Synchronous execution of designated computing events using hardware-assisted virtualization
First Claim
1. A non-transitory machine readable medium on which are stored instructions, the stored instructions comprising instructions that when executed cause a machine for providing synchronous processing of designated computing events to:
- detect a designated computing event using a high priority, low capability routine;
create a copy code in an alternate memory space of a first code located in a first memory space;
modify the copy code to call for analysis of at least a portion of the copy code that corresponds to the first code;
update an address translation data structure so that the modified copy code is executed instead of the first code, the address translation data structure configured to translate a guest memory address to a host memory address after a return of the high priority, low capability routine; and
analyze synchronously the portion of the copy code that corresponds to the first code.
11 Assignments
0 Petitions
Accused Products
Abstract
Providing synchronous processing of the designated computing events using hardware-assisted virtualization technology by performing at least the following: detecting a designated computing event using a high priority, low capability routine, creating a copy code in an alternate memory space of a first code located in a first memory space, modifying the copy code to call for analysis of at least a portion of the copy code that corresponds to the first code, switching execution of the first code with the modified copy code using an address translation data structure that translates a guest memory address to a host memory address after a return of the high priority, low capability routine; and analyzing synchronously the at least a portion of the code within the copy code that corresponds to the first code based on the replacement of the first code with the modified copy code.
-
Citations
25 Claims
-
1. A non-transitory machine readable medium on which are stored instructions, the stored instructions comprising instructions that when executed cause a machine for providing synchronous processing of designated computing events to:
-
detect a designated computing event using a high priority, low capability routine; create a copy code in an alternate memory space of a first code located in a first memory space; modify the copy code to call for analysis of at least a portion of the copy code that corresponds to the first code; update an address translation data structure so that the modified copy code is executed instead of the first code, the address translation data structure configured to translate a guest memory address to a host memory address after a return of the high priority, low capability routine; and analyze synchronously the portion of the copy code that corresponds to the first code. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11)
-
-
12. A system for providing synchronous processing of designated computing events, comprising:
-
at least one processor; and a memory, coupled to the at least one processor, and comprises instructions, when executed by the at least one processor causes the system to; detect a designated computing event using a high priority, low capability routine, wherein the high priority, low capability routine interrupts a current process handled by the at least one processor; create a plurality of copy code instructions located in an alternate memory space that copies a plurality of original code instructions located in an original memory space; generate modified copy code instructions by adding a plurality of analysis instructions to the plurality of copy code instructions, the plurality of analysis instructions calling for analysis of at least a portion of the plurality of copy code instructions that match the plurality of original code instructions; execute the modified copy code instructions by mapping a guest memory address to a host memory address that references the alternate memory space with an address translation data structure; and during execution of the modified copy code instructions, analyze synchronously at least some of the plurality of copy code instructions that were copied from the plurality of original code instructions. - View Dependent Claims (13, 14, 15, 16, 17)
-
-
18. A method for providing synchronous processing of designated computing events, comprising:
-
detecting, using a programmable device, a designated computing event using a high priority, low capability routine, wherein the high priority, low capability routine interrupts one or more instructions currently handled by at least one processor; copying, using the programmable device, an original memory page to create an alternate memory page; modifying, using the programmable device, the alternate memory page such that the alternate memory page calls for further analysis of at least one instruction in the alternate memory page that matches the original memory page; mapping, using the programmable device, a guest memory address to a host memory address that references the alternate memory page with an address translation data structure; executing, using the programmable device, code in the modified alternate memory page; and analyzing synchronously, using the programmable device, the at least one instruction in the alternate memory page that matches the original memory page during execution of the code. - View Dependent Claims (19, 20, 21, 22)
-
-
23. A non-transitory machine readable medium on which instructions are stored, comprising instructions that when executed cause a machine to:
-
detect a designated computing event using a high priority, low capability routine, wherein the high priority, low capability routine interrupts one or more instructions currently processed by at least one processor; copy an original memory page to create an alternate memory page; modify the alternate memory page such that the alternate memory page calls for further analysis of at least one instruction in the alternate memory page that matches the original memory page; map a guest memory address to a host memory address that references the alternate memory page with an address translation data structure; execute code in the modified alternate memory page; and analyze synchronously the at least one instruction in the alternate memory page that matches the original memory page during execution of the code. - View Dependent Claims (24, 25)
-
Specification