Scribd
Upload
155 views16 pages

Arm Virtualization

Arm Virtualization

Uploaded by

Ravi Kuppan
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
155 views16 pages

Arm Virtualization

Arm Virtualization

Uploaded by

Ravi Kuppan
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 16

ARM Virtualization: CPU & MMU Issues

Prashanth Bungale, Sr. Member of Technical Staff

© 2010 VMware Inc. All rights reserved


Overview
 Virtualizability and Sensitive Instructions
 ARM CPU State
 Sensitive Instructions in ARM
• Dealing with Sensitive Instructions
• In place binary translation
 MMU Virtualization: Why & How?
 Comparison of ARM & x86 Virtualization

2
Virtualizability and Sensitive Instructions

 Defined in the context of a particular virtualization technique


 Example: Trap and Emulate Model
• Let VM execute most of its instructions directly on the h/w
• Except for some sensitive instructions that trap into the VMM and are emulated
• Sensitive instructions are those that interfere with:
• Correct emulation of the VM, or
• Correct functioning of the VMM
• E.g. “Halt Machine” instruction

VM1 VM2
VMM
Hardware

3
Virtualizability and Sensitive Instructions

 Sensitive Instructions as defined by Goldberg [1]


• Mode Referencing Instructions
• Sensitive Register/Memory Access Instructions
• Storage Protection System Referencing Instructions
• All I/O Instructions
 Popek and Goldberg’s Theorem about strict virtualizability [2]
• For any conventional third generation computer, a virtual machine monitor may be
constructed if the set of sensitive instructions for that computer is a subset of the set of
privileged instructions.

[1] Goldberg. Architectural Principles for Virtual Computer Systems. Ph.D. thesis, Harvard University, 1972.
[2] Popek and Goldberg, Formal requirements for virtualizable third generation architectures. In SOSP '73

4
ARM CPU State

Coprocessor Registers

5
CPSR: Current Program Status Register

IT
N Z C V Q J Reserved GE[3:0] IT[7:2] E A I F T M[4:0]
[1:0]

Current
Interrupt Processor Mode
Execution State Registers: Masks

ISETSTATE
Privileged-only Access Registers

ITSTATE Execution State Registers


Condition Flags
E ENDIANSTATE

6
Sensitive Instructions on ARM

 Coprocessor Access Instructions


• MRC / MCR / CDP / LDC / STC
 SIMD/VFP System Register Access Instructions
• VMRS / VMSR
 TrustZone Secure State Entry Instructions
• SMC
 Memory-Mapped I/O Access Instructions
• Load/Store instructions from/into memory-mapped I/O locations
 Direct (Explicit/Implicit) CPSR Access Instructions
• MRS / MSR / CPS / SRS / RFE / LDM(Exc. Return) / DPSPC
 Indirect CPSR Access Instructions
• LDRT / STRT – Load/Store Unprivileged (“As User”)
 Banked Register Access Instructions
• LDM/STM(User mode registers)

7
Dealing with Sensitive Instructions

 Hardware Techniques
• Privileged Instruction Semantics dictated by ISA - 1, 2, 3
• MMU-enforced traps (e.g., page fault) - 4
• Tracing/debug support (e.g., bkpt)
• Hardware-assisted Virtualization (e.g., extra privileged mode)

8
Dealing with Sensitive Instructions

 Software Techniques
• Interpretation / Full Emulation
• Binary Translation
• Cached Translation 
• In-Place Translation
• Para-Virtualization
• Shallow Para-Virtualization: replace sensitive instructions
• Deep Para-Virtualization: replace sensitive subsystems (e.g., process model, page-
table management, etc.)
• Binary Patching / Pre-Virtualization

9
In-place binary translation

 ARM has a fixed instruction size


• 32-bit in ARM mode and 16-bit in Thumb mode
 Perform binary translation in-place Guest
OS
• Instead of in a separate cache
• Follow control-flow
• Translate basic block (if not already translated) at the current PC Program
• Ensure interposition at end of translated sequence Counter

• All writes (but not reads) to PC now become dangerous instructions


• Replace dangerous (i.e., sensitive but unprivileged) instructions 1-1 with
hypercalls to force trap and emulate
 Guest transparency issues

10
1-1 Hypercalls

 Replace dangerous instructions with 1-1 Hypercalls


• Use trap instruction to issue hypercall
• Encode hypercall type & original instruction bits in hypercall hint
• Example:
mrs Rd, R <cpsr/spsr>

mrs r8, cpsr swi 0x088000

 Trap and Emulate Semantics


• Upon trapping into the monitor, decode the hypercall type and the original
instruction bits, and emulate instruction semantics

11
MMU Virtualization: Why?

 Translation Virtualization
• VAPA; PAMA
 Protection Virtualization
• Access permissions, domains
• Multiplex available hardware MMU protection support among:
• Protecting the hypervisor from the guests
• Protecting the guest kernel from guest user
 Cross-architectural versions (e.g., ARMv5 on ARMv6)
• Dealing with differences in cache, TLB architectures, page-table layout, etc.

12
MMU Virtualization: How?

 Shadow PT
• Intercept guest MMU events of interest
• Data/Prefetch Aborts, TTBR deltas, PT deltas, TLB ops
• Maintain (lazily) hypervisor-controlled, trusted shadow PT
• Options:
• TLB Coherency-based Shadow PTs / Cached Shadow PTs
• In-place Shadow PTs
 Para-Virtualized trusted guest PT
• Highly intrusive to guest MMU software
 Hardware virtualization support
• Nested / 2-stage Page Tables: VA->PA; PA->MA

13
Comparison of ARM vs. x86 Virtualizability

 Sensitive Instructions
Type of Sensitive Violating X86 [3] ARM
Instructions Goldberg’s
Requirement #
Sensitive Register 3B SGDT, SIDT, SLDT, -
Access SMSW, PUSHF/POPF
Protection System 3C LAR, LSL, VERR, VERW, LDM/STM (user regs),
References PUSH/POP, CALL, JMP, LDRT/STRT (“As User”)
INT n, RET, STR, MOVE
Both 3B & 3C - MRS, MSR, CPS, SRS,
RFE, DPSPC,
LDM (exc. return)

[3] John Scott Robin and Cynthia Irvine, Analysis of the Intel Pentium’s Ability to
Support a Secure Virtual Machine Monitor, USENIX Security Symposium, 2000.

14
Comparison of ARM vs. x86 Virtualizability

 Ring compression – protection mechanisms


• x86: Segmentation + Paging
• ARM: Paging (+ domains?)

 Instruction execution vs. Data Read/Write protection


• x86: CS for instruction fetch vs. DS/other for data access
• ARM: No explicit distinction b/w execute and read protection

 Cache architecture
• x86: Largely transparent; PIPT across all versions
• ARM: Exposes a lot of the cache architecture; VIVT/VIPT/PIPT

15
Comparison of ARM vs. x86 Virtualizability

 Instruction size
• x86: Variable
• ARM: Fixed -> enables more in-place patching mechanisms

 I/O
• x86: I/O instructions + memory-mapped I/O
• ARM: Only memory-mapped I/O

16

You might also like