一种基于微内核虚拟化的设备驱动优化模型

为解决日趋复杂的嵌入式系统的效率和可靠性问题,本文比较并分析了现有的设备驱动模型,针对嵌入式设备对虚拟化的特殊要求,参考L4微内核虚拟化技术,提出了一种新的虚拟设备驱动优化模型,不仅实现了微内核架构中多虚拟机间的驱动共享,并且在提供系统可靠性的同时,弥补了虚拟化技术带来的性能开销,提供了一个在效率、功能和可靠性三方面取得相对均衡的虚拟化环境。     

ARM-MuxOS:一台手机，多个世界

在移动设备上并发运行多个操作系统,可拓宽和多样化其使用模式,但目前采用的移动虚拟化管理系统技术会带来性能开销和多余的内存消耗。通过分析在单一移动设备上支持多个操作系统所带来的多OS内存管理和外设分配等方面挑战,研究并设计了物理内存在线分配和分时复用外设等新技术,本设计在Galaxy Nexus智能手机上最终实现了ARM-MuxOS原型系统。这一系统不仅可在单一移动设备上支持多个操作系统,而且可在内存较少的环境下管理多个OS的内存分配,避免了传统虚拟化技术的性能开销与工程量。实验结果表明,ARM-MuxOS原型系统不仅能支持Android与FireFox OS的快速并发执行,而且其性能和内存消耗优于现有的移动虚拟化管理系统。     

轻量级虚拟机软件技术——LVMM

为提高PC系统的可管理性和安全性,提出一种轻量级虚拟机软件技术——LVMM。定义活跃用户域,可直接访问除磁盘和网络之外的物理设备,以及虚拟磁盘和虚拟网络设备。保证在保持PC使用模式基本不变的前提下,可在同一平台上同时运行多个用户虚拟系统,且支持独立于用户操作系统的资源访问控制。经测试,LVMM原型系统具有较小的整体虚拟化开销。     

基于LXC的Android系统虚拟化技术

虚拟化技术的研究正逐渐从高性能服务器端转向移动智能设备领域. 现有的虚拟化方案多是采用多内核方案,系统负载高,效率低. 针对车载系统等平台多屏显示以及资源受限等问题,本文提出一种基于容器技术的Android轻量级虚拟化方案. 该方案通过利用Namespace资源隔离机制和Cgroup资源分配机制,使得ARM平台在资源使用较少的同时,能够同时启动多个Android虚拟机,并且各虚拟机上的屏幕显示相互独立. 测试结果表明,该方案的内存占用率较双系统方案降低了7%,而平均CPU使用率较原生Android系统仅增加了1%.     

墓于MIPS架构的内存虚拟化研究

内存虚拟化是系统虚拟化中如何有效抽象、利用、隔离计算机物理内存的重要方法,决定着系统虚拟化的整体性能.传统的纯软件内存虚拟化方法会产生较大的资源开销并且兼容性差,而硬件辅助的内存虚拟化方法需要重新设计处理器硬件架构.基于MIPS架构处理器提出一种软硬件协同的内存虚拟化方法,在不增加硬件支持的情况下提高内存虚拟化性能.提出的多层虚拟地址空间模型不仅可以解决MIPS架构处理器存在的虚拟化缺陷,而且可以在已有的内存虚拟化方法上提高性能.在多层虚拟地址空间模型的基础上,提出基于地址空间标识码(address space identity,ASID)、动态划分的旁路转换缓冲(translation lookaside buffer,TLB)共享方法,降低了虚拟机切换的开销.最终,在MIPS架构的龙芯3号处理器上实现了系统虚拟机VIRT-LOONGSO)N.性能测试表明,提出的方法可以提高大多数测试程序的性能,达到二进制翻译执行性能的3～5倍,并在TLB模拟方法的基础上提高了5％～16％的性能.     

虚拟化技术下的安全

随着作为云底层的虚拟化技术的蓬勃发展,在很多机构中,虚拟化技术已经成为其基础IT架构中的重要组成部分,许多虚拟化技术的优势也在各个部门中体现,如：服务器整合、更快更强大的硬件、简单的使用方法、灵活的快照技术,强大的故障迁移能力以及灾备能力等.在虚拟化技术应用越来越广泛的今天,虚拟化的安全问题也成为了这种繁荣背后的隐患.虚拟化技术的安全缺陷主要包括：宿主系统的安全、虚拟网络的安全、虚拟系统的安全以及主机系统和虚拟系统之间的控制安全等.     

一种适用于智能设备的多重操作系统架构

针对智能设备,为避免引入虚拟化技术而产生的性能开销,提出并实现了MuxOS。MuxOS是一种多重操作系统架构,使得智能设备可以在非虚拟化条件下运行多个操作系统。介绍了MuxOS工作原理,描述了MuxOS运行流程。测试结果表明, MuxOS性能优于Xen等虚拟化产品,可以实现操作系统间亚秒级的快速切换。     

基于单根I/O虚拟化的多根I/O资源池化方法

虚拟化技术在为现代数据中心提供高效的服务器整合能力和灵活的应用部署能力的同时,也对数据中心服务器的I/O系统设计提出了新的需求,现有I/O资源与服务器紧密绑定的I/O体系架构将产生成本上升、资源冗余、I/O连线复杂化等一系列问题.针对上述问题,提出了一种基于单根I/O虚拟化协议(single root I/O virtualization,SR-IOV)的多根I/O资源池化方法:基于硬件的多根域间地址和ID映射机制,实现了多个物理服务器对同一 I/O设备的共享复用,有效减少单体服务器所需的设备数量和连线数量,并进一步提高服务器密度;同时提出虚拟I/O设备热插拔技术和多根共享管理机制,实现了虚拟I/O资源在服务器间的实时动态分配,提高资源的利用效率.提出的方法在可编程逻辑器件(fieid-programmable gate array,FPGA)原型系统中进行了验证,其评测表明,方法能够在实现多根I/O虚拟化共享的同时,保证各个根节点服务器获得近乎本地直连设备的I/O性能.     

基于Android的虚拟桌面USB设备重映像系统的设计

虚拟桌面是基于服务器的计算模型,可提高计算机的资源管理效率。现有的虚拟桌面对USB设备支持不足,无法实现USB设备的桌面虚拟化。针对这一问题,在基于Android的虚拟桌面上设计USB设备重映像系统,实现通过虚拟桌面对USB设备的操控。该系统通过NDK构建USB设备监听模块和控制模块,利用Socket在进程间传递USB设备信息,利用基于TCP/IP协议的消息框架与服务器进行数据传输。实验结果表明,在Android虚拟桌面上对重映像的USB设备进行读写操作,其传输速率与本地USB的传输速率相当。     

性能虚拟化存储系统的设计与实现

针对集中共享存储环境中不同应用间的性能隔离和性能保证问题,在容量虚拟化管理的基础上提出一种性能虚拟化管理机制,实现同时支持容量和性能虚拟化管理的虚拟存储系统。该系统采用扩展了接纳管理和空闲资源公平分配机制的比例带宽资源分配算法,实现虚拟磁盘间的性能虚拟化,避免多个虚拟磁盘间的性能干扰。     

Intel virtualization technology

A virtualized system includes a new layer of software, the virtual machine monitor. The VMM's principal role is to arbitrate accesses to the underlying physical host platform's resources so that multiple operating systems (which are guests of the VMM) can share them. The VMM presents to each guest OS a set of virtual platform interfaces that constitute a virtual machine (VM). Once confined to specialized, proprietary, high-end server and mainframe systems, virtualization is now becoming more broadly available and is supported in off-the-shelf systems based on Intel architecture (IA) hardware. This development is due in part to the steady performance improvements of IA-based systems, which mitigates traditional virtualization performance overheads. Intel virtualization technology provides hardware support for processor virtualization, enabling simplifications of virtual machine monitor software. Resulting VMMs can support a wider range of legacy and future operating systems while maintaining high performance.     

基于轻量级虚拟机的透明计算系统

基于虚拟机的透明计算系统MMNC-VX实现了未经修改的操作系统在透明计算环境中可按需加载,但其性能与同配置PC相比有较大差距。针对该问题,提出一种基于轻量级虚拟机的透明计算系统,仅虚拟网络设备,减少了由全虚拟化带来的开销,利用设备模型将用户操作系统的存储I/O请求重定向到服务器上处理,实现透明计算。经测试,原型系统性能与同配置PC基本相当,与MMNC-VX相比有较大提高。     

农机监控调度系统的设计与实现

针对目前农机作业中信息发布滞后、农机资源调度不合理、效率低下等问题,提出一种基于地理信息系统(GIS)、通用分组无线业务(GPRS)及全球定位系统(GPS)技术的农机监控调度系统,运用GPRS数据传输技术和GIS组件MapObjects,实现农机作业信息的即时采集与监控调度。为满足实时计算的需要,采用A-Star寻路算法规划农机的调度路径。应用结果表明,该系统能有效管理和调度农机,提高作业效率。     

基于XenDesktop桌面虚拟化网络平台的研究

Citrix公司推出的XenDesktop桌面虚拟化软件囊括了从虚拟底层硬件到虚拟应用程序的全部软件,它能将操作系统、应用程序和数据与底层的硬件系统分隔开。利用XenDesktop构建的整体虚拟化网络平台,解决了传统网络平台的软硬件费用高,架构复杂利用率低,管理、维护、升级困难,灾难和数据保护不足等缺陷。此外,其客户端可以通过局域网、互联网和无线网络进行访问,而且客户端本身也不再局限于传统X86 PC,MAC、平板电脑、手机都可作为客户端,实现了在任何位置、任何设备上进行访问的能力。     

网络功能虚拟化技术综述

无论是企业网还是数据中心,为实现相关应用功能、提升网络性能和加强网络安全等部署了大量的网络功能设备,但这些网络功能设备大多基于硬件,存在功能固化、扩展能力差、统一管理困难等问题。为解决上述问题,学术界和工业界不约而同将目光投向了网络功能虚拟化NFV技术。通过解耦网络功能和物理设备,使网络功能不受物理设备的约束,便于网络设备服务的升级更新,同时,NFV为新的体系结构、系统和应用的产生提供了可能。首先介绍了NFV技术,并与云计算和SDN进行对比,然后从VNF的系统结构、数据平面、控制平面、部署方式、实现语言和应用6个维度详细阐述了当前的研究成果,最后总结并展望了NFV未来的研究发展方向。     

Secure mobile device structure for trust IoT

In the IoT environment, all devices are connected to each other, and mobile device is considered as key device. But hacking into mobile devices is increasing rapidly with the increase in mobile device users. As the market share of Android OS increases, hacking of mobile devices has focused on Android devices. Although there are many security solutions for mobile devices, they are fragmentary for mobile threats; that is, they are solutions for only several threats rather than comprehensive solutions. There is hence a limit to protecting user’s and company’s data stored or used on mobile devices from various types of hacking. To address this, we propose a mobile device protection technology based on domain isolation. Virtualization technology has emerged to increase CPU utilization in server-class PCs and to run various OSs in one system. As these virtualization technologies become lightweight, they are beginning to be applied to embedded devices. In this paper, we applied this lightweight embedded virtualization technology to mobile devices to divide mobile devices into two areas. Therefore, users can have hidden area from hacker attack in addition to Android OS area which can use same as existing mobile device. There is a hardware-based mobile security solution using an secure element, but this has to be reflected in the manufacturing process of the mobile device. However, since the domain separation technology using the virtualization, proposed in this paper, is a software solution, it has an advantage that it can be applied to a device that is already in use. In addition, to protect the hidden area, application authentication/authorization and user authentication technology were applied. And we use white-box cryptography to get root of trust of the key which is used for secure storage and data encryption/decryption. We believe this is a fundamental solution for protecting the mobile device users from hacking. We implemented and tested various mobile applications operating on a mobile device that incorporates our proposed structure based on domain isolation. There is some performance degradation caused by the domain separation, but it is negligible. According to https://www.wired.com/insights/2012/11/mobile-supercomputers/, the chips for mobile phones have evolved and mobile phones will soon become supercomputers. In this case, the addition of virtualization to the mobile device will have less impact on the computing power of the mobile device, and data protection stored in mobile devices and secure execution environment of security programs will become more important issues. Therefore, our TeeMo structure is a necessary technology to protect mobile device users.     

New distributed virtual TV set architecture for a synergistic operation of sensors and improved interaction between real and virtual worlds

A virtual TV set is a studio that is able to combine recorded actors and objects with computer generated virtual environments in real time. In order to achieve this combination seamlessly, in an ideal configuration, several elements such as cameras, objects and people should be tracked so that all their actions on the stage have a corresponding effect in the virtual world. However, in the actual professional virtual TV sets, the tracking possibilities are quite limited because of the hardware and software architecture used, which has not had a major evolution since the first prototypes presented in the nineties. This traditional architecture uses to be rigid, including just one monolithic tracking system and low levels of interactivity. In this paper, a new distributed, flexible and scalable hardware and software architecture that allows the inclusion of multiple kinds of devices in parallel is introduced. It breaks with the traditional structure of the virtual TV sets, opening the technology to an easier inclusion of new devices without the need of updating the proprietary software of the set, thus facilitating its future evolution. The design, implementation and test of this architecture, through the adaptation of a traditional virtual TV set, is presented. The tests are developed through the inclusion of modern devices (in our case Optitrack infrared cameras, Microsoft Kinect V2 and Leap Motion) that, through a synergistic operation, allow the system to solve some traditional drawbacks of this technology such as free and multiple object and camera tracking, presenter natural interaction and automatic distance keying.     

Virtio network paravirtualization driver: Implementation and performance of a de-facto standard

One of the techniques used to improve I/O performance of virtual machines is paravirtualization. Paravirtualized devices are intended to reduce the performance overhead on full virtualization where all hardware devices are emulated. The interface of a paravirtualized device is not identical to that of the underlying hardware. The OS of the virtual guest machine must be ported in order to use a paravirtualized device. In this paper, the network virtualization done by the Kernel-based Virtual Machine (KVM) is described. The KVM model is different from other Virtual Machines Monitors (VMMs) because the KVM is a Linux kernel model and it depends on hardware support. In this work, the overhead of using such virtual networks is been measured. A paravirtualized model by using the virtio [38] network driver is described, and some performance results of web benchmark on the two models are presented.