-
公开(公告)号：US10592267B2
公开(公告)日：2020-03-17
申请号：US15402243
申请日：2017-01-10
Applicant: VMWARE, INC.
Inventor： David Dunn , Alok Nemchand Kataria , Wei Xu , Jeffrey W. Sheldon
Abstract: Mechanisms to protect the integrity of a data structure that is traversed to locate protected memory pages are provided. Leaf nodes of the data structure store mappings that indicate which memory pages are protected. Both the pages indicated by the mappings and the pages that store the data structure are monitored by a tracing service that sends a notification to the hypervisor when a write to a traced page occurs. When system software receives such a notification, the system software traverses the data structure to determine whether any of the memory pages of the data structure is the traced page that was written to. If so, the alert action for that page is performed. If not, the system software determines whether any of the mappings in the leaf nodes include such a page and, if so, the alert action for that page is performed.
-
公开(公告)号：US10198299B1
公开(公告)日：2019-02-05
申请号：US15798365
申请日：2017-10-30
Applicant: VMware, Inc.
Inventor： Xin Xu , Bryan Tan , Wei Xu , Tao Ren , Radu Rugina , Vivek Mohan Thampi
Abstract: Techniques for enabling live migration of VMs with passthrough PCI devices are provided. In one set of embodiments, a hypervisor of a host system can create a copy of a DMA buffer used by a VM of the host system and a passthrough PCI device of the VM. The hypervisor can further designate one of the DMA buffer or the copy of the DMA buffer as a vCPU buffer that is accessible by the VM, and designate the other of the DMA buffer or the copy of the DMA buffer as a device buffer that is accessible by the passthrough PCI device. The hypervisor can then synchronize the vCPU buffer and the device buffer with each other as the VM and passthrough PCI device interact with their respective buffers, and as part of the synchronization can intercept DMA work requests submitted by the VM/completed by the passthrough PCI device.
-
公开(公告)号：US20160299851A1
公开(公告)日：2016-10-13
申请号：US14798483
申请日：2015-07-14
Applicant: VMWARE, INC.
Inventor： James S. Mattson, JR. , Rakesh Agarwal , Alok Nemchand Kataria , Wei Xu , Frederick Joseph Jacobs
IPC: G06F12/10
CPC classification number: G06F12/145 , G06F9/45558 , G06F21/78 , G06F2009/45587 , G06F2212/1052 , G06F2212/151
Abstract: A hypervisor provides a guest operating system with a plurality of protection domains, including a root protection domain and one or more secure protection domains, and mechanisms for controlling the transitions between the protection domains. The guest physical memory region of a secure protection domain, which is mapped to host physical memory by secure nested page tables, stores secure guest code and data, and guest page tables for the secure guest code. When executing secure guest code, the guest page tables stored in the secure protection domain region are used for guest virtual to guest physical address translations, and the secure nested page tables are used for guest physical to host physical address translations.
Abstract translation: 管理程序为客户机操作系统提供了多个保护域，包括根保护域和一个或多个安全保护域，以及用于控制保护域之间转换的机制。 通过安全嵌套页面表映射到主机物理内存的安全保护域的访客物理内存区域存储安全访客代码和数据，以及安全访客代码的访客页面表。 当执行安全访客代码时，存储在安全保护域区域中的访客页面表用于访客虚拟客户物理地址转换，并且安全嵌套页面表用于访客物理主机物理地址转换。
-
公开(公告)号：US10430223B2
公开(公告)日：2019-10-01
申请号：US15256779
申请日：2016-09-06
Applicant: VMWARE, INC.
Inventor： Wei Xu , Alok Nemchand Kataria , Jeffrey W. Sheldon
IPC: G06F9/455
Abstract: Mechanisms to protect the integrity of memory of a virtual machine are provided. The mechanisms involve utilizing certain capabilities of the hypervisor underlying the virtual machine to monitor writes to memory pages of the virtual machine. A guest integrity driver communicates with the hypervisor to request such functionality. Additional protections are provided for protecting the guest integrity driver and associated data, as well as for preventing use of these mechanisms by malicious software. These additional protections include an elevated execution mode, termed “integrity mode,” as well as protections on the memory pages that store the guest integrity driver. To prevent spurious alerts associated with the GI driver accessing its own data, the hypervisor maintains two page tables. In one copy, pages storing data for the GI driver are not protected and in the other, those pages are protected. The hypervisor switches the page tables when entering and exiting integrity mode.
-
公开(公告)号：US20190146853A1
公开(公告)日：2019-05-16
申请号：US16223071
申请日：2018-12-17
Applicant: VMware, Inc.
Inventor： Xin Xu , Bryan Tan , Wei Xu , Tao Ren , Radu Rugina , Vivek Mohan Thampi
Abstract: Techniques for enabling live migration of VMs with passthrough PCI devices are provided. In one set of embodiments, a hypervisor of a host system can create a copy of a DMA buffer used by a VM of the host system and a passthrough PCI device of the VM. The hypervisor can further designate one of the DMA buffer or the copy of the DMA buffer as a vCPU buffer that is accessible by the VM, and designate the other of the DMA buffer or the copy of the DMA buffer as a device buffer that is accessible by the passthrough PCI device. The hypervisor can then synchronize the vCPU buffer and the device buffer with each other as the VM and passthrough PCI device interact with their respective buffers, and as part of the synchronization can intercept DMA work requests submitted by the VM/completed by the passthrough PCI device.
-
Patent Agency Ranking
公开(公告)号：US20190129814A1
公开(公告)日：2019-05-02
申请号：US15881480
申请日：2018-01-26
Applicant: VMware, Inc.
Inventor： Kiran Tati , Qasim Ali , Wei Xu , Rajesh Venkatasubramanian , Pratap Subrahmanyam
Abstract: Techniques for implementing application fault tolerance via battery-backed replication of volatile state are provided. In one set of embodiments, a primary host system can detect a failure that causes an application of the primary host system to stop running. In response to detecting the failure, the primary host system can replicate volatile state that is used by the application to a secondary host system, where the secondary host system maintains a copy of the application, and where execution of the application is failed over to the copy on the secondary host system using the replicated volatile state.
-
公开(公告)号：US11379385B2
公开(公告)日：2022-07-05
申请号：US15444350
申请日：2017-02-28
Applicant: VMWARE, INC.
Inventor： Alok Nemchand Kataria , Wei Xu , Radu Rugina , Jeffrey W. Sheldon , James S. Mattson , Rakesh Agarwal , David Dunn
Abstract: Mechanisms to protect the integrity of memory of a virtual machine are provided. The mechanisms involve utilizing certain capabilities of the hypervisor underlying the virtual machine to monitor writes to memory pages of the virtual machine. A guest integrity driver communicates with the hypervisor to request such functionality. Additional protections are provided for protecting the guest integrity driver and associated data, as well as for preventing use of these mechanisms by malicious software. These additional protections include an elevated execution mode, termed “integrity mode,” which can only be entered from a specified entry point, as well as protections on the memory pages that store the guest integrity driver and associated data.
-
公开(公告)号：US10929234B2
公开(公告)日：2021-02-23
申请号：US15881480
申请日：2018-01-26
Applicant: VMware, Inc.
Inventor： Kiran Tati , Qasim Ali , Wei Xu , Rajesh Venkatasubramanian , Pratap Subrahmanyam
Abstract: Techniques for implementing application fault tolerance via battery-backed replication of volatile state are provided. In one set of embodiments, a primary host system can detect a failure that causes an application of the primary host system to stop running. In response to detecting the failure, the primary host system can replicate volatile state that is used by the application to a secondary host system, where the secondary host system maintains a copy of the application, and where execution of the application is failed over to the copy on the secondary host system using the replicated volatile state.
-
9.发明授权公开(公告)号：US10922402B2
公开(公告)日：2021-02-16
申请号：US14550881
申请日：2014-11-21
Applicant: VMware, Inc.
Inventor： Wei Xu , Alok Nemchand Kataria , Rakesh Agarwal , Martim Carbone
Abstract: In a computer system operable at more than one privilege level, an interrupt security module handles interrupts without exposing a secret value of a register to virtual interrupt handling code that executes at a lower privilege level than the interrupt security module. The interrupt security module is configured to intercept interrupts generated while executing code at lower privilege levels. Upon receiving such an interrupt, the interrupt security module overwrites the secret value of the register with an unrelated constant. Subsequently, the interrupt security module generates a virtual interrupt corresponding to the interrupt and forwards the virtual interrupt to the virtual interrupt handling code. Advantageously, although the virtual interrupt handling code is able to determine the value of the register and consequently the unrelated constant, the virtual interrupt handling code is unable to determine the secret value.
-
公开(公告)号：US09870324B2
公开(公告)日：2018-01-16
申请号：US14798483
申请日：2015-07-14
Applicant: VMWARE, INC.
Inventor： James S. Mattson, Jr. , Rakesh Agarwal , Alok Nemchand Kataria , Wei Xu , Frederick Joseph Jacobs
CPC classification number: G06F12/145 , G06F9/45558 , G06F21/78 , G06F2009/45587 , G06F2212/1052 , G06F2212/151
Abstract: A hypervisor provides a guest operating system with a plurality of protection domains, including a root protection domain and one or more secure protection domains, and mechanisms for controlling the transitions between the protection domains. The guest physical memory region of a secure protection domain, which is mapped to host physical memory by secure nested page tables, stores secure guest code and data, and guest page tables for the secure guest code. When executing secure guest code, the guest page tables stored in the secure protection domain region are used for guest virtual to guest physical address translations, and the secure nested page tables are used for guest physical to host physical address translations.
-
-
-
-
-
-
-
-
-
Search Results
10
records
(took 0.015 seconds)
