Virtual Machine Hardware Power Management Through a Privileged Guest
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems for power management of hardware devices by virtual machines are inefficient, limited by host operating systems, and pose security risks due to direct interface exposure, leading to latency and potential malicious exploitation.
Innovation Solution
A system utilizing a privileged hypervisor and privileged guest, executed in system management mode, bypasses the host OS to directly manage hardware devices, obfuscating power-mode identifiers, and containing power management requests within the privileged guest to enhance security and reduce latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a guest driver is used to allow the virtual machine to access the power management hook, then the virtual machine can control power distribution, but the host OS may deny access due to security risks and limit available power modes
Solution Approach 1:
The patent introduces a privileged guest operating system as an intermediary between the virtual machine and the host system's power management hooks. This privileged guest acts as a trusted mediator that can safely access and control power management functions without requiring the host OS to expose its interfaces directly to the untrusted virtual machine, thereby resolving the security concern while enabling power management control.
2Ease of operation
If the host OS exposes an interface to the guest OS for power management, then the virtual machine can access power management hooks, but latency increases due to going through the traditional ACPI stack
Solution Approach 1:
The patent segments the power management control path by creating a dedicated privileged guest environment that has direct access to power management hooks, separating it from the traditional ACPI stack path. This segmentation allows power management operations to bypass the slower host OS ACPI processing layer, reducing latency while maintaining control.
3Adaptability or versatility
If the host OS exposes power management interface to the guest OS, then the virtual machine can control power modes, but security risks increase due to potential malicious exploitation
Solution Approach 1:
The privileged guest operating system serves as a secure intermediary that mediates all power management requests from the virtual machine. It validates and filters these requests before executing them, preventing malicious exploitation while still allowing legitimate power mode control. The privileged guest maintains security boundaries while enabling the desired adaptability.
4Reliability
If conventional power management methods are used through the host OS, then system security is maintained, but power management efficiency and control are reduced
Solution Approach 1:
The patent segments the system into a privileged guest environment that handles power management operations directly, separating this efficiency-critical function from the security-managed host OS path. This segmentation allows power management to execute more efficiently in the privileged guest while the host OS maintains overall system security through its normal protective mechanisms.
Data Source
AI summary
Some examples can enable secure and efficient power management of a target hardware device by a virtual machine. For example, a first hypervisor supporting a first virtual machine can receive a first request from the first virtual machine. The first request can indicate a target power mode for the target hardware device assigned to the first virtual machine. In response to receiving the first request, the first hypervisor can transmit a second request indicating the target power mode for the target hardware device to a second hypervisor. The second hypervisor can forward the second request to a second virtual machine, and the second virtual machine can cause the target hardware device to enter the target power mode in response to receiving the second request.


