KR20130051271A - System and method that provides policies for virtualizing arm based operating system - Google Patents

Abstract

PURPOSE: A policy providing system for the virtualization of an ARM(Advanced RISC Machine )-based OS(Operating System) and a method thereof are provided to ease the performance of emulation by using information stored for virtualization sensitive command emulation for VM(Virtual Machine) operation. CONSTITUTION: A command detecting module(214) detects a command not generating a trap in a specific mode during guest OS compile. A basis policy module(216) stores the command in a specific area of an execution file, converts the command into a command for a system call interface, and converts the command into an offset of the specific area in order to virtualize a guest OS. A specific mode is a nonprivileged mode only for an allocated address area and the command is a virtualization sensitive command not generating a trap in a user mode. [Reference numerals] (210) System call interface; (212) Hardware; (214) Command detecting module; (216) Basis policy module

Description

[0001] SYSTEM AND METHOD FOR PROVIDING VIRTUALIZING ARM BASED OPERATING SYSTEM FOR VIRTUALIZATION OF ARM-

The present invention is for pre-processing virtualization-sensitive instructions to implement virtualization in an ARM-based operating system. It detects virtualization-sensitive instructions when compiling kernel source code, stores the location in a specific section, Based system for virtualization of an ARM-based operating system for emulating virtualization sensitive instructions by replacing virtualization sensitive instructions with trap generation instructions and offsets.

In recent years, as the performance of embedded systems such as smart phones has increased as well as existing server systems, the necessity of virtualization technology is increasing.

In a typical system where virtualization is not implemented, one operating system controls all the hardware resources. In the case of a virtualization system, a software layer called a VMM (Virtual Machine Monitor) is added between the hardware and the operating system to manage the hardware resources. The VMM plays a role of sharing hardware resources of a host to a plurality of guest operating systems (VMs).

Typical third-generation architectures, such as OS / 360, have two processor modes: Privileged mode and Non-privileged mode. The privileged mode is a processor mode capable of freely accessing resources of a hardware system such as I / O. The VMM performs in a privileged mode because it manages the resources of the hardware, but a VM operating on the VMM is performed in a non-privileged mode.

However, there is a case where privilege mode privilege is required for operating system existing in each VM to use resources of the system during execution. Most user programs can be run in non-privileged mode if the privilege mode of the hardware is not needed, but in order to use the privileged mode function such as I / O access, a supervisor call or trap is generated, State conversion is required.

Thus, instructions that are not sensitive to the current processor mode can be executed directly without intervention of the VMM, but other instructions are sensitive to the current processor mode, and processing of the corresponding instructions is required when virtualization is implemented.

The privileged instruction is a command that does not generate a trap when the processor mode is executed in the privileged mode, but generates a trap when executed in the non-privileged mode. A sensitive instruction consists of a control sensitive instruction and a behavior sensitive instruction. Control-sensitive instructions mean that changes in the resource used are caused by changes in the processor mode or by changes in the relocation bound registers. In the case of third-generation computers, resources are memory. The behavior sensitive instruction is a command whose execution result depends on the value of the current relocation bound register.

FIG. 1 is a diagram showing a satisfaction condition for virtualizing a third generation computer. A generic third generation computer 120 generates a trap when the sensitive instruction set belongs to a subset of the privileged instruction set and all sensitive instructions are executed in the non-privileged mode. In this case, virtualization can be implemented using the trap-and-emulation method. However, processors 110 such as x86 and ARM are not included in the set of privileged instructions in the set of sensitive instructions, so that there is a virtualization-sensitive instruction that does not cause a trap in execution in non-privileged mode. A problem that is difficult to implement occurs.

The present invention is for implementing virtualization in an ARM-based operating system, and aims to provide a technique for detecting a virtualization-sensitive instruction in a kernel source compilation and storing the position in a specific section of the ELF file.

It is another object of the present invention to provide a technology for emulating a virtualization sensitive command by changing the virtualization sensitive instruction to a trap generation instruction and an offset by viewing the position information of the virtualization sensitive instruction written in the ELF file of the compiled kernel.

According to one aspect of the present invention, there is provided a policy-based provision system for virtualization of an ARM-based operating system, the system comprising: a command detection module for detecting an instruction for which a trap is not generated in a specific mode upon compilation of a guest OS; A base policy module that stores a command detected in the module in a specific area of a predetermined executable file, converts the stored command into a command capable of a system call interface, converts the command into an offset of the specific area, and controls the virtualization of the guest operating system .

According to another aspect of the present invention, there is provided a policy-based provisioning method for virtualization of an ARM-based operating system, the method comprising: compiling a guest operating system; detecting virtualization-sensitive commands that do not cause a trap in a particular mode during execution of the guest operating system compilation; Storing the location of the detected virtualization sensitive command in a specific section of an Executable and Linking Format (ELF) file; and writing the stored virtualization sensitive instruction into a software interrupt (SWI) command and an offset of the specific section, and performing the virtualized guest operating system by virtualizing the guest operating system.

The present invention has the effect of facilitating emulation by storing information on virtualization sensitive commands in an ELF file of a precompiled kernel to use information stored in virtualization sensitive command emulation for virtual machine operation.

FIG. 1 illustrates a process of compiling a conventional ARM architecture-based operating system and a process of processing a virtualization sensitive command by executing a tool developed in the present invention.
2 is a schematic configuration diagram of a policy-based providing system for virtualization of an ARM-based operating system according to an embodiment of the present invention.
FIG. 3 illustrates a structure of an ELF file compiled in a policy-based system based policy module for virtualization of an ARM-based operating system according to an embodiment of the present invention; FIG.
FIG. 4 illustrates a structure of a kernel ELF file compiled in a policy-based system based policy-based system for virtualization of an ARM-based operating system according to an embodiment of the present invention; FIG.
FIG. 5 is a flowchart of a policy-based provision method for virtualization of an ARM-based operating system according to an embodiment of the present invention. FIG.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. It will be appreciated that those skilled in the art will readily observe that certain changes in form and detail may be made therein without departing from the spirit and scope of the present invention as defined by the appended claims. To those of ordinary skill in the art.

The present invention relates to a method for pre-processing a virtualization-sensitive instruction to implement virtualization in an ARM-based operating system, and more particularly, to a method for detecting a virtualization-sensitive instruction in a kernel source code compile and storing the position in a specific section, Emulation of virtualization-sensitive instructions for virtual machine operation by emulating virtualization-sensitive instructions by changing virtualization-sensitive instructions to trap-generating instructions and offsets using section information in the compiled kernel's Executable and Linking Format (ELF) And to provide a technique for effectively performing emulation by using the same.

And throughout the specification, the term "module" refers to a unit for handling a particular function or operation, which may be implemented in hardware or software, or a combination of hardware and software.

Hereinafter, a policy-based provision system for virtualization of an ARM-based operating system according to an embodiment of the present invention will be described in detail with reference to FIG.

2 is a schematic configuration diagram of a policy-based provision system for virtualization of an ARM-based operating system according to an embodiment of the present invention.

Referring to FIG. 2, a system 200 to which the present invention is applied includes a system call interface 210, a control module 213, and hardware 212.

The system call interface 210 enables an application, which is a user mode process, to use the functions of the kernel.

Herein, the user mode is divided into one of the representative features of the Unix system together with the kernel mode.

The kernel mode is a privileged mode in which all address space is accessible and all instructions can be executed.

Privileged commands (mrs, msr, ldrbt, strbt, etc.) that may have a catastrophic effect on the system are accessible only to the address space allocated to the user mode and not accessible to the address space of the kernel mode I can not use it.

Thus, distinguishing between kernel mode and user mode is intended to protect the system against abnormal or malicious performance of application applications.

Subsequently, the control module 213 includes a command detection module 214 and an infrastructure policy module 216.

The command detection module 214 detects an instruction for which a trap is not generated in a specific mode at the time of compiling the guest operating system (guest OS).

At this time, when detecting the virtualization sensitive command, the corresponding command is processed as follows.

The base policy module 216 stores the command detected by the command detection module 214 in a specific area of a predetermined executable file, converts the stored command into a command capable of a system call interface, And controls to virtualize the guest operating system.

In this case, the specific mode refers to a user mode which is accessible only to a preallocated address area, that is, a non-privileged mode, and the detected instruction is a trap that is generated when the application is executed in a user mode Which means no virtualization sensitive instructions.

In addition, the base policy module 216 stores the location of the stored instruction in a specific section of an Executable and Linking Format (ELF) file at the time of compiling the kernel source code, Stores the default binary for the command.

Hereinafter, the ELF file refers to a file of a kernel compiled with information on the stored command. The following description will be made on the assumption that the stored command in the ELF file of the compiled kernel, Process.

The translated instruction in the base policy module 216 means a software interrupt (SWI) instruction that an application uses to call a system call and a trap can be generated. The application operates in a user mode Therefore, since the kernel function or the kernel data structure can not be accessed in the kernel area, the application program must use the system call interface 210 to use a kernel function or a data structure in the kernel area.

This system call interface 210 is implemented using a software interrupt, and the application application calls the system call interface 210 by explicitly calling the SWI instruction.

The base policy module 216 performs the emulation for the virtual machine operation.

Hereinafter, a structure of an ELF file compiled in a policy-based system based policy module for virtualization of an ARM-based operating system according to an embodiment of the present invention will be described in detail with reference to FIG.

FIG. 3 shows a structure of an ELF file compiled in a policy-based system based policy module for virtualization of an ARM-based operating system according to an embodiment of the present invention. Referring to FIG. 3, in the kernel source code S322, The modified ccl (S324), which has been converted into a script file, calls the original compiler cc1 (S326), and performs arm-parse according to the operation of the command detection module and the base policy module according to the present invention S328).

The arm-parse detects the virtualization-sensitive command in the file .s (S326) which is the result of the execution of the modified cc1 (S324) and stores the virtualization-sensitive command in a specific section (S332).

Here, we use the ARM assembler directives .pushsection and .popsection to store the location of the virtualization sensitive instructions in the section.

Thereafter, the as file is assembled to generate an .o file which is an object file (S334).

The linker collect2 (S336) links the generated .o (S334) file to generate a vmlinux file in ELF format, which is the final result (S338).

The kernel ELF file thus compiled is shown in FIG.

Referring to FIG. 4, in the compiled kernel ELF file, if the .sensitive (434) section is left as it is, it is bootable in general hardware. When virtualization is performed, the position of the virtualization sensitive command in the .sensitive (434) Look for the original virtualization-sensitive instruction and save it in the SWI instruction and the .sensitive (434) section, which are the trap generation instructions. In this way, when the virtualization sensitive instruction is to be executed during kernel execution, information about the original virtualization sensitive instruction that caused the trap is needed. This information can be detected by adding the offset behind the SWI instruction in the .sensitive (434) have.

Hereinabove, a schematic configuration of a policy-based system for virtualization of an ARM-based operating system according to an embodiment of the present invention has been described.

Hereinafter, a policy-based provision method for virtualization of an ARM-based operating system according to an embodiment of the present invention will be described with reference to FIG.

FIG. 5 is a flowchart of a policy-based provision method for virtualization of an ARM-based operating system according to an exemplary embodiment of the present invention.

Referring to FIG. 5, a guest operating system is compiled at step 510, and at step 512, a virtualization sensitive command that does not cause a trap in a specific mode during the compilation of the guest operating system is detected.

In this case, the specific mode refers to a non-privileged mode accessible only to a preallocated address area, and the virtualization sensitive command does not cause a trap when the application is executed in a user mode in which an application can operate.

In step 514, the kernel source code is compiled. In step 516, the detected virtualization sensitive command is stored in a specific section of an Executable and Linking Format (ELF) file.

In this case, the ELF file refers to a file of a kernel compiled with information on the stored command.

In step 518, the stored virtualization sensitive instruction is converted into a software interrupt (SWI) instruction. In step 520, the virtualization instruction is converted into an offset of the specific section.

In step 522, the guest operating system is virtualized, and the virtualized guest operating system is executed in step 524.

As described above, the operation of the policy-based provision system and method for virtualization of the ARM-based operating system according to the present invention can be performed. While the present invention has been described with respect to the specific embodiments, Can be carried out without departing from the scope. Accordingly, the scope of the present invention should not be limited by the illustrated embodiments, but should be determined by equivalents of the claims and the claims.

210: system call interface 213: control module
214: command detection module 216: based policy module
212: Hardware

Claims (13)

A policy-based provisioning system for virtualization of an ARM-based operating system,
A command detection module for detecting an instruction that does not generate a trap in a specific mode when compiling a guest OS;
A base for controlling the guest operating system to virtualize the guest operating system by converting the stored command into a command for enabling a system call interface and converting the stored command into an offset of the specific area, Policy-based provisioning system for virtualization of an ARM-based operating system. The method according to claim 1,
And a non-privileged mode accessible only to a pre-allocated address area. The method of claim 1,
Wherein the virtual application is a virtualization-sensitive instruction that does not cause a trap when the application is executed in a user mode in which the application is operable. 2. The system of claim 1,
And storing the stored instruction in a specific section of an executable and linking format (ELF) file when the kernel source code is compiled. 2. The method of claim 1,
Wherein the application program is a software interrupt (SWI) instruction that is used by an application to call a system call and generate a trap. 2. The system of claim 1,
Wherein the default binary of the instruction word is stored in a location where the virtual address of the stored instruction word is stored. The method according to claim 4,
Wherein the information about the stored command is a file of a precompiled kernel. 2. The system of claim 1,
Wherein the emulation of the stored instructions is performed for a virtual machine operation. 2. The system of claim 1,
And the specific compiler is converted into a script file when the guest operating system is compiled. A policy-based provisioning method for virtualization of an ARM-based operating system,
The process of compiling the guest operating system,
Detecting a virtual sensitive command in which a trap is not generated in a specific mode while compiling the guest OS;
The process of compiling the kernel source code,
Storing the detected virtualization sensitive command in a specific section of an Executable and Linking Format (ELF) file;
Translating the stored virtualization sensitive instructions into Software Interrupt (SWI) instructions and offsets of the specific sections;
And virtualizing the guest operating system to perform the virtualized guest operating system. 11. The method according to claim 10,
Wherein the non-privileged mode is a non-privileged mode accessible only to a pre-allocated address region. 11. The method of claim 10, wherein the virtualization-
A method for providing policy-based virtualization for an ARM-based operating system, characterized in that no trap occurs when the application is executed in a user mode in which the application is operable. The method of claim 10,
Further comprising the step of storing a default binary of the virtualization sensitive instruction in a location where the virtual address of the stored virtualization sensitive instruction is stored.

Images