• Journal of KIISE:Computer Systems and Theory
• /
• v.34 no.12
• /
• pp.618-629
• /
• 2007

In this paper, we propose an effective memory test environment, called a virtualized kernel, for 64bit multi-core computing environments. The term of effectiveness means that we can test all of the physical memory space, even the memory space occupied by the kernel itself, without rebooting. To obtain this capability, our virtualized kernel provides four mechanisms. The first is direct accessing to physical memory both in kernel and user mode, which allows applying various test patterns to any place of physical memory. The second is making kernel virtualized so that we can run two or more kernel image at the different location of physical memory. The third is isolating memory space used by different instances of virtualized kernel. The final is kernel hibernation, which enables the context switch between kernels. We have implemented the proposed virtualized kernel by modifying the latest Linux kernel 2.6.18 running on Intel Xeon system that has two 64bit dual-core CPUs with hyper-threading technology and 2GB main memory. Experimental results have shown that the two instances of virtualized kernel run at the different location of physical memory and the kernel hibernation works well as we have designed. As the results, the every place of physical memory can be tested without rebooting.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2009.11a
• /
• pp.45-46
• /
• 2009

최근에 다기능 복합화되는 임베디드 시스템을 위한 가상화 연구가 활발하다. 본 논문에서는 L4 마이크로커널을 기반으로 한 실시간 운영체제 MicroC/OS-II 가상화를 위한 L4 환경에서의 전체 구성, 인터럽트 핸들링, 게스트 운영체제 초기화 과정의 설계에 대해 기술한다.

• Journal of the Korea Society of Computer and Information
• /
• v.12 no.5
• /
• pp.103-112
• /
• 2007

In this paper, we implement a hypervisor that runs multiple uC/OS-II real-time kernels on one microprocessor. The hypervisor virtualizes microprocessor and memory that are main resources managed by uC/OS-II kernel. Microprocessor is virtualized by controlling interrupts that uC/OS-II real-time kernel handles and memory is virtualized by partitioning physical memory. The hypervisor consists of three components: interrupt control routines that virtualize timer interrupt and software interrupt, a startup code that initializes the hypervisor and uC/OS-II kernels, and an API that provides communication between two kernels. The original uC/OS-II kernel needs to be modified slightly in source-code level to run on the hypervisor. We performed a real-time test and an independent computation test on Jupiter 32-bit EISC microprocessor and showed that the virtualized kernels run without problem. The result of our research can reduce the hardware cost, the system space and weight, and system power consumption when the hypervisor is applied in embedded applications that require many embedded microprocessors.

• Journal of the Korea Society of Computer and Information
• /
• v.17 no.2
• /
• pp.1-11
• /
• 2012

Recently, we have seen several implementations that virtualize the ARM architecture. Since the current ARM architecture is not possible to be virtualized using the traditional technique called "trap-and-emulation", we usually detect all virtualization sensitive instructions during the run-time of a guest kernel and emulate them virtually rather than executing them directly. The emulation for virtualization is usually implemented either by binary translation or interpretation. Our research is about how to improve the performance of emulation for virtualization based on interpretation. The interpretation usually requires a few steps: instruction fetching, instruction decoding and instruction executing. In this paper, we propose a method that decodes all virtualization sensitive instructions during the compilation time of a guest kernel and reduces the time required for interpretation during the run time of the guest kernel. Our method provides both implementation simplicity and performance improvement of emulation for virtualization based on interpretation.

• Proceedings of the Korean Information Science Society Conference
• /
• 2012.06a
• /
• pp.158-160
• /
• 2012

가상화 기술은 하드웨어와 소프트웨어의 비약적인 발전과 함께 다양한 분야에 적용되어 컴퓨팅 자원 활용성을 높이고 있다. 최근에는 클라우드 컴퓨팅 환경과 함께 더 많은 수의 가상 머신의 지원이 요구되고 있다. 이에 따라 많은 수의 가상 머신에게 효율적인 I/O를 제공하기 위한 장치 가상화 기술의 중요성이 커지고 있다. 이를 해결하기 위해 다양한 장치 모델이 제안되었으나 모드 전환 비용에 대한 근본적인 해결 방법을 제시하지 못하고 있다. 이에 본 논문에서는 새로운 폴링 장치 가상화 기술인 커널 레벨 장치 가상화 프레임워크를 제안하고 구현된 프로토타입에 대한 실험을 통하여 본 기술을 검증하였다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2010.11a
• /
• pp.90-94
• /
• 2010

최근 많은 보안 공격 도구들은 커널 레벨에서 동작하도록 설계 되고 있다. 악의적인 행동이 시스템 모니터링 프로그램과 같은 권한 레벨에서 이루어지기 때문에 공격 도구들은 공격 대상으로부터 자신의 존재를 숨기고 활동할 수 있다. 이러한 커널 레벨 악성코드들에 대한 대처 방법으로 가상화 기술을 이용하는 더 높은 권한 레벨을 가진 가상머신모니터(VMM)에서의 시스템 모니터링 방법이 소개 되었다. 그러나 많은 가상화 기반 모니터링 도구들이 주로 페이지 폴트 예외를 이용하여 시스템 콜 호출을 감시하기 때문에 신뢰성이 떨어지고 확장 페이지 테이블 (EPT) 과 같은 최신 하드웨어 가상화 기술 지원을 받지 못한다. 이에 본 논문에서는 일반 보호 예외를 이용하는 새로운 시스템 콜 인터셉트 기법을 제안함으로써 기존 기법의 기술적 한계를 극복하고 신뢰도 높은 모니터링 기법을 제공하고자 한다. 또 해당 기법의 구체적 구현 방법을 서술하고 구현 결과를 실험함으로서 제안 기법을 검증한다.

• Proceedings of the IEEK Conference
• /
• 2009.05a
• /
• pp.255-257
• /
• 2009

Recently, researchers are focusing on the usefulness of microkernels regarding to the virtualization of embedded systems. We ported OKL4 2.1 microkernel on MBA2440 and SMDK6410 that use ARM920T and ARM1176JFZ-S cores respectively. The ported OKL4 2.1 environment will be used to develop various virtualization applications.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2021.07a
• /
• pp.541-542
• /
• 2021

클라우드 컴퓨팅 환경에서는 고성능 컴퓨팅을 지원하기 위해 사용자에게 GPU(Graphic Processing Unit)가 할당된 가상머신을 제공하여 사용자가 고성능 응용을 실행할 수 있도록 지원한다. 일반적인 컴퓨팅 환경에서 한 명의 사용자가 GPU를 독점해서 사용하기 때문에 자원 경쟁으로 인한 문제가 상대적으로 적게 발생하지만 독립적인 여러 사용자가 컴퓨팅 자원을 공유하는 클라우드 환경에서는 자원 경쟁으로 인해 서로 성능 영향을 미치는 문제를 발생시킨다. 본 논문에서는 여러 개의 가상머신이 단일 GPU를 공유하는 RPC(Remote Procedure Call) 기반 GPU 가상화 환경에서 다수의 가상머신이 GPGPU(General Purpose computing on Graphics Processing Units) 작업을 수행할 때 GPU 메모리 입력 경쟁으로 인해 발생하는 커널 함수의 실행 지연 문제를 분석한다.

• The KIPS Transactions:PartC
• /
• v.18C no.3
• /
• pp.157-166
• /
• 2011

The virtualization layer is executed in higher authority layer than kernel layer and suitable for monitoring operating systems. However, existing virtualization monitoring systems provide simple information about the usage rate of CPU or memory. In this paper, the monitoring system using full virtualization technique is proposed, which can monitor virtual machine's dynamic kernel object as memory, register, GDT, IDT and system call table. To verify the monitoring system, the proposed system was implemented based on KVM(Kernel-based Virtual Machine) with full virtualization that is directly applied to linux kernel without any modification. The proposed system consists of KvmAccess module to access KVM's internal object and API to provide other external modules with monitoring result. In experiments, the CPU utilization for monitoring operations in the proposed monitering system is 0.35% when the system is monitored with 1-second period. The proposed monitoring system has a little performance degradation.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2017.10a
• /
• pp.330-334
• /
• 2017

Container-based virtualization reduces performance overhead compared with other virtualization technologies and guarantees an isolation of each virtual execution environment. So, it is being studied to block access to host resources or container resources for sandboxing in restricted system resource like embedded devices. However, because security threats which are caused by security vulnerabilities of the host OS or the security issues of the host environment exist, the needs of the technology to prevent an illegal accesses and unauthorized behaviors by malware has to be increased. In this paper, we define additional access permissions to access a virtual execution environment newly and control them in kernel space to protect attacks from illegal access and unauthorized behaviors by malware and suggest the Container Access Control to control them. Also, we suggest a way to block a loading of unauthenticated kernel driver to disable the Container Access Control running in host OS by malware. We implement and verify proposed technologies on Linux Kernel.