支援嵌入式作業系統動態更新及資源保護的平台之實作

A Platform for Supporting Dynamic Update and Resource Protection in an Embedded Operating System

徐翔宇(Hsiang-Yu Hsu)

指導教授 ： 姜美玲

共同指導教授 ： 黃光璿

國立暨南國際大學/科技學院/資訊工程學系/碩士(2010年)

https://doi.org/10.6837/NCNU.2010.00190

摘要

隨著硬體的快速發展與成熟的技術，嵌入式系統的功能需求也越來越多元與複雜。近年來，許多研究著重在提供動態更新的功能。動態更新的好處在於系統不需要重新開機即可動態升級系統的功能，如此一來才不會破壞系統的狀態或是停止任何系統的服務。對於已被售出或是配置出去的嵌入式系統像是無線感測節點來說，由於我們無法一一回收並更新它的功能，動態更新的機制更顯出它的重要。
本篇論文針對LyraOS [2-7] 嵌入式作業系統實作了一個動態更新的平台，透過此平台我們可以在不用重新開機的情況下動態升級嵌入式作業系統的功能。雖然在LyraOS先前的研究成果 [6,7] 已經支援動態更新的機制，但是此機制的主要目的在於降低系統在動態更新時的負擔，並且此機制也只有支援需求下載的功能。於本篇論文中，我們更進一步的實作動態更新的平台，來支援動態更新的傳播機制和提供系統資源保護機制。當系統完成更新之後，我們平台的元件管理單元會維護這些元件以及元件的相依性，被下載的元件也可以透過元件管理單元所釋出的API，讓與它相依的元件也一併被下載並安裝至嵌入式裝置中。
由於嵌入式系統的資源通常都是有限的，例如它所擁有的記憶體或是電源都非常有限。因此，如果沒有系統資源保護功能，動態更新下載的元件有潛在的風險可能會誤用系統的資源。雖然在LyraOS過去的研究成果中也已經實作一記憶體保護的機制，此機制是使用protection domain來限制下載元件的記憶體存取權限，使它們不會去破壞到其它的元件或是系統核心的記憶體空間。而這些下載的元件可以透過呼叫system call來取得系統的服務並且可以任意獲得系統資源。於本篇論文中，我們更進一步地設計與實作了一系統資源保護單元來保護我們系統的資源。透過此機制，我們的系統會記錄元件配置了哪些系統資源，如果偵測到元件誤用了系統的資源，我們系統將會回收系統資源並把設計不良的元件從系統中移除。目前，我們的平台可以有效地回收被浪費的記憶體空間、確保critical section的正常執行和防止null pointer access。
實驗結果證明，我們的平台可以有效地支援動態更新，並且防止設計不良的元件誤用系統資源。透過我們的修改，LyraOS的kernel image size總共增加了大約10%，記憶體保護功能的額外負擔小於5微秒。為了確保critical section能夠正常地執行，系統的額外負擔大約是11微秒。處理null pointer access的額外負擔需要約13915微秒。而每一個元件下載到嵌入式客戶端需要額外花費約66微秒，從系統移除元件則需要額外花費約190微秒。

關鍵字

嵌入式作業系統 ； 動態更新 ； 系統資源保護

並列摘要

As the rapid development of hardware and maturity of technology, embedded systems’ functions become more and more versatile and complex. In recent years, many researches focus on providing dynamic update functionality in embedded systems. The advantage of dynamic update is that we can dynamically upgrade system’s functionality without rebooting the whole system. Thus, this update would not corrupt system’s status or stop any system services. Dynamic update mechanism is very important for embedded systems such as wireless sensor modes. When they are deployed or sold, they can not be reclaimed to upgrade their functionalities.
In this thesis, we have implemented a platform that can dynamically upgrade LyraOS [2-7] embedded operating system without rebooting the whole systems. Although the original LyraOS has already supported a dynamic update mechanism [6,7], its aim is to reduce energy consumption while upgrading system’s functionality. In addition, the mechanism only supports demand loading functionality. In this thesis, we have further implemented a platform for supporting dynamic update dissemination mechanism and providing system resource protection mechanism. A component manager is developed to maintain the downloaded components and their component dependency. The downloaded components can invoke component manager exported API to download their dependent components into our platform.
Embedded systems’ resources such as memory and energy are usually limited. If our platform does not support any system resource protector functionality, the downloaded components have potential risk to misuse system resources. Although the original LyraOS has supported a memory protection mechanism, it uses ARM’s hardware protection domain to restrict the memory access permission of each downloaded component. Thus, downloaded components would not corrupt the memory spaces of other components or kernel. However, downloaded components can arbitrary acquire system resources through invoking system call service. In this thesis, we have designed and implemented a system resource protection mechanism to protect our system’s resources. Through this mechanism, the embedded client will record the information of each system resource that has been allocated to components. If our system detects the misuse of system resource from an error component, it will reclaim the wasted resource and remove the error component out of our embedded client. Currently, our platform can reclaim lost memory space, ensure normal execution of critical sections, and prevent null pointer access.
Experimental results demonstrate that our platform can effectively support dynamic update and prevent incautiously components to misuse our system’s resources. Our work totally increases about 10% of the size of LyraOS kernel image. The extra overhead of garbage collection is less than 5 microseconds. In order to ensure the normal execution of a critical section, the extra overhead is less than 11 microseconds. The extra overhead for handling null pointer access is about 13915 microseconds. The extra overhead for downloading a component into our embedded client is about 66 microseconds. The extra overhead for removing a component out of our embedded client is about 190 microseconds.

並列關鍵字

Embedded Operating System ； Dynamic Update ； System Resource Protection

參考文獻

[1] David Seal, ARM Architecture Reference Manual, Second Edition, Addison-Wesley, ISBN 0-201-73719-1, 2001.

[2] LyraOS homepage, http at http://163.22.32.199/joannaResearch/LyraOS/index.htm.

[3] Z. Y. Cheng, M. L. Chiang, and R. C. Chang, “A Component Based Operating System for Resource Limited Embedded Devices,” IEEE International Symposium on Consumer Electronics (ISCE’2000), Hong Kong, Dec. 5-7, 2000.

[4] Chi-Wei Yang, C. H. Lee, and R. C. Chang, “Lyra: A System Framework in Supporting Multimedia Applications,” IEEE International Conference on Multimedia Computing and Systems’99, Florence, Italy, June 1999.

[5] Zan-Yu Chen, “A Component Based Embedded Operating System,” Master Thesis, Department of Computer and Information Science, National Chiao-Tung University, Taiwan, R.O.C., June 2000.