Security vulnerability mitigation using address space co-execution
A first set of instructions, which is provided access to a first address space, is scheduled for execution at a first hardware thread of a processor. Prior to executing an instruction of a second set of instructions, which accesses a second address space, at the first hardware thread, a determination is made that the second address space is accessible from a second hardware thread of the processor.
1. A computer-implemented method, comprising:
receiving, from a client of a cloud computing environment via one or more programmatic interfaces, an indication that at least a pair of compute instances established on behalf of the client at the cloud computing environment belong to a trusted group of compute instances;
propagating, to one or more hypervisors of respective virtualization hosts of the cloud computing environment, information about the trusted group of compute instances;
executing a hypervisor of the one or more hypervisors on a virtualization host of the respective virtualization hosts, wherein the virtualization host includes a set of processors that implement simultaneous multi-threading (SMT), wherein the hypervisor controls allocation of hardware threads on the set of processors to execute instruction streams of compute instances; and
executing, on the virtualization host, a set of hardware threads on the set or processors allocated to a set of instruction streams of a set of compute instances, including a particular hardware thread of a processor allocated to a first instruction stream of a particular compute instance, wherein the allocations are made based at least in part on the information about the trusted group of compute instances so that trusted compute instances in the trusted group are executed on one or more processors different from one or more processors used to execute untrusted compute instances not in the trusted group, wherein the allocations mitigate one or more co-execution security vulnerabilities associated with execution of the untrusted compute instances and trusted compute instances on a same processor of the virtualization host.
2. The computer-implemented method as recited in claim 1 , wherein the particular compute instance belongs to the trusted group of compute instances, and wherein allocation of the particular hardware thread is based at least in part on determining that a second instruction stream of a compute instance of the trusted group of compute instances is running at another hardware thread of the processor.
3. The computer-implemented method as recited in claim 1 , wherein the particular compute instance does not belong to the trusted group of compute instances, and wherein allocation of the particular hardware thread is based at least in part on determining that a second instruction stream of a compute instance of the trusted group of compute instances is not running at any of the hardware threads of the processor.
4. The computer-implemented method as recited in claim 1 , further comprising:
receiving, from another client of the cloud computing environment, via the one or more programmatic interfaces, an indication that at least a pair of programs executed at a particular computing resource on behalf of the other client belong to a trusted group of programs, wherein the particular computing resource includes an operating system;
propagating, to the operating system, information about the trusted group of programs; and
allocating, by the operating system, based at least in part on the information about the trusted group of programs, a first hardware thread of a first processor of the particular computing resource to execute a first instruction stream of a particular program.
5. The computer-implemented method as recited in claim 4 , wherein the particular program belongs to the trusted group of programs, and wherein allocation of the first hardware thread is based at least in part on determining that a second instruction stream of a program of the trusted group of programs is running at a second hardware thread of the first processor.
6. The computer-implemented method as recited in claim 4 , wherein the particular program does not belong to the trusted group of programs, and wherein allocation of the first hardware thread is based at least in part on determining that a second instruction stream of a program of the trusted group of programs is not running at any of the hardware threads of the first processor.
7. The computer-implemented method as recited in claim 4 , wherein the particular computing resource comprises a non-virtualized host.
8. A system, comprising:
one or more computing devices;
wherein the one or more computing devices include instructions that upon execution on or across one or more processors cause the one or more processors to:
receive, from a client of a cloud computing environment via one or more programmatic interfaces, an indication that at least a pair of compute instances established on behalf of the client at the cloud computing environment belong to a trusted group of compute instances;
propagate, to one or more hypervisors of respective virtualization hosts of the cloud computing environment, information about the trusted group of compute instances;
execute a hypervisor of the one or more hypervisors on a virtualization host of the respective virtualization hosts, wherein the virtualization host includes a set of processors that implement simultaneous multi-threading (SMT), wherein the hypervisor controls allocation of hardware threads on the set of processors to execute instruction streams of compute instances; and
execute, on the virtualization host, a set of hardware threads on the set or processors allocated to a set of instruction streams of a set of compute instances, including a particular hardware thread of a processor allocated to a first instruction stream of a particular compute instance, wherein the allocations are made based at least in part on the information about the trusted group of compute instances so that trusted compute instances in the trusted group are executed on one or more processors different from one or more processors used to execute untrusted compute instances not in the trusted group, wherein the allocations mitigate one or more co-execution security vulnerabilities associated with execution of the untrusted compute instances and trusted compute instances on a same processor of the virtualization host.
9. The system as recited in claim 8 , wherein the particular compute instance belongs to the trusted group of compute instances, and wherein the particular hardware thread is allocated based at least in part on determining that a second instruction stream of a compute instance of the trusted group of compute instances is running at another hardware thread of the processor.
10. The system as recited in claim 8 , wherein the particular compute instance does not belong to the trusted group of compute instances, and wherein the particular hardware thread is allocated based at least in part on determining that a second instruction stream of a compute instance of the trusted group of compute instances is not running at any of the hardware threads of the processor.
11. The system as recited in claim 8 , wherein the one or more computing devices include further instructions that upon execution on or across one or more processors cause the one or more processors to:
receive, from another client of the cloud computing environment, via the one or more programmatic interfaces, an indication that at least a pair of programs executed at a particular computing resource on behalf of the other client belong to a trusted group of programs, wherein the particular computing resource includes an operating system;
propagate, to the operating system, information about the trusted group of programs; and
allocate, by the operating system, based at least in part on the information about the trusted group of programs, a first hardware thread of a first processor of the particular computing resource to execute a first instruction stream of a particular program.
12. The system as recited in claim 11 , wherein the particular program belongs to the trusted group of programs, and wherein the first hardware thread is allocated based at least in part on determining that a second instruction stream of a program of the trusted group of programs is running at a second hardware thread of the first processor.
13. The system as recited in claim 11 , wherein the particular program does not belong to the trusted group of programs, and wherein the first hardware thread is allocated based at least in part on determining that a second instruction stream of a program of the trusted group of programs is not running at any of the hardware threads of the first processor.
14. The system as recited in claim 11 , wherein the particular computing resource comprises a non-virtualized host.
15. One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors:
receive, from a client of a cloud computing environment via one or more programmatic interfaces, an indication that at least a pair of compute instances established on behalf of the client at the cloud computing environment belong to a trusted group of compute instances;
propagate, to one or more hypervisors of respective virtualization hosts of the cloud computing environment, information about the trusted group of compute instances;
execute a hypervisor of the one or more hypervisors on a virtualization host of the respective virtualization hosts, wherein the virtualization host includes a set of processors that implement simultaneous multi-threading (SMT), wherein the hypervisor controls allocation of hardware threads on the set of processors to execute instruction streams of compute instances; and
execute, on the virtualization host, a set of hardware threads on the set or processors allocated to a set of instruction streams of a set of compute instances, including a particular hardware thread of a processor allocated to a first instruction stream of a particular compute instance, wherein the allocations are made based at least in part on the information about the trusted group of compute instances so that trusted compute instances in the trusted group are executed on one or more processors different from one or more processors used to execute untrusted compute instances not in the trusted group, wherein the allocations mitigate one or more co-execution security vulnerabilities associated with execution of the untrusted compute instances and trusted compute instances on a same processor of the virtualization host.
16. The one or more non-transitory computer-accessible storage media as recited in claim 15 , wherein the particular compute instance belongs to the trusted group of compute instances, and wherein the particular hardware thread is allocated based at least in part on determining that a second instruction stream of a compute instance of the trusted group of compute instances is running at another hardware thread of the processor.
17. The one or more non-transitory computer-accessible storage media as recited in claim 15 , wherein the particular compute instance does not belong to the trusted group of compute instances, and wherein the particular hardware thread is allocated based at least in part on determining that a second instruction stream of a compute instance of the trusted group of compute instances is not running at any of the hardware threads of the processor.
18. The one or more non-transitory computer-accessible storage media as recited in claim 15 , storing further program instructions that when executed on or across the one or more processors:
receive, from another client of the cloud computing environment, via the one or more programmatic interfaces, an indication that at least a pair of programs executed at a particular computing resource on behalf of the other client belong to a trusted group of programs, wherein the particular computing resource includes an operating system;
propagate, to the operating system, information about the trusted group of programs; and
allocate, by the operating system, based at least in part on the information about the trusted group of programs, a first hardware thread of a first processor of the particular computing resource to execute a first instruction stream of a particular program.
19. The one or more non-transitory computer-accessible storage media as recited in claim 18 , wherein the particular program belongs to the trusted group of programs, and wherein the first hardware thread is allocated based at least in part on determining that a second instruction stream of a program of the trusted group of programs is running at a second hardware thread of the first processor.
20. The one or more non-transitory computer-accessible storage media as recited in claim 18 , wherein the particular program does not belong to the trusted group of programs, and wherein the first hardware thread is allocated based at least in part on determining that a second instruction stream of a program of the trusted group of programs is not running at any of the hardware threads of the first processor.