Red Hat, Inc.

International Business Machines Corporation

Red Hat Israel, Ltd.

Other

Xyratex Technology Limited

David Alan Gilbert

Michael Tsirkin

David Haikney

James William Walker

Vivek Goyal

Stefan Hajnoczi

Miklos Szeredi

Andrea Arcangeli

Steven John Whitehouse

Paolo Bonzini

David MacKintosh

Patrick Varley

David N Mackintosh

Secure and efficient access to host memory for guests is disclosed. For example, a system includes (i) a processor, (ii) a host memory, (iii) a hypervisor including a filesystem daemon, (iv) a guest including a storage controller, and (v) a first filesystem queue. The storage controller is configured to receive a file request, translate the file request, and add the translated file request to a filesystem queue. The filesystem daemon is configured to retrieve the translated file request from the filesystem queue and provide access to a file in the host memory identified in the file request to the guest.

Secure and efficient access to host memory for guests

Direct access to host memory for guests is disclosed. For example, a system includes a processor, a host memory, a filesystem daemon, a guest including a storage controller, and a filesystem queue accessible to the filesystem daemon and the storage controller. The storage controller receives a file retrieval request associated with a file stored in the host memory and forwards the file retrieval request to the filesystem daemon by adding the file retrieval request to the filesystem queue. The filesystem daemon retrieves the file retrieval request from the filesystem queue, determines a host memory address (HMA) associated with the file, and causes the HMA to be mapped to a guest memory address (GMA). The guest accesses the file in the host memory with the GMA, and later terminates access to the file, where the filesystem daemon is then configured cause the GMA to be unmapped.

Direct access to host memory for guests

Systems and methods of the disclosure include: identifying, by a destination host computer system, a first memory page residing in a memory of the destination host computer system; transmitting, by the destination host computer system, at least a part of the first memory page to a source host computer system; receiving, by the destination host computer system, a confirmation from the source host computer system that the first memory page matches a second memory page associated with a virtual machine to be migrated from the source host computer system to the destination host computer system; and associating, by the destination host computer system, the first memory page with the virtual machine.

Memory page copying for virtual machine migration

A method includes identifying two virtual machines (VMs) to be migrated from a source host. The method further includes determining that the two VMs correspond to identical memory pages in a memory deduplicaiton module. The method further includes recording, in hypervisor memory, an indication that the two VMs correspond to the two identical memory pages in the memory deduplication module. The method further includes sending, by a processing device of the hypvervisor, a single memory page of the two identical memory pages to a first destination host.

Migration speed-up for multiple virtual machines

Systems and methods for memory management for guests. An example method may include running, by a host computer system, a host component managing a guest in communication with a peripheral device, wherein the peripheral device comprises an input/output memory management unit (IOMMU). The method may further include appending, to a page table of the IOMMU, a plurality of records referencing present memory pages associated with a task running on the guest and appending, to the page table of the IOMMU, a plurality of records referencing read-only memory pages associated with the task, wherein the read-only memory pages are indicated as read-only in the page table.

Non-interrupting portable page request interface

Systems and methods for providing memory over-commit support for live migration of virtual machines (VMs). In one implementation, a processing device of a source host computer system may identify a host page cache associated with a VM undergoing live migration from the source to a destination host computer system. The host page cache comprises a first plurality of memory pages associated with the VM. The processing device may transmit, from the source to the destination, at least a part of the host page cache. The processing device may discard the part of the host page cache. The processing device may read into the host page cache one or more memory pages of a second plurality of memory pages associated with the VM. The processing device may transmit, from the source to the destination, the one or more memory pages stored by the host page cache.

Memory over-commit support for live migration of virtual machines

Mechanisms for reducing memory inconsistencies between two synchronized computing devices are provided. A first hypervisor module of a first computing device iteratively determines that content of a memory page of a plurality of memory pages has been modified. The content of the memory page is sent to a second hypervisor module on a second computing device. At least one other memory page of the plurality of memory pages is identified, and a verification value based on the content of the at least one other memory page is generated. The verification value and a memory page identifier that identifies the at least one other memory page is sent to the second hypervisor module on the second computing device.

Reducing memory inconsistencies between synchronized computing devices

Systems and methods of the disclosure include: publishing, by a first host computer system of a computing cluster comprising a plurality of host computer systems running a plurality of virtual machines, a list of memory page identifiers, wherein each memory page identifier is associated with a corresponding content identifier; receiving, from a second host computer system of the computing cluster, a memory page request comprising a first memory page identifier; and sending, to the first host computer system, a first memory page identified by the first memory page identifier.

Post-copy migration cross cluster synchronization for post-copy migration of virtual machines

Aspects of the disclosure provide for mechanisms for memory protection of virtual machines in a computer system. A first host page table and a second host page table is generated by a processing device running a hypervisor in view of a guest page table associated with a virtual machine. The first host page table includes a first mapping corresponding to a privileged page of a guest memory and a second mapping corresponding to an unprivileged page of the guest memory. The second host page table includes a third mapping corresponding to the unprivileged page of the guest memory. The first host page table is associated with the virtual machine. In response to detecting a transition from a first guest mode to a second guest mode by the virtual machine, the virtual machine is associated with the second page table.

Memory protection in virtualized computer systems using shadow page tables

Systems and methods for memory management for virtual machines. An example method may include generating, by a Peripheral Component Interconnect (PCI) device comprising an input/output memory management unit (IOMMU), a first bit sequence and generating a second sequence by applying a predetermined transformation to the first bit sequence. The method may then write the second bit sequence to a memory buffer, read a first value from the memory buffer, write the first bit sequence to the memory buffer, and read a second value from the memory buffer. Responsive to determining that the second value does not match the first value, the method may associate a writable attribute with an IOMMU page table entry associated with the memory buffer.

Shared filesystem metadata caching is disclosed. For example, a system includes a guest with a storage controller (SC) and a metadata cache on a host with a filesystem daemon (FSD), and a host memory storing a registration table (RT). The SC receives a first metadata request associated with a file stored in the host memory. A first version identifier (VID) of metadata associated with the file is retrieved from the metadata cache and validated against a corresponding second VID in the RT. Upon determining the first VID matches the second VID, the SC responds to the first metadata request based on the metadata. Upon determining the first VID fails to match the second VID, the SC requests the FSD to update the metadata. The first VID is updated to match the second VID and the SC responds to the first metadata request based on the updated metadata.

Shared filesystem metadata caching

A system and method relates to detecting a hardware event, determining a first virtual memory address associated with the hardware event, wherein the first virtual memory address is associated with a first processing thread, identifying, using the first virtual memory address, an entry of a logical address table, the entry comprising a file descriptor and a file offset associated with a file, identifying a memory address table associated with the file descriptor, translating, using the memory address table, the file offset into a second virtual memory address associated with a second processing thread, and transmitting, to the second processing thread, a notification comprising the second virtual memory address.

Process isolation for out of process page fault handling

Aspects of the disclosure provide for mechanisms for memory protection of virtual machines in a computer system. A method of the disclosure includes: obtaining, by a hypervisor, a guest page table associated with a virtual machine, wherein the guest page table comprises a first guest page table entry associated with a privilege flag indicating that a first virtual page of a guest memory of the virtual machine is accessible to unprivileged code; and in view of a determination that the virtual machine is running in a kernel mode, generating a first host page table in view of the guest page table, wherein the first host page table comprises a first host page table entry corresponding to the first guest page table entry, and wherein the first host page table entry is associated with a privilege flag indicating that the first virtual page is not accessible to the unprivileged code.

Updating boot components in compliance with a chain of trust by loading a boot component update forming part of the chain of trust during a boot process in an execution environment. Boot component measurements are detected and stored as a revised set of attestation values for retrieval by an attestation system. Performing the boot component update upon determining a pass indication for the chain of trust including the boot component update.

Growing community of inventors

Manchester, United Kingdom

David Alan Gilbert