Other

Vmware, Inc.

Transmeta Corporation

Hewlett-packard Company

Nvidia Corporation

David A Dunn

Guillermo Juan Rozas

Alexander Klaiber

H Peter Anvin

Lacky V Shah

Jeffrey W Sheldon

Paul S Serris

Ross Segelken

Adrian Drzewiecki

Abhishek Srivastava

Rupert Brauch

William B Buzbee

Alok Nemchand Kataria

Robert F Cmelik

Nathan Daniel Tuck

Madhu Swarna

Wei Xu

John P Banning

Jesse Pool

Alex Klaiber

Keith Klayman

Radu Rugina

Andrew Morgan

James Van Zoeren

Doug Covelli

Ben Hertzberg

James S Mattson

Andrei Warkentin

Darrell D Boggs

Gabriel Tarasuk-Levin

Cyprien Laplace

Haoqiang Zheng

Yury Baskakov

Arunachalam Ramanathan

Sunil Kumar Kotian

Xunjia Lu

Timothy P Mann

Frederick Joseph Jacobs

Rakesh Agarwal

Magnus Ekman

Anurekh Saxena

Brian Holscher

Hens Vanderschoot

Brad Hoyt

Sridharan Ramakrishnan

Aravindh Baktha

Yanlei Zhao

Jared McNeill

Karthik Ramachandra

Thomas Kistler

Timothy Zhu

Randy Spurlock

Thomas Spacie

Fred Jacobs

Daniel H Nelsen

David Dobrikin

Bharath Chandramohan

Sreekanth Setty

Disclosed are various examples of provisioning a data processing unit (DPU) management operating system using a capsule. A management hypervisor installer executed on a host device receives a listing DPU device from a baseboard management controller (BMC). A preinstalled DPU management operating system image is identified for a DPU device from the listing, and is wrapped with a capsule that specifies the capsule as a DPU management operating system image capsule. A server component provides the DPU management operating system image capsule at a particular URI, and the URI is transmitted to the BMC.

Provisioning DPU management operating systems using firmware capsules

A virtual machine (VM) is migrated from a source host to a destination host in a virtualized computing system, the VM having a plurality of virtual central processing units (CPUs). The method includes copying, by VM migration software executing in the source host and the destination host, memory of the VM from the source host to the destination host by installing, at the source host, write traces spanning all of the memory and then copying the memory from the source host to the destination host over a plurality of iterations; and performing switch-over, by the VM migration software, to quiesce the VM in the source host and resume the VM in the destination host. The VM migration software installs write traces using less than all of the virtual CPUs, and using trace granularity larger than a smallest page granularity.

Memory copy during virtual machine migration in a virtualized computing system

An example method of secure attestation of a workload deployed in a virtualized computing system is described. The virtualized computing system includes a host cluster and a virtualization management server, the host cluster having hosts and a virtualization layer executing on hardware platforms of the hosts. The method includes storing, in a trust authority, a pre-defined attestation report for a workload executing in a virtual machine (VM) managed by the virtualization layer, the pre-defined attestation report including a hash of at least a portion of an image of the VM; receiving, at the trust authority from a security module of a host in which the VM executes, an attestation report generated by measuring memory of the VM; comparing the attestation report with the pre-defined attestation report; and generating an indication of validity for the workload based on a result of the comparison.

Secure storage of workload attestation reports in a virtualized and clustered computer system

In one set of embodiments, confidential data needed by a workload component running within a worker VM can be placed on an encrypted virtual disk that is attached to the worker VM and hardware-based attestation can be used to validate the worker VM's software and isolate its guest memory from its hypervisor. Upon successful completion of this attestation process, a data decryption key can be delivered to the worker VM via a secure channel established via the attestation, such that the hypervisor cannot read or alter the key. The worker VM can then decrypt the contents of the encrypted virtual disk using the data decryption key, thereby granting the workload component access to the confidential data.

Leveraging hardware-based attestation to grant workloads access to confidential data

A framework is provided that assigns a digital certificate to each VM-based control plane element and computing node (i.e., worker VM) of a workload orchestration platform implemented in a virtualized environment, where the digital certificate is signed by a trusted entity and provides cryptographic proof that the control plane element/worker VM has been successfully attested by that trusted entity using hardware-based attestation. Each control plane element/worker VM is configured to verify the digital certificates of other platform components prior to communicating with those components. With these digital certificates in place, when an end-user submits to the platform's front-end control plane element a new workload for deployment, the end-user can verify the digital certificate of the front-end control plane element in order to be assured that the workload will be deployed and executed by the platform in a secure manner.

Secure end-to-end deployment of workloads in a virtualized environment using hardware-based attestation

An example method of secure attestation of a workload deployed in a virtualized computing system is described. The virtualized computing system includes a host cluster and a virtualization management server, the host cluster having hosts and a virtualization layer executing on hardware platforms of the hosts. The method includes: launching, in cooperation with a security module of a host, a guest as a virtual machine (VM) managed by the virtualization layer, the security module generating an attestation report from at least a portion of the VM loaded into memory of the host; sending the attestation report from the security module to a trust authority; receiving, in response to verification of the attestation report by the trust authority, a secret from the trust authority at the security module; and providing the secret from the security module to the guest.

Provisioning identity certificates using hardware-based secure attestation in a virtualized and clustered computer system

Mechanisms to protect the integrity of memory of a virtual machine are provided. The mechanisms involve utilizing certain capabilities of the hypervisor underlying the virtual machine to monitor writes to memory pages of the virtual machine. A guest integrity driver communicates with the hypervisor to request such functionality. Additional protections are provided for protecting the guest integrity driver and associated data, as well as for preventing use of these mechanisms by malicious software. These additional protections include an elevated execution mode, termed 'integrity mode,' which can only be entered from a specified entry point, as well as protections on the memory pages that store the guest integrity driver and associated data.

Techniques for protecting memory pages of a virtual computing instance

Disclosed are various embodiments that utilize conflict cost for workload placements in datacenter environments. In some examples, a protected memory level is identified for a computing environment. The computing environment includes a number of processor resources. Incompatible processor workloads are prohibited from concurrently executing on parallel processor resources. Parallel processor resources share memory at the protected memory level. A number of conflict costs are determined for a processor workload. Each conflict cost is determined based on a measure of compatibility between the processor workload and a parallel processor resource that shares a particular memory with the respective processor resource. The processor workload is assigned to execute on a processor resource associated with a minimum conflict cost.

Workload placement using conflict cost

A method of emulating nested page table (NPT) mode-based execute control in a virtualized computing system includes: providing NPT mode-based execute control from a hypervisor to a virtual machine (VM) executing in the virtualized computing system; generating a plurality of shadow NPT hierarchies at the hypervisor based on an NPT mode-based execute policy obtained from the VM; configuring a processor of the virtualized computing system to exit from the VM to the hypervisor in response to an escalation from a user privilege level to a supervisor privilege level caused by guest code of the VM; and exposing a first shadow NPT hierarchy of the plurality of shadow NPT hierarchies to the processor in response to an exit from the VM to the hypervisor due to the escalation from the user privilege level to the supervisor privilege level.

Emulating mode-based execute control for memory pages in virtualized computing systems

Techniques for securely supporting a global view of system memory in a physical/virtual computer system comprising a plurality of physical/virtual CPUs are provided. In one set of embodiments, the physical/virtual computer system can receive an interrupt indicating that a first physical/virtual CPU should enter a privileged CPU operating mode. The physical/virtual computer system can further determine that none of the plurality of physical/virtual CPUs are currently in the privileged CPU operating mode. In response to this determination, the physical/virtual computer system can modify the global view of system memory to include a special memory region comprising program code to be executed while in the privileged CPU operating mode; communicate, to the other physical/virtual CPUs, a signal to enter a stop state in which execution is halted but interrupts are accepted for entering the privileged CPU operating mode; and cause the first physical/virtual CPU to enter the privileged CPU operating mode.

Securely supporting a global view of system memory in a multi-processor system

Mechanisms to protect the integrity of a data structure that is traversed to locate protected memory pages are provided. Leaf nodes of the data structure store mappings that indicate which memory pages are protected. Both the pages indicated by the mappings and the pages that store the data structure are monitored by a tracing service that sends a notification to the hypervisor when a write to a traced page occurs. When system software receives such a notification, the system software traverses the data structure to determine whether any of the memory pages of the data structure is the traced page that was written to. If so, the alert action for that page is performed. If not, the system software determines whether any of the mappings in the leaf nodes include such a page and, if so, the alert action for that page is performed.

Tree structure for storing monitored memory page data

The disclosure provides a method and a system for identifying and replacing code translations that generate spurious fault events. In one embodiment the method includes executing a first set and a second set of native instructions, performing a third translation of a target instruction to form a third set of native instructions in response to a determination that a fault occurrence is attributed to a first translation, wherein the third set of native instructions is not the same as the second set of native instructions, and the third set of native instructions is not the same as the first set of native instructions, and executing the third set of native instructions.

Fault detection in instruction translations

A processing system comprising a microprocessor core and a translator. Within the microprocessor core is arranged a hardware decoder configured to selectively decode instructions for execution in the microprocessor core, and, a logic structure configured to track usage of the hardware decoder. The translator is operatively coupled to the logic structure and configured to selectively translate the instructions for execution in the microprocessor core, based on the usage of the hardware decoder as determined by the logic structure.

Instruction-optimizing processor with branch-count table in hardware

Embodiments related to fetching instructions and alternate versions achieving the same functionality as the instructions from an instruction cache included in a microprocessor are provided. In one example, a method is provided, comprising, at an example microprocessor, fetching an instruction from an instruction cache. The example method also includes hashing an address for the instruction to determine whether an alternate version of the instruction which achieves the same functionality as the instruction exists. The example method further includes, if hashing results in a determination that such an alternate version exists, aborting fetching of the instruction and retrieving and executing the alternate version.

Translation address cache for a microprocessor

Guest memory data structures are read by one or more read operations which are set up to handle page faults and general protection faults generated during the read in various ways. If such a fault occurs while performing the one or more read operations, the fault is handled and the one or more read operation is terminated. The fault is handled by either dropping the fault and reporting an error instead of the fault, by dropping the fault and invoking an error handler that is set up prior to performing the read operations, or by forwarding the fault to a fault handler that is setup prior to performing the read operations. If no fault occurs, the read operations complete successfully. Thus, under normal circumstances, no fault is incurred in a read operation on guest memory data structures.

Hypervisor techniques for performing non-faulting reads in virtual machines

Growing community of inventors

Sammamish, WA, United States of America

David A Dunn