DOCSLIB.ORG

A Practical Look at Micro-Kernels and Virtual Machine Monitors

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
A Practical Look at Micro-Kernels and Virtual Machine Monitors A Practical Look at Micro-Kernels and Virtual Machine Monitors François Armand, Michel Gien, Member, IEEE of the main drivers is the need to run new or feature-rich open Abstract — In this paper, we look at two different approaches system software while maintaining existing legacy software used to provide embedded system support for virtualization and that has been already tested and validated in their own virtual machine monitors for consumer electronics and mobile operating environment. Such open software commonly devices. We compare the micro-kernel approach, which has been includes Linux and more established operating systems such a popular choice for building embedded operating systems with the Virtual Machine Monitor (VMM) or hypervisor approach as Windows or Symbian where developers want to run the widely deployed in general purpose computing environments operating system unchanged while also extending their device such as desktops and data center servers. Comparison criteria security and manageability at all levels. are based on virtualization use cases that are typical of Consumer Co-existence of several operating environments on the same Electronics (CE) systems such as mobile devices and IPTV. These hardware platform is one of the main purposes of hardware approaches are further evaluated based on performance and on virtualization software, made possible by the provision of a their ability to allow re-use of existing (often real-time) software as well as modern open operating systems such as Linux while virtual image of the hardware to each operating system, which remaining as transparently as possible. Such transparency can believes it is running alone on the underlying hardware. come through different paths, including: leveraging of hardware Mobile phone platform products that are now been deployed virtualization support, minimal modifications to the original with such virtualized operating environments include the NXP operating system internals (kernel, device drivers, etc.), and the 7210 platform used in the Purple Magic single core Linux ability to use existing operating system applications as-is and reference phone design [1], [2]. without the need to port them to a new environment. An analysis of the fundamental principles behind each approach is presented Hardware virtualization is not a new concept. It has been with a discussion of their impact on existing operating used in data centers for years. However, its introduction in environments, together with practical performance results based embedded systems, in particular mobile devices is relatively on existing micro-kernels and real-time hypervisor benchmarks. new. Several approaches are being used to provide hardware We conclude that mapping the VMM (hypervisor) approach used virtualization in embedded devices. One extends the data in data centers to the needs of embedded systems is a better center Virtual Machine Monitor (VMM) or hypervisor option for the support of complete operating systems (as guests) than extending micro-kernels for such functionality. approach to fit the constraints of embedded systems. Another approach extends micro-kernels that have traditionally been Keywords—Virtual machine monitors for CE systems such used in embedded systems so they can support full operating as mobile devices and IPTV, Virtualization for security system kernels in addition to their own embedded and fault-isolation on CE systems, Embedded operating applications. system support for virtualization, Virtualization This paper examines foundation concepts of each approach architecture for real-time applications and discusses their implications on the expected benefits of virtualization in embedded devices. A parallel can be made Index Terms—Embedded system, hypervisor, micro-kernel, with the arguments exchanged in two papers issued by Operating System (OS), virtualization, Virtual Machine Monitor stakeholders from each “camp”, ie, Xen [3] and L4 [4]. (VMM). Finally actual measurements and performance benchmarks of the L4 microkernel and the VirtualLogix VLX hypervisor I. INTRODUCTION illustrate the implications of the two approaches in real-world FTER several years of availability in the enterprise and scenario. Aserver space, virtualization is becoming a hot topic in embedded systems, particularly for consumer electronics II. VIRTUAL MACHINE MONITORS AND HYPERVISORS systems such as mobile devices and IPTV set-top boxes. One A. Virtualization in the Data Center The common term, virtual machine monitor (VMM), refers Manuscript received October 10, 2008. to software that controls and virtualizes the system "physical" François Armand is with VirtualLogix, 6 avenue Gustave Eiffel, 78180 – Montigny-le-Bretonneux, France (phone: +33 1 39 44 74 00; fax: +33 1 30 57 hardware and reflects that this software generates and 00 66; (e-mail: [email protected]). monitors "virtual machines" in which operating systems (OS) Michel Gien is with VirtualLogix, 6 avenue Gustave Eiffel, 78180 – are executed. An operating system that executes in the context Montigny-le-Bretonneux, France (phone: +33 1 39 44 74 22; fax: +33 1 30 57 00 66; e-mail: [email protected]). of a virtual machine is often referred to as a "guest OS," as 978-1-4244-2309-5/09/$25.00 ©2009 IEEE 1 Authorized licensed use limited to: UNSW Library. Downloaded on November 9, 2009 at 02:19 from IEEE Xplore. Restrictions apply. opposed to a "native OS" that has full control over the increased processing power and operating system support hardware resources (i.e. the "real machine"). The VMM may allows virtualization technology to be applied to mobile sometimes be called a "hypervisor" by analogy to the term handsets and provide them with a software architecture that "supervisor" used to designate the function of the inner part of allows them to consolidate different operating environments an OS called the OS kernel, which supervises the execution of on the same hardware platform. applications and their access to hardware resources Running along side of a feature-rich open operating system, (computing, memory, storage, network, etc.). In the case of a real-time operating system (RTOS) is used in mobile "virtualization technology," the hypervisor provides access to handsets to support deterministic tasks, such as running the hardware resources for the operating systems via fully or wireless protocol stacks and core phone services. Aside from partially virtualized interfaces. This adds one layer of the operating system choices, mobile handsets present a hardware management which multiplexes usage of the “real” further challenge to virtualization solutions in their support for hardware to several operating systems or several instances of real-time operating systems and for many peripherals such as the same operating system, which can thus share that same screen, touchpad, keyboard, audio I/O, camera, flash memory, hardware. disk, Bluetooth, USB, WiFi as well as wireless telecom The first hypervisor, called Control Program 67 (CP-67) network protocols. [5], was introduced in the summer of 1966 by IBM in its Emerging from these market and technical requirements is a famous System/360 family of mainframe computers, the new generation of hypervisors, sometimes referred to as using 360/67. It then became VM/370 on the S/370 and was used to "real-time virtualization" technology targeting embedded run various operating systems such as "single user" (e.g. devices by allowing a guest OS of the hypervisor to be a real- CMS) or "batch" operating systems (e.g. OS 360) time operating system (RTOS) without compromising its simultaneously and securely on the same computer. native real-time characteristics and behavior. VirtualLogix Essentially VM/370 and hardware cooperate so multiple VLX is an example of such a “real-time virtualization” instances of any operating system, each with protected access hypervisor [10]. to the full instruction set, can peacefully and concurrently Like other hypervisors in the traditional computing space, coexist. This is one of the more successful hypervisors and real-time hypervisors ensure strict isolation and secure still sees wide use in IBM mainframes today. communication between multiple virtualized execution Since then, hypervisors have gained increasing popularity in environments. In addition, real-time hypervisors support the the computing space with many commercial and public ARM processor family powering the vast majority of mobile options now available. The most widely used hypervisor on phones and when it is made available by the silicon x86-based computers is VMware [6], which is offered by a manufacturer, these hypervisors are able to leverage hardware subsidiary of the EMC Corporation. The University of support for virtualization, on Intel VT-based architectures for Cambridge Computer Laboratory has developed a competing example. open source project called Xen [7] that is supported by various "Real-time virtualization" can be used to securely computer manufacturers including IBM, Sun Microsystems consolidate a RTOS and a rich operating system – which and HP to run several instances of Linux and other operating would otherwise run on independent processors – on a single systems primarily on x86-based servers. Microsoft recently CPU lowering the cost of smart phones and bringing more announced its own hypervisor software named Hyper-V [8]. functionality into the high-volume mass market. It can also be Hypervisors provide "hardware virtual machines" and used to support
Load more

Recommended publications
  • Carrier Grade Virtualization
    Carrier Grade Virtualization Leveraging virtualization in Carrier Grade Systems Abstract Network Equipment Providers (NEPs) have been building networking infrastructure equipment able to deliver “carrier grade” services, typically mission-critical services such as voice telephony. In decades past, NEPs have achieved high degrees of availability through purpose-built hardware and software implementations. Today they increasingly build on COTS (Commercial Off The Shelf) hardware and Open Source Software (OSS), freeing their engineering resources to focus on core telephony competencies. The move to COTS and OSS requires that these hardware and software components be available from an ecosystem of suppliers, and that they interoperate seamlessly. Bodies such as The Linux Foundation (LF), the Service Availability Forum (SA Forum) and PICMG have defined standards and specifications such as carrier grade OSes (CGLinux), Service Availability Forum APIs and AdvancedTCA hardware to target carrier grade applications. Recent advances have made virtualization appealing for carrier class equipment by permitting significant cost reduction through consolidation of workloads and of physical hardware. Virtualization also transparently lets NEPs and other OEMs (Original Equipment Manufacturers) leverage multi-core processors to run legacy software designed for uniprocessor hardware. However, virtualization needs to meet specific requirements to enable network equipment deploying this technology to meet industry expectations for carrier grade systems. This
    [Show full text]
  • Comparison of Platform Virtual Machines - Wikipedia
    Comparison of platform virtual machines - Wikipedia... http://en.wikipedia.org/wiki/Comparison_of_platform... Comparison of platform virtual machines From Wikipedia, the free encyclopedia The table below compares basic information about platform virtual machine (VM) packages. Contents 1 General Information 2 More details 3 Features 4 Other emulators 5 See also 6 References 7 External links General Information Name Creator Host CPU Guest CPU Bochs Kevin Lawton any x86, AMD64 CHARON-AXP Stromasys x86 (64 bit) DEC Alphaserver CHARON-VAX Stromasys x86, IA-64 VAX x86, x86-64, SPARC (portable: Contai ners (al so 'Zones') Sun Microsystems (Same as host) not tied to hardware) Dan Aloni helped by other Cooperati ve Li nux x86[1] (Same as parent) developers (1) Denal i University of Washington x86 x86 Peter Veenstra and Sjoerd with DOSBox any x86 community help DOSEMU Community Project x86, AMD64 x86 1 of 15 10/26/2009 12:50 PM Comparison of platform virtual machines - Wikipedia... http://en.wikipedia.org/wiki/Comparison_of_platform... FreeVPS PSoft (http://www.FreeVPS.com) x86, AMD64 compatible ARM, MIPS, M88K GXemul Anders Gavare any PowerPC, SuperH Written by Roger Bowler, Hercul es currently maintained by Jay any z/Architecture Maynard x64 + hardware-assisted Hyper-V Microsoft virtualization (Intel VT or x64,x86 AMD-V) OR1K, MIPS32, ARC600/ARC700, A (can use all OVP OVP Imperas [1] [2] Imperas OVP Tool s x86 (http://www.imperas.com) (http://www.ovpworld compliant models, u can write own to pu OVP APIs) i Core Vi rtual Accounts iCore Software
    [Show full text]
  • Partitioned System with Xtratum on Powerpc
    Tesina de M´asteren Autom´aticae Inform´aticaIndustrial Partitioned System with XtratuM on PowerPC Author: Rui Zhou Advisor: Prof. Alfons Crespo i Lorente December 2009 Contents 1. Introduction1 1.1. MILS......................................2 1.2. ARINC 653..................................3 1.3. PikeOS.....................................6 1.4. ADEOS....................................7 2. Overview of XtratuM 11 2.1. Virtualization and Hypervisor........................ 11 2.2. XtratuM.................................... 12 3. Overview of PowerPC 16 3.1. POWER.................................... 16 3.2. PowerPC.................................... 17 3.3. PowerPC in Safety-critical.......................... 19 4. Main PowerPC Drivers to Virtualize 20 4.1. Processors................................... 20 4.2. Timer..................................... 21 4.3. Interrupt.................................... 23 4.4. Memory.................................... 24 5. Porting Implementation 25 5.1. Hypercall................................... 26 5.2. Timer..................................... 27 5.3. Interrupt.................................... 28 5.4. Memory.................................... 31 5.5. Partition.................................... 32 6. Benchmark 34 7. Conclusions and Future Work 38 Abstract Nowadays, the diversity of embedded applications has been developed into a new stage with the availability of various new high-performance processors and low cost on-chip memory. As the result of these new advances in hardware, there is a
    [Show full text]
  • Family of Solutions for HSPA Enterprise Femtocell Applications
    New single-chip, multicore DSP solution for HSPA enterprise femtocell applications Product Bulletin Key features The TMS320TCI6489 from Texas Instruments is a high-performance, cost-competitive, TMS320TCI6489 high-performance DSP single-chip digital signal processor (DSP) solution. Targeted at the demanding enterprise • Three 850-MHz, TMS320C64x+™ cores femtocell market, the TCI6489 is capable of supporting PHY and MAC layer processing provide flexible processing for supporting different standards for 2G, 3G and 4G femtocell base stations, and offers substantial development Built-in UMTS receiver accelerator coprocessor (RAC) benefits for manufacturers. Optimized for wireless baseband applications with turbo and Viterbi The TCI6489 DSP includes three cores and In the office femtocell base stations enhance decoder coprocessors is capable of supporting 32 users on a single the wireless experience by bringing higher 1 MB of internal L2 memory per core WCDMA carrier. Designed to run both PHY data rates, better coverage and lower cost sGMII Gigabit Ethernet and higher layer processing, it is also capable plans to the user. A typical femtocell network Four antenna interface lanes supporting of supporting 32 users on a single WCDMA architecture is shown on next page. The either OBSAI or CPRI carrier. With a broad selection of available femtocell architecture allows a mobile phone DDR2 667 MHz McBSP – Two McBSP links, each at analog RF components, the TCI6489 user in enterprise to be connected to a femto 100 Mbps enterprise platform is ideally suited for base station. This femto base station uses McBSP can be used for multichannel any femtocell original equipment the existing landline connection (typically clocked serial communications manufacturer (OEM).
    [Show full text]
  • A State-Of-The-Art Survey on Real-Time Issues in Embedded Systems Virtualization
    Journal of Software Engineering and Applications, 2012, 5, 277-290 277 http://dx.doi.org/10.4236/jsea.2012.54033 Published Online April 2012 (http://www.SciRP.org/journal/jsea) A State-of-the-Art Survey on Real-Time Issues in Embedded Systems Virtualization Zonghua Gu, Qingling Zhao College of Computer Science, Zhejiang University, Hangzhou, China. Email: {zgu, ada_zhao}@zju.edu.cn Received January 1st, 2012; revised February 5th, 2012; accepted March 10th, 2012 ABSTRACT Virtualization has gained great acceptance in the server and cloud computing arena. In recent years, it has also been widely applied to real-time embedded systems with stringent timing constraints. We present a comprehensive survey on real-time issues in virtualization for embedded systems, covering popular virtualization systems including KVM, Xen, L4 and others. Keywords: Virtualization; Embedded Systems; Real-Time Scheduling 1. Introduction on L4Ka::Pistachio microkernel; in turn, unmodified guest OS can run on top of QEMU; Schild et al. [2] used Platform virtualization refers to the creation of Virtual Intel VT-d HW extensions to run unmodified guest OS Machines (VMs), also called domains, guest OSes, or on L4. There are also Type-2, para-virtualization solu- partitions, running on the physical machine managed by tions, e.g., VMWare MVP (Mobile Virtualization Plat- a Virtual Machine Monitor (VMM), also called a hyper- form) [3], as well as some attempts at adding para-virtu- visor. Virtualization technology enables concurrent exe- alization features to Type-2 virtualization systems to im- cution of multiple VMs on the same hardware (single or prove performance, e.g., task-grain scheduling in KVM multicore) processor.
    [Show full text]
  • Dynamic Management of Multiple Operating Systems in an Embedded Multi-Core Environment
    AALTO UNIVERSITY SCHOOL OF SCIENCE AND TECHNOLOGY Faculty of Electronics, Communications and Automation Department of Signal Processing and Acoustics Aleksi Aalto Dynamic management of multiple operating systems in an embedded multi-core environment Master's Thesis submitted in partial fulfillment of the requirements for the degree of Master of Science in Technology. Espoo, May 7, 2010 Supervisor: Professor Jorma Skytt¨a Instructors: Professor Tatsuo Nakajima and D.Sc. (Tech) Vesa Hirvisalo AALTO UNIVERSITY ABSTRACT OF THE SCHOOL OF SCIENCE AND TECHNOLOGY MASTER'S THESIS Author: Aleksi Aalto Name of the Thesis: Dynamic management of multiple operating systems in an embedded multi-core environment Date: May 7, 2010 Number of pages: xi + 69 Faculty: Faculty of Electronics, Communications and Automation Professorship: S-88 Signal Processing Supervisor: Prof. Jorma Skytt¨a Instructors: Prof. Tatsuo Nakajima and D.Sc. (Tech.) Vesa Hirvisalo Modern embedded devices, such as smartphones, have grown into complex computer systems that provide a rich set of functionality for their users while still maintain- ing real-time responsiveness for their low level functions such as radio communication or camera control. The embedded market is very competitive, especially in end-user mobile devices, making it desirable to reduce manufacturing costs without compromis- ing device performance wherever possible. The ever-growing user demand for more computing-intensive applications coupled with tight energy budgets has led the em- bedded manufacturers to seek performance gains from multi-core architectures, much like their desktop counterparts. However, multi-core architectures have little to provide in performance gains when used with applications developed with traditional software design methods that are aimed at single-core archictures.
    [Show full text]
  • Armvisor: System Virtualization for ARM
    ARMvisor: System Virtualization for ARM Jiun-Hung Ding Chang-Jung Lin National Tsing Hua University National Tsing Hua University [email protected] [email protected] Ping-Hao Chang Chieh-Hao Tsang National Tsing Hua University National Tsing Hua University [email protected] [email protected] Wei-Chung Hsu Yeh-Ching Chung National Chiao Tung University National Tsing Hua University [email protected] [email protected] Abstract ARMvisor. At this time, we can successfully run a guest Ubuntu system on an Ubuntu host OS with ARMvisor In recent years, system virtualization technology has on the ARM-based TI BeagleBoard. gradually shifted its focus from data centers to embed- ded systems for enhancing security, simplifying the pro- cess of application porting as well as increasing sys- 1 Introduction tem robustness and reliability. In traditional servers, which are mostly based on x86 or PowerPC processors, Virtualization has been a hot topic and is widely em- Kernel-based Virtual Machine (KVM) is a commonly ployed in data centers and server farms for enterprise adopted virtual machine monitor. However, there are no usage. Today’s mobile devices are equipped with GHz such KVM implementations available for the ARM ar- CPU, gigabytes of memory and high-speed network. chitecture which dominates modern embedded systems. With the advancement of computing power and Internet In order to understand the challenges of system virtual- connection in embedded devices, system virtualization ization for embedded systems, we have implemented a also assists to address security challenges, and reduces hypervisor, called ARMvisor, which is based on KVM software development cost for the mobile and embedded for the ARM architecture.
    [Show full text]
  • Valpont.Com, a Technology Content Platform Valpont.Com, a Technology Content Platform
    Valpont.com, a Technology Content Platform Valpont.com, a Technology Content Platform Software Development for Embedded Multi-core Systems Valpont.com, a Technology Content Platform This page intentionally left blank Valpont.com, a Technology Content Platform Software Development for Embedded Multi-core Systems A Practical Guide Using Embedded Intel ® Architecture Max Domeika AMSTERDAM • BOSTON • HEIDELBERG • LONDON NEW YORK • OXFORD • PARIS • SAN DIEGO SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO Newnes is an imprint of Elsevier Valpont.com, a Technology Content Platform Cover image by iStockphoto Newnes is an imprint of Elsevier 30 Corporate Drive, Suite 400, Burlington, MA 01803, USA Linacre House, Jordan Hill, Oxford OX2 8DP, UK Copyright © 2008, Elsevier Inc. All rights reserved. Intel® and Pentium® are registered trademarks of Intel Corporation. *Other names and brands may be the property of others. The author is not speaking for Intel Corporation. This book represents the opinions of author. Performance tests and ratings are measured using specifi c computer systems and/or components and refl ect the approximate performance of Intel products as measured by those tests. Any difference in system hardware or software design or confi guration may affect actual performance. Buyers should consult other sources of information to evaluate the performance of systems or components they are considering purchasing. For more information on performance tests and on the performance of Intel products, visit Intel Performance Benchmark Limitations. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of the publisher.
    [Show full text]
  • Virtualization – the Power and Limitations for Military Embedded Systems – a Structured Decision Approach
    2010 NDIA GROUND VEHICLE SYSTEMS ENGINEERING AND TECHNOLOGY SYMPOSIUM VEHICLE ELECTRONICS & ARCHITECTURE (VEA) MINI-SYMPOSIUM AUGUST 17-19, 2010 DEARBORN, MICHIGAN VIRTUALIZATION – THE POWER AND LIMITATIONS FOR MILITARY EMBEDDED SYSTEMS – A STRUCTURED DECISION APPROACH Mike Korzenowski Vehicle Infrastructure Software General Dynamics Land Systems Sterling Heights, MI ABSTRACT Virtualization is becoming an important technology for military embedded systems. The advantages to using virtualization start with its ability to facilitate porting to new hardware designs or integrating new software and applications onto existing platforms. Virtualization is a tool to reuse existing legacy software on new hardware and to combine new features alongside existing proven software. For embedded systems, especially critical components of military systems, virtualization techniques must have the ability to meet performance requirements when running application software in a virtual environment. Together, these needs define the key factors driving the development of hypervisor products for the embedded market: a desire to support and preserve legacy code, software that has been field-proven and tested over years of use; and a need to ensure that real-time performance is not compromised. Embedded-systems developers need to understand the power and limitations of virtualization. This paper presents virtualization technologies and its application to embedded systems. With the dominant market of multi-core processing systems, the need for performing specific hardware/software configuration and usages with relations to Platform Virtualization is becoming more and more prevalent. This paper will discuss different architectures, with security being emphasized to overcome challenges, through the use of a structures decision matrix. This matrix will cover the best suited technology to perform a specific function or use-case for a particular architecture chosen.
    [Show full text]
  • Software and Hardware Supports for Multi-OS Environment
    Software and Hardware Supports for Multi-OS Environment マルチ OS 環境を支援するソフトウェア およびハードウェア機能の提案 February 2012 Waseda University Graduate School of Fundamental Science and Engineering Major in Computer Science and Engineering Research on Distributed Systems Yuki KINEBUCHI 2 c Copyright by Yuki Kinebuchi 2012 All rights reserved 2 Acknowledgements This is a great opportunity to express my respect to my thesis advisor, Prof. Tatsuo Nakajima. My research and this dissertation would not exist without his support and patience. I would also like to thank all the members at Distributed Computing Laboratory in Waseda University for encouraging me. 3 4 Abstract Personal mobile devices are rapidly enhancing their functionalities. Not limited to phone and text messages, they offer web browsing via the Internet, free to install applications on the users’ requests, play musics and videos, etc. Now they are capable of running multiple OS instances with support of virtualization. Like the use in desktop/enterprise systems, virtualization for embedded mobile devices allows consolidating multiple OS instances and enhancing the security of hosted OS environment. In addition, there are applications specific to embedded systems such as hosting real-time OS (RTOS) and application OS (GPOS) concurrently without spoiling the real-time responsiveness of the RTOS. There is no doubt that virtualization brings many benefits to the embedded mobile devices, however virtualization is not a panacea. Additional layer of virtualization incurs additional complexity to the software stack of devices. Some extra engineering efforts of developing such device might make the system prone to bugs and security risks. In this dissertation we take the position that some applications of embedded virtualization can be supported with more light-weight methods.
    [Show full text]
  • Linux Virtualization Goes Mobile
    Linux Virtualization Goes Mobile Jim Huang ( 黃敬群 ) <jserv @ 0xlab.org> Aug 15, 2009 COSCUP 關於講者 宅色夫 宅色夫 自由軟體 ARM SoC 環保 Android 搜尋結果洽好是本議程的提綱 昔有凱撒 我來，我見，我征服 I came, I saw, I conquered! 今有宅色夫 我宅，我色，我舒服 I home, I suck, I comforted! 虛擬化兩大重點 我來，我見，我征服 Exec. Env. #1 Exec. Env. #2 Exec. Env. #3 I came, I saw, I conquered Main OS Modified Guest OS Modified Guest OS Modified Guest OS Virtual Hardware Virtual Hardware Virtual Hardware 我宅，我色，我舒服 Para Modified Drivers Virtual Machine Monitor I home, I suck, I comforted Hypervisor Hardware 儘可能「征服」硬體 ( 充分使用系統資源 ) 軟體予以「舒服」 ( 提高使用比例與感受 ) Virtualization 技術很熱門， 但不是新玩意 Hypervisor: 早在 1967 年，即提出隔離 Application 與 Hardware 的途徑 Virtualization 技術里程碑 1998 2004 2006 1972 2009 1967 2003 2007 2005 2008 VMware Trango AMD-V (x86) Virtual PC Intel→ WindRiver VM/370 - 1st commercial product Xen Open Kernel Labs OKL4 VirtualLogix VLX Citrix→ Xen Intel VT-x, Intel VT-i CP-40 RedHat → KVM 1st Full Virtualization NICTA L4 Microkernel + Qualcomm Sun → VirtualBox Hypervisor vmware→ Trango (VMware MVP) Spam and virus User tolerance for infected email email downtime is account for over 70% of all email less than 30 sent today minutes Security Services Virtualization 技術的轉變： Embedded/Mobile [2006] Toshiba W47T CDMA Phone [2007] 3G phones from HTC, LG, Mobile [2008] Samsung SPH-m800 [2008] Instinct™ and HTC Dream (G1) with Android Source: Open Kernel Labs. 走入消費性 電子產品 那英《征服》 「就這樣被你征服 切斷了所有退路 我的心情是堅固 我的決定是糊塗 就這樣被你征服 喝下你藏好的毒 我的劇情已落幕 我的愛恨已入土」 那英《征服》 「就這樣被你征服 切斷了所有退路 我的心情是堅固 我的決定是糊塗 就這樣被你征服 喝下你藏好的毒 我的劇情已落幕 我的愛恨已入土」 [ 佳句偶得 ] 切斷了所有退路
    [Show full text]
  • Thin Hypervisor-Based Security Architectures for Embedded Platforms
    View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by Software institutes' Online Digital Archive Thin Hypervisor-Based Security Architectures for Embedded Platforms Heradon Douglas The Royal Institute of Technology, Stockholm, Sweden Advisor: Christian Gehrmann Swedish Institute of Computer Science, Stockholm, Sweden February 26, 2010 To my wife, Guiniwere, who is everything to me. Till min hustru, Guiniwere, som är allt för mig. I would also like to thank my advisor, Christian Gehrmann, for his support, guidance and collaboration; Louise Yngström, Alan Davidson, Stewart Kowalski and my other teachers and colleagues at DSV for their generosity and tutelage; and my friends and family for their love. ABSTRACT Virtualization has grown increasingly popular, thanks to its benefits of isolation, management, and utilization, supported by hardware advances. It is also re- ceiving attention for its potential to support security, through hypervisor-based services and advanced protections supplied to guests. Today, virtualization is even making inroads in the embedded space, and embedded systems, with their security needs, have already started to benefit from virtualization’s security po- tential. In this thesis, we investigate the possibilities for thin hypervisor-based security on embedded platforms. In addition to significant background study, we present implementation of a low-footprint, thin hypervisor capable of provd- ing security protections to a single FreeRTOS guest kernel on ARM. Backed by performance test results, our hypervisor provides security to a formerly unse- cured kernel with minimal performance overhead, and represents a first step in a greater research effort into the security advantages and possibilities of embed- ded thin hypervisors.
    [Show full text]