Runtime Self-Diagnosis and Self-Recovery Infrastructure for Embedded Systems

Cloud computing model along with virtualization enables scalable infrastructures and provides on demand access to computing resources. Virtualization technology facilitates multiple virtual servers to run on a physical server to enhance the utilization of the server. Hypervisor as a virtualization layer provides an infrastructural support to multiple virtual machines above it by virtualizing hardware resources such as CPU, Memory, Disk and NIC. Hypervisors give near native performance by negating virtualization overhead. ESXi is one of the hypervisors which gives near native performance using full virtualization technique. It is encouraging to study how different Operating Systems (OSs) perform in a virtualized environment in the Private Cloud with ESXi hypervisor. Guest Operating Systems do come in para-virtualized and hardware virtualized flavors. It is innovative idea to compare them from performance perspective to give an idea about their performance variations in different tests. This paper conducts different performance tests with low, medium, high workloads and results are gathered using SIGAR API (System Information Gatherer and Reporter) and explains the behavior of each operating system and gives the reasoning of results with the help of different virtualization techniques. In the experiment, CloudStack (open source cloud computing software) is used to create a private cloud, in which management server is installed on Ubuntu 12.04 - 64 bit operating system. ESXi hypervisor is installed on bare metal as a host in the cluster. The different guest operating systems are installed on ESXi hypervisor and their performances have been evaluated in detail by using SIGAR Framework.

In traditional framework, mandatory access control (MAC) system and malicious software are run in kernel mode. Malicious software can stop MAC systems to be started and make it do invalid. This problem cannot be solved under the traditional framework if the operating system (OS) is comprised since malwares are running in ring0 level. In this paper, we propose a novel way to use hypervisors to protect kernel integrity and the access control system in commodity operating systems. We separate the access control system into three parts: policy management (PM), security server (SS) and policy enforcement (PE). Policy management and the security server reside in the security domain to protect them against malware and the isolation feather of the hypervisor can protect them from attacks. We add an access vector cache (AVC) between SS and PE in the guest OS, in order to speed up communication between the guest OS and the security domain. The policy enforcement module is retained in the guest OS for performance. The security of AVC and PE can be ensured by using a memory protection mechanism. The goal of protecting the OS kernel is to ensure the security of the execution path. We implement the system by a modified Xen hypervisor. The result shows that we can secure the security of the access control system in the guest OS with no overhead compared with modules in the latter. Our system offers a centralized security policy for virtual domains in virtual machine environments.

Virtualization platforms allow multiple operating systems to run on the same hardware. One of their central goal is to provide strong isolation between guest operating systems, unfortunately, they are often vulnerable to practical side-channel attacks. Cache attacks are a common class of side-channel attacks that use the cache as a side channel. We formalize an idealized model of virtualization that features the cache and the Translation Look aside Buffer (TLB), and that provides an abstract treatment of cache-based side-channels. We then use the model for reasoning about cache-based attacks and countermeasures, and for proving that isolation between guest operating systems can be enforced by flushing the cache upon context switch. In addition, we show that virtualized platforms are transparent, i.e. a guest operating system cannot distinguish whether it executes alone or together with other guest operating systems on the platform. The models and proofs have been machine-checked in the Coqproof assistant.

Consolidating multiple virtual machines into a single server has been widely adopted in cloud computing to improve system utilization. However, the sharing of physical CPUs among virtual machines in consolidated systems poses a new challenge in providing an illusion of continuous CPU execution to the guest operating systems (OS). Due to the time-sharing of physical CPUs, the execution of a guest OS is periodically interrupted, while the guest OS may not be aware of the discontinuity of virtual time against the real time. The virtual time discontinuity problem causes the delayed processing of critical OS operations, such as interrupt handling and lock processing. Although there have been several prior studies to mitigate the problem, they address only a subset of symptoms, require the modification of guest OSes, or change the processor architecture. This paper proposes a novel way to comprehensively reduce the inefficiency of guest OS execution in consolidated systems. It migrates the short-lived critical OS tasks to dedicated micro-sliced cores, minimizing the delays caused by time sharing. The hypervisor identifies the critical OS tasks without any OS intervention, and schedules the critical code sections onto the dynamically partitioned cores at runtime. The dedicated micro-sliced cores employ a short sub-millisecond quantum to minimize the response latencies for consolidated virtual machines. By readily servicing the critical tasks, the proposed scheme can minimize the adverse artifact of virtual machine consolidation without any modification of guest OSes.

The current operating system security is mainly achieved by controlling the access to the operating system, which cannot effectively ensure the kernel security and leads to a large amount of data redundancy in the system kernel due to the need to review and other judgments on all access operations in turn. To address these problems, we study the kernel security of operating systems based on the mandatory behavior control mechanism (MBC). Partition management of the kernel is achieved by partitioning the system kernel for isolation and setting inter-partition communication. The kernel functions are divided into three parts: security detection, storage management, and read management, to facilitate modular kernel management. After building the framework of the control The comparative experimental data show that the OS kernel data redundancy ratio is less than 13% and has good security when applying this OS security scheme.

Virtualization is used for various purposes such as cloud computing and a virtualized environment has been one of the most important platforms. In many virtualized environments, access to its persistent storage device, e.g. hard disk drive (HDD) or solid-state drive (SSD), is performed via two caches, which are page caches of guest and host operating systems. Both caches are usually managed based on the least recently used (LRU) algorithm. Previous work demonstrated that accesses to the host operating system page cache have a negative temporal locality of reference in these cases. Namely, an accessed block will probably not be accessed again in the near future. This locality severely decreases the hit ratio of a host operating system page cache. For addressing this issue, a method for improving the locality of reference in the accesses in the host operating system page cache by fixing data stored in the guest operating system page cache was proposed. However, the method assumed that the hot spot, which is the data area aggressively accessed, was given. Because of this limitation, the method can rarely be used. In this paper, we propose a method for improving the hit ratio of a host operating system page cache by enhancing the locality of reference at the cache. First, we explain the negative temporal locality of reference in virtualized environments. Second, we propose a method for enhancing the locality of reference in the host operating system page cache for improving its hit ratio without an assumption that its hotspot is given. This method observes file accesses in the system using an operating system kernel function and automatically detects the hotspot. This then stores the area in the guest operating system page cache. As a result, the locality of reference in the host operating system cache increases. Lastly, we evaluate this proposed method, then show that this method outperforms the normal method and can provide comparable performance with an existing method even if the hot spot is not given.

Cloud infrastructure commonly relies on virtualization. Customers provide their own VMs, and the cloud provider runs them often without knowledge of the guest OSes or their configurations. However, cloud customers also want effective and efficient security for their VMs. Cloud providers offering security-as-a-service based on VM introspection promise the best of both worlds: efficient centralization and effective protection. Since customers can move images from one cloud to another, an effective solution requires learning what guest OS runs in each VM and securing the guest OS without relying on the guest OS functionality or an initially secure guest VM state.We present a solution that is highly scalable in that it (i) centralizes guest protection into a security VM, (ii) supports Linux and Windows operating systems and can be easily extended to support new operating systems, (iii) does not assume any a-priori semantic knowledge of the guest, (iv) does not require any a-priori trust assumptions into any state of the guest VM. While other introspection monitoring solutions exist, to our knowledge none of them monitor guests on the semantic level required to effectively support both white- and black-listing of kernel functions, or allows to start monitoring VMs at any state during run-time, resumed from saved state, and cold-boot without the assumptions of a secure start state for monitoring.

As technology scales for increased circuit density and performance, the management of power consumption in embedded systems is becoming critical. Because the operating system (OS) is a basic component of the embedded system, the reduction and characterization of its energy consumption is a main challenge for the designers. In this work, a flow of low power OS energy characterization is introduced. The variation of the energy and power consumption of the embedded OS services is studied. The remainder of this article details the methods used to determine energy and power overheads of a set of basic services of the embedded OS: scheduling, context switch and inter-process communication. The impacts of hardware and software parameters like processor frequency and scheduling policy on the energy consumption are analyzed. Also, models and laws of the power and energy are extracted. Then, to quantify the low power OS energetic overhead, the obtained models are integrated in the system level design. Our method allows estimating the energy consumption of the low power OS services when running an application on a specific hardware platform.

On virtualization platforms, peak memory demand caused by hotspot applications often triggers page swapping in guest OS, causing performance degradation inside and outside of this virtual machine (VM). Even though host holds sufficient memory pages, guest OS is unable to utilize free pages in host directly due to the semantic gap between virtual machine monitor (VMM) and guest operating system (OS). Our work aims at utilizing the free memory scattered in multiple hosts in a virtualization environment to improve the performance of guest swapping in a transparent and implicit way. Based on the insightful analysis of behavioral characteristics of guest swapping, we design and implement a distributed and scalable framework HybridSwap. It dynamically constructs virtual swap pools using various policies, and builds up a synthetic swapping mechanism in a peer-to-peer way, which can adaptively choose different virtual swap pools.We implement the prototype of HybridSwap and evaluate it with some benchmarks in different scenarios. The evaluation results demonstrate that our solution has the ability to promote the guest swapping efficiency indeed and shows a double performance promotion in some cases. Even in the worst case, the system overhead brought by HybridSwap is acceptable.

In cloud computing, it is often assumed that cloud vendors are trusted; the guest Operating System (OS) and the Virtual Machine Monitor (VMM, also called Hypervisor) are secure. However, these assumptions are not always true in practice and existing approaches cannot protect the data privacy of applications when none of these parties are trusted. We investigate how to cope with a strong threat model which is that the cloud vendors, the guest OS, or the VMM, or both of them are malicious or untrusted, and can launch attacks against privacy of trusted user applications. This model is relevant because applications may be small enough to be formally verified, while the guest OS and VMM are too complex to be formally verified. Specifically, we present the design and analysis of an architectural solution which integrates a set of components on-chip to protect the memory of trusted applications from potential software and hardware based attacks from untrusted cloud providers, compromised guest OS, or malicious VMM. Full-system performance evaluation results show that the design only incurs 9 percent overhead on average, which is a small performance price that is paid for the substantial security gain.

The next decade will afford us computer chips with 100's to 1,000's of cores on a single piece of silicon. Contemporary operating systems have been designed to operate on a single core or small number of cores and hence are not well suited to manage and provide operating system services at such large scale. If multicore trends continue, the number of cores that an operating system will be managing will continue to double every 18 months. The traditional evolutionary approach of redesigning OS subsystems when there is insufficient parallelism will cease to work because the rate of increasing parallelism will far outpace the rate at which OS designers will be capable of redesigning subsystems. The fundamental design of operating systems and operating system data structures must be rethought to put scalability as the prime design constraint. This work begins by documenting the scalability problems of contemporary operating systems. These studies are used to motivate the design of a factored operating system (fos). fos is a new operating system targeting manycore systems with scalability as the primary design constraint, where space sharing replaces time sharing to increase scalability.We describe fos, which is built in a message passing manner, out of a collection of Internet inspired services. Each operating system service is factored into a set of communicating servers which in aggregate implement a system service. These servers are designed much in the way that distributed Internet services are designed, but instead of providing high level Internet services, these servers provide traditional kernel services and replace traditional kernel data structures in a factored, spatially distributed manner. fos replaces time sharing with space sharing. In other words, fos's servers are bound to distinct processing cores and by doing so do not fight with end user applications for implicit resources such as TLBs and caches. We describe how fos's design is well suited to attack the scalability challenge of future multicores and discuss how traditional application-operating systems interfaces can be redesigned to improve scalability.

Storage cache prefetching is an effective technique for reducing the access latency in hierarchical storage systems when the access pattern is predictable based on access locality.In Infrastructure-as-a-Service (IaaS) clouds, however, storage virtualization significantly rearranges data placement, thereby reducing the spatial locality observed in the host operating system (OS). Moreover, IaaS clouds consolidate applications with various workloads that may change over time.Therefore, the access pattern changes both spatially and temporally.This paper proposes an adaptive storage cache prefetching scheme that uses structural and statistical information inside virtual machines (VMs). Observation of the application's file usage and internal file-layout information in the guest OS allows the host OS to capture spatial and temporal locality during storage access.In addition, application-level performance statistics allow the host OS to tune the prefetch speed adaptively to prevent performance degradation due to excessive prefetching.We implemented a prototype cache prefetching system that cooperates with Linux and PostgreSQL in a VM.Experiments using the TPCx-V benchmark showed that VM-awareness improved the performance by 17.1% compared with traditional prefetching.Our system achieved 3.15 times better performance than an existing non-prefetching caching system.

Cloud datacenters are largely adopting virtual machines (VMs) to provide elastic computing services. As many cloud applications are communication-intensive, such as distributed data processing and web services, satisfactory network performance is critical to guarantee the service quality. In virtualized environments, a major problem is that the end hosts are separated by a virtualization layer and subject to the intervention of the hypervisor’s scheduling. Since the scheduling delays due to CPU sharing are commonly from tens of milliseconds to over one hundred milliseconds, when they are added to packet processing, network performance can be seriously degraded. To tackle this problem, prior works focus dominantly on modifying the hypervisor scheduler to hide the virtualization reality by reducing the delays as much as possible. However, this type of approaches brings many other problems, such as increased VM context switches and more complicated CPU resource allocation. This thesis tries to look at the problem from a different but simpler angle: we let the guest operating system (OS) accept the reality that each virtual CPU (vCPU) can be suspended and resumed at any time, and then think about how to refactor the network I/O subsystem to automatically tolerate such scheduling delays.
\nIn general, network I/O processing in the kernel includes two layers: protocol layer and interrupt layer. Our study shows that both layers are very sensitive to VM scheduling delays, and therefore must be redesigned accordingly. First, in the protocol layer, we propose a paravirtualized approach to help TCP counteract the distortion of congestion control caused by the hypervisor scheduler. Second, in the interrupt layer, for SMP-VMs that have multiple vCPUs, we propose a method to dynamically migrate interrupts from a preempted vCPU to a running one whenever it is possible, so that the delays will not be propagated to the protocol layer. Experiments with our prototypes in Xen/Linux show that our approaches can significantly improve the network throughput and responsiveness.

A prerequisite to implementing virtualization-aware security solutions is to solve the 'semantic gap' problem. Current approaches require a deep knowledge of the kernel data to manually solve the semantic gap. However, kernel data is very complex; an Operating System (OS) kernel contains thousands of data structures that have direct and indirect (pointer) relations between each other with no explicit integrity constraints. This complexity makes it impractical to use manual methods. In this paper, we present a new solution to systematically and efficiently solve the semantic gap for any OS, without any prior knowledge of the OS. We present: (i) KDD, a tool that systematically builds a precise kernel data definition for any C-based OS such as Windows and Linux. KDD generates this definition by performing points-to analysis on the kernel's source code to disambiguate the pointer relations. (ii) SVA, a security appliance that solves the semantic gap based on the generated definition, to systematically and externally map the virtual machines' physical memory and extract the runtime dynamic objects. We have implemented prototypes for KDD and SVA, and have performed different experiments to prove their effectiveness..

Multiprocessor application performance can be limited by the operating system when the application uses the operating system frequently and the operating system services use data structures shared and modified by multiple processing cores. If the application does not need the sharing, then the operating system will become an unnecessary bottleneck to the application's performance.This paper argues that applications should control sharing: the kernel should arrange each data structure so that only a single processor need update it, unless directed otherwise by the application. Guided by this design principle, this paper proposes three operating system abstractions (address ranges, kernel cores, and shares) that allow applications to control inter-core sharing and to take advantage of the likely abundance of cores by dedicating cores to specific operating system functions.Measurements of microbenchmarks on the Corey prototype operating system, which embodies the new abstractions, show how control over sharing can improve performance. Application benchmarks, using MapReduce and a Web server, show that the improvements can be significant for overall performance: MapReduce on Corey performs 25% faster than on Linux when using 16 cores. Hardware event counters confirm that these improvements are due to avoiding operations that are expensive on multicore machines.