CNS Core: Medium: Rethinking Architecture and Operating Systems for Modern Virtualization Technologies

该项目解决了现代虚拟化技术（包括容器和功能即服务环境）的广泛部署所带来的重要挑战。容器是开销非常低的虚拟机，而功能即服务环境是用户运行许多小作业的系统，并以此为收费标准。在这些环境中，两个主要挑战是由于缺乏隔离而导致的不安全性，以及由于正在运行的许多作业而导致的较差的可伸缩性。该项目重新考虑了计算机体系结构和机器的操作系统，以安全、可扩展地支持这些环境。这项工作开发了一套新颖的、变革性的计算机体系结构和操作系统技术，这些技术将极大地提高新型虚拟化技术的安全性和可扩展性。在安全方面，该项目将探索新的硬件和软件设计，以有效地过滤系统调用。其思想是检查程序在运行时发出的每个系统调用，并检查和验证其参数的安全性。在可伸缩性方面，通过重新设计tlb （Translation Lookaside Buffers）和页表，该项目将支持在同一台机器上同时运行数千个容器或函数。总的来说，这些技术将增强云计算。该项目将在伊利诺伊大学开展多学科研究和教育工作，以支持现代云虚拟化技术的全系统支持。该项目的努力包括与计算机科学系合作，在云计算和数据中心技术的一般领域开设多学科课程，以扩大课程设置。该项目还将为本科生提供研究机会，并扩大少数族裔的参与。该项目将包括指导初中和高中机器人团队。该项目将维护一个存储库，其中包含在项目期间使用和开发的所有数据、代码、结果、模拟器和模拟器。该存储库无需密码即可通过http://iacoma.cs.uiuc.edu访问，并在项目结束后至少三年内保持最新状态。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

This project addresses important challenges posed by the widespread deployment of modern virtualization technologies, including containers and function-as-a-service environments. Containers are very low-overhead virtual machines, and function-as-a-service environments are systems where users run many small jobs, and are billed as such. In these environments, two major challenges are insecurity due to the lack of isolation, and poor scalability due to the many jobs that are running. This project rethinks the computer architecture and the operating system of machines to support these environments securely and scalably.This work develops a set of novel, transformative computer architecture and operating system technologies that will dramatically improve the security and the scalability of novel virtualization technologies. On the security side, this project will explore novel hardware and software designs to filter system calls efficiently. The idea is to examine every system call that programs issue at runtime and check and validate their arguments for security. On the scalability side, this project will enable the ability to run thousands of containers or functions on the same machine simultaneously, by redesigning TLBs (Translation Lookaside Buffers) and page tables. Overall, these technologies will enhance cloud computing. This project will initiate an effort on multidisciplinary research and education on whole-system support for modern virtualization technologies in cloud at the University of Illinois. The efforts in this project include working with the Department of Computer Science to broaden the course offerings with multidisciplinary courses in the general area of cloud computing and datacenter technologies. This project will also offer research opportunities to undergraduate students, and broaden participation to under-represented minorities. The project will include an effort of coaching middle and high school robotics teams. This project will maintain a repository with all the data, code, results, emulators and simulators used and developed during the duration of the project. The repository will be accessible password-free through http://iacoma.cs.uiuc.edu, and will be kept up to date for at least three years after the project ends.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.