Microsoft Technology Licensing, LLC

David Hepkin

Kevin Michael Broas

Wen Jia Liu

Arun Upadhyaya Kishan

Hadden Mark Hoppert

Matthew David Kurjanowicz

Liang Yang

Murtaza Ghiya

Martijn De Kort

Kenneth Dean Johnson

Mehmet Iyigun

Yevgeniy Bak

Landy Wang

Xin Zhang

Bruce John Sherwin, Jr

Jin Lin

Michael Bishop Ebersol

Brandon Allsop

Sai Ganesh Ramachandran

Alexander Daniel Grest

Steve Pronovost

Jonathan E Lange

Christopher Warner McCarron

Jason Stewart Wohlgemuth

Allen Marshall

Artem A Oks

Aditya Bhandari

Mathew John

Kapil Vaswani

Attilio Mainetti

Steven Adrian West

Antoine Jean Denis Delignat-lavaud

Emily Cara Clemens

Dexuan Cui

Michael Halstead Kelley

Sarah Elizabeth Stephenson

Carolina Cecilia Perez-vargas

Stephanie Sumyi Luck

Artem Oks

Isolating resources of a virtual machine (VM) guest from a host operating system. A computer system receives an acceptance request from a guest partition corresponding to an isolated VM. The acceptance request identifies a guest memory page that is mapped into a guest physical address space of the guest partition, and a memory page visibility class. The computer system determines whether a physical memory page that is mapped to the guest memory page meets the memory page visibility class. The computer system sets a page acceptance indication for the guest memory page from an unaccepted state to an accepted state based on the physical memory page meeting the memory page visibility class.

Software isolation of virtual machine resources

A computing system running a host operating system and a virtual machine (VM). The computing system includes at least one device that is directly assigned to the VM. The computing system is configured to execute one or more first VM components and one or more second VM components. The one or more first VM components are configured to manage the one or more second VM components via one or more identification pointers. While the one or more second VM components remain loaded in a system memory, and the directly assigned device remains attached to the VM and remains configured to communicate with the one or more second VM component, the one or more first VM components are shut down and restored.

Virtual machine update while keeping devices attached to the virtual machine

Methods, systems, and computer program products for direct assignment of physical devices to confidential virtual machines (VMs). At a first guest privilege context of a guest partition, a direct assignment of a physical device associated with a host computer system to the guest partition is identified. The guest partition includes the first guest privilege context and a second guest privilege context, which is restricted from accessing memory associated with the first guest privilege context. The guest partition corresponds to a confidential VM, such that a memory region associated with the guest partition is inaccessible to a host operating system. It is determined, based on a policy, that the physical device is allowed to be directly assigned to the guest partition. Communication between the physical device and the second guest privilege context is permitted, such as by exposing the physical device on a virtual bus and/or forwarding an interrupt.

Direct assignment of physical devices to confidential virtual machines

Techniques for computer memory management are disclosed herein. In one embodiment, a method includes in response to receiving a request for allocation of memory, determining whether the request is for allocation from a first memory region or a second memory region of the physical memory. The first memory region has first memory subregions of a first size and the second memory region having second memory subregions of a second size larger than the first size of the first memory region. The method further includes in response to determining that the request for allocation of memory is for allocation from the first or second memory region, allocating a portion of the first or second multiple memory subregions of the first or second memory region, respectively, in response to the request.

Computer memory management in computing devices

Techniques of implementing software filtered non-volatile memory in a computing device are disclosed herein. In one embodiment, a method includes detecting an entry being written to a guest admin submission queue (gASQ) by a memory driver of a virtual machine hosted on the computing device. Upon detecting the entry written to the gASQ by the memory driver, the command in the entry is analyzed to determine whether the command is allowed based on a list of allowed or disallowed commands. In response to determining that the command in the entry is not allowed, without sending the command to the non-volatile memory, generating an execution result of the command in response to the entry being written to the gASQ by the memory driver. As such, potentially harmful commands from the memory driver are prevented from being executed by the non-volatile memory.

Software filtered memory devices in computing systems

An operation of a VM running first and second VM components is suspended so that a servicing operation for the VM can be performed. The VM has devices directly attached to it. A state of the first VM components is saved. An identification pointer for the second VM components is saved in a portion of the computing system physical memory without removing any underlying data structures of second VM components from computing system physical hardware. The directly attached devices remain configured as attached to the VM and remain configured to communicate with the VM while the VM is suspended and while the servicing operation is performed. The first VM components are shut down and then restored at the completion of the servicing operation using the saved state. The restored first VM components are reconnected to the second VM components using the identification pointers. The operation of the VM is restored.

Moving scheduling of processor time for virtual processors (VPs) out of a virtualization hypervisor. A host operating system schedules VP (virtual processor) processor time. The host operating system creates VP backing threads, one for each VP of each virtual machine. There is a one-to-one mapping between each VP thread in the host operating system and each VP in the hypervisor. When a VP thread is dispatched for a slice of processor time, the host operating system calls into the hypervisor to have the hypervisor start executing the VP, and the hypervisor may perform a processor context switch for the VP. Of note is the security separation between VP scheduling and VP context switching. The hypervisor manages VP context switching in kernel mode while VP scheduling is performed in user mode. There is a security/interface boundary between the unit that schedules VP processor time and the hypervisor.

Hypervisor virtual processor execution with extra-hypervisor scheduling

A virtual machine manager facilitates selective code integrity enforcement. A virtual machine manager (or other higher privileged entity) can verify the integrity of code in memory pages, and a virtual processor running in kernel mode executes the code on a memory page only if the virtual machine manager (or other higher privileged entity) has verified the code integrity of that code. However, the virtual machine manager need not verify the integrity of code in memory pages when the virtual processor is running in user mode. Rather, an operating system running on the virtual processor can apply any of a variety of policies (e.g., optionally perform any of a variety of different checks or verifications of the code) to determine whether the code can be executed in user mode.

Virtual machine manager facilitated selective code integrity enforcement

The disclosed technology is generally directed to the patching of executing binaries. In one example of the technology, at separate times, a plurality of hot patch requests is received. Each hot patch request of the plurality of hot patch requests includes a corresponding hot patch to hot patch the executing binary. A cardinality of the plurality of hot patch requested is greater than the fixed number of logical patch slots. with the executing binary continuing to execute, each time a request to apply a hot patch to the executing binary is received, the corresponding hot patch is assigned to an inactive logical patch slot of the fixed number of logical patch slots. The corresponding hot patch is executed from the assigned logical patch slot to hot patch the executing binary based on the corresponding hot patch.

Resource efficient deployment of multiple hot patches

Growing community of inventors

Redmond, WA, United States of America

David Hepkin