International Business Machines Corporation

Kyndryl, Inc.

Rafael Camarda Silva Folco

Breno H Leitao

Mauro Sergio Martins Rodrigues

Daniel Battaiola Kreling

Tiago Nunes Dos Santos

Murilo Opsfelder Araújo

Rafael Peria De Sene

Plinio A S Freire

Kleber Sacilotto De Souza

Juscelino Candido De Lima Junior

Jose F Santiago Filho

Desnes A Nunes Do Rosario

Desnes A Nunes Do Rosário

Tiago Nune Dos Santos

Secure memory sharing between enclaves (virtual machines) and virtual input/output adapters includes, in response to a request for an enclave to create a virtual input/output adapter, creating a virtual input/output adapter associated with the enclave, creating a non-sharable micro-enclave, to contain only data, nested within the enclave to use with the virtual input/output adapter, generating a key by a memory encryption engine of an ultravisor for the virtual input/output adapter for use by only the virtual input/output adapter, in response to a request to obtain data from the enclave by the virtual input/output adapter, exchanging the key with the non-sharable micro-enclave, in response to receiving the key, decrypting memory of only the non-sharable micro-enclave associated with the virtual input/output adapter to obtain the data, and sending the data from the non-sharable micro-enclave nested within the enclave to the virtual input/output adapter.

Mechanism to enable secure memory sharing between enclaves and I/O adapters

Systems and methods for improved process caching through iterative feedback are disclosed. In embodiments, a computer implemented method comprises retrieving updated metadata of a process to be executed, wherein the updated metadata includes information regarding cache misses from a prior execution of the process; automatically modifying a setting of a data stream control register based on the updated metadata; automatically setting a hint at a data cache block touch module; performing an initial execution of the process after the steps of retrieving the updated metadata, automatically modifying the setting of the data stream control register, and automatically setting the hint at the data cache block touch module; and modifying the updated metadata of the process after the execution of the process based on cache miss statistical data gathered during the execution of the process, to produce newly updated metadata.

Process data caching through iterative feedback

Embodiments of the present invention disclose a method, computer program product, and system for managing memory bandwidth usage in software containers. Software container properties are received from a software container engine. In response to detecting the execution of one or more software containers by the software container engine, a monitoring layer is generated. At periodic time intervals, the generated monitoring layer monitors a memory bandwidth use value associated with each of the executed software containers. For each periodic time interval, an average memory use value is calculated, associated with each executed software container. In response to the calculated average memory use value being above a threshold associated with a monitored software container of the executed containers, the monitored software container is suspended for a suspend time duration. The suspended monitored software container is reactivated based on the suspend time duration expiring.

Bandwidth management of memory through containers

Booting a virtual machine instance using remote direct memory access is provided. In response to beginning to receive pages of a predetermined set of pages corresponding to a requested image of a virtual machine from an image provider server, a boot process of an instance of the virtual machine is commenced while the received pages are written directly into a random-access memory (RAM) disk. The received pages are read from the RAM disk during the boot process of the instance of the virtual machine until transfer of the predetermined set of pages corresponding to the requested image is complete. The predetermined set of pages corresponding to the requested image are written to a local hard disk drive from the memory releasing memory usage. In response to completing the boot process, a RAM image is switched to a local hard disk drive image.

Instantaneous boot of virtual machine instances via remote direct memory access

Managing seamless server halt and restart is provided. A suspend event corresponding to a non-non-volatile dual-inline memory module (non-NVDIMM) server that comprises a set of virtual machines is received. In response to receiving the suspend event corresponding to the non-NVDIMM server, running virtual machine processes are stopped on the non-NVDIMM server. Virtual machine state information corresponding to stopped non-NVDIMM server virtual machine processes is saved on a set of non-volatile dual-inline memory modules (NVDIMMs) located in a non-volatile dual-inline memory module (NVDIMM) server.

Seamless virtual machine halt and restart on a server

Systems and methods improve performance and resource-efficiency of Just-in-Time (JIT) compilation in a hypervisor-based virtualized computing environment. A user attempts to launch an application that has been previously compiled by a JIT compiler into an intermediate, platform-independent format. A JIT accelerator selects a unique function signature that identifies the application and the user's target platform. If the signature cannot be found in a repository, indicating that the application has never been run on the target platform, the accelerator generates and stores the requested executable program in shared memory and saves the signature in the repository. The system then returns to the user a pointer to the stored platform-specific executable. If multiple users of the same platform request the same application, the system recognizes an affinity among those requests identified by their shared signature, and provides each user a pointer to the same previously stored, shared executable.

Hypervisor-based just-in-time compilation

Systems and methods for cache balance when using hardware transactional memory are disclosed. A method includes: determining, by a computing device, a hardware transactional memory (HTM) attrition rate for a workload in a distributed computing environment; determining, by the computing device, whether or not the HTM attrition rate for the workload exceeds a predetermined threshold; and in response to determining that the HTM attrition rate for the workload does not exceed the predetermined threshold, the computing device causing a requested HTM transaction to begin.

Cache balance when using hardware transactional memory

Disclosed embodiments provide techniques for inter-enclave communication through shared memory. Enclaves (containers) operate in a protected memory space that inhibits the use of shared memory. Disclosed embodiments enable enclaves to use shared memory, eliminating the communication bottlenecks associated with networking. A memory cryptography coprocessor implemented in hardware generates shared memory key data for a shared memory region that is to be used by two or more enclaves. The shared memory key data is sent to the enclaves that require a shared memory interface. The enclaves access the shared memory securely utilizing the shared memory key data. The memory cryptography coprocessor facilitates shared memory key generation and exchange. The memory cryptography coprocessor data is not directly accessible by the processes executing on the main processor. This enables secure cloud hosting on untrusted environments, since the hosting entity cannot directly access the internal data of the memory cryptography coprocessor.

Shared memory inter-enclave communication

In an approach for moving workloads between central processing units (CPUs) to accommodate balance, a processor profiles a first processor and a second processor of a plurality of processors, using a cycle per instruction metric. A processor assigns a first group of instructions to the first processor and a second group of instructions to the second processor. A processor sums an instruction count for the first group of instructions and an instruction count for the second group of instructions. A processor determines that a balance condition, defined by a predetermined threshold, does not exist across the first processor and the second processor. A processor identifies the second processor has a lower cycle per instruction metric than the first processor. A processor moves a workload, running on the first processor, with a maximum number of instructions of an unbalanced group to the second processor to balance workloads.

Optimized multi-processor instruction scheduler

A method, computer program product, and system for managing container security, the method including consuming a recipe queue on a first checker container, wherein the first checker container is on a first host of a computer system, and the recipe queue comprises a predefined set of rules, storing the first checker container recipe queue result in the first checker container, comparing the first checker container recipe queue result with an expected result of the recipe queue, wherein the expected result is stored in the first checker container, and following a first fail procedure from a plurality of fail procedures, based on the first checker container recipe queue result not matching the expected result.

Malicious code avoidance using transparent containers

There is provided a method for managing heterogeneous cloud data storage systems across heterogeneous cloud computing systems. The method comprises: defining rules that govern storing of data in one or more of a plurality of heterogeneous cloud data storage systems; receiving complete data from a user's computer; splitting the complete data; and storing the split data according to the defined rules into the plurality of heterogeneous cloud data storage systems.

Scalable approach to manage storage volumes across heterogenous cloud systems

Optimization and affinity for hypervisor-based just-in-time translator

A dual chipset architecture, a method of operating a scheduler for a dual chipset architecture, and a computer program product for operating a scheduler for a dual chipset architecture. In an embodiment, the dual chipset architecture comprises a high performance processor, a low performance processor, and a scheduler for the processors. The scheduler is provided for determining an expected data traffic flow to the chipset, and for selectively enabling the high and low performance processors, based on this expected data flow, ahead of this expected data flow reaching the chipset. In one embodiment, a specified data traffic indicator is associated with the expected data traffic flow, and the scheduler uses this specified data traffic indicator to determine the expected data traffic flow. In an embodiment, this specified data traffic indicator is a value for a defined window size for the expected data flow.

Growing community of inventors

Santa Barbara d'Oeste, Brazil

Rafael Camarda Silva Folco