Secure operating system switching

• US 20080092145A1
• Filed: 03/14/2007
• Published: 04/17/2008
• Est. Priority Date: 03/16/2006
• Status: Active Grant

• Current Assignee: NTT Docomo Incorporated (Nippon Telegraph and Telephone Corporation)
• Original Assignee: NTT Docomo Incorporated (Nippon Telegraph and Telephone Corporation)
• Inventors: Sun, Jun, Zhou, Dong
• Granted Patent: US 7,950,020 B2
• Time in Patent Office: Days
• US Class Current: 719/312
• CPC Class Codes: G06F 12/1441 for a range
• CPC Class Codes: G06F 12/145 the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism
• CPC Class Codes: G06F 2009/45583 Memory management, e.g. access or allocation
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

A method and apparatus is disclosed herein for secure operating system switching. In one embodiment, the method comprises identifying a second operating system of a plurality of operating systems that is to be active next; causing a memory access controller to enable exclusive access to a portion of memory for the second operating system once the second operating system becomes active; and causing the second operating system to become active.

Claims

1. A method for enabling a plurality of operating systems to run concurrently on a computer, wherein a first operating system in the plurality of operating systems is currently active, the method comprising:

identifying a second operating system of a plurality of operating systems that is to be active next;

causing a memory access controller to enable exclusive access to a portion of memory for the second operating system once the second operating system becomes active; and

causing the second operating system to become active.

2. The method defined in claim 1 wherein causing the second operation system to become active comprises performing a resume operation for the second operating system to cause the second operating system to resume operation.

3. The method defined in claim 1 further comprising:

determining that a forcible switching event occurred, wherein identifying the one operating system that is to be active next occurs in response to determining that the forcible switching event has occurred; and

performing a forced control transfer.

4. The method defined in claim 3 wherein the forcible switching event occurs after a currently active operating system fails to become inactive and fails to allow the one operating system to become active.

5. The method defined in claim 1 further comprising initiating operating system switching in response to an operating system switching event.

6. The method defined in claim 5 wherein the operating system switching event is a user event.

7. The method defined in claim 5 wherein the operating system switching event is generated in response to a switching button being depressed.

8. The method defined in claim 7 wherein the switching button is mapped as a secure device with state that the plurality of operating systems cannot alter and one or more interrupts that the plurality of operating systems cannot block.

9. The method defined in claim 7 wherein the switching event is generated after a timer reaches a predetermined time, where the timer is trigger to run in response to the switching button being depressed.

10. The method defined in claim 1 wherein causing the memory access controller to enable exclusive access to a portion of memory for the second operating system once the second operating system becomes active comprises statically partitioning memory into non-secure memory that is accessible by the second operating system and secure memory that is not accessible to the second operating system.

11. The method defined in claim 10 wherein the secure memory and non-secure memory include portions of memory on a chip.

12. The method defined in claim 1 further comprising monitoring for memory access violation by one or more operating systems in the plurality of operating systems other than the second operating system.

13. The method defined in claim 1 further comprising:

the second operating system performing a resume operation.

14. The method defined in claim 13 wherein the second operating system performing a resume operation comprises:

one or more drivers of the second operating system restoring hardware device states;

a kernel in the second operating system restoring and resuming operation of one or more subsystems; and

resuming normal operation by the second operating system.

15. The method defined in claim 13 further comprising:

receiving an indication to switch from a currently active operating system to the second operating system; and

the currently active operating system saving state associated with the currently active operating system.

16. The method defined in claim 15 wherein receiving the indication is in response to a user action or an operating system event.

17. The method defined in claim 1 further comprising:

the first operating system performing a suspend operation.

18. The method defined in claim 17 wherein the first operating system performing a suspend operation comprises:

saving state associated with one or more sub-systems and one or more hardware devices.

19. An article of manufacture having one or more computer readable storage media storing instructions thereon which, when executed by a system, cause the system to perform a method for enabling a plurality of operating systems to run concurrently on a computer, wherein a first operating system in the plurality of operating systems is currently active, the method comprising:

identifying a second operating system of a plurality of operating systems that is to be active next;

causing a memory access controller to enable exclusive access to a portion of memory for the second operating system once the second operating system becomes active; and

causing the second operating system to become active.

20. The article of manufacture defined in claim 19 wherein causing the second operation system to become active comprises performing a resume operation for the second operating system to cause the second operating system to resume operation.

21. The article of manufacture defined in claim 19 further comprising:

determining that a forcible switching event occurred, wherein identifying the one operating system that is to be active next occurs in response to determining that the forcible switching event has occurred; and

performing a forced control transfer.

22. The article of manufacture defined in claim 21 wherein the forcible switching event occurs after a currently active operating system fails to fails to become inactive and fails to allow the one operating system to become active.

23. The article of manufacture defined in claim 19 further comprising initiating operating system switching in response to an operating system switching event, wherein the operating system switching event is generated in response to a switching button being depressed, and further wherein the switching button is mapped as a secure device with state that the plurality of operating systems cannot alter and one or more interrupts that the plurality of operating systems cannot block.

24. The article of manufacture defined in claim 19 wherein causing the memory access controller to enable exclusive access to a portion of memory for the second operating system once the second operating system becomes active comprises statically partitioning memory into non-secure memory that is accessible by the second operating system and secure memory that is not accessible to the second operating system.

25. The article of manufacture defined in claim 19 further comprising:

the second operating system performing a resume operation.

26. The article of manufacture defined in claim 25 further comprising:

receiving an indication to switch from a currently active operating system to the second operating system; and

the current operating saving state associated with the currently active operating system.

27. The article of manufacture defined in claim 26 wherein receiving the indication is in response to a user action or an operating system event.

28. A system comprising:

a CPU;

a memory storing an operating system switcher having a memory access controller module to enable access and disable access to a plurality of regions by the plurality of operating systems, wherein the memory access controller disables access to a plurality memory regions for operating systems other than the one operating system during switching mode when the switcher causes a currently active operating system to become inactive and the one operating system to become active.

29. The system defined in claim 28 wherein the operating system switcher further comprises a switch policy enforcement module.

30. The system defined in claim 28 further comprising a computer-readable media storing the switch policy enforcement code;

and wherein the switch policy enforcement module comprises;

a processing device to execute the switch policy enforcement code;

switch policy enforcement hardware to generate one or more events; and

an event router controller to route switching requests and events generated by the policy enforcement hardware to the processing device for handling with execution of the switch policy enforcement code.

31. The system defined in claim 30 wherein state of the switch policy enforcement hardware and the routing performed by the event router controller are not modifiable by any of the plurality of operating systems.

32. The system defined in claim 29 wherein the memory access controller monitors for memory accesses for violations.

33. A method comprising:

performing secure operating system switching using n OS switcher that maintains secure isolation between OSes to prevent an OS from reading the memory of another and prevent an OS from crashing another OS or the system.

34. The method defined in claim 33 further comprising splitting memory to into a portion dedicated to use by a first operating system and a second portion dedicated to use by the second operation system.