Abstract: A technique allows for a hybrid hypervisor-assisted security model that monitors and protects an operating system from rootkits or other malware through use of monitoring policies for the operating system (OS). The OS monitoring policies may be separated into rules that can be enforced using an in-guest agent running in a monitored guest OS domain and an out-of-guest agent running in a privileged/monitoring guest OS domain. Embodiments may use virtualization technologies including permissions and policies in one or more page tables (and virtualization exceptions (# VE) to avoid virtual machine (VM) exits during runtime events and thereby, avoid context switching into a hypervisor. An embodiment includes configuring the in-guest agent in a monitored OS such that hardware events can be switched to lightweight events and can be dynamically switched to complex processing in the privileged OS domain only when requested.

Abstract: A technique allows for a hybrid hypervisor-assisted security model that monitors and protects an operating system from rootkits or other malware through use of monitoring policies for the operating system (OS). The OS monitoring policies may be separated into rules that can be enforced using an in-guest agent running in a monitored guest OS domain and an out-of-guest agent running in a privileged/monitoring guest OS domain. Embodiments may use virtualization technologies including permissions and policies in one or more page tables (and virtualization exceptions (#VE) to avoid virtual machine (VM) exits during runtime events and thereby, avoid context switching into a hypervisor. An embodiment includes configuring the in-guest agent in a monitored OS such that hardware events can be switched to lightweight events and can be dynamically switched to complex processing in the privileged OS domain only when requested.

Abstract: A debug network on a multiprocessor array having multiple clock domains includes a backbone communication channel which communicates with information nodes on the channel. The information nodes store and access information about an attached processor. The nodes are also coupled to registers within the attached processor, which operate at the speed of the processor. A master controller solicits information from the information nodes by sending messages along the backbone. If a message requires interaction with a processor register, the node performs the action by synchronizing to the local processor clock.

Abstract: A debug network on a multiprocessor array includes communication channels, a master controller, and one or more individual debug units in communication with one or more of the processors. The master controller solicits information from the debug units by sending messages along the communication channels. The debug units can control some aspects of the processors, and can simply report on other aspects. By using commands to invoke processor action, then accessing the result, interactive debugging of a multiprocessor array is possible.

Abstract: A system, method and computer program product are provided for on-access computer virus scanning of files in an efficient manner. If no identifier is assigned to a process for accessing files, virus detection actions are selected based at least in part on the identification of the process. Further, an identifier is assigned to the process. Thereafter, virus detection actions may be selected based at least in part on the identifier for accelerating the selection process. In operation, the selected virus detection actions are performed on the files.