281 results about "Hypervisor" patented technology

The invention discloses a method for communication between a user program and a virtual machine on a microkernel Hypervisor, the microkernel Hypervisor is provided with two shared memory areas, the shared memory area 1 is accessed by the user program and a root service Rootserver, the shared memory area 2 is accessed by the Rootserver and the virtual machine, the user program writes communication request data with the virtual machine into the shared memory area 1, and the user program writes communication request data with the virtual machine into the shared memory area 2. The method comprises the following steps that a VMM sub-thread is used as a shared memory area 1, a Rootserver is notified through inter-process communication, the Rootserver reads communication request data from the shared memory area 1, the communication request data is written into a shared memory area 2 after being analyzed by the VMM sub-thread, a system calls a syscale to transmit a communication request to a kernel, the kernel injects virtual interrupt into a virtual machine, and the virtual machine sends the communication request to the Rootserver. And an interrupt processing program of the virtual machine processes the communication request and writes a processing result into the shared memory area 2, then the processing result is returned to the Hypervisor through the Hypercall, and a Rootserver of the Hypervisor feeds back the processing result to a user program through the IPC. The method is designed for the microkernel Hypervisor environment, and the overall performance and efficiency of the embedded virtualization system are improved.

The invention discloses an ARMv8-based virtual machine interrupt through routing method, which comprises the following steps that: a Hypervisor directly routes a physical interrupt to an EL1 through configuration, sets a top page table address of a vCPU (Virtual Central Processing Unit) and a Hypervisor control register at the same time, and sets a vcpudid flag bit for indicating whether the vCPU adopts a virtual interrupt injection mechanism or a physical interrupt through routing mechanism; and judging whether an interrupt through routing condition is met or not so as to determine whether an interrupt through routing mechanism or a virtual interrupt injection mechanism is adopted, periodically judging whether a switching condition is met or not when the interrupt through routing mechanism is adopted, and switching from the interrupt through routing mechanism to the virtual interrupt injection mechanism if the switching condition is met. The method is compatible with two interrupt controller specifications of GICv2 and GICv3, supports the virtual machine and the hypervisor to respectively and independently respond to respective corresponding interrupt requests, and meanwhile, the method has the capability of dynamically switching an interrupt routing mechanism during the system operation period, so that the flexibility of interrupt processing and the expandability of the system are improved.

The invention relates to an operating system environment construction technology, and discloses an ARM (Advanced RISC Machines) processor-oriented micro-kernel operating system confidential computing environment construction method, which is characterized in that a hierarchical system architecture is constructed, a virtual machine monitor and a confidential domain management monitor are decoupled at an ARM exception level EL2, and the virtual machine monitor and the confidential domain management monitor run in mutually isolated address spaces. The RMM is used as an independent module for dynamic loading, a management mechanism of a confidential computing domain is specially used, and the Hypervisor is only responsible for strategy scheduling, so that the defect that the Hypervisor is bloated in function in a traditional scheme is overcome. According to the method, the RMM is loaded through the security startup process during startup, the confidential virtual machine is dynamically created during running, mirror image security verification, memory encryption and other mechanisms are integrated, and finally the security domain is destroyed after the application is finished. The method has the advantages that a flexible and safe confidential computing environment conforming to the minimum privilege principle is provided for the microkernel system, and the method is particularly suitable for embedded scenes with high safety requirements such as the Internet of Things and industrial control.

A secure boot method, system and device for an in-vehicle infotainment system, and a medium and a vehicle, which improve the security of a vehicle startup process. The method comprises: when a microcontroller unit detects an in-vehicle infotainment system power-on signal, using a first preset encryption algorithm to verify an application program; and if the verification of the application program is successful, outputting an enable signal to initiate the boot of a system on chip (S100); the system on chip using a second preset encryption algorithm to verify a digital signature of the system on chip; and if the verification of the digital signature is successful, loading a bootloader (S200); once the bootloader starts successfully, launching a hypervisor and a kernel to boot the system on chip (S300); and once the system on chip is successfully booted, loading a file system to boot an in-vehicle infotainment system (S400). The present invention can improve the security of the vehicle startup process and can be widely applied in the technical field of automotive control.

In examples, a VM may receive and aggregate a first attestation report corresponding to a CPU and a second attestation report corresponding to a GPU. The aggregated data may be provided to an attestation service, which may verify the attestation reports indicate a TCB is to include the VM and GPU state data and is to isolate the GPU state data and the VM from an untrusted host OS. Based at least on the TCB being verified, the VM may perform one or more operations using the TCB. The TCB may include a trusted hypervisor to isolate the VM and GPU state data within the GPU(s) from the untrusted host OS. The trusted hypervisor may prevent the host OS from accessing device memory assigned to the VM based at least on controlling an IOMMU and / or second-level address translation (SLAT) used to access the data.

Systems and methods are directed toward migration operations, such as live migration operations, associated with confidential computing environments. Responsive to a request to migrate data, a secure hypervisor may establish a secure communication channel to a network interface controller to pass one or more keys for accessing securely stored data. The secure hypervisor may generate a descriptor associated with a memory location of the data and then pass the descriptor to the network interface controller. As a result, encryption / decryption operations may be offloaded to the network interface controller, which may use the descriptor and key to migrate the data from a source location to a destination location.

The invention provides a virtualization-based big language model parameter encryption protection method and system, and the method comprises the steps: carrying out the corresponding preprocessing of a current to-be-protected big language model in a trusted environment, obtaining a modified linear operator parameter, and carrying out the encryption of a nonlinear operator; the non-trusted virtual machine is a main interface which can be accessed by a user, executes a reasoning task on the preprocessed large language model, and when operation of nonlinear operator encryption needs to be carried out, the non-trusted virtual machine is switched to the trusted virtual machine by calling the service of the virtual machine hypervisor, and the trusted virtual machine completes the operation of nonlinear operator encryption; and the trusted virtual machine processes the encryption operator operation unauthorized to be processed by the non-trusted virtual machine, and returns a result to the non-trusted virtual machine for next calculation of the non-trusted virtual machine. According to the method, mathematical characteristics of different operators of the model are identified, a mode of dynamically modifying the weight of the linear operator without influencing the output result of the model is provided, and safe and efficient operation of the linear operator is ensured.

A hypervisor controller is configured to assign an application identifier to a specific application running on a virtual machine in response to a transfer of control from the virtual machine to the hypervisor. Moreover, the virtual machine runs a plurality of applications of which the specific application is one and the hypervisor controller is further configured to generate the application identifier based on one or more registers of an emulated processor of the virtual machine. Therefore, the hypervisor controller provides a robust, secure, and efficient framework for managing the plurality of applications that are executed on the virtual machine, contributing to a high-performance virtualized environment.

Disclosed systems and methods for authenticating virtual machines, upon detecting a virtual machine launch (VML) request associated with a hypervisor and an unconfirmed VM, request a VM signing (VMS) certificate from a deployment / verification cloud server. The VMS certificate is forwarded to a certificate store of the hypervisor. After an unconfirmed VM is successfully authenticated, the VMS certificate may be deleted from the hypervisor certificate store. If an alert indicating a failed authentication associated is detected, termination operations are performed to prevent the unconfirmed VM from running under the hypervisor. The termination operations may include identifying a suspect key or signature associated with the unconfirmed VM and recording the suspect key or signature in a prohibited database store, such as a UEFI Secure Boot DBX variable store. For example, a suspect key or signature may be a key used to sign the unconfirmed VM.

An exemplary system includes a computing device configured to host a hypervisor. The hypervisor is configured to create a first container configured to host a first application and is allocated a first location of the plurality of locations of the memory and a second container configured to host a second application and is allocated a second location of the plurality of locations of the memory. During boot of the first container, the first container is configured to generate a cryptographic key that is based on a measurement or characteristic of process code of the first container, a configuration parameter of the first container, or any combination thereof. During boot of the second container, the second container is configured to generate a cryptographic key that is based on a measurement or characteristic of process code of the second container, a configuration parameter of the second container, or any combination thereof.

A method for authentication using a virtual machine by an electronic device is provided. The method includes identifying, in a first virtual machine in which a host operating system (OS) is implemented, a user input for an application or data requiring authentication, in response to the user input, setting, by the first virtual machine through a hypervisor, a control authority for the application or the data to a second virtual machine in which a guest operating system (OS) is implemented, and performing, based on control of the second virtual machine, an external authentication procedure for the application or the data, wherein the hypervisor is a platform for concurrently executing the host OS and the guest OS on the electronic device.

A system for global system memory management unit (SMMU) fault handling, the system comprising: a peripheral device having a guest virtual machine (GVM), the peripheral device configured to access a memory (DDR) through a system memory management unit (SMMU); a hosted hypervisor associated with the peripheral device, the GVM, the SMMU, and the memory (DDR), where, upon identification of a faulty memory transaction and a global SMMU fault issued, the hosted hypervisor is configured to identify that a flow identifier (SID) associated with the global SMMU fault is assigned to the GVM, and the hosted hypervisor is configured to reset only the GVM, and to identify that the flow identifier (SID) associated with the global SMMU fault is assigned to the GVM. And restarting of the complete system is avoided.

A system and method for validating the consistency of a computer backup mounts the backup as a virtual machine on a hypervisor host. A screenshot of the virtual machine's boot screen is recorded and sent to a machine-learning service for verification of boot status. The resulting boot status as successful or failed is recorded in metadata associated with that computer backup.

Disclosed are systems and methods for debugging program code using a computing system. The disclosed method includes designating a control point in a software application subject to a debugging procedure, and then executing the program code for the software application as a guest application executing within a virtual machine. Upon detection of a virtualization event, the hardware processor transfers program control to a hypervisor which then determines whether the virtualization event corresponds to the designated control point based on an execution state of the guest application. If so, the virtualization event handler may generate a debugging event that is used by a debugger.

The embodiment of the invention provides a time synchronization method and device between virtual machines, computing equipment and a storage medium, the virtual machines are type1 virtualized virtual machines and comprise a service virtual machine and an application virtual machine, the application virtual machine comprises a real-time virtual machine, and the method comprises the steps that the service virtual machine obtains PTP time through a PTP mechanism; the service virtual machine is used for sending the PTP (Precision Time Protocol) time to the Hypervisor through the Hypercall; after the Hypervisor is synchronized with the received PTP time, the Hypervisor notifies each application virtual machine to synchronize the PTP time; and each application virtual machine obtains the PTP time from the Hypervisor through the hypercall, and the PTP time is synchronized with the PTP time. According to the technical scheme provided by the embodiment of the invention, the PTP time is obtained through the service virtual machine by utilizing the PTP mechanism, and the time among the Hypervisor, the service virtual machine and the user virtual machine is synchronized by adopting the virtual PTP technology, so that high-precision synchronization of the time of all virtual machines in the same physical node is ensured.

The invention discloses a vehicle-mounted intelligent cabin log system and a vehicle-mounted intelligent cabin log management method, and relates to the field of vehicle machine logs, and the vehicle-mounted cabin system comprises an MCU and an SOC; the MCU runs an AutoSAR real-time operating system and is responsible for CAN signal receiving and transmitting, communication diagnosis, sleep awakening and power management of the whole vehicle; the SOC runs dual systems through a Hypervisor virtual machine monitoring program, and the dual systems comprise an instrument system and a central control system; wherein the instrument system end runs a QNX / Linux system to realize quick response, and the central control system end runs an Android system to process intelligent interaction and cockpit entertainment functions; wherein the cabin log system is established based on the vehicle-mounted cabin system of the vehicle infotainment device 1 and the vehicle-mounted cabin system of the vehicle infotainment device 2; the cabin log system is used for log generation and storage of the vehicle-mounted cabin system of the vehicle infotainment device 1 and the vehicle-mounted cabin system of the vehicle infotainment device 2.

Systems and methods for virtual machine networking can include detecting, by a virtual machine (VM), a primary virtual Network Interface Controller (vNIC) configured with a first media access control (MAC) address assigned to the VM by a hypervisor running on a host computer system, and detecting a standby vNIC configured with a second MAC address. They can further include binding a software Network Interface Controller (NIC) configured with a third MAC address to the primary vNIC and the standby vNIC, and selecting a vNIC from among those two vNICs for use by the software NIC for communicating network data packets. Additionally, they can include assigning the third MAC address to the selected vNIC, and communicating network data packets through the software NIC using the third MAC address.

Systems and methods for encryption support for virtual machines. An example method may comprise initializing, by a firmware module associated with a virtual machine running on a host computer system, an exclusion range register associated with the virtual machine with a value specifying a first portion of guest memory. The first portion of the guest memory may include an exclusion range marked as reserved. The second portion of the guest memory may b e encrypted using an ephemeral encryption key. Virtual machine firmware may identify, in the second portion of the guest memory, an instruction to a virtual device associated with the virtual machine, copy data corresponding to the instruction to the first portion of guest memory, and alert the hypervisor of the data stored in the first portion of guest memory.

A system for kernel protection includes a processor and a transmission interface. The processor is arranged to execute at least one guest virtual machine (VM), at least one primary VM, and a hypervisor. The at least one guest VM is arranged to send at least one command to a command hub. The at least one primary VM is arranged to manage and configure a safety setting according to the at least one command from the command hub and at least one policy, and manage and configure a safety protection component according to the safety setting. The hypervisor is arranged to manage and configure the safety protection component according to a ground rule and at least one safety setting command from the at least one primary VM. The transmission interface is arranged to bind the at least one primary VM to the hypervisor.

A method and system for replicating data change operations in a virtualized environment is provided. A data change filter and a data change driver in a hypervisor intercept data change operations from a virtual machine. A replication processing service receives a first stream of data change operations from the data change driver and a second stream from the data change filter. The service identifies a matching data change operation in both streams, replicates operations from the first stream up to a transition point, and then replicates operations from the second stream starting from the transition point. The transition point is pre-defined with respect to the matching data change operation. This approach enables seamless migration between driver-based and filter-based replication methods while maintaining data consistency and continuity.

A first hypervisor running on a first processor cluster is provided. During operation, the first hypervisor can determine a first set of processing nodes and a first memory unit of the first processor cluster in response to the booting up of a first Basic Input / Output System (BIOS) of the first processor cluster. The first hypervisor can discover a second hypervisor running on a second processor cluster comprising a second set of processing nodes and a second memory unit. The first hypervisor can operate, with the second hypervisor, a distributed system comprising the first and second sets of processing nodes and the first and second memory units. The first hypervisor can then operate, with the second hypervisor, a global virtual machine on the distributed system. The virtual memory space of the global virtual machine can be mapped to respective memory spaces of the first and second processor clusters.

The embodiment of the invention provides a security defense method and device based on Hypervisor, and relates to the technical field of virtualization. The method comprises the steps of determining a memory processing type in response to a preset trigger operation; and calling an hvc command by calling a virtual machine monitor corresponding to the memory processing type so as to indicate a Hypervisor to execute a Hypervisor processing function corresponding to the hvc command. According to the embodiment of the invention, the distribution or release of the internal memory of the process is realized through the Hypervisor with higher authority, even if the kernel of the operating system is broken by a malicious application program, the integrity of a security mechanism of the operating system can still be ensured, and the effective defense of security threats of the operating system is realized.

Technology is disclosed for establishing and administering multiple virtual machines, each with an audio, video and control (AVC) operating system (OS). The technology can also establish and administer cloud based AVC OSs. A server implementing this technology can perform real-time AVC processing, alongside soft and non-real-time processing and can host multiple, independent, virtual AVC OSs. Each AVC OS can perform the processing for an AVC setup. Each of the AVC OSs can be operated by a corresponding virtual machine controlled by a hypervisor running on the server. A cloud based AVC OS can perform processing for a corresponding remote AVC setup comprising multiple AVC devices. An AVC routing system can cause AVC signals from a particular AVC setup to reach a corresponding cloud AVC OS and conversely can cause signals from an AVC OS to reach the correct destination device.

The invention relates to a method for providing attestations for a virtualized computing platform communicating with a relay server, the relay server being configured to generate a vector commitment from a random vector transmitted by the hypervisor of the virtualized computing platform and generate a zero-knowledge proof from this vector commitment, the proof being generated so as to prove that the hypervisor is in a valid configuration and that the link between the hypervisor and a virtual machine is valid, without disclosing the exact configuration thereof.

A method, according to one embodiment, includes obtaining information generated by a hypervisor, where the generated information details a classification process. The classification process includes classifying physical memory blocks as residing on a first server or a second server, and associating the physical memory blocks with logical memory blocks of logical partitions of the first server and logical partitions of the second server. The method further includes providing the generated information to an operating system used to manage the logical partitions of the first server and the logical partitions of the second server. The operating system is caused to use the information to classify memory pools to a home memory cluster of the first server or to a remote memory cluster of the second server, and memory pages are caused to be dynamically stored within allocations of the memory pools based on predetermined usage statistics.

To provide a system and a method that support efficient virtualization in lossless interconnect networks.SOLUTION: A network switching environment 600 includes: one or more switches including at least a leaf switch; a plurality of host channel adapters each including at least one virtual function (VF), a virtual switch, and at least one physical function (PF); a plurality of hypervisors; and a plurality of virtual machines (VMs), and each of the plurality of virtual functions associated with at least one VF. A method deploys a plurality of host channel adapters comprising one or more virtual switches with a prepopulated local identifier (LID) architecture or a virtual switch with a dynamic LID assignment architecture, assigns the LID to each virtual switch, and calculates one or more linear forwarding tables based at least on the LIDs assigned to each of the virtual switches.SELECTED DRAWING: Figure 6

An aspect of the present disclosure is directed to a system for dynamic provisioning of hardware instances via reprogrammable fabric provided by a reprogrammable hardware device (RHD). The system preferably includes a memory having a first instruction set disposed therein, the first instruction set for provisioning a hypervisor processing unit (HPU) instance (also referred to herein as an orchestrator instance) within the reprogrammable fabric of the RHD, and a startup sequence for execution by the HPU instance. The startup sequence of the HPU instance is preferably configured to cause provisioning of at least a first hardware instance within the second portion of the reprogrammable fabric of the RHD, and for provisioning an interface instance to allow for a physical hardware device of the host computer system to communicate with the first hardware instance via a virtualized communication channel.

A verification operating system (VOS) is an intermediary operating system that verifies data of a primary operating system before the primary operating system controls of the computing device. When the computing device is initialized, initial boot processes load the VOS instead of the primary operating system. The VOS performs verification processes on data storing the primary operating system to verify that the primary operating system has not been manipulated or corrupted before passing control of the computing device to the primary operating system. A VOS also may be used to verify an operating system used by a virtual machine (VM). The VOS verifies data storing a VM operating system to be used for requested VMs. If the VOS verifies that the VM OS data is accurate, the VOS provides the VM OS data to a hypervisor for use in a VM.

Systems and techniques are provided for a booting a container. For instance, a process can include obtaining, from a first verified boot metadata partition of a host operating system, a first public key associated with a container; verifying a second verified boot metadata partition of the container using the first public key, wherein the second verified boot metadata partition of the container is signed using a first private key corresponding to the first public key associated with the container; accessing the second verified boot metadata partition of the container to obtain a first hash tree for a first file system of the container; and verifying the first file system of the container based on the first hash tree for the first file system of the container.

Upon receiving a request to hibernate a hypervisor of a virtualization system running on a first computer, acts are carried out to capture a state of the hypervisor, where the state of the hypervisor comprises hypervisor logical resource parameters and an execution state of the hypervisor. After hibernating the hypervisor by quiescing the hypervisor and storing the state of the hypervisor into a data structure, the data structure is moved to a different location. At a later moment in time, the data structure is loaded onto a second computing machine and restored. The restore operation restores the hypervisor and all of its state, including all of the virtual machines of the hypervisor as well as all of the virtual disks and other virtual devices of the virtual machines. Differences between the first computing machine and the second computing machine are reconciled before execution of the hypervisor on the second machine.