Digital Equipment Corporation

Hewlett-packard Development Company, L.p.

Compaq Information Technologies Group, L.p.

Compaq Computer Corporation, Inc.

Andrew Halstead Mason

Clifford Earl Kahn

Judith Shelhorse Hall

Paul T Robinson

Karen Lee Noel

Mary Ellen Zurko

Paul Ashley Karger

Morrie Gasser

James R Kauffman

Gregory H Jordan

Steven B Lipner

Paul Douglas Sawyer

Leslie Richard Kendall

Thomas Andrew Casey, Jr

Stephen H Zalewski

Reinhard C Schumann

Paul Karl Harter, Jr

James Jonathan Delmonico

Wei-Ming Hu

John C Wray

Richard T Witek

Stephen F Shirron

Frederick G Kleinsorge

Timothy Edwin Leonard

Anthony L Priborsky

Timothy E Leonard

A method for executing trusted commands, in which a trusted command is first received from a user at a user terminal and parsed by untrusted code; then passed to a trusted computing base for execution. The trusted computing base displays some indication of what is to be done back to the user for confirmation. Confirmation of the commands prevents unauthorized modification of the commands and increases system confidence. A randomly (or pseudo-randomly) generated process identifier is employed to verify the existence of a trusted path.

Verification of trusted-path commands

Processing trusted commands in trusted and untrusted environments

Multiple instances of operating systems execute cooperatively in a single multiprocessor computer wherein all processors and resources are electrically connected together. The single physical machine with multiple physical processors and resources is subdivided by software into multiple partitions, each with the ability to run a distinct copy, or instance, of an operating system. At different times, different operating system instances may be loaded on a given partition. Resources, such as CPUs and memory, can be dynamically assigned to different partitions and used by instances of operating systems running within the machine by modifying the configuration. The partitions themselves can also be changed without rebooting the system by modifying the configuration tree.

Multiprocessor computer architecture with multiple operating system instances and software controlled resource allocation

Multiple instances of operating systems execute cooperatively in a single multiprocessor computer wherein all processors and resources are electrically connected together. The single physical machine with multiple physical processors and resources is subdivided by software into multiple partitions, each running a distinct copy, or instance, of an operating system. Each of the partitions has access to its own physical resources plus resources designated as shared. The partitioning is performed by assigning all resources with a configuration tree. None, some, or all, resources may be designated as shared among multiple partitions. Each individual operating instance will generally be assigned the resources it needs to execute independently and these resources will be designated as &ldquo;private.&rdquo; Other resources, particularly memory, can be assigned to more than one instance and shared. Shared memory is cache coherent so that instances may be tightly coupled, and may share resources that are normally allocated to a single instance. This allows previously distributed user or operating system applications which usually must pass messages via an external interconnect to operate cooperatively in the shared memory without the need for either an external interconnect or message passing. Examples of application that could take advantage of this capability include distributed lock managers and cluster interconnects. Newly-added resources, such as CPUs and memory, can be dynamically assigned to different partitions and used by instances of operating systems running within the machine by modifying the configuration.

Software partitioned multi-processor system with flexible resource sharing levels

A method for executing trusted commands, in which a trusted command is first received from a user at a user terminal and parsed by untrusted code; then passed to a trusted computing base for execution. The trusted computing base displays to the user for confirmation indication of what is to be done. Confirmation of the commands prevents unauthorized modification of the commands and increases system confidence. A randomly (or pseudo-randomly) generated process identifier is employed to verify the existence of a trusted path.

Method for executing trusted-path commands

Multiple instances of operating systems execute cooperatively in a single multiprocessor computer wherein all processors and resources are electrically connected together. The single physical machine with multiple physical processors and resources is subdivided by software into multiple partitions, each with the ability to run a distinct copy, or instance, of an operating system. At different times, different operating system instances may be loaded on a given partition. Resources, such as CPUs and memory, can be dynamically assigned to different partitions and used by instances of operating systems running within the machine by modifying the configuration. The partitions themselves can also be changed without rebooting the system by modifying the configuration tree. Inter-instance communication can occur in at least two different ways. In a first communication method, a single bit, which is part of a bitvector in shared memory, is modified by a first instance to indicate to a second instance that a predetermined event associated with that bit has occurred. In a second method, packetized data from the first instance is stored in shared memory, and the first instance notifies the second instance of the presence of the data. The second instance then retrieves the data and acts upon it accordingly.

Method and apparatus for communication in a multi-processor computer system

Multiple instances of operating systems execute cooperatively in a single multi-processor computer wherein a single physical machine is subdivided by software into multiple partitions, each with the ability to run a distinct copy, or instance, of an operating system. Each individual instance has the resources it needs to execute independently, but instances cooperate to migrate resources from one partition to another. The migration can be initiated and carried out under control of the operating system instances &ldquo;on the fly&rdquo; without intervention of the system administrator. Alternatively, a system administrator can reconfigure the system. Resource migration is carried out under a &ldquo;push&rdquo; model in which resources are controlled by an owning partition and must be released by that partition before they can be migrated to another partition. In accordance with this model, a first operating system instance which requires a resource must first request the resource from a second instance. In response to this request, the second instance determines whether it can spare the resource, and if so, begins to bring the resource into an idle state. The resource is actually transferred when the second instance stops using the resource.

Method and apparatus for migrating resources in a multi-processor computer system

A method for reducing power consumption in a computer system is provided wherein the computer system includes a system bus interface connected by a signal line to a power supply and/or clock circuitry for the central processing unit, each having the capability to change the characteristic of its output responsive to the signal line for placing the central processing unit in a low-power consuming state. The system bus interface chip further including a storage location and counter for storing the type and quantity of interrupt assertions during the period of time when the central processing unit is in the low power consuming state. The system software determines the desired period of time to put the central processing unit into the low-power consuming safe and does not return it to normal power consuming state until the time period has expired, a non interval clock interrupt is asserted, or another critical event occurs that needs immediate CPU attention. When one of these conditions arises, the signal line changes polarity, the power supply and/or clock circuitry returns normal operating levels to the CPU, and the system bus interface presents all interrupts that asserted while the CPU was in the low-power consuming state to the CPU so it can continue normal operation.

Skipping clock interrupts during system inactivity to reduce power

A method for reducing power consumption in a computer system is provided wherein the computer system includes a system bus interface connected by a signal line to a power supply and/or clock circuitry for the central processing unit, each having the capability to change the characteristic of its output responsive to the signal line for placing the central processing unit in a low-power consuming state. The system bus interface chip further including a storage location and counter for storing the type and quantity of interrupt assertions during the period of time when the central processing unit is in the low power consuming state. The system software determines the desired period of time to put the central processing unit into the low-power consuming state and does not return it to normal power consuming state until the time period has expired, a non interval clock interrupt is asserted, or another critical event occurs that needs immediate CPU attention. When one of these conditions arises, the signal line changes polarity, the power supply and/or clock circuitry returns normal operating levels to the CPU, and the system bus interface presents all interrupts that asserted while the CPU was in the low-power consuming state to the CPU so it can continue normal operation.

A method for scheduling processes for execution in a computer system organizes the processes into run queues in accordance with the respective secrecy classes of the processes. A CPU time slot is assigned to each run queue. If all processes in a run queue give up the CPU before the expiration of the run queue's assigned time slot, the leftover time is given to a run queue whose secrecy class dominates that of the previous run queue. Covert-channel countermeasures are not taken in between two run queues if the secrecy class of the second run queue dominates the secrecy class of the first run queue.

Lattice scheduler method for reducing the impact of covert-channel

In a system for implementing virtual machines a Virtual Machine Monitor (VMM) is assigned an address space separate and distinct from the address space assigned to the virtual machines (VMs). A VM-bit is used to determine whether the processor is executing a process in the VM or the VMM. Through the use of the separate address spaces and the VM-bit a system is disclosed wherein the VMM can take full advantage of all the protection rings offered by the system on which it runs and the VMs are also allowed to operate in an environment that essentially offers the same number of real protection rings as are available on the underlying computer system.

Protection ring extension for computers having distinct virtual machine

A digital computer system includes at least one process, an input/output subsystem, and an input/output interface. The process which input/output requests and receives input/output responses. The input/output system perform input/output operations and generates completion notifications in response thereto. The input/output interface generates input/output responses for the process in the order in which the process issued the input/output requests, to reduce the possibility of the process obtaining information from the order in which the input/output system processed input/output requests.

System and method for reducing storage channels in disk systems

A central processing unit (CPU) executing a virtual memory management system employs a translation buffer for caching recently used page table entries. When more than one process is executing on the CPU, the translation buffer is usually flushed when a context switch is made, even though some of the entries would still be valid for commonly-referenced memory areas. An address space number feature is employed to allow entries to remain in the translation buffer for processes not currently executing, and the separate processes or the operating system can reuse entries in the translation buffer for such pages of memory that are commonly referenced. To allow this, an 'address space match' entry in the page table entry signals that the translation buffer content can be used when the address tag matches, even though the address space numbers do not necessarily match. When executing virtual machines on this CPU, with a virtual machine monitor, the address space match feature is employed among processes of a virtual machine, but an additional entry is provided to disable the address space match feature for all address space numbers for the virtual machine monitor.

Translation buffer for virtual machines with address space match

A digital computer system for processing at least one process, said process generating operational requests for enabling selected operations. The computer system comprises a timer portion for generating two series of unpredictable timing indications. An operational processor portion is responsive to the timing indications from said timer and the operational requests for initiating operations enabled by the operational requests in response to one of the series of timing indications. The operational processor communicates with the processes regarding operations enabled with respective operational requests in response to the second series of timing indications. Since the timings of the operations by the operational processor are distinct from the timings of the communications between the operational processor and the process, the process is unable to determine timing information from the operations performed by the operational processor in response to the operational requests, thereby ensuring that the process will be unable to use the timings of the operations by the operational processor to determine timing intervals. In another aspect, the digital computer system includes a system timing generator for generating a system timing value that provides timing information. The system timing generator updates the system timing value at unpredictable intervals, but so that the system timing value provides timing information that is accurate as of the time of update. When the process requests the system timing value, the system timing generator supplies only a selected high-order portion of the system timing value, also ensuring that the process only has imprecise timing information. Since the process has access to only an imprecise system timing value, and since it is unable to use external operations, by the operational processor, for timing information, the bandwidth of any convert timing channels is reduced accordingly.

System and method for reducing timing channels in digital data

A computer system including a processor and memory, the processor having a virtual mode of operation in which it uses a virtual machine monitor which allows it to service a plurality of users contemporaneously in a multiplexed manner, and a non-virtual, or real, mode of operation. The computer system has a set of at least three operation mode protection rings representing a hierarchy of access privilege levels in both the real and virtual modes, with the number of privilege levels in both the real and virtual modes being the same. The privilege levels govern the accessibility of memory locations to programs and the executability of certain privileged instructions, which cause control to be transferred to the virtual machine monitor when the processor is in a virtual mode. The two most privileged levels in the virtual mode are both treated as corresponding to the second most privileged level in the real mode, whereby if the processor is in the most privileged virtual operating mode, access to memory locations is permitted only if the location is accessible to the second most privileged mode. When an instruction is retrieved, the processor first performs a probe operation to determine whether it can access any required memory locations in response to its current privilege level, and then determines whether it is in a privilege level which allows it to process the instruction.

Growing community of inventors

Hollis, NH, United States of America

Andrew Halstead Mason