Affordable Separation on Embedded Platforms

Soft Reboot Enabled Virtualization on a Dual Mode System
  • Oliver Schwarz
  • Christian Gehrmann
  • Viktor Do
Part of the Lecture Notes in Computer Science book series (LNCS, volume 8564)


While security has become important in embedded systems, commodity operating systems often fail in effectively separating processes, mainly due to a too large trusted computing base. System virtualization can establish isolation already with a small code base, but many existing embedded CPU architectures have very limited virtualization hardware support, so that the performance impact is often non-negligible. Targeting both security and performance, we investigate an approach in which a few minor hardware additions together with virtualization offer protected execution in embedded systems while still allowing non-virtualized execution when secure services are not needed. Benchmarks of a prototype implementation on an emulated ARM Cortex A8 platform confirm that switching between those two execution forms can be done efficiently.


Dual Mode Separation Soft Reboot Virtualization Hypervisor Embedded Systems Security 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    AMD: AMD64 virtualization: Secure virtualization: Secure virtual machine architecture reference manual. AMD Publication number 33047, revision 3.01 (2005)Google Scholar
  2. 2.
    ARM: ARMv7-A architecture reference manual, issue C,
  3. 3.
  4. 4.
  5. 5.
    ARM Technical Support Knowledge Articles: What is the fastest way to copy memory on a Cortex-A8? (2011),
  6. 6.
    Azab, A.M., Ning, P., Zhang, X.: SICE: a hardware-level strongly isolated computing environment for x86 multi-core platforms. In: Proceedings of the 18th ACM Conference on Computer and Communications Security, pp. 375–388 (2011)Google Scholar
  7. 7. Foundation: BeagleBoard product page,
  8. 8. Foundation: BeagleBoard-xM product page,
  9. 9. Foundation: BeagleBone product page,
  10. 10.
    Chaves, R., Kuzmanov, G., Sousa, L., Vassiliadis, S.: Improving SHA-2 hardware implementations. In: Goubin, L., Matsui, M. (eds.) CHES 2006. LNCS, vol. 4249, pp. 298–310. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  11. 11.
    Dam, M., Guanciale, R., Khakpour, N., Nemati, H., Schwarz, O.: Formal verification of information flow security for a simple ARM-based separation kernel. In: Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security, CCS 2013 (2013)Google Scholar
  12. 12.
    Ding, J.H., Lin, C.J., Chang, P.H., Tsang, C.H., Hsu, W.C., Chung, Y.C.: ARMvisor: System virtualization for ARM. In: Linux Symposium (2012)Google Scholar
  13. 13.
    Douglas, H., Gehrmann, C.: Secure virtualization and multicore platforms state-of-the-art report. Tech. Report (2009),
  14. 14.
    Gábriš, F.: Turning off hypervisor and resuming OS in 100 instructions. Presentation at FASM CON 2009, Myjava, Slovak Republic (2009),
  15. 15.
    Goldberg, R.P.: Architectural principles of virtual machines. Ph.D. thesis, Harvard University (1972)Google Scholar
  16. 16.
    Goldberg, R.P.: Survey of virtual machine research. IEEE Comp. Magazine (1974)Google Scholar
  17. 17.
    Grawrock, D.: The Intel safer computing initiative: Building blocks for trusted computing (2006)Google Scholar
  18. 18.
    Harrington, B.R., Mehta, C., Milton, D.M.I., Perez, M.A., Randall, D.L., Willoughby, D.R.: System and method for selectively executing a reboot request after a reset to power on state for a particular partition in a logically partitioned system. US patent US 7146515 B2,
  19. 19.
    Hwang, J.Y., Suh, S.B., Heo, S.K., Park, C.J., Ryu, J.M., Park, S.Y., Kim, C.R.: Xen on ARM: System virtualization using Xen hypervisor for ARM-based secure mobile phones. In: CCNC (2008)Google Scholar
  20. 20.
    Liu, J., Huang, W., Abali, B., Panda, D.K.: High performance VMM-bypass I/O in virtual machines. In: Proceedings of the annual conference on USENIX 2006 Annual Technical Conference, ATEC 2006, p. 3. USENIX Association, Berkeley (2006)Google Scholar
  21. 21.
    Make Linux Software: Super fast boot of embedded Linux,
  22. 22.
    McCune, J.M., Parno, B.J., Perrig, A., Reiter, M.K., Isozaki, H.: Flicker: an execution infrastructure for TCB minimization. SIGOPS Oper. Syst. Rev. 42, 315–328 (2008)CrossRefGoogle Scholar
  23. 23.
    Naughton, T., Vallee, G., Scott, S.: Dynamic adaptation using Xen. In: System-level Virtualization for High Performance Computing, HPCVirt (2007)Google Scholar
  24. 24.
    Open Virtual Platforms: OVP website,
  25. 25.
    Schellekens, D.: Design and Analysis of Trusted Computing Platforms. Ph.D. thesis, Katholieke Universiteit Leuven (2012)Google Scholar
  26. 26.
    Shafi, Q.: Cyber physical systems security: A brief survey. In: Computational Science and Its Applications (ICCSA), pp. 146–150 (2012)Google Scholar
  27. 27.
    SICS: SICS Thin Hypervisor (STH) source,
  28. 28.
    Smith, J.E., Nair, R.: Virtual Machines: Versatile Platforms for Systems and Processes. Morgan Kaufmann Publishers, USA (2005)Google Scholar
  29. 29.
  30. 30.
    Trusted Computing Group: PC client specific TPM interface specification. Version 1.2, Revision 1.0 (2005)Google Scholar
  31. 31.
    Wojtczuk, R., Rutkowska, J.: Attacking Intel trusted execution technology. Black Hat DC (2009)Google Scholar

Copyright information

© Springer International Publishing Switzerland 2014

Authors and Affiliations

  • Oliver Schwarz
    • 1
  • Christian Gehrmann
    • 1
  • Viktor Do
    • 1
  1. 1.SICS Swedish ICTSweden

Personalised recommendations