Thin Hypervisor-Based Security Architectures for Embedded Platforms Heradon Douglas The Royal Institute of Technology, Stockholm, Sweden Advisor: Christian Gehrmann Swedish Institute of Computer Science, Stockholm, Sweden February 26, 2010 To my wife, Guiniwere, who is everything to me. Till min hustru, Guiniwere, som är allt för mig. I would also like to thank my advisor, Christian Gehrmann, for his support, guidance and collaboration; Louise Yngström, Alan Davidson, Stewart Kowalski and my other teachers and colleagues at DSV for their generosity and tutelage; and my friends and family for their love. ABSTRACT Virtualization has grown increasingly popular, thanks to its benefits of isolation, management, and utilization, supported by hardware advances. It is also re- ceiving attention for its potential to support security, through hypervisor-based services and advanced protections supplied to guests. Today, virtualization is even making inroads in the embedded space, and embedded systems, with their security needs, have already started to benefit from virtualization’s security po- tential. In this thesis, we investigate the possibilities for thin hypervisor-based security on embedded platforms. In addition to significant background study, we present implementation of a low-footprint, thin hypervisor capable of provd- ing security protections to a single FreeRTOS guest kernel on ARM. Backed by performance test results, our hypervisor provides security to a formerly unse- cured kernel with minimal performance overhead, and represents a first step in a greater research effort into the security advantages and possibilities of embed- ded thin hypervisors. Our results show that thin hypervisors are both possible and beneficial even on limited embedded systems, and sets the stage for more advanced investigations, implementations, and security applications in the fu- ture. CONTENTS List of Tables . viii List of Figures . ix Abbreviations . x 1. Introduction ................................. 1 1.1 Security and Virtualization on Embedded Systems . 1 1.2 Thesis Organization . 2 1.3 Problem Definition . 2 1.3.1 Impetus . 2 1.3.2 Originality . 2 1.3.3 Feasibility . 3 1.4 Purpose and Goals . 3 1.5 Method . 3 2. Virtualization Technologies ........................ 5 2.1 What is virtualization? . 5 2.2 Virtualization Basics . 6 2.2.1 Interfaces . 6 2.2.2 Types of virtualization . 8 2.2.3 Non-standard systems . 12 2.3 Hypervisors . 12 2.3.1 Traditional hypervisors . 12 2.3.2 Hosted hypervisors . 13 2.3.3 Microkernels . 14 2.3.4 Thin hypervisors . 14 2.4 Advantages of System Virtualization . 15 2.4.1 Isolation . 15 2.4.2 Minimized trusted computing base . 16 2.4.3 Architectural flexibility . 16 2.4.4 Simplified development . 16 2.4.5 Management . 17 2.4.6 Security . 17 2.5 Hardware Support for Virtualization . 18 2.5.1 Basic virtualization requirements . 19 2.5.2 Challenges in x86 architecture . 19 2.5.3 Intel VT . 20 2.5.4 AMD-V . 24 2.5.5 ARM TrustZone . 25 2.6 Typical Virtualization Scenarios . 27 2.6.1 Hosting center . 27 2.6.2 Desktop . 28 Contents vi 2.6.3 Service provider . 28 2.6.4 Mobile/embedded . 28 2.7 Hypervisor-based security architectures . 29 2.7.1 Advantages . 29 2.7.2 Virtualization security challenges . 29 2.7.3 Architectural limitations . 31 2.7.4 Architectural patterns . 33 2.7.5 Isolation-based services . 34 2.7.6 Monitoring-based services . 39 2.7.7 Alternatives . 41 2.8 Summary . 41 3. Multicore and Embedded Systems .................... 42 3.1 Embedded systems . 42 3.1.1 Traditional characteristics . 42 3.1.2 Emerging trends . 42 3.2 Virtualization and embedded systems . 43 3.2.1 Existing platforms . 43 3.2.2 Companies . 43 3.2.3 Applications . 44 3.3 Multicore systems . 46 3.3.1 Why multicore? . 46 3.3.2 Hardware considerations . 47 3.3.3 Software considerations . 49 3.3.4 Interesting multicore architectures . 51 3.4 Multicore and virtualization . 52 3.4.1 Multicore virtualization architectures . 53 3.5 Embedded multicore systems . 54 3.5.1 Virtualization and embedded multicore . 54 3.6 Summary . 55 4. Thin Hypervisors on ARM Architecture ................. 56 4.1 ARMv5 Architecture . 57 4.1.1 Operating modes . 57 4.1.2 Exceptions and exception handlers . 57 4.1.3 Registers . 58 4.1.4 MMU . 59 4.1.5 Key differences with ARM TrustZone processors . 62 4.2 The FreeRTOS Kernel . 63 4.3 Thin Hypervisor Approach . 64 4.3.1 General concerns . 64 4.3.2 A thin hypervisor on TrustZone . 67 4.3.3 A thin hypervisor for FreeRTOS . 68 4.4 Analysis and Transitioning of Current Systems . 69 4.4.1 Kernel code interity . 69 4.4.2 Application protection . 71 4.4.3 Identifying covert binaries . 74 4.5 Summary . 76 Contents vii 5. Implementation of a Thin Hypervisor .................. 77 5.1 Use of OVP . 77 5.2 Overall structure . 78 5.2.1 The core kernel . 79 5.2.2 Platform-dependent code . 79 5.2.3 The hypervisor . 79 5.3 Key system aspects . 80 5.3.1 Hypercall interface . 80 5.3.2 Memory protection . 81 5.3.3 Interrupts and yielding . 83 5.4 Security Analysis . 83 5.5 Design Recommendations . 85 5.5.1 Trapping vs. Hypercalls . 85 5.5.2 Memory protection . 85 5.5.3 Security Services . 86 5.5.4 Multicore . 86 5.5.5 Hardware heterogeneity . 86 5.5.6 Multiple guests . 87 5.6 Summary . 87 6. Performance Tests ............................. 88 6.1 Description of Tests . 88 6.2 Results . 89 7. Conclusions and Future Work ....................... 90 7.1 Future Work . 90 7.2 Conclusions . 90 LIST OF TABLES 4.1 ARMv5 operating modes . 57 4.2 ARMv5 exceptions . 58 4.3 ARMv5 “special” general purpose registers. 58 4.4 ARMv5 system control coprocessor registers . 60 4.5 ARMv5 MMU access control . 61 4.6 Memory domains . 66 5.1 Hypercall interface . 80 6.1 Test Results, in OVP-simulated instruction counts . 89 LIST OF FIGURES 2.1 Virtualization in a nutshell . 5 2.2 Interposition . 6 2.3 Virtual memory for processes . 9 2.4 System virtualization . 10 2.5 Domain isolation in a mobile device . 34 5.1 Overall implementation structure . 78 5.2 MMU domains . 81 5.3 Interrupt sequence . 83 ABBREVIATIONS ABI Application Binary Interface API Application Programming Interface ASID Address Space Identifier CPSR current program status register CPU central processing unit DMA direct memory access DMAC DMA controller DMR dual-modular redundancy DRM Digital Rights Management EPT Extended Page Table FCSE PID Fast Context-Switch Extension Process ID I/O Input/Output IOMMU I/O Memory Management Unit IPC interprocess communication ISA Instruction Set Architecture MAC Mandatory Access Control MMM Mixed-Mode Multicore reliability MMU Memory Management Unit MPU Memory Protection Unit MVA modified virtual address NUMA Non-Uniform Memory Architecture OMTP Open Mobile Terminal Platform OSTI Open and Secure Terminal Initiative OVP Open Virtual Platforms SPMD.