International Business Machines Corporation

Ching-Farn Eric Wu

Joefon Jann

Ramanjaneya Sarma Burugula

Niteesh Kumar Dubey

Charles Scott Graham

Timothy J Schimke

Jesse Paul Arroyo

Paul Gregory Crumley

Juan J Alvarez

Christian Jacobi

Chung-Lung K Shum

Hubertus Franke

Aaron Tsai

Hans-Werner Tast

Rong Nickle Chang

Barry Watson Krumm

Hao Yu

Sandra Johnson Baylor

James Arthur Lindeman

Yarsun Hsu

Anthony Simon Bolmarcich

Ramanjaneva Sarma Burugula

Kaoutar El Maghroaui

A method, a computer program product, and a system for mitigating unauthorized encryptions of filesystem objects stored on a computing system. The method includes allocating a backup memory area for storing pre-encrypted filesystem objects, setting data bits in an encryption register that allow for monitoring a filesystem object marked for ransomware protection. The method also includes calculating an encryption rate of an encryption occurring on the filesystem object and determining that the encryption rate of the filesystem object exceeds an encryption-rate threshold. The encryption-rate threshold can be set by an administrator when marking the filesystem object for ransomware protection. The method further includes generating an alert to an administrator that the encryption rate of the filesystem object exceeds the encryption rate threshold and storing a backup of the filesystem object for a predetermined amount of time in the backup memory area.

Filesystem object protection from ransomware attacks

A method, a computer program product, and a system for initializing components to monitor for unauthorized encryptions of filesystem objects stored on a computing system. The method includes configuring an encryption monitor register to establish monitoring preferences of filesystem objects and allocating a predetermined size of persistent memory as a backup memory area for storing pre-encrypted versions of the filesystem objects. The method also includes inserting a starting address of the backup memory area in data bits of the encryption monitor register, and setting encryption monitor bits of page table entries in a hardware page table that correspond to at least one filesystem object, thereby establishing encryption monitoring of the filesystem object.

Encryption monitor register and system

Communication endpoints associated with a virtual machine for migration can be discovered. Properties associated with the communication endpoints can be discovered. The communication endpoints can be matched to establish a communication channel between the endpoints. The communication endpoints, the properties and the at least one communication channel can be used in recreating the communication channel for a migrated version of the virtual machine.

Discovery and recreation of communication endpoints in virtual machine migration

The present disclosure relates to sharing an I/O device across multiple virtual machines. According to one embodiment, a computing system configures shared ownership of the I/O device between a first partition and one or more of the plurality of virtual machines. The computing system transfers partial ownership of the I/O device from the first partition to the one or more virtual machines and generates device configuration information for the I/O device. The virtual machines can use the generated device configuration information to access and configure the I/O device. Once the I/O device is configured for shared ownership, the computing system boots the one or more virtual machines.

Sharing ownership of an input/output device using a device driver partition

Systems, methods, and computer program products to perform an operation comprising executing a device driver in a private logical partition on a compute host, wherein the device driver is configured to execute in an environment different than an environment of a hypervisor of the compute host, establishing a communication channel between the private logical partition and an adjunct partition executing on the compute host, and configuring, responsive to a command sent by the adjunct partition to the device driver via the communication channel, a physical function of a single root I/O virtualization (SR-IOV) device of the host system.

Extending trusted hypervisor functions with existing device drivers

A method (and structure) of operating an operating system (OS) on a computer. When a failure of the OS is detected, the computer automatically performs a diagnosis of the OS failure. The computer also attempts to automatically repair/recover the failed OS, based on the diagnosis, without requiring a reboot.

Automated transition to a recovery kernel via firmware-assisted-dump flows providing automated operating system diagnosis and repair

Method and system for a multi-level virtual/real cache system with synonym resolution. An exemplary embodiment includes a multi-level cache hierarchy, including a set of L1 caches associated with one or more processor cores and a set of L2 caches, wherein the set of L1 caches are a subset of the set of L2 caches, wherein the set of L1 caches underneath a given L2 cache are associated with one or more of the processor cores.

Method and system for a multi-level virtual/real cache system with synonym resolution

A system and method for visualizing data in two-dimensional time-space diagrams including generating multi-dimensional program trace files, converting and merging them into interval trace files, and generating multiple time-space diagrams (multiple Gantt charts) to visualize the resulting multi-dimensional interval trace files. The needed events and trace information required to form multi-dimensional event traces are described in event trace files typically gathered from running programs, such as parallel programs for technical computing and Web server processes. The method includes converting event traces into interval traces. In one selectable design, the two-dimensional time-space diagrams includes three discriminator types (thread, processor, and activity) and six discriminator-legend combinations, capable of producing seven possible views. The six discriminator-legend combinations are thread-activity, thread-processor, processor-thread, processor-activity, activity-thread, and activity-processor. Each discriminator-legend combination corresponds to one time-space diagram, except that the thread-activity combination has two possible views: Thread-Activity View and Connected Thread-Activity View.

System and method on generating multi-dimensional trace files and visualizing them using multiple Gantt charts

A method of reducing false sharing in a shared memory system by enabling two caches to modify the same line at the same time. More specifically, with this invention a lock associated with a segment of shared memory is acquired, where the segment will then be used exclusively by processor of the shared memory system that has acquired the lock. For each line of the segment, an invalidation request is sent to a number of caches of the system. When a cache receives the invalidation request, it invalidates each line of the segment that is in the cache. When each line of the segment is invalidated, an invalidation acknowledgement is sent to the global directory. For each line of the segment that has been updated or modified, the update data is written back to main memory. Then, an acquire signal is sent to the requesting processor which then has exclusive use of the segment.

Cache coherence for lazy entry consistency in lockup-free caches

A two-level virtual/real cache system, and a method for detecting and resolving synonyms in the two-level virtual/real cache system, are described. Lines of a first level virtual cache are tagged with a virtual address and a real pointer which points to a corresponding line in a second level real cache. Lines in the second level real cache are tagged with a real address and a virtual pointer which points to a corresponding line in the first level virtual cache, if one exists. A translation-lookaside buffer (TLB) is used for translating virtual to real addresses for accessing the second level real cache. Synonym detection is performed at the second level real cache. An inclusion bit I is set in a directory of the second level real cache to indicate that a particular line is included in the first level virtual cache. Another bit, called a buffer bit B, is set whenever a line in the first level virtual cache is placed in a first level virtual cache writeback buffer for updating main memory. When a first level cache miss occurs, the TLB generates a corresponding real address for that page and the first level virtual cache selects a line for replacement and also notifies the second level real cache which line it chooses for replacement. The real address is then used to access the second level real cache. Synonym detection and resolution are performed by the second level real cache.

Growing community of inventors

Yorktown Heights, NY, United States of America

Ching-Farn Eric Wu