Separate cores to secure processes from speculative rogue cache loads
AssigneeVMware, Inc.
InventorsMichael Wei, Dan Tsafrir, Nadav Amit
Life of this patent
Estimating the term…
Abstract
The present disclosure addresses the meltdown vulnerability resulting from speculative execution in a multi-core processing system. The operating system (OS) can be loaded for execution on one of several processing cores (OS core), while an application can be loaded for execution on another of the processing cores (application core). The OS core uses process page tables that map the entire kernel address space to physical memory. Conversely, the application core uses pages tables that map only a portion of the kernel address space to physical memory.
Claims20
A method for executing an application on a computing system, the method comprising:
- executing an operating system (OS) on a first processing core selected from among a plurality of processing cores in the computing system;
- translating virtual addresses in a first virtual address space of an application received from the first processing core using a first set of page tables that maps an entire user address space of the application and an entire kernel address space of the OS to a physical memory shared by the plurality of processing cores;
- executing the application on a second processing core selected from among the plurality of processing cores in the computing system;
- and
- translating virtual addresses in a second virtual address space of the application received from the second processing core using a second set of page tables that maps the entire user address space of the application and at most only a portion of the kernel address space of the OS to the physical memory.
A non-transitory computer-readable storage medium having stored thereon computer executable instructions, which when executed by a computer device, cause the computer device to:
- execute an operating system (OS) on a first processing core selected from among a plurality of processing cores comprising the computer device;
- translate virtual addresses in a first virtual address space of an application received from the first processing core using a first set of page tables that maps an entire user address space of the application and an entire kernel address space of the OS to a physical memory shared by the plurality of processing cores;
- execute the application on a second processing core selected from among the plurality of processing cores comprising the computer device;
- and
- translate virtual addresses in a second virtual address space of the application received from the second processing core using a second set of page tables that maps the entire user address space of the application and at most only a portion of the kernel address space of the OS to the physical memory.
A computer apparatus comprising:
- a plurality of processing cores;
- a physical memory shared by the plurality of processing cores;
- and
- a computer-readable storage medium comprising instructions for controlling the target processor to be operable to:
- execute an operating system (OS) on a first processing core selected from among a plurality of processing cores;
- translate virtual addresses in a first virtual address space of an application received from the first processing core using a first set of page tables that maps an entire user address space of the application and an entire kernel address space of the OS to the physical memory;
- execute the application on a second processing core selected from among the plurality of processing cores;
- and
- translate virtual addresses in a second virtual address space of the application received from the second processing core using a second set of page tables that maps the entire user address space of the application and at most only a portion of the kernel address space of the OS to the physical memory.
Dependencies are inferred from the claim text.