Abstract: Methods, systems, and computer program products for direct assignment of physical devices to confidential virtual machines (VMs). At a first guest privilege context of a guest partition, a direct assignment of a physical device associated with a host computer system to the guest partition is identified. The guest partition includes the first guest privilege context and a second guest privilege context, which is restricted from accessing memory associated with the first guest privilege context. The guest partition corresponds to a confidential VM, such that a memory region associated with the guest partition is inaccessible to a host operating system. It is determined, based on a policy, that the physical device is allowed to be directly assigned to the guest partition. Communication between the physical device and the second guest privilege context is permitted, such as by exposing the physical device on a virtual bus and/or forwarding an interrupt.

Abstract: Implementing a firmware watchdog timer. A system presents a data structure over a bus which exposes, to software executing at a central processing unit (CPU), a hardware resource that is associated with a watchdog timer, attribute(s) of the watchdog timer, and (iii) commands available to the software executing at the CPU for managing the watchdog timer via one or more native CPU instructions that target the hardware resource. The system listens on the bus for a data value written to the hardware resource (i.e., by a native CPU operation issued by the software executing at the CPU), and identifies a particular command for managing the watchdog timer based on the data value written. Based on identifying the particular command, the system performs at least one of: initializing the watchdog timer, starting the watchdog timer, resetting the watchdog timer, or stopping the watchdog timer.

Abstract: Implementing a firmware watchdog timer. A system presents a data structure over a bus which exposes, to software executing at a central processing unit (CPU), a hardware resource that is associated with a watchdog timer, attribute(s) of the watchdog timer, and (iii) commands available to the software executing at the CPU for managing the watchdog timer via one or more native CPU instructions that target the hardware resource. The system listens on the bus for a data value written to the hardware resource (i.e., by a native CPU operation issued by the software executing at the CPU), and identifies a particular command for managing the watchdog timer based on the data value written. Based on identifying the particular command, the system performs at least one of: initializing the watchdog timer, starting the watchdog timer, resetting the watchdog timer, or stopping the watchdog timer.

Abstract: The resource leak detector attempts to identify the causes of resource leaks and fix the causes if possible. At a minimum, the located resource leaks are reported to an operating system manufacture for additional study and possible correction, either by the operating system manufacturer or the application manufacturer that is causing the resource leak. In an embodiment, in operation, a leak trigger for starting leak detection is started. If the leak trigger is activated, leak detection is started when an application begins. Resource allocations are tracked for the leaked resource and each leaked resource is matched to a corresponding allocation call stack. A type of the leaked resource may be identified. The leak detection and the leak trigger may be controlled according to at least one of a local policy and a global policy.

Abstract: The resource leak detector attempts to identify the causes of resource leaks and fix the causes if possible. At a minimum, the located resource leaks are reported to an operating system manufacture for additional study and possible correction, either by the operating system manufacturer or the application manufacturer that is causing the resource leak.