux代码中，可以确保在支持系统安全性研究的基础上广泛使用该功能。

Mobile devices and embedded systems have become ubiquitous in our society. Such systems use ARM processors, which differ greatly from the traditional x86 processors found in larger computing devices. As devices become smaller, there is a growing demand for virtualization, which provides benefits such as energy efficiency and the ability to use the device in multiple operational modes. Virtualization is especially important in the context of system security as many security mechanisms leverage virtualization as a core technology for fault containment and isolation, intrusion detection, malware analysis, and the detection, diagnosis, and remediation of software vulnerabilities. To address the challenges of ARM virtualization, this project designs, implements, and deploys KVM/ARM, an open-source ARM hypervisor in the Linux operating system. Since the traditional x86 architecture is vastly different from ARM, past work on x86 hardware support for virtualization cannot be carried over to ARM. In addition, ARM processors vary greatly since each licensee of the ARM technology adapts and changes the systems software to meet their needs. Successfully creating an ARM hypervisor that is adaptable across a range of ARM implementations offers rich opportunities for incorporating security into the hardware itself. Adopting this research into mainline Linux code ensures that capability is broadly available on a supported foundation for system security research.