Vmware, Inc.

Technion Research & Development Foundation Ltd

Dan Tsafrir

Nadav Amit

Michael Wei

Assaf Schuster

Igor Smolyar

Amy Tai

Eitan Rosenfeld

A computing device, comprising at least one peripheral computing component, electrically connected to each of a plurality of hardware processors; wherein at least one of the plurality of hardware processors is adapted to executing a code for: configuring the at least one peripheral computing component to access at least one first memory location in a first memory component electrically coupled with a first hardware processor of the plurality of hardware processors via a first electrical connection between the peripheral computing component and the first hardware processor; and configuring the at least one peripheral computing component to access at least one second memory location in a second memory component electrically coupled with a second hardware processor of the plurality of hardware processors via a second electrical connection between the peripheral computing component and the second hardware processor; and wherein the first hardware processor is not the second hardware processor.

Multiple processor computing device with configurable electrical connectivity to peripherals

Described herein are embodiments that adaptively reduce the number of interrupts that occur between a device controller and a computer system. Device commands are submitted to the controller by an operating system on behalf of an application. The device performs the received commands and indicates command completions to the controller. A counter counts completions, and if the count exceeds a threshold number, the controller generates an interrupt to the computer system. If the count is greater than zero and the timeout interval has expired, then the controller generates an interrupt to the computer system. In some embodiments, the application attaches flags to one of the commands indicating that an interrupt relating to completion of the flagged command should be generated as soon as possible or that an interrupt relating to completion of all commands prior to and including the flagged command should be generated as soon as possible.

Software-controlled interrupts for I/O devices

In accordance with embodiments of the present disclosure, a compiler can compile source code to produce binary code that includes address shifting code inserted with memory operations. The address shifting code can shift addresses of memory operations that access locations in the kernel address space into address locations in the user space, thus avoiding speculative access into the kernel address space.

Compilation-time checks to secure processes from speculative rogue cache loads

In accordance with embodiments of the present disclosure, a binary translator can perform address shifting on the binary code of an executing application. Address shifting serves to shift the addresses of memory operations that can access locations in the kernel address space into address locations in the user space, thus avoiding speculative access into the kernel address space.

Dynamic binary translation to secure processes from speculative rogue cache loads

The present disclosure addresses the meltdown vulnerability resulting from speculative execution in a multi-core processing system. The operating system (OS) can be loaded for execution on one of several processing cores (OS core), while an application can be loaded for execution on another of the processing cores (application core). The OS core uses process page tables that map the entire kernel address space to physical memory. Conversely, the application core uses pages tables that map only a portion of the kernel address space to physical memory.

Separate cores to secure processes from speculative rogue cache loads

Embodiments are disclosed to mitigate the meltdown vulnerability by selectively using page table isolation. Page table isolation is enabled for 64-bit applications, so that unprivileged areas in the kernel address space cannot be accessed in user mode due to speculative execution by the processor. On the other hand, page table isolation is disabled for 32-bit applications thereby providing mapping into unprivileged areas in the kernel address space. However, speculative execution is limited to a 32-bit address space in a 32-bit application, and s access to unprivileged areas in the kernel address space can be inhibited.

32-bit address space containment to secure processes from speculative rogue cache loads

A method for reducing disk read rate by managing dataset mapping of virtual machine (VM) guest memory, comprising: monitoring a plurality of disk read write operations of a VM guest; updating a dataset mapping between disk blocks allocated to the VM guest and corresponding physical addresses of memory pages of the VM guest containing replica of data stored in the disk blocks, based on the plurality of disk read write operations; when identifying writing to one of the memory pages, removing a mapping of corresponding disk block and corresponding physical address of memory page; when reclaiming a mapped memory page of the VM guest by a host of the VM guest, discarding data contained in the memory page; and when the data is requested by the VM guest after it was reclaimed by said host, retrieving the data from corresponding disk block according to the mapping.

Memory swapper for virtualized environments

A method of data replica recovery that is based on separate storage drives connected to a network where each storage drive has a storage space divided to contiguous storage segments and is electronically connected to a memory support component via a connection. Pairs of replicas, each of one of a plurality of data units, are stored in a manner that allows, in response to detection of a storage failure in one storage drive, to create replacement replicas in the memory support components of the other storage drives to assure that two replicas of each data unit can be found in the storage system.

Growing community of inventors

Haifa, Israel

Dan Tsafrir