KR100928866B1 - Apparatus and method for running an application in a virtual environment - Google Patents

Abstract

An apparatus and method for executing an application in a virtual environment.

An application execution method in a virtual environment according to an embodiment of the present invention comprises the steps of performing initialization for building a virtual environment, switching to a kernel level of the virtual environment, and storing first CPU state information which is current CPU state information. Modifying the contents of the current CPU register to a value generated by performing an initialization step after performing the step of storing the first CPU state information; and restoring second CPU state information, which is CPU state information of an application running in the virtual environment. Executing the application using the restored second CPU state information, storing the second CPU state information if the execution of the application is interrupted without completing the first step, and storing the second CPU state information. Restoring CPU state information.

Description

Apparatus and method for executing an application in a virtual environment}

The present invention relates to an apparatus and method for executing an application in a virtual environment, and more particularly, to an apparatus and method for providing a virtual environment isolated from the kernel of an existing operating system to execute a specific application.

A hierarchical illustration of a mechanism in which one application is performed is shown in FIG. 1. The application 4 calls the library function through the API, the library 3 requests the hardware resource 1 from the operating system 2 through a system call, and the operating system controls the hardware resource through the ISA. do. The virtualization technique is a technique for providing an environment in which applications based on different operating systems can be executed by allowing a plurality of operating systems to be supported on common hardware resources. This virtualization concept can be classified according to the layer on which it is implemented. ISA level virtualization is a method that emulates ISA of multiple operating systems so that multiple operating systems can run on a single hardware. The speed is too slow because all instructions for hardware from multiple operating systems must be converted. There was this. Therefore, the hardware abstraction layer (HAL) level virtualization has emerged, which virtualizes only a part of ISA by using the existing code as it is and emulating only the instructions related to other state changes. 2 illustrates a general concept of HAL level virtualization.

HAL level virtualization is based on the guest operating system by the applications (11, 21) running in the guest operating system (12, 22) different from the host operating system with the host operating system (31) mounted on the common hardware 33 The hardware is accessed through system calls, and the virtual machines 13 and 23 and the virtual machine monitor 32 relay the operation instructions during these calls so that the operation codes of the host operating system can be used as they are, and other state transition related instructions In this case, by providing newly defined codes, the applications 11 and 21 on the plurality of operating systems can be allocated hardware. However, HAL-level virtualization also has a problem that there is a very large overhead in handling interrupts by different operating systems because the interrupts for multiple operating systems must be mapped to common hardware.

The technical problem to be achieved by the present invention is to provide a virtual environment in which one application can be executed in isolation from the kernel of the existing operating system and virtually without the need for an additional guest operating system like the existing HAL level virtualization technique. By providing an optimized kernel only for the application code executed in the environment, it provides a device and method for executing an application in a virtual environment that can be isolated from the kernel of the existing operating system with dramatically less overhead than the existing virtualization. I would like to.

Another object of the present invention is to provide an apparatus and method for executing an application in a virtual environment with low overhead by causing a switch between an application running in a virtual environment and an application running in a real environment using a context switching mechanism. It is.

Another technical problem to be achieved by the present invention is to debug code or to execute code by a hacking tool by allowing a code to be executed to be executed in a virtual environment isolated from the kernel of an existing operating system without affecting the code to be protected or the operating system. It is an object of the present invention to provide an apparatus and a method for executing an application in a virtual environment that can prevent damage to an operating system and a system.

The objects of the present invention are not limited to the above-mentioned objects, and other objects which are not mentioned will be clearly understood by those skilled in the art from the following description.

In order to achieve the above object, the application execution apparatus in the virtual environment according to an embodiment of the present invention, means for performing initialization for building a virtual environment, means for switching to the kernel level of the virtual environment, the current CPU state information Means for storing the first CPU state information, means for modifying the contents of the current CPU register to a value generated by performing the initialization step after performing the first CPU state information storing step, and CPU state information of an application running in the virtual environment. Means for restoring the second CPU state information, means for executing the application using the restored second CPU state information, means for storing the second CPU state information if the execution of the application is interrupted without being completed, and the second CPU Means for restoring the first CPU state information after performing the state information storing step.

In order to achieve the above object, an application execution method in a virtual environment according to an embodiment of the present invention, performing the initialization for the virtual environment, the step of switching to the kernel level of the virtual environment, the current CPU state information Storing the first CPU state information, modifying the contents of the current CPU register to a value generated by performing an initialization step after performing the first CPU state information storing step; CPU state information of an application running in the virtual environment. Restoring the second CPU state information, executing the application using the restored second CPU state information, storing the second CPU state information if the execution of the application is interrupted without being completed, and the second CPU Restoring the first CPU state information after performing the state information storing step.

Specific details of other embodiments are included in the detailed description and the drawings.

According to the apparatus and the method for executing an application in the virtual environment of the present invention as described above, there are one or more effects as follows.

First, it provides a virtual environment in which an application can be executed in isolation from the kernel of the existing operating system. Only the application code executed in the virtual environment without the need of an additional guest operating system like the existing HAL level virtualization technique. By building only the optimized kernel, the application can be isolated from the kernel of the existing operating system with significantly less overhead than the existing virtualization.

Second, there is an advantage that the overhead is reduced by using a context switching mechanism to switch between the application running in the virtual environment and the application running in the real environment.

Third, the code to be executed without affecting the code or operating system to be protected is executed in a virtual environment separate from the kernel of the existing operating system, thereby preventing damage to the operating system and the system by debugging the code or executing the code by the hacking tool. It also has the advantage of being prevented.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various different forms, and only the embodiments make the disclosure of the present invention complete, and the general knowledge in the art to which the present invention belongs. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. It will be appreciated that the combination of each block in the accompanying block diagram and each step in the flowchart may be performed by computer program instructions. These computer program instructions may be mounted on a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment such that instructions executed through the processor of the computer or other programmable data processing equipment may not be included in each block or flowchart of the block diagram. It will create means for performing the functions described in each step. These computer program instructions may be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer readable memory. It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the functions described in each block or flowchart of each step of the block diagram. Computer program instructions It can also be mounted on a computer or other programmable data processing equipment, so a series of operating steps are performed on the computer or other programmable data processing equipment to create a computer-implemented process to perform the computer or other programmable data processing equipment. It is also possible for the instructions to provide steps for performing the functions described in each block of the block diagram and in each step of the flowchart.

In addition, each block or step may represent a portion of a module, segment or code that includes one or more executable instructions for executing a specified logical function (s). It should also be noted that in some alternative implementations, the functions noted in the blocks or steps may occur out of order. For example, the two blocks or steps shown in succession may in fact be executed substantially concurrently or the blocks or steps may sometimes be performed in the reverse order, depending on the functionality involved.

3 is a diagram illustrating a hierarchical structure when a program for building a virtual environment in which an application is executed is executed according to an embodiment of the present invention.

When the virtual environment building application is executed, the virtual environment kernel 44 is isolated from the existing operating system 43, and the application 41 to be executed in the virtual environment is an emulation API that supports system calls to the virtual environment kernel. At 42, system calls are made to the operating system. At this time, the virtual environment kernel can use the existing operating system kernel code 43 as it is, except for operating system codes related to CPU registers and memory for applications executed in the virtual environment. For example, interrupt handling code of the existing operating system can be used as it is. The relationship between the virtual environment kernel and the existing operating system and the mechanism in which the application is executed in the virtual environment will be described in more detail with reference to FIG. 4.

First, when the virtual environment building application 52 is executed to create a virtual environment for the execution application 61 in the virtual environment to be executed, this is an existing operating system, that is, another application 51 from the standpoint of the Windows operating system 54 in FIG. 4. It is recognized as one application that is equivalent to. The virtual environment building application 52 switches to the virtual environment kernel level through the initial entry path to the predefined virtual environment kernel 62. The initial entry path to the virtual environment kernel 62 may be implemented in various forms. For example, a call gate may be one implementation form.

The virtual environment building application 52 switches to the virtual environment kernel level by the call gate, and then generates a virtual environment kernel 62 that is isolated from the kernel 54 of the existing operating system by the context switching mechanism and executes in the virtual environment. Allow application 61 to access hardware resources 55 through virtual environment kernel 62.

Here, context switching is a computing process that stores and restores the state (context) of a CPU so that a plurality of processes can share a single CPU resource, and is a register context switch, a task context switch, a thread context switch, or It can mean a process context switch. What constitutes a context is determined by the processor and operating system.

Looking at the process of the CPU allocation is switched between the application 51 running in the real environment and the execution application 52 in the virtual environment in more detail as follows. In a multitasking environment, the application 51 and the virtual environment building application 52 may be allocated a CPU by a context switching mechanism. When the virtual environment building application 52 is allocated a CPU, the virtual environment building application 52 isolates the application from the existing operating system by storing its CPU context and restoring the CPU context of the running application 61 in the virtual environment. To run in a virtualized environment. However, other than that, the kernel code of the existing operating system, for example, interrupt handling code, can be used as it is.

5 is a block diagram illustrating a configuration of an application execution apparatus in a virtual environment according to an embodiment of the present invention.

The application execution apparatus 70 in the virtual environment is largely composed of an initialization unit 71, a task manager 72, a virtual environment switching unit 73, an application execution unit 74, and an actual environment restoration unit 75.

The initialization unit 71 configures a call gate defining an initial entry path to the virtual environment kernel level and performs initialization for the virtual environment. Initialization for the virtual environment involves initializing the CPU register values and allocating memory.

The task manager 72 receives an instruction regarding the execution of the execution application 61 in the virtual environment from the outside and manages the operation of the application 61 at the user level of the virtual environment according to the instruction. The instruction may include a command for stopping execution of the execution application 61 in the virtual environment, resuming execution of the paused application, outputting the contents of the memory at the present time to the hard disk, or terminating execution of the application. This could be

The virtual environment switching unit 73 enters the virtual kernel level by the call gate configured by the initialization unit and stores the registry information of the CPU which has been executed recently at the user level of the existing operating system, that is, the CPU context information of the current real environment. Then, when another application 51 is executed as a system quantum time out, when the virtual environment building application 52 is allocated CPU, the CPU context of the execution application in the virtual environment is executed before the user level code execution. The code is registered as an Asynchronous Procedure Call (APC) so that the steps of storing and restoring the CPU context of the real environment, that is, the CPU context of the virtual environment building application 52 can be performed.

In the present embodiment, a method of switching from an application executed in a real environment to an executed application in a virtual environment has been described based on a context switching technique by APC registration. However, the scope of the present invention is not limited thereto. According to the scope of the present invention, when the virtual environment building application 52 is allocated CPU time again, the virtual environment is stored again by storing the CPU context of the execution application 61 in the virtual environment that cannot be recognized by the existing operating system. It should be construed to include all implementation methods that enable the continuous execution of the application 61 that was executed in the virtual environment when switching to.

The virtual environment switching unit 73 modifies the value of the CPU system register to a value for the virtual environment after performing the APC registration step. That is, the values of the CR3 register and the Interrupt Description Table (IDT) register are changed according to the virtual environment to be constructed. The CPU context of the application executed in the virtual environment is restored to complete the switch to the virtual environment in which the application is executed.

The application execution unit 74 allows the application 61 to access CPU resources through the virtual environment kernel in the virtual environment provided by the virtual environment switching unit 73 so that the application can be executed in an environment isolated from the existing operating system. Make sure The application execution unit 74 executes the application under the control of the job manager 72.

When the virtual environment building application 52 is newly allocated CPU resources, the real environment restoration unit 75 executes the code registered as APC by the virtual environment switching unit 73 to execute the virtual environment building application 52. Restore the real environment. That is, by saving the CPU context information of the application executed in the virtual environment and restoring the CPU context information of the real environment, the execution of the virtual environment building application can be resumed and switched to the virtual environment kernel level. Meanwhile, when the execution of the execution application in the virtual environment is completed during the quantum time, the real environment restoration unit 75 restores the CPU context information of the real environment so that the execution of the virtual environment construction application can be resumed and switched to the virtual environment kernel level. do.

Until now, each component of FIG. 5 may refer to software or hardware such as a field-programmable gate array (FPGA) or an application-specific integrated circuit (ASIC). However, the components are not limited to software or hardware, and may be configured to be in an addressable storage medium and may be configured to execute one or more processors. The functions provided in the above components may be implemented by more detailed components, or may be implemented by combining a plurality of components to perform a specific function. In addition, the components may be implemented to execute one or more computers in a system.

6 is a flowchart illustrating a method of executing an application in a virtual environment according to an embodiment of the present invention.

The virtual environment building application 52 generates a call gate for entering the virtual environment kernel level (S1) and performs initialization for building the virtual environment (S2). In the virtual environment construction initialization phase, CPU register values to be used in the virtual environment are initialized and memory allocation and initialization are performed. Before switching to the virtual environment kernel level, an instruction regarding execution of an application executed in the virtual environment is received from the outside (S3). Instructions regarding the execution of the execution application 61 in the virtual environment are as described above with reference to FIG. 5. It includes instructions for resuming execution of a stopped application and terminating the execution of the application. The virtual environment building application switches from the user level to the virtual environment kernel level through the call gate generated in step S1 (S4).

At the virtual environment kernel level, the CPU context information that was executed at the user level of the existing operating system to the last is stored (S5), and the CPU context information of the running application in the virtual environment is preserved at the next scheduling and the CPU context information of the existing physical environment is stored. The APC for restoring is registered (S6). Thereafter, the virtual environment conversion unit 73 changes the values of the system registers and general registers of the current CPU to values initialized to be used in the virtual environment in step S2 (S7), thereby changing the CPU to the current operating system. It is separated from (S9).

When the execution of the application at the virtual environment user level is the end of the system quantum time (No in S10), the next time the context switch to the virtual environment building application occurs after the CPU is allocated to the application in the real environment, in S6 By executing the code registered with the APC, the CPU context information of the application executed in the virtual environment is stored (S12), and the trap frame of the corresponding process is applied to the registers of the application that was finally executed at the user level of the existing real environment. By modifying the frame), execution is made possible again in the actual environment in the context switching step (S13).

On the other hand, if the execution of the application 61 in the virtual environment is completed before the end of the system quantum time (YES in S10), it was finally executed at the user level of the real environment before the application execution at the virtual environment user level. After restoring the CPU context information (S11) and receiving an instruction from the outside (S3), the process switches back to the virtual environment kernel level through the call gate (S4).

Although embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art to which the present invention pertains may implement the present invention in other specific forms without changing the technical spirit or essential features thereof. I can understand that. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive.

1 is a hierarchical diagram of application execution on a typical computer.

FIG. 2 is a diagram illustrating a virtualization concept in a conventional hardware abstraction layer (HAL).

3 is a hierarchical diagram of an application execution program in a virtual environment according to an embodiment of the present invention.

4 illustrates an application execution mechanism in a virtual environment according to an embodiment of the present invention.

5 is a block diagram illustrating a configuration of an application execution apparatus in a virtual environment according to an embodiment of the present invention.

6 is a flowchart illustrating a method of executing an application in a virtual environment according to an embodiment of the present invention.

<Explanation of symbols on main parts of the drawings>

70: application execution device in the virtual environment 71: initialization unit

72: Task Manager 73: Virtual Environment Switcher

74: application execution unit 75: real environment restore unit

Claims (12)

Performing initialization for building a virtual environment; Switching to a kernel level of the virtual environment; Storing first CPU state information which is current CPU state information; Modifying the contents of a current CPU register to a value generated by performing the initialization after performing the step of storing the first CPU state information; Restoring second CPU state information, which is CPU state information of an application executed in the virtual environment; Executing the application using the restored second CPU state information; Storing the second CPU state information when the execution of the application is stopped without completing; And Restoring the first CPU state information after performing the step of storing the second CPU state information. How to run an application in a virtual environment. The method of claim 1, Performing the initialization is Creating a path to enter a kernel level of the virtual environment without passing through an existing operating system; And Initializing a CPU register and a memory to be used in the virtual environment; How to run an application in a virtual environment. The method of claim 2, The path to the kernel level of the virtual environment is Call Gate Inn How to run an application in a virtual environment. The method of claim 2, Switching to the kernel level of the virtual environment Receiving a command regarding execution of the application from an external source; And Switching to the kernel level of the virtual environment through a path entering the kernel level of the virtual environment; How to run an application in a virtual environment. The method of claim 4, wherein Receiving the command is Receiving any one of stopping execution of the application, dumping a RAM value when executing the application, resuming execution of the application, and terminating execution of the application; How to run an application in a virtual environment. The method of claim 2, Modifying to a value generated by performing the initialization Modifying the CPU register and the CPU register value initialized by the step of initializing the memory. How to run an application in a virtual environment. The method of claim 1, Running the application When an interrupt occurs, executing an interrupt handler corresponding to the modified value of the CPU register. How to run an application in a virtual environment. The method of claim 1, The code for performing the steps of storing the second CPU state information and restoring the first CPU state information is registered as an Asynchronous Procedure Call (APC). How to run an application in a virtual environment. The method of claim 1, The storing of the second CPU state information may include Storing the second CPU state information when the execution of the application is stopped due to a quantum timeout; How to run an application in a virtual environment. The method of claim 1, Storing the second CPU state information and restoring the first CPU state information after performing the step of storing the first CPU state information and before performing the step of modifying to a value generated by performing the initialization. And registering the code to perform the step as an Asynchronous Procedure Call (APC). How to run an application in a virtual environment. An initialization unit that performs initialization for building a virtual environment; Storing the CPU state information of the real environment, modifying the contents of the CPU register in the virtual environment to a value generated by performing the initialization, and restoring the CPU state information of the virtual environment to restore the CPU state information of the virtual environment. A virtual environment switching unit for switching to a kernel level; An application execution unit that executes an application in the virtual environment by using CPU state information of the virtual environment; When the execution of the application is stopped or completed, the CPU state information of the virtual environment is stored, and restores the CPU state information of the real environment to include a real environment restorer for restoring from the virtual environment to the real environment; Device that runs applications in a virtual environment. A recording medium having recorded thereon a computer readable program for executing the method according to any one of claims 1 to 10.

Images