Vmware, Inc.

Technion Research & Development Foundation Limited

International Business Machines Corporation

Nadav Amit

Michael Wei

Dan Tsafrir

Frederick Joseph Jacobs

Amy Tai

Assaf Schuster

Pratap Subrahmanyam

Rajesh Venkatasubramanian

Marcos Kawazoe Aguilera

Shmuel Ben-Yehuda

Kiran Tati

Abel Alkon Gordon

Irina Calciu

Xavier Deguillard

Jayneel Gandhi

Lalith Suresh

Alexander Landau

Nadav Har'El

Igor Smolyar

Stanko Novakovic

Cheng Chun Tu

A hypervisor communicates with a guest operating system running in a virtual machine supported by the hypervisor using a hyper-callback whose functions are based on the particular guest operating system running the virtual machine and are triggered by one or more events in the guest operating system. The functions are modified to make sure they are safe to execute and to allow only limited access to the guest operating system. Additionally, the functions are converted to byte code corresponding to a simplified CPU and memory model and are safety checked by the hypervisor when registered with the hypervisor. The functions are executed by the hypervisor without any context switch between the hypervisor and guest operating system, and when executed, provide information about the particular guest operating system, allowing the hypervisor to improve operations such as page reclamation, virtual CPU scheduling, I/O operations, and tracing of the guest operating system.

Safe execution of virtual machine callbacks in a hypervisor

One or more kernel-modifying procedures are stored in a trusted computing base (TCB) when bringing up a guest operating system (OS) on a virtual machine (VM) on a virtualization platform. When the guest OS invokes an OS-level kernel-modifying procedure, a call is made to the hypervisor. If the hypervisor determines the TCB to be valid, the kernel-modifying procedure in the TCB that corresponds to the OS-level kernel-modifying procedure is invoked so that the kernel code can be modified.

Enforcing code integrity using a trusted computing base

Techniques for consolidating shared state for translation lookaside buffer (TLB) shootdowns are provided. In one set of embodiments, an operating system (OS) kernel of a computer system can co-locate, in a system memory of the computer system, a plurality of shared data accessed by first and second processing cores of the computer system for performing a translation lookaside buffer (TLB) shootdown of the first processing core by the second processing core, where the co-locating allows the plurality of shared data to occupy a single cache line when brought from the system memory into a CPU (central processing unit) cache of the first or second processing core. This can include, e.g., (1) co-locating a lazy mode indicator and a call function queue (CFQ) head element of the first processing core, such that these two data components occupy the same cache line, and (2) co-locating a TLB flush info entry and a call function data (CFD) entry created by the second processing core at the time of initiating the TLB shootdown, such that these two data components occupy the same cache line.

Consolidating shared state for translation lookaside buffer shootdowns

Techniques for implementing early acknowledgement for translation lookaside buffer (TLB) shootdowns are provided. In one set of embodiments, a first (i.e., remote) processing core of a computer system can receive an inter-processor interrupt (IPI) from a second (i.e., initiator) processing core of the computer system for performing a TLB shootdown of the first processing core. Upon receiving the IPI, an interrupt handler of the first processing core can communicate an acknowledgement to the second processing core that the TLB of the first processing core has been flushed, prior to actually flushing the TLB.

Early acknowledgement of translation lookaside buffer shootdowns

Described herein are embodiments that adaptively reduce the number of interrupts that occur between a device controller and a computer system. Device commands are submitted to the controller by an operating system on behalf of an application. The device performs the received commands and indicates command completions to the controller. A counter counts completions, and if the count exceeds a threshold number, the controller generates an interrupt to the computer system. If the count is greater than zero and the timeout interval has expired, then the controller generates an interrupt to the computer system. In some embodiments, the application attaches flags to one of the commands indicating that an interrupt relating to completion of the flagged command should be generated as soon as possible or that an interrupt relating to completion of all commands prior to and including the flagged command should be generated as soon as possible.

Software-controlled interrupts for I/O devices

A method for redirecting indirect calls to direct calls on a per-process basis includes accessing a memory code region of an operating system kernel that has a different mapping for each of one or more user processes running on the operating system kernel. The memory code region stores a first trampoline that refers directly to a second trampoline, which is an inline or outline trampoline that is correlated with a particular user process. Executing the first trampoline invokes the second trampoline, as a result of which the indirect calls are redirected to direct calls.

Target injection safe method for inlining instance-dependent calls

A method for redirecting an indirect call in an operating system kernel to a direct call is disclosed. The direct calls are contained in trampoline code called an inline jump switch (IJS) or an outline jump switch (OJS). The IJS and OJS can operate in either a use mode, redirecting an indirect call to a direct call, a learning and update mode or fallback mode. In the learning and update mode, target addresses in a trampoline code template are learned and updated by a jump switch worker thread that periodically runs as a kernel process. When building the kernel binary, a plug-in is integrated into the kernel. The plug-in replaces call sites with a trampoline code template containing a direct call so that the template can be later updated by the jump switch worker thread.

Target injection safe method for dynamically inlining branch predictions

In accordance with embodiments of the present disclosure, a compiler can compile source code to produce binary code that includes address shifting code inserted with memory operations. The address shifting code can shift addresses of memory operations that access locations in the kernel address space into address locations in the user space, thus avoiding speculative access into the kernel address space.

Compilation-time checks to secure processes from speculative rogue cache loads

A method of redirecting an indirect call in a callback list associated with a list of functions that are registered, includes the steps of: upon registering the list of functions, determining a list of function pointers, each of which corresponds to an address in an associated callback; for each function pointer in the list of function pointers, adding a direct call instruction to the registration trampoline corresponding to the associated callback of the function pointer; and upon invoking the associated callback of one of the function pointers in the list of function pointers, invoking the corresponding direct call instruction in the registration trampoline.

Target injection safe method for inlining registration calls

A method redirecting an indirect call in a call table to direct call includes the steps of: recording frequencies of calls in a frequency table; updating a search trampoline to cache, as direct calls, calls of the call table that are most frequently made according to the recorded calls in the frequency table; receiving a request to perform one of the calls in the call table; performing a search of the search trampoline to determine whether or not the requested call is cached in the search trampoline; if the requested call is cached in the search trampoline, performing the requested call that is cached in the search trampoline; and if the requested call is not cached in the search trampoline, performing the requested call by accessing the call via the call table.

Target injection safe method for inlining large call tables

In accordance with embodiments of the present disclosure, a binary translator can perform address shifting on the binary code of an executing application. Address shifting serves to shift the addresses of memory operations that can access locations in the kernel address space into address locations in the user space, thus avoiding speculative access into the kernel address space.

Dynamic binary translation to secure processes from speculative rogue cache loads

The present disclosure addresses the meltdown vulnerability resulting from speculative execution in a multi-core processing system. The operating system (OS) can be loaded for execution on one of several processing cores (OS core), while an application can be loaded for execution on another of the processing cores (application core). The OS core uses process page tables that map the entire kernel address space to physical memory. Conversely, the application core uses pages tables that map only a portion of the kernel address space to physical memory.

Separate cores to secure processes from speculative rogue cache loads

Exemplary methods, apparatuses, and systems include a distributed memory agent within a first node intercepting an operating system request to open a file from an application running on the first node. The request includes a file identifier, which the distributed memory agent transmits to a remote memory manager. The distributed memory agent receives, from the remote memory manager, a memory location within a second node for the file identifier and information to establish a remote direct memory access channel between the first node and the second node. In response to the request to open the file, the distributed memory agent establishes the remote direct memory access channel between the first node and the second node. The remote direct memory access channel allows the first node to read directly from or write directly to the memory location within the second node while bypassing an operating system of the second node.

File system interface for remote direct memory access

Embodiments are disclosed to mitigate the meltdown vulnerability by selectively using page table isolation. Page table isolation is enabled for 64-bit applications, so that unprivileged areas in the kernel address space cannot be accessed in user mode due to speculative execution by the processor. On the other hand, page table isolation is disabled for 32-bit applications thereby providing mapping into unprivileged areas in the kernel address space. However, speculative execution is limited to a 32-bit address space in a 32-bit application, and s access to unprivileged areas in the kernel address space can be inhibited.

32-bit address space containment to secure processes from speculative rogue cache loads

A method for reducing disk read rate by managing dataset mapping of virtual machine (VM) guest memory, comprising: monitoring a plurality of disk read write operations of a VM guest; updating a dataset mapping between disk blocks allocated to the VM guest and corresponding physical addresses of memory pages of the VM guest containing replica of data stored in the disk blocks, based on the plurality of disk read write operations; when identifying writing to one of the memory pages, removing a mapping of corresponding disk block and corresponding physical address of memory page; when reclaiming a mapped memory page of the VM guest by a host of the VM guest, discarding data contained in the memory page; and when the data is requested by the VM guest after it was reclaimed by said host, retrieving the data from corresponding disk block according to the mapping.

Growing community of inventors

Mountain View, CA, United States of America

Nadav Amit