Ultra-low cost sandboxing for application appliances
US-2016196426-A1 · Jul 7, 2016 · US
US9495183B2 · US · B2
| Field | Value |
|---|---|
| Publication number | US-9495183-B2 |
| Application number | US-201113107973-A |
| Country | US |
| Kind code | B2 |
| Filing date | May 16, 2011 |
| Priority date | May 16, 2011 |
| Publication date | Nov 15, 2016 |
| Grant date | Nov 15, 2016 |
A practical reading order for non-experts. Skip the full description unless you need deep technical detail.
What the patent document calls the invention.
A short plain-language summary of the technical disclosure.
Who owns or filed the patent and who is credited as inventor.
Filing, priority, publication, and grant dates set the timeline.
The legal scope of protection — read this for what is actually claimed.
Technology tags used to group this patent with similar filings.
Prior art links and similar publications in this corpus.
Official abstract text for this publication.
The described implementations relate to virtual computing techniques. One implementation provides a technique that can include receiving a request to execute an application. The application can include first application instructions from a guest instruction set architecture. The technique can also include loading an emulator and a guest operating system into an execution context with the application. The emulator can translate the first application instructions into second application instructions from a host instruction set architecture. The technique can also include running the application by executing the second application instructions.
Opening claim text (preview).
The invention claimed is: 1. A method performed by a host computing device, the method comprising: receiving a request to execute an application on the host computing device, wherein the host computing device has a corresponding host instruction set architecture and the application comprises first application instructions from a guest instruction set architecture that is different than the host instruction set architecture; loading a processing unit emulator and a guest operating system together into a first process with the application, wherein: the processing unit emulator translates the first application instructions into second application instructions in the host instruction set architecture, and the guest operating system provides at least one guest operating system interface that is called by the application; and running the application by executing the second application instructions on the host computing device, wherein the first process comprises a shared address space that is shared by the application, the processing unit emulator, and the guest operating system, and wherein the host computing device comprises a host operating system that includes a second process. 2. The method according to claim 1 , further comprising: loading another application on the host computing system into at least one other address space. 3. The method according to claim 1 , wherein the processing unit emulator also translates at least some instructions of the guest operating system from the guest instruction set architecture to the host instruction set architecture. 4. The method according to claim 3 , further comprising: assigning different privileges to the first process and the second process with respect to individual instructions of the host instruction set architecture. 5. The method according to claim 4 , the host operating system comprising host operating system instructions in the host instruction set architecture. 6. The method according to claim 3 , the at least some instructions of the guest operating system being operable to display graphical features responsive to a further request received from the application. 7. The method according to claim 1 , further comprising: providing the application with a value that indicates that the first process is non-privileged when the first process is actually privileged. 8. The method according to claim 1 , further comprising: copying the first process from the host computing device to another host computing device, the another host computing device having another host instruction set architecture, the another host computing device comprising another emulator configured to translate the first application instructions into third application instructions from the another host instruction set architecture. 9. One or more computer-readable storage media storing instructions which, when executed by one or more processing devices, cause the one or more processing devices to perform acts comprising: receiving a request to execute a guest application on a host device comprising a host instruction set architecture and a host operating system, the guest application comprising one or more guest application binaries; checking application metadata associated with the guest application to identify a guest instruction set architecture and a guest operating system for the guest application, wherein the guest instruction set architecture is different than the host instruction set architecture; and in a first instance, loading the guest application, the guest operating system for the guest application, and an emulator configured to translate the one or more guest application binaries into the host instruction set architecture together in a single process. 10. The one or more computer-readable storage media of claim 9 , the acts further comprising: enforcing a single set of permissions for the single process into which the guest application, the emulator, and the guest operating system are loaded, the single set of permissions restricting at least some operations of the guest operating system, the guest application, and the emulator. 11. The one or more computer-readable storage media according to claim 10 , the enforcing comprising restricting access to at least one file. 12. The one or more computer-readable storage media according to claim 9 , the acts further comprising: in a second instance, loading another guest application comprising one or more other guest application binaries in another guest instruction set architecture, another emulator configured to translate the one or more other guest application binaries into the host instruction set architecture, and another guest operating system together in another single process. 13. The one or more computer-readable storage media according to claim 12 , wherein the guest instruction set architecture, the another guest instruction set architecture, and the host instruction set architecture comprise three different instruction set architectures. 14. The one or more computer-readable storage media according to claim 13 , wherein the guest operating system, the another guest operating system, and the host operating system comprise three different operating systems. 15. A computing device comprising: at least one processing unit having an associated native instruction set architecture; and at least one memory or storage device storing native instructions in the native instruction set architecture that, when executed by the at least one processing unit, cause the at least one processing unit to: receive a request to execute a guest application, the guest application comprising one or more guest application binaries; identify a guest instruction set architecture and a guest operating system for the guest application, wherein the guest instruction set architecture is different than the native instruction set architecture; load the guest application, the guest operating system for the guest application, and an emulator together in a shared execution context; and translate the one or more guest application binaries into the native instruction set architecture using the emulator that is loaded into the shared execution context with the guest application and the guest operating system. 16. The computing device of claim 15 , wherein the native instructions cause the at least one processing unit to: provide a virtualization monitor that implements a virtualization monitor interface; receive a first call of the virtualization monitor interface from the guest operating system to the virtualization monitor; and translate the first call into a corresponding second call to a host operating system interface implemented by a host operating system of the computing device. 17. The computing device of claim 16 , wherein the native instructions cause the at least one processing unit to: assign the shared execution context a level of privilege that prevents the shared execution context from executing at least one privileged instruction, wherein the corresponding second call includes the at least one privileged instruction. 18. The computing device of claim 17 , wherein the first call requests to access a file and the corresponding second call accesses the file on behalf of the guest application. 19. The computing device of claim 17 , wherein the first call requests to create a new thread and the corresponding second call creates the new thread on behalf of the guest application.
Involving translation to a different instruction set architecture, e.g. just-in-time translation in a JVM · CPC title
Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox · CPC title
Related publications grouped by family.
Answers are generated from the same data shown on this page.