Jitk: A trustworthy in-kernel interpreter infrastructure

Proceedings of the 11th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2014

Volumn , Issue , 2014, Pages 33-47

  Wang, Xi ^a   Lazar, David ^a   Zeldovich, Nickolai ^a   Chlipala, Adam ^a   Tatlock, Zachary ^a  

^a MASSACHUSETTS INSTITUTE OF TECHNOLOGY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

HIGH LEVEL LANGUAGES; PROGRAM DEBUGGING; SPACE APPLICATIONS; SYSTEMS ANALYSIS;

APPLICATION DEVELOPERS; FUNCTIONAL CORRECTNESS; HIGH-LEVEL RULES; LINES OF CODE; LINUX KERNEL; MACHINE CODES; SYSTEM CALLS; SYSTEM SECURITY;

LINUX;

EID: 84957951159     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (59)

1. B. N. Bershad, S. Savage, P. Pardyak, E. G. Sirer, M. Fiuczynski, D. Becker, S. Eggers, and C. Chambers. Extensibility, safety and performance in the SPIN operating system. In Proceedings of the 15th ACM Symposium on Operating Systems Principles (SOSP), pages 267-284, Copper Mountain, CO, Dec. 1995.
2. Bitcoin. Script, 2014. https://en.bitcoin.it/wiki/Script.
3. D. Borkmann. net: sched: cls_bpf: add BPF-based classifier, Oct. 2013. http://patchwork.ozlabs.org/patch/286589/.
4. D. Borkmann. net: filter: seccomp: fix wrong decoding of BPF_S_ANC_SECCOMP_LD_W, Apr. 2014. http://patchwork.ozlabs.org/patch/339039/.
5. C. Cadar, V. Ganesh, P. M. Pawlowski, D. L. Dill, and D. R. Engler. EXE: Automatically generating inputs of death. In Proceedings of the 13th ACM Conference on Computer and Communications Security (CCS), pages 322-335, Alexandria, VA, Oct.-Nov. 2006.
6. C. Cadar, D. Dunbar, and D. Engler. KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs. In Proceedings of the 8th Symposium on Operating Systems Design and Implementation (OSDI), pages 209-224, San Diego, CA, Dec. 2008.
7. B. M. Cantrill, M. W. Shapiro, and A. H. Leventhal. Dynamic instrumentation of production systems. In Proceedings of the 2004 USENIX Annual Technical Conference, pages 15-28, Boston, MA, June-July 2004.
8. Q. Carbonneaux, J. Hoffmann, T. Ramananandro, and Z. Shao. End-to-end verification of stack-space bounds for C programs. In Proceedings of the 2014 ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI), pages 270-281, Edinburgh, UK, June 2014.
9. M. Castro, M. Costa, J. P. Martin, M. Peinado, P. Akritidis, A. Donnelly, P. Barham, and R. Black. Fast byte-granularity software fault isolation. In Proceedings of the 22nd ACM Symposium on Operating Systems Principles (SOSP), pages 45-58, Big Sky, MT, Oct. 2009.
10. H. Chen, C. Cutler, T. Kim, Y. Mao, X. Wang, N. Zeldovich, and M. F. Kaashoek. Security bugs in embedded interpreters. In Proceedings of the 4th Asia-Pacific Workshop on Systems, Singapore, July 2013.
11. D. Chisnall. LLVM in the FreeBSD toolchain. In Proceedings of AsiaBSDCon, pages 13-20, Tokyo, Japan, Mar. 2014.
12. A. Chlipala. Mostly-automated verification of low-level programs in computational separation logic. In Proceedings of the 2011 ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI), pages 234-245, San Jose, CA, June 2011.
13. A. Chlipala. The Bedrock structured programming system: Combining generative metaprogramming and Hoare logic in an extensible program verifier. In Proceedings of the 18th ACM SIGPLAN International Conference on Functional Programming (ICFP), pages 391-402, Boston, MA, Sept. 2013.
14. A. Chlipala. Certified Programming with Dependent Types. MIT Press, Nov. 2013.
15. J. Corbet. A JIT for packet filters, Apr. 2011. https://lwn.net/Articles/437981/.
16. J. Corbet. BPF tracing filters, Dec. 2013. https://lwn.net/Articles/575531/.
17. J. Criswell, A. Lenharth, D. Dhurjati, and V. Adve. Secure Virtual Architecture: A safe execution environment for commodity operating systems. In Proceedings of the 21st ACM Symposium on Operating Systems Principles (SOSP), pages 351-366, Stevenson, WA, Oct. 2007.
18. F. M. David, E. M. Chan, J. C. Carlyle, and R. H. Campbell. CuriOS: Improving reliability through operating system structure. In Proceedings of the 8th Symposium on Operating Systems Design and Implementation (OSDI), pages 59-72, San Diego, CA, Dec. 2008.
19. der Mouse. NetBSD PR #3366: bpf doesn't check its filter enough, Mar. 1997. http://gnats.netbsd.org/3366.
20. W. Drewry. SECure COMPuting with filters, Jan. 2012. http://lwn.net/Articles/498231/.
21. E. Dumazet. bpf: do not use reciprocal divide, Jan. 2014. http://patchwork.ozlabs.org/patch/311163/.
22. J. Edge. A library for seccomp filters, Apr. 2012. http://lwn.net/Articles/494252/.
23. K. Elphinstone and G. Heiser. From L3 to seL4: What have we learnt in 20 years of L4 microkernels? In Proceedings of the 24th ACM Symposium on Operating Systems Principles (SOSP), pages 133-150, Farmington, PA, Nov. 2013.
24. D. R. Engler, M. F. Kaashoek, and J. W. O'Toole. Exokernel: An operating system architecture for application-level resource management. In Proceedings of the 15th ACM Symposium on Operating Systems Principles (SOSP), pages 251-266, Copper Mountain, CO, Dec. 1995.
25. U. Erlingsson, M. Abadi, M. Vrable, M. Budiu, and G. C. Necula. XFI: Software guards for system address spaces. In Proceedings of the 7th Symposium on Operating Systems Design and Implementation (OSDI), pages 75-88, Seattle, WA, Nov. 2006.
26. G. Harris. Issue #38: Another optimization bug, Dec. 2003. https://github.com/thetcpdump-group/libpcap/issues/38.
27. G. Harris. NetBSD PR #32198: bpf_validate() needs to do more checks, Nov. 2005. http://gnats.netbsd.org/32198.
28. G. Harris. NetBSD PR #37663: bpf_validate rejects valid programs that use the multiply instruction, Jan. 2008. http://gnats.netbsd.org/37663.
29. G. Harris. NetBSD PR #43185: bpf_validate() uses BPF_RVAL() when it should use BPF_SRC(), Apr. 2010. http://gnats.netbsd.org/43185.
30. G. Harris. NetBSD PR #45412: bpf_filter() can leak kernel stack contents, July 2011. http://gnats.netbsd.org/45412.
31. J. N. Herder, H. Bos, B. Gras, P. Homburg, and A. Tanenbaum. Fault isolation for device drivers. In Proceedings of the 2009 IEEE Dependable Systems and Networks Conference, pages 33-42, Lisbon, Portugal, June-July 2009.
32. Hewlett-Packard, Intel, Microsoft, Phoenix, and Toshiba. Advanced configuration and power interface specification, Dec. 2011. http://www.acpi.info/DOWNLOADS/ACPIspec50.pdf.
33. G. C. Hunt, J. R. Larus, M. Abadi, M. Aiken, P. Barham, M. Fahndrich, C. Hawblitzel, O. Hod-son, S. Levi, N. Murphy, B. Steensgaard, D. Tarditi, T. Wobber, and B. Zill. An overview of the Singularity project. Technical Report MSR-TR-2005-135, Microsoft, Redmond, WA, Oct. 2005.
34. M. F. Kaashoek, D. R. Engler, G. R. Ganger, H. M. Briceño, R. Hunt, D. Mazières, T. Pinckney, R. Grimm, J. Jannotti, and K. Mackenzie. Application performance and flexibility on exokernel systems. In Proceedings of the 16th ACM Symposium on Operating Systems Principles (SOSP), pages 52-65, Saint-Malo, France, Oct. 1997.
35. B. Keats. TCPDUMP 3.9.4 under Fedora Core 5 seems to generate the wrong BPF for DLT_PRISM_HEADER, Aug. 2006. http://seclists.org/tcpdump/2006/q3/37.
36. M. Kerrisk. LCA: The Trinity fuzz tester, Feb. 2013. https://lwn.net/Articles/536173/.
37. J.-U. Kim. Add experimental BPF Just-In-Time compiler for amd64 and i386, Dec. 2005. http://docs.freebsd.org/cgi/mid.cgi?200512060258.jB62wCnk084452.
38. G. Klein, K. Elphinstone, G. Heiser, J. Andronick, D. Cock, P. Derrin, D. Elkaduwe, K. Engelhardt, M. Norrish, R. Kolanski, T. Sewell, H. Tuch, and S. Winwood. seL4: Formal verification of an OS kernel. In Proceedings of the 22nd ACM Symposium on Operating Systems Principles (SOSP), pages 207-220, Big Sky, MT, Oct. 2009.
39. M. Koetter. Linux 3.0 bpf jit x86_64 exploit, Dec. 2011. http://carnivore.it/2011/12/27/linux_3.0_bpf_jit_x86_64_exploit.
40. A. Kuznetosv. SS utility: Quick intro, Sept. 2001. http://www.cyberciti.biz/files/ss.html.
41. D. Leinenbach and T. Santen. Verifying the Microsoft Hyper-V hypervisor with VCC. In Proceedings of 16th International Symposium on Formal Methods, pages 806-809, Eindhoven, the Netherlands, Nov. 2009.
42. X. Leroy. Formal verification of a realistic compiler. Communications of the ACM, 52(7):107-115, July 2009.
43. X. Leroy. A formally verified compiler back-end. Journal of Automated Reasoning, 43(4):363-446, Dec. 2009.
44. Z. Li, S. Lu, S. Myagmar, and Y. Zhou. CP-Miner: A tool for finding copy-paste and related bugs in operating system code. In Proceedings of the 6th Symposium on Operating Systems Design and Implementation (OSDI), pages 289-302, San Francisco, CA, Dec. 2004.
45. A. Madhavapeddy, R. Mortier, C. Rotsos, D. Scott, B. Singh, T. Gazagnaire, S. Smith, S. Hand, and J. Crowcroft. Unikernels: Library operating systems for the cloud. In Proceedings of the 18th International Conference on Architectural Support for Programming Languages and Operating Systems (ASP-LOS), pages 461-472, Houston, TX, Mar. 2013.
46. Y. Mao, H. Chen, D. Zhou, X. Wang, N. Zeldovich, and M. F. Kaashoek. Software fault isolation with API integrity and multi-principal modules. In Proceedings of the 23rd ACM Symposium on Operating Systems Principles (SOSP), pages 115-128, Cascais, Portugal, Oct. 2011.
47. K. McAllister. Attacking hardened Linux systems with kernel JIT spraying, Nov. 2012. http://mainisusuallyafunction.blogspot.com/2012/11/attacking-hardened-linuxsystems-with.html.
48. S. McCanne and V. Jacobson. The BSD packet filter: A new architecture for user-level packet capture. In Proceedings of the Winter 1993 USENIX Technical Conference, pages 259-270, San Diego, CA, Jan. 1993.
49. M. McCoyd, R. Krug, D. Goel, M. Dahlin, and W. Young. Building a hypervisor on a formally verified protection layer. In Proceedings of the Hawaii International Conference on System Sciences, pages 5069-5078, Maui, HI, Jan. 2013.
50. M. O. Myreen. Verified just-in-time compiler on x86. In Proceedings of the 37th ACM Symposium on Principles of Programming Languages (POPL), pages 107-118, Madrid, Spain, Jan. 2011.
51. A. Nasonov. NetBSD PR #45751: No overflow check in BPF_LD|BPF_ABS, Dec. 2011. http://gnats.netbsd.org/45751.
52. G. C. Necula and P. Lee. Safe kernel extensions without run-time checking. In Proceedings of the 2nd Symposium on Operating Systems Design and Implementation (OSDI), pages 229-243, Seattle, WA, Oct. 1996.
53. M. I. Seltzer, Y. Endo, C. Small, and K. A. Smith. Dealing with disaster: Surviving misbehaved kernel extensions. In Proceedings of the 2nd Symposium on Operating Systems Design and Implementation (OSDI), pages 213-227, Seattle, WA, Oct. 1996.
54. T. Sewell, M. Myreen, and G. Klein. Translation validation for a verified OS kernel. In Proceedings of the 2013 ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI), pages 471-482, Seattle, WA, June 2013.
55. J. S. Shapiro, J. M. Smith, and D. J. Farber. EROS: a fast capability system. In Proceedings of the 17th ACM Symposium on Operating Systems Principles (SOSP), pages 170-185, Kiawah Island, SC, Dec. 1999.
56. A. Starovoitov. net: filter: initialize A and X registers, Apr. 2014. http://patchwork.ozlabs.org/patch/341693/.
57. F. Tuong. Bug 2570 - in extraction optimization, a eta-reduction leads to a not generalizable'_a, July 2011. https://coq.inria.fr/bugs/show_bug.cgi?id=2570.
58. R. Wahbe, S. Lucco, T. E. Anderson, and S. L. Graham. Efficient software-based fault isolation. In Proceedings of the 14th ACM Symposium on Operating Systems Principles (SOSP), pages 203-216, Asheville, NC, Dec. 1993.
59. R. Zumkeller. Bug 843 - extraction breaks module typing, Aug. 2004. https://coq.inria.fr/bugs/show_bug.cgi?id=843.