Search 250 million research papers

Detecting Hardware-Assisted Virtualization

Michael Brengel, Michael Backes, Christian Rossow · Lecture notes in computer science · 2016

Cited by 43

Hardware assisted embedded virtualization

Sawant, Saurabh Prakash · Fraunhofer-Publica (Fraunhofer-Gesellschaft) · 2014

Recent developments in embedded platforms and growing complexity of embedded applications have fathered certain functional demands for ex. security, portability etc. which virtualization techniques can efficiently address. Hardware manufacturers for embedded platforms have realized the benefits of virtualization and subsequently enhanced processor architecture to assist virtualization. In this thesis, we enhance FreeRTOS kernel for PowerPC architecture by utilizing the hardware support for virtualization in order to offer a virtualization platform for embedded applications. We design and implement microkernel components including hardware-enabled secure spatial partitioning. The outcome shows that hardware support for virtualization can offer efficient logical partitioning and improve security in embedded systems.

Cited by 0

Hardware-supported virtualization on ARM

Prashant Varanasi, Gernot Heiser · 2011

ARM is the dominant processor architecture for mobile devices and many other high-end embedded systems. Late last year ARM announced architectural support for virtualization, which will allow execution of unmodified guest operating system binaries. We have designed and implemented what we believe is the first hypervisor supporting pure virtualization using those hardware extensions and evaluated it on simulated hardware. We describe our approach and report our initial experience with the architecture.

Cited by 89

NeuroVM: Dynamic Neuromorphic Hardware Virtualization

Murat Işık, Jonathan Naoukin, I. Can Dikmen · 2024

This paper introduces a novel approach in neuromorphic computing, integrating heterogeneous hardware nodes into a unified, massively parallel architecture. Our system transcends traditional single-node constraints, harnessing the neural structure and functionality of the human brain to efficiently process complex tasks. We present an architecture that dynamically virtualizes neuromorphic resources, enabling adaptable allocation and reconfiguration for various applications. Our evaluation, using diverse applications and performance metrics, provides significant insights into the system’s adaptability and efficiency. We observed scalable throughput increases across configurations of 1, 2, and 4 Virtual Machines (VMs), reaching up to 5.1 Gibibits per second (Gib/s) for different data transfer sizes. This scalability demonstrates the system’s capacity to handle tasks that require substantial amounts of data. The energy consumption of our virtualized accelerator environment increased nearly linearly with the addition of more NeuroVM accelerators, ranging from 25 to 45 millijoules (mJ) as the number of accelerators increased from 1 to 20. Further, our investigation of reconfiguration overheads revealed that partial reconfigurations significantly reduce the time spent on reconfigurations compared to full reconfigurations, particularly when there are more virtual machines, as indicated by the logarithmic scale of time measurements.

Cited by 0

Hardware assisted embedded virtualization: Masterarbeit

Sawant, Saurabh Prakash · Publikationsdatenbank der Fraunhofer-Gesellschaft (Fraunhofer-Gesellschaft) · 2014

Recent developments in embedded platforms and growing complexity of embedded applications have fathered certain functional demands for ex. security, portability etc. which virtualization techniques can efficiently address. Hardware manufacturers for embedded platforms have realized the benefits of virtualization and subsequently enhanced processor architecture to assist virtualization. In this thesis, we enhance FreeRTOS kernel for PowerPC architecture by utilizing the hardware support for virtualization in order to offer a virtualization platform for embedded applications. We design and implement microkernel components including hardware-enabled secure spatial partitioning. The outcome shows that hardware support for virtualization can offer efficient logical partitioning and improve security in embedded systems.

Cited by 0

Towards hardware embedded virtualization technology

Paulo Garcia, T. Gomes, F. Salgado et al. · ACM SIGBED Review · 2014

Embedded virtualization possesses inherent challenges which differentiate the domain from traditional virtualization application fields such as server and desktop computing. Standard software virtualization solutions have a negative impact, not only on memory footprint and performance, but also on determinism and interrupt latency which are critical for the embedded real-time domain. Thus, efficient embedded virtualization requires domain-specific software and hardware support. This paper presents work in progress results of hardware-based Hypervisor implementation. The use cases of embedded virtualization are analyzed, justifying the reasoning for hardware-supported virtualization. Architectural and micro-architectural improvements to an ARM v5TE processor are described, demonstrating the performance advantages, and compared against ARM Virtualization Extensions, identifying respective vulnerabilities and providing alternative solutions which enable higher flexibility, minimizing virtualization costs. The research roadmap towards a hardware-complete Hypervisor, based on the presented results, is described.

Cited by 9

Hardware support for efficient virtualization

John Fisher-ogden · 2006

Virtual machines have been used since the 1960’s in creative ways. From multiplexing expensive mainframes to providing backwards compatibility for customers migrating to new hard-ware, virtualization has allowed users to maximize their usage of limited hardware resources. Despite virtual machines falling by the way-side in the 1980’s with the rise of the minicomputer, we are now seeing a revival of virtualization with virtual machines being used for security, isolation, and testing among others. With so many creative uses for virtualization, ensuring high performance for applications running in a virtual machine be-comes critical. In this paper, we survey current research to-wards this end, focusing on the hardware support which en-ables efficient virtualization. Both Intel and AMD have incor-porated explicit support for virtualization into their CPU de-signs. While this can simplify the design of a stand alone virtual machine monitor (VMM), techniques such as paravirtualization and hosted VMM’s are still quite effective in supporting virtual machines. We compare and contrast current approaches to efficient vir-tualization, drawing parallels to techniques developed by IBM over thirty years ago. In addition to virtualizing the CPU, we also examine techniques focused on virtualizing I/O and the memory management unit (MMU). Where relevant, we identify shortcomings in current research and provide our own thoughts on the future direction of the virtualization field. 1

Cited by 0

Selective hardware/software memory virtualization

Xiaolin Wang, Jiarui Zang, Zhenlin Wang et al. · ACM SIGPLAN Notices · 2011

As virtualization becomes a key technique for supporting cloud computing, much effort has been made to reduce virtualization overhead, so a virtualized system can match its native performance. One major overhead is due to memory or page table virtualization. Conventional virtual machines rely on a shadow mechanism to manage page tables, where a shadow page table maintained by the VMM (Virtual Machine Monitor) maps virtual addresses to machine addresses while a guest maintains its own virtual to physical page table. This shadow mechanism will result in expensive VM exits whenever there is a page fault that requires synchronization between the two page tables. To avoid this cost, both Intel and AMD provide hardware assists, EPT (extended page table) and NPT (nested page table), to facilitate address translation. With the hardware assists, the MMU (Memory Management Unit) maintains an ordinary guest page table that translates virtual addresses to guest physical addresses. In addition, the extended page table as provided by EPT translates from guest physical addresses to host physical or machine addresses. NPT works in a similar style. With EPT or NPT, a guest page fault can be handled by the guest itself without triggering VM exits. However, the hardware assists do have their disadvantage compared to the conventional shadow mechanism -- the page walk yields more memory accesses and thus longer latency. Our experimental results show that neither hardware-assisted paging (HAP) nor shadow paging (SP) can be a definite winner. Despite the fact that in over half of the cases, there is no noticeable gap between the two mechanisms, an up to 34% performance gap exists for a few benchmarks. We propose a dynamic switching mechanism that monitors TLB misses and guest page faults on the fly, and dynam-ically switches between the two paging modes. Our experiments show that this new mechanism can match and, sometimes, even beat the better performance of HAP and SP.

Cited by 14

Hardware Virtualization Applied to Rootkit Defense

Douglas P. Medley · 2007

Cited by 0

Hardware virtualization support for Afterburner/L4

Lehrstuhl Systemarchitektur, Verantwortlicher Betreuer, Prof Dr et al. · 2014

Hiermit erkläre ich, die vorliegende Arbeit selbständig verfaßt und keine anderen als die angegebenen Literaturhilfsmittel verwendet zu haben. I hereby declare that this thesis is a work of my own, and that only cited sources have been used. Karlsruhe, den 4. Mai 2007

Cited by 0

APIs, virtualization, serverless, hardware/software identification

Wang Hon · Edward Elgar Publishing eBooks · 2024

Cited by 1

Abstract Hardware Support for Efficient Virtualization

2008

Virtual machines have been used since the 1960’s in creative ways. From multiplexing expensive mainframes to providing backwards compatibility for customers migrating to new hardware, virtualization has allowed users to maximize their usage of limited hardware resources. Despite virtual machines falling by the way-side in the 1980’s with the rise of the minicomputer, we are now seeing a revival of virtualization with virtual machines being used for security, isolation, and testing among others. With so many creative uses for virtualization, ensuring high performance for applications running in a virtual machine becomes critical. In this paper, we survey current research towards this end, focusing on the hardware support which enables efficient virtualization. Both Intel and AMD have incorporated explicit support for virtualization into their CPU designs. While this can simplify the design of a stand alone virtual machine monitor (VMM), techniques such as paravirtualization and hosted VMM’s are still quite effective in supporting virtual machines. We compare and contrast current approaches to efficient virtualization, drawing parallels to techniques developed by IBM over thirty years ago. In addition to virtualizing the CPU, we also examine techniques focused on virtualizing I/O and the memory management unit (MMU). Where relevant, we identify shortcomings in current research and provide our own thoughts on the future direction of the virtualization field. 1

Cited by 0

Wireless Virtualization on commodity 802.11 hardware

Suman Banerjee, Arunesh Mishra, Anmol Chaturvedi et al. · 2008

In this paper we describe specific challenges in virtualizating a wireless network and multiple strategies to address them. Among different possible wireless virtualization strategies, our current work in this domain is focussed on a Time-Division Multiplexing (TDM) approach. Hence, we we present our experiences in the design and implementation of such TDM-based wireless virtualization. Our wireless virtualization system is specifically targeted for multiplexing experiments on a large-scale 802.11 wireless testbed facility. 1

Cited by 0

Hardware acceleration for Processing Function Virtualization

Federico Civerchia, Andrea Sgambelluri, Francesco Paolucci et al. · 2021

The 5G revolution will shape the telecommunication ecosystem providing high bandwidth and low latency. Moreover, the advent of Network Function Virtualizations (NFVs) will require higher network flexibility to move functions to the edge. Many NFVs are dedicated to data processing at the edge, thus they can be defined as Processing Function Virtualizations (PFVs) that may be accelerated exploiting programmable hardware. This paper proposes a Field Programmable Gate Array (FPGA) pipeline for multi-service chain, enabling dynamic deployment and hardware resources management. Results show the effectiveness of the approach since the pipeline latency remains constant with different input aggregated throughput.

Cited by 0

A Uniquified Virtualization Approach to Hardware Security

Greg Stitt, Robert Karam, Kai Yang et al. · IEEE Embedded Systems Letters · 2017

Virtualization has well-known security advantages for operating systems and software, but current techniques do not address increasingly important hardware-security concerns. For widely deployed systems (e.g., Internet of Things) and safety-critical systems (e.g., defense and automobiles), protecting against device tampering is critical, but is often unavoidable due to the relative ease of side-channel attacks. In this letter, we present a novel usage of virtualization that limits damage from bitstream tampering to a single instance of a deployed system by employing unique virtual architectures (i.e., overlays) on field-programmable gate arrays.

Cited by 8

Detecting Hardware-Assisted Virtualization With Inconspicuous Features

Zhi Zhang, Yueqiang Cheng, Yansong Gao et al. · IEEE Transactions on Information Forensics and Security · 2020

Recent years have witnessed the proliferation of the deployment of virtualization techniques. Virtualization is designed to be transparent, that is, unprivileged users should not be able to detect whether a system is virtualized. Such detection can result in serious security threats such as evading virtual machine (VM)-based malware dynamic analysis and exploiting vulnerabilities for cross-VM attacks. The traditional software-based virtualization leaves numerous artifacts/fingerprints, which can be exploited without much effort to detect the virtualization. In contrast, current mainstream hardware-assisted virtualization significantly enhances the virtualization transparency, making itself more transparent and difficult to be detected. Nonetheless, we showcase three new identified low-level inconspicuous features, which can be leveraged by an unprivileged adversary to effectively and stealthily detect the hardware-assisted virtualization. All three features come from the chipset fingerprints, rather than the traces of software-based virtualization implementations (e.g., Xen or KVM). The identified features include i) Translation-Lookaside Buffer (TLB) stores an extra layer of address translations; ii) Last-Level Cache (LLC) caches one more layer of page-table entries; and iii) Level-1 Data (L1D) Cache is unstable. Based on the above features, we develop three corresponding virtualization detection techniques, which are then comprehensively evaluated on three native environments and three popular cloud providers: i) Amazon Elastic Compute Cloud, ii) Google Compute Engine and iii) Microsoft Azure. Experimental results validate that these three adversarial detection techniques are effective (with no false positive) and stealthy (without triggering suspicious system events, e.g., VM-exit) in detecting the above commodity virtualized environments.

Cited by 16

Hardware Failure Virtualization Via Software Encoded Processing

Ute Wappler, Christof Fetzer · 2007

In future, the decreasing feature size will make it much more difficult to built reliable microprocessors. Economic pressure will most likely result in the reliability of microprocessors being tuned for the commodity market. Dedicated reliable hardware is very expensive and usually slower than commodity hardware. Thus, software implemented hardware fault tolerance (SIHFT) will become essential for building safe systems. Existing SIHFT approaches either are not broadly applicable or lack the ability to reliably deal with permanent hardware faults. In contrast, Forin (1989) introduced the vital coded microprocessor which reliably detects transient and permanent hardware failures, but is not applicable to arbitrary programs. It requires a dedicated development process and special hardware. We extend Forin's Vital Code, so that it is applicable to arbitrary binary code which enables us to apply it to existing binaries or automatically during compile time. Furthermore, our approach does not require special purpose hardware.

Cited by 18

Ether: Malware Analysis via Hardware Virtualization Extensions

Artem Dinaburg, Paul Royal, Monirul Sharif et al. · 2008

Malware has become the centerpiece of most security threats on the Internet. Malware analysis is an essential technology that extracts the runtime behavior of malware, and supplies signatures to detection systems and provides evidence for recovery and cleanup. The focal point in the malware analysis battle is how to detect versus how to hide a malware analyzer from malware during runtime. State-of-the-art analyzers reside in or emulate part of the guest operating system and its underlying hardware, making them easy to detect and evade. In this paper, we propose a transparent and external approach to malware analysis, which is motivated by the intuition that for a malware analyzer to be transparent, it must not induce any side-effects that are unconditionally detectable by malware. Our analyzer, Ether, is based on a novel application of hardware virtualization extensions such as Intel VT, and resides completely outside of the target OS environment. Thus, there are no in-guest software components vulnerable to detection, and there are no shortcomings that arise from incomplete or inaccurate system emulation. Our experiments are based on our study of obfuscation techniques used to create 25,000 recent malware samples. The results show that Ether remains transparent and defeats the obfuscation tools that evade existing approaches.

Cited by 0

Hardware-Accelerated Cross-Architecture Full-System Virtualization

Tom Spink, Harry Wagstaff, Björn Franke · ACM Transactions on Architecture and Code Optimization · 2016

Hardware virtualization solutions provide users with benefits ranging from application isolation through server consolidation to improved disaster recovery and faster server provisioning. While hardware assistance for virtualization is supported by all major processor architectures, including Intel, ARM, PowerPC, and MIPS, these extensions are targeted at virtualization of the same architecture, for example, an x86 guest on an x86 host system. Existing techniques for cross-architecture virtualization, for example, an ARM guest on an x86 host, still incur a substantial overhead for CPU, memory, and I/O virtualization due to the necessity for software emulation of these mismatched system components. In this article, we present a new hardware-accelerated hypervisor called C aptive , employing a range of novel techniques that exploit existing hardware virtualization extensions for improving the performance of full-system cross-platform virtualization. We illustrate how (1) guest memory management unit (MMU) events and operations can be mapped onto host memory virtualization extensions, eliminating the need for costly software MMU emulation, (2) a block-based dynamic binary translation engine inside the virtual machine can improve CPU virtualization performance, (3) memory-mapped guest I/O can be efficiently translated to fast I/O specific calls to emulated devices, and (4) the cost for asynchronous guest interrupts can be reduced. For an ARM-based Linux guest system running on an x86 host with Intel VT support, we demonstrate application performance levels, based on SPEC CPU2006 benchmarks, of up to 5.88× over state-of-the-art Q emu and 2.5× on average, achieving a guest dynamic instruction throughput of up to 1280 MIPS (million instructions per second) and 915.52 MIPS, on average.

Cited by 15Open access

Malware Collection and Analysis via Hardware Virtualization

Tamas K. Lengyel · OpenCommons - UConn (University of Connecticut) · 2015

Malware is one of the biggest security threat today and deploying effective defensive solutions requires the collection and rapid analysis of a continuously increasing number of samples. The collection and analysis is greatly complicated by the proliferation of metamorphic malware as the efficacy of signature-based static analysis systems is greatly reduced. While honeypots and dynamic malware analysis has been effectively deployed to combat the problem, significant challenges remain. The rapidly increasing number of malware samples poses a particular challenge as it greatly inflates the cost of the hardware required to process the influx. As modern malware also deploys anti-debugging and obfuscation techniques, the time it takes to formulate effective solutions is further exacerbated. There is a clear need for effective scalability in automated malware collection and analysis. At the same time, modern malware can both detect the monitoring environment and hide in unmonitored corners of the system. It has also been observed that malware modifies its run-time behavior to lead the analysis system astray when it detects a monitoring environment. Consequently, it is critical to create a stealthy environment to hide the presence of the data collection from the external attacker. Such systems also need to isolate critical system components from the executing malware sample while keeping the concurrent collection and analysis sessions separate. Furthermore, the fidelity of the collected data is essential for effective dynamic analysis. As rootkits now employ a variety of techniques to hide their presence on a system, the broader the scope of data collection, the more likely the analysis will reveal useful features. Over the last decade hardware virtualization has been proposed to develop such tools with promising results. In this dissertation we present a systematic evaluation of hardware virtualization as an underlying technology to construct effective malware collection and analysis systems. The evaluation is realized via the combination of four distinct objectives such systems need to fulfill: scalability, stealth, fidelity and isolation.

Cited by 5Open access