System integrity monitors, such as rootkit detectors, rely critically on the ability to fetch and inspect pages containing code and data of a target system under study. To avoid being infected by malicious or compromised targets, state-of-the-art system integrity monitors rely on virtualization technology to set up a tamper-proof execution environment. Consequently, the virtualization infrastructure is part of the trusted computing base. However, modern virtual machine monitors are complex entities, with large code bases that are difficult to verify. In this paper, we present a new machine architecture called limited local memory (LLM), which we use to set up an alternative tamper-proof execution environment for system integrity monitors. This architecture builds upon recent trends in multicore chip design to equip each processing core with access to a small, private memory area. We show that the features of the LLM architecture, combined with a novel secure paging mechanism, suffice to bootstrap a tamper-proof execution environment without support for hardware virtualization. We demonstrate the utility of this architecture by building a rootkit detector that leverages the key features of LLM. This rootkit detector can safely inspect a target operating system without itself becoming the victim of infection.

In this paper, we introduce a lightweight processor abstraction layer named SPUMONE. SPUMONE provides virtual CPUs for respective guest OSes, and schedules them according to their priorities. In a typical case, SPUMONE schedules Linux with a low priority and an RTOS with a high priority. We first discuss why the traditional virtual machine monitor design is not appropriate for embedded systems, and how the features of SPUMONE allow us to design modern complex embedded systems with less efforts. Then, we describe two features of SPUMONE for the real-time resource management. SPUMONE also offers a novel mechanism to protect a critical component from malicious programs injected into the GPOS kernel.

When a real-time OS (RTOS) and a symmetric multiprocessing general purpose OS (SMP GPOS) are executed on the same multicore processor, there is a possibility to cause the lock holder preemption (LHP) problem, which is a well known problem of the sources of the performance degradation on an SMP GPOS. The problem occurs when a kernel mode thread holding a lock in a SMP GPOS is preempted by other OSes if these OSes share the same physical core. The existing solution does not take into account real-time responsiveness so it is not suitable to use in embedded systems. The paper proposes two new techniques to avoid the LHP problem for ensuring both the real-time responsiveness of real-time OS and the high throughput of SMP GPOS. The new proposed techniques have been implemented on our virtualization layer called SPUMONE, and we measured the results showing that the proposed new techniques reduce the LHP problem without degrading the real-time responsiveness.

A virtualization layer makes it possible to compose multiple functionalities on a multi-core processor with minimum modifications of OS kernels and applications. A multi-core processor is a good candidate to compose various software independently developed for dedicated processors into one multi-core processor to reduce both the hardware and development cost. In this paper, we present SPUMONE, which is a virtualization layer suitable for developing multi-core processor based-information appliances.

In this paper, we propose a virtualization architecture for the multi-core embedded system to provide more system reliability and security while maintaining the same performance without introducing additional special hardware supports or having to implement complex protection mechanism in the virtualization layer. Virtualization has been widely used in embedded systems, especially in consumer electronics, albeit itself is not a new technique, because there are various needs for both GPOS (General Purpose Operating System) and RTOS (Real Time Operating System). The surge of the multi-core platform in the embedded system also helps the consolidation of the virtualization system for its better performance and lower power consumption. Embedded virtualization design usually uses two kinds of approaches. The first one is to use the traditional VMM, but it is too complicated for use in the embedded environment if there is no additional special hardware support. The other is the use of the micro kernel which imposes a modular design. The guest systems, however, would suffer from considerable amount of modifications because the micro kernel lets the guest systems to run in user space. For some RTOSes and theirs applications originally running in kernel space, it makes this approach more difficult to work because a lot of privileged instructions are used in those codes. To achieve better reliability and keep the virtualization layer design light weighted, a common hardware component adopted in the multi-core embedded processors is used in this work. In the most embedded platforms, vendors provide additional on-chip local memory for each physical core and these local memory areas are private only to their cores. By taking this memory architecture's advantage, we can mitigate above-mentioned problems at once. We choose to re-map the virtualization layer's program called SPUMONE, which it runs all its guest systems in kernel space, on the local memory. By doing so, it can provide additional reliability and security for the entire system because the SPUMONE's design in a multi-core platform has each instance being installed on a separated processor core which is different from the traditional virtualization layer design and the content of each SPUMONE is inaccessible to each others. We also achieve this goal without bringing any overhead to the overall performance.

While recent embedded systems start to own more and more functionalities, security requirements become more and more important. In this paper we propose an approach to enhance the security of embedded systems. In this approach SPUMONE, a thin virtualization layer, is selected to build a multi-OS environment for its low overhead. Xv6 runs as trusted OS for executing the monitoring service that detects the violation of the integrity of the Linux kernel while Linux as a general purpose OS. The monitoring service checks whether Linux is compromised or not. A secure pager that offers the spatial isolation based on the core-local memory is proposed to protect the integrity of the xv6 kernel located in the main memory, which can make Linux and xv6 run in high security level.

In this paper, we propose a virtualization architecture for the multi-core embedded system to provide more sys-tem reliability and security while maintaining the same performance without introducing additional special hardware supports or having to implement complex protection mechanism in the virtualization layer. Embedded virtualization design usually uses two kinds of approaches, traditional VMM and microkernel approaches, but both of them suffer from performance or engineering cost problems. To achieve better reliability and keep the virtualization layer design light weighted, a common hardware component called local memory adopted in the multi-core embedded processors is used in this work. By taking this memory ar-chitecture's advantage, we can mitigate above-mentioned problems at once. We choose to re-map the virtualizationlayer's program called SPUMONE, which it runs all its guest systems in kernel space, on the local memory. By doing so, it can provide additional reliability and security for the entire system because the SPUMONE's design in a multi-core platform has each instance being installed on a separated processor core, which is different from the traditional virtualization layer design, and therefore the content of each SPUMONE in the local memory is inaccessible to each others.

The recent increase in complexity and functionality in embedded systems makes them more vulnerable to rootkit-type attacks, raising the need for integrity management systems. However, as of today there is no such system that can guarantee the system's safety while matching the low-resource, real-time and multi-core requirements of embedded systems. In this paper, we present a Virtual Machine Monitor (VMM) based monitoring service for embedded systems that checks the actual kernel data against a safe data specification. However, due to the VMM and multi-core nature of the system, the guest OS can be preempted at any time, leading to the checking of potentially inconsistent states. We evaluated two approaches to solve this problem: detecting such invalid states by checking specific kernel data, and detecting system calls using the VMM.

A hypervisor consolidates multiple numbers and multiple types of OSes into a single machine by multiplexing a real machine into a number of virtual machines (VMs). An example the typical application of a hypervisor is server consolidation which uses the same or similar types of VMs and OSes (symmetric). Another application is accommodating different types of OSes (asymmetric): open platform and closed platform, real-time and time sharing, general-purpose and dedicated purpose, emerging and legacy, etc. For instance, a mobile device consists of real-time OS, which controls radio transmissions, and general-purpose OS, which exposes highlevel API.

Multi-core processors are being increasingly adopted for embedded systems because they improve performance, power consumption and lower development cost. Composing multiple operating systems on a multi-core processor enhances the reusability of software when developing rich functional embedded systems. Multiple OS environments enable the product to use two versions of an operating system at the same time. In order to build multiple OS environments, a virtualization layer specialized for embedded systems is necessary, since most of processors for embedded systems support only two protection levels, and there is no hardware support for virtualization. In traditional approaches, an OS kernel runs at the user level to isolate the respective OS kernels to increase reliability, but this approach requires heavy modifications to the guest OSes if there is no proper hardware virtualization support that is rarely used in embedded systems. Therefore existing solutions are not preferred by the embedded system industry. In this paper, we propose a composition kernel where multiple OS kernels are running on top of a very thin hardware abstraction layer. A composition kernel can reduce the engineering cost of developing an embedded system by reusing existing OS kernels and application with minimum modification without assuming special hardware supports.

This paper introduces a new dependable operating system project, called DEOS, started in 2006, and scheduled to continue for six years. In this project, a safety extension mechanism called P-Bus is to be designed, and implemented in the Linux kernel so that a future dependability attribute is implemented with P-Bus. A hardware abstraction layer, called SPUMONE, is introduced so that a light-weight operating system, called ArcOS, and a monitoring service on top of ArcOS monitors the Linux kernel to provide a safety-net for the Linux kernel. New dependability metrics are being designed to enable developers and users to decide which hardware or software solution meets their dependability requirements, and thus can be used.

Recently, the engineering cost of embedded systems is rapidly increasing due to growing sophistication of services. To deal with the problem, hybrid operating system environments have been proposed. This enables to run a RTOS and a general purpose OS concurrently and to reuse software resources on both of them. This approach is efficient in reducing engineering costs. We reconfigured the requirement for these hybrid operating system environment and build a new architecture which fulfills these requirements by using virtualization techniques. Our system provides the facilities to build multiple operating system environment easily. There are two contributions in our systems. One is that the modification cost of the guest OS is small. The second contribution is improvement in system availability by enabling guest OS to reboot independently. Although we used virtualization layer to construct a hybrid operating system environment, the performance overhead is considering small. Therefor our approach is very practical and efficient for recent sophisticated embedded systems.

The emergence of functional embedded systems such as cell-phones and digital appliances brought up a new issue, building a system supporting both real-time and rich services. One of the solutions is leveraging a hypervisor to integrate an RTOS and a commodity OS into a single device. However, this approach induces the limitation of application deployment; all the high priority tasks should reside in the RTOS. In this paper, we propose a task grain scheduling for a real-time hypervisor, which enables a flexible application deployment between an RTOS and a commodity OS. We constructed a prototype system with an existing hypervisor, an RTOS, and a commodity OS. We measured some basic overheads, and fixed some tasks which were missing their deadlines using the task grain scheduling to meet their deadlines. The overheads were small and the task grain scheduling achieved a flexible real-time scheduling for the hypervisor based system.