Red Hat, Inc.

Red Hat Israel, Ltd.

Andrea Arcangeli

Michael Tsirkin

David Alan Gilbert

Izik Eidus

Christopher M Wright

Bandan Das

Zhe Xu

Michael Hingston Mclaughlin Bursell

Systems and methods for identifying memory devices for swapping virtual machine memory pages. An example method may comprise: identifying, by a processing device, a workload type associated with a workload being executed by a computer system; identifying a memory device associated with the workload type; evaluating a memory pressure metric reflecting a period of time during which an application being executed by the computer system has been blocked by a memory allocation operation; and responsive to determining that the memory pressure metric exceeds a threshold value, allocating a memory block on the identified memory device.

Identifying memory devices for swapping virtual machine memory pages

Aspects of the disclosure provide for implementing host address space identifiers for non-uniform memory access (NUMA) locality in virtual machines. A method of the disclosure includes determining, by a virtual machine (VM), that a guest memory page is to be moved from a first virtual NUMA node of the VM to a second virtual NUMA node of the VM. The method also includes updating, one or more designated bits of a guest physical address (GPA) of the memory page to include a host address space identifier (HASID) of the second virtual NUMA node, where the guest page table maps the GPA of the memory page to a corresponding guest virtual address (GVA) of the VM and where the HASID associates the GPA of the memory page with a corresponding virtual NUMA node locality, and accessing by the VM, the updated GPA.

Host address space identifier for non-uniform memory access locality in virtual machines

Systems and methods are disclosed for establishing controlled remote access to debug logs. An example method may comprise: receiving, by a first computing device, from a second computing device, an encrypted file comprising a debug log; running, within a trusted execution environment of the first computing device, a log access application; sending, to the second computing device, a request for access to the debug log by the log access application, wherein the request comprises a validation measurement generated by the trusted execution environment with respect to the log access application; receiving, from the second computing device, an access key; and accessing the debug log using the access key.

Establishing controlled remote access to debug logs

Systems and methods are disclosed for establishing secure remote access to debug logs. An example method may comprise: receiving, by a processing device, from a computing device, an encrypted virtual disk image comprising a set of debug logs; initiating, by the processing device, instantiation of a virtual machine (VM) using the encrypted virtual disk image, wherein the VM is to execute a log access application to analyze the set of debug logs; sending, to the computing device, a request for access to the set of debug logs by the log access application; receiving, from the computing device, an indication granting access to the set of debug logs by the log access application, wherein having access to the set of debug logs allows the log access application to analyze the set of debug logs to identify an issue associated with the set of debug logs.

Establishing secure remote access to debug logs

A method includes receiving a request to migrate a virtual machine executing on a source host computer system to a first destination host computer system. The method further includes receiving, from the virtual machine executing on the source host computer system, an encryption key specific to the virtual machine. One or more memory pages associated with the virtual machine are encrypted using the encryption key specific to the virtual machine. The method further includes causing the one or more memory pages associated with the virtual machine to be copied to the first destination host computer system.

Multicast live migration for encrypted virtual machines

A guest operating system (OS) of a virtual machine (VM) receives a first request from an application to enable memory deduplication for a memory page associated with the application, identifies a mergeable memory range for memory space of the guest OS, where the mergeable memory rage is associated with guest OS memory pages to be deduplicated, and maps, in a page table of the guest OS, a page table entry for the memory page to a memory address within the mergeable memory range. The guest OS causes a hypervisor to enable deduplication for the memory page responsive to detecting an access of the memory page by the application.

Selective memory deduplication for virtual machines

Systems and methods are described for resource-efficient memory deduplication and write-protection. In an example, a method includes receiving, by a computing device having a processor, a request to assess deduplication for a plurality of candidate files. The computing device may perform one or more iterative steps for deduplication. The iterative steps may include: receiving, from the plurality of candidate files, a candidate file that is not write-protected; determining, based on a predetermined Bernoulli distribution, a decision to write-protect the candidate file; rendering the candidate file as a write-protected candidate file; determining, based on a review of other candidate files from the plurality of candidate files, that the write-protected candidate file can be deduplicated; and deduplicating the write-protected candidate file.

Constant time updates after memory deduplication

Systems and methods for managing library-based memory deduplication are disclosed. In one implementation, a processing device may start a first instance of an application on a host computer system. Responsive to detecting that the first instance completed an initialization stage, the processing device may create a data structure referencing a first plurality of memory pages created by the first instance of the application. The processing device may further identify, among a second plurality of memory pages associated with the application, a first memory page. The processing device may also identify, among the first plurality of memory pages referenced by the data structure, a second memory page identical to the first memory page. The processing device may further modify a pointer referencing the first memory page to reference the second memory page and may release the first memory page.

Library-based memory deduplication

A hypervisor on a destination host receives a request to migrate a virtual machine (VM) from a source host to the destination host and determines a total amount of memory associated with the VM on the source host. The hypervisor on the destination host allocates one or more memory pages in a page table on the destination host to satisfy the total amount of memory associated with the VM on the source host, where the one or more memory pages are to be associated with the VM on the destination host. Responsive to determining that the one or more memory pages have been allocated on the destination host, the hypervisor on the destination host initiates migration of the VM from the source host to the destination host.

Fail-safe post copy migration of virtual machines

Aspects of the disclosure provide for implementing host address space identifiers for non-uniform memory access (NUMA) locality in virtual machines. A method of the disclosure includes determining, by a virtual machine (VM) executed by a processing device and managed by a hypervisor, that a memory page of the guest is to be moved from a first virtual non-uniform memory access (NUMA) node of the VM to a second virtual NUMA node of the VM. The method further includes updating, by the VM in a guest page table, upper bits of a guest physical address (GPA) of the memory page to include a host address space identifier (HASID) of the second virtual NUMA node, and causing an execution control to be transferred from the VM to the hypervisor due to a page fault resulting from attempting to access the updated GPA.

A system includes a memory, at least one physical processor in communication with the memory, and a plurality of hardware threads executing on the at least one physical processor. A first thread of the plurality of hardware threads is configured to execute a plurality of instructions that includes a restartable sequence. Responsive to a different second thread in communication with the first thread being pre-empted while the first thread is executing the restartable sequence, the first thread is configured to restart the restartable sequence prior to reaching a memory barrier.

Memory barrier elision for multi-threaded workloads

Systems and methods for memory management for virtual machines. An example method may comprise running, by a host computer system, a Level 0 hypervisor managing a Level 1 virtual machine running a Level 1 hypervisor which manages a Level 2 virtual machine having encrypted memory pages. The Level 1 hypervisor may generate a shadow page table where each shadow page table entry of the plurality of shadow page table entries maps a Level 2 guest virtual address of a Level 2 address space associated with the Level 2 virtual machine to a corresponding Level 1 guest physical address of a Level 1 address space associated with the Level 1 virtual machine. The Level 0 hypervisor may generate a Level 0 page table comprising a plurality of Level 0 page table entries that maps a Level 1 guest physical address to a corresponding Level 0 host physical address.

Reverse shadow page tables for firewalled nested encrypted virtual machines

Systems and methods for memory management for virtual machines. An example method may comprise determining that a first memory page and a second memory page are mapped to respective guest addresses that are contiguous in a guest address space of a virtual machine running, wherein the first memory page is mapped to a first guest address, determining that the first memory page and the second memory page are mapped to respective host addresses that are not contiguous in a host address space of the host computer system, tracking modifications of the first memory page, causing the virtual machine to copy the first memory page to a third memory page, such that the third memory page and the second memory page are mapped to respective contiguous host addresses, and in response to determining that the first guest page has not been modified, mapping the first guest address to the third memory page.

Transparent huge pages support for encrypted virtual machines

A method performed by a physical computing system includes, with a hypervisor, determining a first time difference between when pause exiting was last enabled for the virtual machine and present time. The method further includes, with the hypervisor, in response to determining that the first time difference is greater than an enablement threshold, enabling pause exiting. The method further includes, with the hypervisor, with pause loop exiting enabled, determining a second time difference between when pause exiting was last disabled and the present time. The method further includes, with the hypervisor, disabling pause exiting in response to determining that the second time difference exceeds a disablement threshold.

Growing community of inventors

Imola, Italy

Andrea Arcangeli