Allocation of shared system resources

• US 9,703,951 B2
• Filed: 09/30/2014
• Issued: 07/11/2017
• Est. Priority Date: 09/30/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Patel, Rahul Gautam, Potlapally, Nachiketh Rao, Earl, William John, Wilson, Matthew Shawn
• Primary Examiner(s): Okeke, Izunna
• Application Number:
  US14/502,891
• Publication Number:
  US 20160092677A1
• Time in Patent Office: 1,015 Days
• CPC Class Codes: G06F 12/0842 for multiprocessing or multitasking
• CPC Class Codes: G06F 12/0846 Cache with multiple tag or data arrays being simultaneously accessible
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06F 9/5077 Logical partitioning of resources; Management or configuration of virtualized resources specific details on emulation or internal functioning of virtual machines G06F9/455

Abstract

Techniques are described for allocating resources to a task from a shared hardware structure. A plurality of tasks may execute on a processor, wherein the processor may include one or more processing cores and each task may include a plurality of computer executable instructions. In accordance with one technique for allocating resources to a task from a shared hardware structure amongst multiple tasks, aspects of the disclosure describe assigning a first identifier to a first task from the plurality of tasks, associating a portion of the shared hardware resource with the first identifier, and restricting access and/or observability for computer executable instructions executed from any other task than the first task to the portion of the hardware resource associated with the first identifier.

Claims

1. A computing device, comprising:

a processor comprising one or more processing cores and operating in a multi-tenant environment, wherein

the one or more processing cores executes at least a first virtual machine and a second virtual machine simultaneously, and

the first virtual machine comprising a first plurality of computer executable instructions for a first tenant and the second virtual machine comprising a second plurality of computer executable instructions for a second tenant;

a cache or a buffer in the processor shared by the first virtual machine and the second virtual machine, the first virtual machine and the second virtual machine executing simultaneously on the one or more processing cores wherein simultaneously executing virtual machines comprises concurrently processing at least one executable instruction belonging to the first virtual machine and at least another executable instruction belonging to the second virtual machine, wherein neither of the instructions belonging to the first virtual machine and the second virtual machine have completed execution;

a hardware resource allocator implemented in microcode for the one or more processing cores or privileged code executing on the one or more processing cores to;

assign a first identifier to the first virtual machine; and

associate a portion of the cache or the buffer with the first identifier; and

the processor comprising a hardware resource manager to;

restrict access for computer executable instructions executed from the first virtual machine to the portion of the cache or the buffer associated with the first identifier, wherein the computer executable instructions access other portions of the cache or the buffer.

2. The computing device of claim 1, wherein restricting access to the portion of the cache or the buffer associated with the first identifier comprises restricting access such that the computer executable instructions executed from the first virtual machine can access only the portion of the cache or the buffer associated with the first identifier from the cache or the buffer, respectively.

3. The computing device of claim 1, wherein restricting access to the portion of the cache or the buffer associated with the first identifier comprises restricting access such that the computer executable instructions executed from the first virtual machine cannot access the portion of the hardware resource associated with the first identifier from the cache or the buffer, respectively.

4. The computing device of claim 1, wherein the cache is one or more of a Level 1 cache, a Level 2 cache, or a Level 3 cache, and wherein the buffer is one or more of Translation Look-aside Buffer (TLB), Write Combining Buffer, Branch Prediction Table, or Branch Target Buffer.

5. A computing device, comprising:

a processor comprising one or more processing cores, wherein the one or more processing cores executes a plurality of tasks simultaneously, wherein each task comprises a respective plurality of computer executable instructions and belongs to a separate virtual machine executing on the one or more processing cores and wherein simultaneously executing tasks from the plurality of tasks comprises concurrently processing at least one executable instruction belonging to a first task from the tasks and at least another executable instruction belonging to a second task from the tasks, wherein neither of the instructions belonging to the first task and the second task have completed execution;

a cache or a buffer in the processor shared by the plurality of tasks executing simultaneously on the one or more processing cores;

a hardware resource allocator implemented in microcode for the one or more processing cores or privileged code executing on the one or more processing cores, to;

assign a first identifier to the first task from the plurality of tasks; and

associate a portion of the cache or the buffer with the first identifier; and

a hardware resource manager in the processor to restrict, for computer executable instructions executed from another task than the first task from the plurality of tasks, access to the portion of the cache or the buffer associated with the first identifier, such that the other task cannot infer information associated with execution of the first task.

6. The computing device of claim 5, the hardware resource manager being configured to restrict access, for computer executable instructions executed from the first task, to the portion of the cache or the buffer associated with the first identifier.

7. The computing device of claim 5, wherein associating the portion of the cache or the buffer with the first identifier comprises the hardware resource allocator to be further configured to:

assign a second identifier to the portion of the cache or the buffer; and

associate the first identifier with the second identifier.

8. The computing device of claim 5, wherein associating the portion of the cache or the buffer with the first identifier comprises the hardware resource allocator being configured to tag the portion of the cache or the buffer with the first identifier.

9. The computing device of claim 6, wherein restricting access to the portion of the cache or the buffer associated with the first identifier comprises restricting access such that the computer executable instructions executed from the first task can access only the portion of the cache or the buffer associated with the first identifier from the cache or the buffer.

10. The computing device of claim 6, wherein restricting access to the portion of the cache or the buffer associated with the first identifier comprises restricting access such that the computer executable instructions executed from the first task cannot access the portion of the cache or the buffer associated with the first identifier from the cache or the buffer.

11. The computing device of claim 5, wherein the cache is one or more of a Level 1 cache, a Level 2 cache, or a Level 3 cache, and wherein the buffer is one or more of Translation Look-aside Buffer (TLB), Write Combining Buffer, Branch Prediction Table, or Branch Target Buffer.

12. The computing device of claim 5, wherein the plurality of tasks execute using same execution pipeline on one of the processing cores.

13. A method, comprising:

executing simultaneously a plurality of tasks on a processor, the processor comprising one or more processing cores, each task comprising a respective plurality of computer executable instructions and belonging to a separate virtual machine executing on the one or more processing cores and wherein simultaneously executing tasks from the plurality of tasks comprises concurrently processing at least one executable instruction belonging to a first task from the tasks and at least another executable instruction belonging to a second task from the tasks, wherein neither of the instructions belonging to the first task and the second task have completed execution, and wherein the plurality of tasks executing on the processor share a hardware resource associated with the processor;

assigning, by microcode or privileged instructions executing on the one or more processors, a first identifier to a first task from the plurality of tasks;

associating a portion of the shared hardware resource with the first identifier, wherein the shared hardware resource is a cache or a buffer in the processor; and

restricting observability, for computer executable instructions executed from a task other than the first task, the other task and the first task executing simultaneously on the one or more processing cores, to the portion of the shared hardware resource associated with the first identifier, such that the other task cannot infer information associated with the execution of the first task.

14. The method of claim 13, wherein restricting access to the portion of the shared hardware resource associated with the first identifier comprises restricting access such that the computer executable instructions executed from the first task can access only the portion of the shared hardware resource associated with the first identifier from the shared hardware resource.

15. The method of claim 13, wherein restricting observability to the portion of the shared hardware resource associated with the first identifier further comprises restricting access such that the computer executable instructions executed from the first task cannot access the portion of the shared hardware resource associated with the first identifier from the shared hardware resource.

16. The method of claim 13, wherein the shared hardware resource is one or more of a Level 1 cache, a Level 2 cache, a Level 3 cache, Translation Look-aside Buffer (TLB), Write Combining Buffer, Branch Prediction Table, Branch Target Buffer processor cycles, memory bus access, cache access, I/O access, or network access.