Intel Corporation

Other

Rambus Inc.

Andrew V Anderson

Gilbert A Neiger

Steven M Bennett

Richard A Uhlig

Sebastian Schoenberg

Rajesh M Sankaran

Dion Rodgers

Scott Dion Rodgers

Barry E Huntley

Erik C Cota-Robles

Camron B Rust

Lawrence O Smith

Stalinselvaraj Jeyasingh

David M Durham

Ravi L Sahita

Rajesh Sankaran Madukkarumukumana

Alain Kagi

Michael Lemay

Thomas J Holman

Alain Kägi

Vedvyas Shanbhogue

David A Koufaty

Craig Edward Hampel

Richard Maurice Barth

Baiju V Patel

Asit K Mallick

Subramanya R Dulloor

Arumugam Thiyagarajah

Ely K Tsern

Sanjay Kumar

Paul G Davis

Xiang Chris Zou

Michael A Kozuch

Deepak K Gupta

Joseph Frank Cihula

Larry O Smith

Lawrence Smith, Iii

Jason W Brandt

Donald C Stark

Abhijit Mukun Abhyankar

Sridhar Muthrasanallur

Ronak Singhal

Scott H Robinson

Sailesh Kottapalli

Xiangbin Wu

Steve M Bennett

Udo Steinberg

Frederick Abbott Ware

Peter D MacWilliams

James B Crossland

Stanislav Shwartsman

Rajesh S Parthasarathy

Sanjoy K Mondal

Ido Ouziel

Richard UhligQ

Altug Koker

Vincent J Zimmer

Michael A Rothman

Raanan Sade

Aditya Navale

David Nguyen

Dheeraj R Subbareddy

Stephen Anthony Fischer

Joseph Nuzman

Philip R Lantz

James A Gasbarro

Michael A Goldsmith

Alaa R Alameldeen

Gideon Gerzon

Rupin H Vakharwala

Zhe Wang

Clifford D Hall

Herbert H J Hum

Leena K Puthiyedath

Salmin Sultana

Yi Zou

Randolph L Campbell

Andrew M Rudoff

Gur Hildesheim

Andy Glew

Shashank Shekhar

Ron Rais

Gregory Mark Jablonski

Volkmar Uhlig

Hans Goran Liljestrand

Udo A Steinburg

Werner Haas

Alexander Robenko

Jonathan Edwards

Erik C Cola-Robles

Rajesh Madukkaraumukumana

Lawrence Smith Iii

Stalinselvaraj Jayasingh

Techniques disclosed include selecting a first key identifier (ID) for a first compartment of a compartmentalized process of a computing system, the first compartment including first private data; assigning a first extended page table (EPT) having at least one memory address including the first key ID; encrypting the first private data with a first key associated with the first key ID; and storing the encrypted first private data in a memory starting at the at least one memory address of the first EPT.

Fast key ID switching via extended paging for cryptographic intra-process isolation

This disclosure is directed to a system for address mapping and translation protection. In one embodiment, processing circuitry may include a virtual machine manager (VMM) to control specific guest linear address (GLA) translations. Control may be implemented in a performance sensitive and secure manner, and may be capable of improving performance for critical linear address page walks over legacy operation by removing some or all of the cost of page walking extended page tables (EPTs) for critical mappings. Alone or in combination with the above, certain portions of a page table structure may be selectively made immutable by a VMM or early boot process using a sub-page policy (SPP). For example, SPP may enable non-volatile kernel and/or user space code and data virtual-to-physical memory mappings to be made immutable (e.g., non-writable) while allowing for modifications to non-protected portions of the OS paging structures and particularly the user space.

System for address mapping and translation protection

Examples herein relate to checkpoint replication and copying of updated checkpoint data. For example, a memory controller coupled to a memory can receive a write request with an associated address to write or update checkpoint data and track updates to checkpoint data based on at least two levels of memory region sizes. A first level is associated with a larger memory region size than a memory region size associated with the second level. In some examples, the first level is a cache-line memory region size and the second level is a page memory region size. Updates to the checkpoint data can be tracked at the second level unless an update was previously tracked at the first level. Reduced amounts of updated checkpoint data can be transmitted during a checkpoint replication by using multiple region size trackers.

Virtual machine replication and migration

Embodiments of an invention for monitoring the operation of a processor are disclosed. In one embodiment, a system includes a processor and a hardware agent external to the processor. The processor includes virtualization logic to provide for the processor to operate in a root mode and in a non-root mode. The hardware agent is to verify operation of the processor in the non-root mode based on tracing information to be collected by a software agent to be executed by the processor in the root mode.

Monitoring the operation of a processor

Embodiments of the present disclosure are directed towards techniques and configurations for an apparatus configured to provide I/O classification information in a distributed cloud storage system, in accordance with some embodiments. In one embodiment, the apparatus may include a partition scanner, to scan an image of a virtual disk associated with the storage system, to determine one or more partitions associated with the virtual disk; a file system scanner coupled with the partition scanner, to identify file systems associated with the determined partitions, to access files stored in the identified file systems; and I/O classifier coupled with the file system scanner, to generate I/O classification information associated with the accessed files. The I/O classification information provides characteristics of input-output operations performed on the virtual disk. Other embodiments may be described and/or claimed.

Provision of input/output classification in a storage system

A processor including logic to execute an instruction to synchronize a mapping from a physical address of a guest of a virtualization based system (guest physical address) to a physical address of the host of the virtualization based system (host physical address), and stored in a translation lookaside buffer (TLB), with a corresponding mapping stored in an extended paging table (EPT) of the virtualization based system.

Synchronizing a translation lookaside buffer with an extended paging table

A processing system includes a processing core to execute a virtual machine (VM) comprising a guest operating system (OS) and a memory management unit, communicatively coupled to the processing core, comprising a storage device to store an extended page table entry (EPTE) comprising a mapping from a guest physical address (GPA) associated with the guest OS to an identifier of a memory frame, a first plurality of access right flags associated with accessing the memory frame in a first page mode referenced by an attribute of a memory page identified by the GPA, and a second plurality of access right flags associated with accessing the memory frame in a second page mode referenced by the attribute of the memory page identified by the GPA.

Defining virtualized page attributes based on guest page attributes

Embodiments of apparatuses and methods for processing virtualization events in a layered virtualization architecture are disclosed. In one embodiment, an apparatus includes a hardware processor including event circuit to recognize a virtualization event, and evaluation circuit to determine whether to transfer control of the apparatus from a child guest to a parent guest in response to the virtualization event, wherein the child guest and the parent guest each include a bit per virtualization event to indicate whether the parent guest is to gain control when the virtualization event occurs.

Virtualization event processing in a layered virtualization architecture

Virtual machine manager for address mapping and translation protection

A processing system includes a processing core to execute a task and a memory management unit, coupled to the core. The memory management unit includes a storage unit to store a page table entry including one or more identifiers of memory frames, a protection key, and an access mode bit indicating whether the one or more memory frames are accessible according to a user mode or according to a supervisor mode, a first permission register including a plurality of fields, each field comprising a set of bits reflecting a set of memory access permissions under the user mode, and a second permission register storing a plurality of fields, each field comprising a set of bits reflecting a set of memory access permissions under the supervisor mode.

Memory protection key architecture with independent user and supervisor domains

Generally, this disclosure provides systems, methods and computer readable media for a protected memory view in a virtual machine (VM) environment enabling nested page table access by trusted guest software outside of VMX root mode. The system may include an editor module configured to provide access to a nested page table structure, by operating system (OS) kernel components and by user space applications within a guest of the VM, wherein the nested page table structure is associated with one of the protected memory views. The system may also include a page handling processor configured to secure that access by maintaining security information in the nested page table structure.

Protected memory view for nested page table access by virtual machine guests

Generally, this disclosure provides systems, methods and computer readable media for a page table edit controller configured to control access to guest page tables by virtual machine (VM) guest software through the manipulation of extended page tables. The system may include a translation look-aside buffer (TLB) to maintain a policy to lock one or more guest linear addresses (GLAs) to one or more allowable guest physical addresses (GPAs); a page walk processor to update the TLB based on the guest page tables; and a page table edit control (PTEC) module to: identify entries of the guest page tables that map GLAs associated with the policy to a first GPA; verify that the mapping conforms to the policy; and place the guest page table into one of a plurality of restricted accessibility states based on the verification, the restricted accessibility applied to the VM guests and to the page walk processor.

Dynamic page table edit control

Growing community of inventors

Hillsboro, OR, United States of America

Andrew V Anderson