Secure migratable architecture having improved performance features

• US 9,965,192 B2
• Filed: 02/19/2016
• Issued: 05/08/2018
• Est. Priority Date: 06/30/2014
• Status: Active Grant

• Current Assignee: Unisys Corporation
• Original Assignee: Unisys Corporation
• Inventors: Beale, Andrew Ward, Strong, David
• Primary Examiner(s): Elmore, Reba I
• Application Number:
  US15/048,169
• Publication Number:
  US 20170024128A1
• Time in Patent Office: 809 Days
• Field of Search: 711154, 711156, 711166, 711170, 711203
• CPC Class Codes: G06F 12/0223 User address space allocation, e.g. contiguous or non contiguous base addressing
• CPC Class Codes: G06F 12/08 in hierarchically structured memory systems, e.g. virtual memory systems
• CPC Class Codes: G06F 12/1458 by checking the subject access rights
• CPC Class Codes: G06F 12/1483 using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45583 Memory management, e.g. access or allocation
• CPC Class Codes: G06F 2212/1004 Compatibility, e.g. with legacy hardware
• CPC Class Codes: G06F 2212/1016 Performance improvement
• CPC Class Codes: G06F 2212/1032 Reliability improvement, data loss prevention, degraded operation etc
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/151 Emulated environment, e.g. virtual machine
• CPC Class Codes: G06F 3/061 Improving I/O performance
• CPC Class Codes: G06F 3/0617 in relation to availability
• CPC Class Codes: G06F 3/062 Securing storage systems
• CPC Class Codes: G06F 3/0631 by allocating resources to storage systems
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/0644 Management of space entities, e.g. partitions, extents, pools
• CPC Class Codes: G06F 3/0647 Migration mechanisms
• CPC Class Codes: G06F 3/0656 Data buffering arrangements
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/0664 : at device level, e.g. emulation of a storage device or system
• CPC Class Codes: G06F 3/067 : Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: G06F 3/0673 : Single storage device
• CPC Class Codes: G06F 8/65 : Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/4401 : Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/455 : Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45558 : Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/5016 : the resource being the memory
• CPC Class Codes: H04L 41/0843 : based on generic templates
• CPC Class Codes: H04L 41/28 : Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Methods and systems for implementing a secure migratable architecture having improved performance features over existing virtualization systems are disclosed. One method includes allocating a portion of a memory for use by a process, the process including a firmware environment representing a virtual computing system having a second computing architecture different from a first computing architecture of a computing system on which the process is executed. The method includes associating area descriptors with each of a plurality of memory areas within the portion of the memory used by the process, and receiving a request within the firmware environment to store data within a first memory area of the plurality of memory areas, the first memory area defined by a first area descriptor of the area descriptors, the request being associated with a plurality of memory addresses within the first memory area. The method includes, in response to the request, performing a check on a tag associated with the first memory area and stored in the first area descriptor. The method further includes, upon completion of the check, storing the data within the first memory area without performing a separate tag check for each of the plurality of memory addresses within the first memory area.

Claims

1. A computing system comprising:

a programmable circuit configured to execute instructions according to a first computing architecture;

a memory communicatively connected to the programmable circuit, the memory storing software executable by the programmable circuit, the software including;

an operating system; and

a process including a firmware environment representing a virtual computing system having a second computing architecture different from the first computing architecture and one or more workloads to be executed within the process, the software executable to perform a method including;

allocating a portion of the memory for use by the process;

associating area descriptors with each of a plurality of memory areas within the portion of the memory used by the process, wherein each of the area descriptors includes a token defining to the firmware environment a base address at which a corresponding memory area is located, the base address translated to an address in memory managed by the operating system;

receiving a request within the firmware environment to store data within a first memory area of the plurality of memory areas, the first memory area defined by a first area descriptor of the area descriptors, the request being associated with a plurality of memory addresses within the first memory area;

in response to the request, performing a check on a tag associated with the first memory area and stored in the area descriptor; and

upon completion of the check, storing the data within the memory area without performing a separate tag check for each of the plurality of memory addresses within the first memory area.

2. The system of claim 1, wherein the first area descriptor includes a common tag value associated with all memory locations within the first memory area.

3. The system of claim 1, wherein the portion of the memory is, according to the second architecture implemented in the firmware environment, addressable as contiguous memory.

4. The system of claim 1, further comprising:

receiving a request to perform an I/O operation associated with a plurality of memory addresses in the first memory area; and

in response to the request, performing a check on the tag associated with the first memory area and stored in the area descriptor; and

upon completion of the check, performing the I/O operation within the memory area without performing a separate tag check for each of the plurality of memory addresses within the first memory area.

5. The system of claim 4, further comprising an I/O processor, wherein the first memory area is exposed to the I/O processor and includes an I/O control buffer and an I/0 data buffer.

6. The system of claim 1, wherein the first area descriptor defines a type and width of data in the first memory area.

7. The system of claim 1, wherein the programmable circuit includes circuitry configured to perform a plurality of native arithmetic operations within the first computing architecture, and wherein the second computing architecture uses a common numerical format with the first computing architecture to allow for use of the native arithmetic operations of the programmable circuit during execution of arithmetic operations performed within the firmware environment.

8. The system of claim 1, wherein storing the data within the memory area includes storing a plurality of data words in contiguous memory within the data area.

9. A computer-implemented method comprising:

allocating a portion of a memory for use by a process, the process including a firmware environment representing a virtual computing system having a second computing architecture different from a first computing architecture of a computing system on which the process is executed;

associating area descriptors with each of a plurality of memory areas within the portion of the memory used by the process, wherein each of the area descriptors includes a token defining to the firmware environment a base address at which a corresponding memory area is located, the base address translated to an address in the memory;

receiving a request within the firmware environment to store data within a first memory area of the plurality of memory areas, the first memory area defined by a first area descriptor of the area descriptors, the request being associated with a plurality of memory addresses within the first memory area;

in response to the request, performing a check on a tag associated with the first memory area and stored in the first area descriptor; and

upon completion of the check, storing the data within the first memory area without performing a separate tag check for each of the plurality of memory addresses within the first memory area.

10. The method of claim 9, wherein storing the data within the first memory area includes storing a plurality of data words in contiguous memory within the first memory area.

11. The method of claim 9, further comprising:

receiving a request to perform an I/O operation associated with a plurality of memory addresses in the first memory area; and

in response to the request, performing a check on the tag associated with the first memory area and stored in the area descriptor; and

upon completion of the check, performing the I/O operation within the memory area without performing a separate tag check for each of the plurality of memory addresses within the first memory area.

12. The method of claim 11, wherein performing the I/O operation within the memory area includes storing a plurality of data words into contiguous memory locations of an I/O data buffer included in the memory area.

13. The method of claim 9, further comprising:

receiving a second request within the firmware environment to store data within a second memory area of the plurality of memory areas, the second memory area defined by a second area descriptor of the area descriptors, the second request being associated with a second plurality of memory addresses within the second memory area;

in response to the request, performing a check on a plurality of tags stored in a tag memory area separate from but associated with the second memory area, wherein a location of the tag memory area and a location of the second memory area are both stored in a second area descriptor; and

storing the data within the second memory area.

14. The method of claim 13, further comprising performing a check against each of the plurality of tags associated with the second plurality of memory addresses.

15. The method of claim 14, wherein storing the data within the second memory area includes storing a plurality of data words in contiguous memory within the second memory area.

16. The method of claim 15, further comprising updating each of the plurality of tags associated with the second plurality of memory addresses.