Abstract: A virtual machine (VM) is migrated from a source host to a destination host in a virtualized computing system, the VM having a plurality of virtual central processing units (CPUs). The method includes copying, by VM migration software executing in the source host and the destination host, memory of the VM from the source host to the destination host by installing, at the source host, write traces spanning all of the memory and then copying the memory from the source host to the destination host over a plurality of iterations; and performing switch-over, by the VM migration software, to quiesce the VM in the source host and resume the VM in the destination host. The VM migration software installs write traces using less than all of the virtual CPUs, and using trace granularity larger than a smallest page granularity.

Abstract: An example method of secure attestation of a workload deployed in a virtualized computing system is described. The virtualized computing system includes a host cluster and a virtualization management server, the host cluster having hosts and a virtualization layer executing on hardware platforms of the hosts. The method includes storing, in a trust authority, a pre-defined attestation report for a workload executing in a virtual machine (VM) managed by the virtualization layer, the pre-defined attestation report including a hash of at least a portion of an image of the VM; receiving, at the trust authority from a security module of a host in which the VM executes, an attestation report generated by measuring memory of the VM; comparing the attestation report with the pre-defined attestation report; and generating an indication of validity for the workload based on a result of the comparison.

Abstract: An example method of secure attestation of a workload deployed in a virtualized computing system is described. The virtualized computing system includes a host cluster and a virtualization management server, the host cluster having hosts and a virtualization layer executing on hardware platforms of the hosts. The method includes: launching, in cooperation with a security module of a host, a guest as a virtual machine (VM) managed by the virtualization layer, the security module generating an attestation report from at least a portion of the VM loaded into memory of the host; sending the attestation report from the security module to a trust authority; receiving, in response to verification of the attestation report by the trust authority, a secret from the trust authority at the security module; and providing the secret from the security module to the guest.

Abstract: Disclosed are various examples of provisioning a data processing unit (DPU) management operating system using a capsule. A management hypervisor installer executed on a host device receives a listing DPU device from a baseboard management controller (BMC). A preinstalled DPU management operating system image is identified for a DPU device from the listing, and is wrapped with a capsule that specifies the capsule as a DPU management operating system image capsule. A server component provides the DPU management operating system image capsule at a particular URI, and the URI is transmitted to the BMC.

Abstract: An example method of secure attestation of a workload deployed in a virtualized computing system is described. The virtualized computing system includes a host cluster and a virtualization management server, the host cluster having hosts and a virtualization layer executing on hardware platforms of the hosts. The method includes: launching, in cooperation with a security module of a host, a guest as a virtual machine (VM) managed by the virtualization layer, the security module generating an attestation report from at least a portion of the VM loaded into memory of the host; sending the attestation report from the security module to a trust authority; receiving, in response to verification of the attestation report by the trust authority, a secret from the trust authority at the security module; and providing the secret from the security module to the guest.

Abstract: An example method of secure attestation of a workload deployed in a virtualized computing system is described. The virtualized computing system includes a host cluster and a virtualization management server, the host cluster having hosts and a virtualization layer executing on hardware platforms of the hosts.

Abstract: An example method of secure attestation of a workload deployed in a virtualized computing system is described. The virtualized computing system includes a host cluster and a virtualization management server, the host cluster having hosts and a virtualization layer executing on hardware platforms of the hosts. The method includes storing, in a trust authority, a pre-defined attestation report for a workload executing in a virtual machine (VM) managed by the virtualization layer, the pre-defined attestation report including a hash of at least a portion of an image of the VM; receiving, at the trust authority from a security module of a host in which the VM executes, an attestation report generated by measuring memory of the VM; comparing the attestation report with the pre-defined attestation report; and generating an indication of validity for the workload based on a result of the comparison.

Abstract: A virtual machine (VM) is migrated from a source host to a destination host in a virtualized computing system, the VM having a plurality of virtual central processing units (CPUs). The method includes copying, by VM migration software executing in the source host and the destination host, memory of the VM from the source host to the destination host by installing, at the source host, write traces spanning all of the memory and then copying the memory from the source host to the destination host over a plurality of iterations; and performing switch-over, by the VM migration software, to quiesce the VM in the source host and resume the VM in the destination host. The VM migration software installs write traces using less than all of the virtual CPUs, and using trace granularity larger than a smallest page granularity.

Abstract: A method can include determining a number of cases received (e.g., a case load), a number of cases processed (e.g., a case rate), and dividing the case load by the case rate. The resource demand can be compared to a resource allocation, and the resource allocation can be changed based upon the resource demand. A information handling system can include a processor and a memory. The memory can have code stored therein, wherein the code can include instructions, which, when executed by the processor, allows the information handling system to perform part or substantially all of the method.

Abstract: Systems and methods for history based pipelined branch prediction. In one example, access to prediction information to predict a plurality of branches within an instruction block is initiated in a same clock cycle of the computer processor as a fetch of the instruction block. The prediction information may be available to the predictor not later than a clock cycle of the computer processor in which the plurality of branches are decoded.

Abstract: Systems and methods for history based pipelined branch prediction. In one embodiment, access to prediction information to predict a plurality of branches within an instruction block is initiated in a same clock cycle of the computer processor as a fetch of the instruction block. The prediction information may be available to the predictor not later than a clock cycle of the computer processor in which the plurality of branches are decoded.

Abstract: Methods for processing more securely are disclosed. Embodiments provide effective and efficient mechanisms for reducing APIC interference with accesses to SMRAM, where enhanced SMM code implementing these mechanisms effectively reduces APIC attacks and increases the security of proprietary, confidential or otherwise secure data stored in SMRAM.

Abstract: Methods for processing more securely are disclosed. Embodiments provide effective and efficient mechanisms for reducing APIC interference with accesses to SMRAM, where enhanced SMM code implementing these mechanisms effectively reduces APIC attacks and increases the security of proprietary, confidential or otherwise secure data stored in SMRAM.

Abstract: A method can include determining a number of cases received (e.g., a case load), a number of cases processed (e.g., a case rate), and dividing the case load by the case rate. The resource demand can be compared to a resource allocation, and the resource allocation can be changed based upon the resource demand. A information handling system can include a processor and a memory. The memory can have code stored therein, wherein the code can include instructions, which, when executed by the processor, allows the information handling system to perform part or substantially all of the method.

Abstract: Systems and methods for history based pipelined branch prediction. In one embodiment, access to prediction information to predict a plurality of branches within an instruction block is initiated in a same clock cycle of the computer processor as a fetch of the instruction block. The prediction information may be available to the predictor not later than a clock cycle of the computer processor in which the plurality of branches are decoded.

Abstract: Methods and systems for efficiently processing direct memory access requests coherently. An external agent requests data from the memory system of a computer system at a target address. A snoop cache determines if the target address is within an address range known to be safe for external access. If the snoop cache determines that the target address is safe, it signals the external agent to proceed with the direct memory access. If the snoop cache does not determine if the target address is safe, then the snoop cache forwards the request on to the processor. After the processor resolves any coherency problems between itself and the memory system, the processor signals the external agent to proceed with the direct memory access. The snoop cache can determine safe address ranges from such processor activity. The snoop cache invalidates its safe address ranges by observing traffic between the processor and the memory system.

Abstract: Methods for processing more securely. Embodiments provide effective and efficient mechanisms for reducing APIC interference with accesses to SMRAM, where enhanced SMM code implementing these mechanisms effectively reduces APIC attacks and increases the security of proprietary, confidential or otherwise secure data stored in SMRAM.

Abstract: The inventive mechanism operates to optimize program efficiency in a two phase process. In the first phase, the mechanism conducts a dependency analysis on the instructions to determine dependency relationships between the various instructions in an instruction window. The mechanism thereby identifies candidates for register renaming and instruction speculation, and provisionally performs the renaming and speculation operations, while preserving information which is preferably used to reverse these operations in the second phase if it is determined that the operations may be effectively rescheduled. In the second phase, the mechanism determines whether the optimizing operations, renaming and speculation, were beneficial in each case. Each instruction for which the mechanism finds the optimizing operation to be beneficial will generally remain in optimized form. Optimizing operations found not be beneficial are generally reversed by the mechanism.

Abstract: The invention determines whether any asynchronous signals are pending and then delivers any such pending signals to the emulated application before the control is transferred to the operating system. A first mechanism sets a global flag, and checks to determine if any signals are pending. If there are pending signals, the emulator halts the emulation of the system call, and delivers the signal to the emulated application. A second mechanism handles signals that arrive after the first mechanism has performed its check. This mechanism checks to see if the global flag is set when a signal arrives. If the flag is set, then the signal is delivered immediately. If the flag is not set, then the signal is deferred. A third mechanism establishes a watch state at the beginning of the emulation, which would be changed by any action of the operating system. When a signal comes in, the emulator checks the watch state. If it does not exist, then the emulator defers the system call.

Abstract: A translating software emulator designed for converting code from a legacy system to a target system and fully preserving the synchronous exception state while still allowing for full and aggressive optimization in the translation. A user application is translated to a target system using full optimization techniques. The translation may be done dynamically by an emulator emulating the legacy system on the target system, or the translation may be a static translation or a compilation, fully generating a new executable program operable on the target system. The invention recovers from the exception properly by restoring the target machine state to the machine state expected by the legacy system. This recovery is done by using an exception delivery mechanism to restore the machine state of the target system before executing the exception handling code.