Red Hat, Inc.

Red Hat Israel, Ltd.

Henri Han Van Riel

Michael Tsirkin

Scott Crenshaw

Daniel J Walsh

Marcelo Wormsbecker Tosatti

Matthias Clasen

Warren I Togami, Jr

Alan Cox

Daniel Berrange

Nitesh Narayan Lal

Avi Kivity

Vivek Goyal

Gleb Natapov

Herman Robert Kenna

Luiz Capitulino

Adriaan Dm Van De Ven

Adriaan D M Van De Ven

Technology for performing data duplication on data that was previously consolidated (e.g., deduplicated or merged). An example method may involve receiving a request to modify a memory page; causing the data at a first storage location to be decrypted using location dependent cryptographic input and then encrypted using a location independent cryptographic input; copying the encrypted data of the memory page from the first storage location to a second storage location; causing the encrypted data at the first and second storage locations to be decrypted using location independent cryptographic input and to each be encrypted using a different location dependent cryptographic input; updating, by the supervisor, one of the references of the plurality of memory pages from pointing to the first storage location in the physical memory to pointing to the second storage location; and modifying the memory page by altering data in the physical memory.

Re-duplication of de-duplicated encrypted memory

Systems and methods for performing data duplication on data that was previously consolidated (e.g., deduplicated or merged). An example method may comprise: receiving, by a processing device, a request to modify a storage block comprising data encrypted using a location dependent cryptographic input; causing the data of the storage block to be encrypted using a location independent cryptographic input corresponding to a first storage location; copying the data encrypted using the location independent cryptographic input from the first storage location to a second storage location; causing data at the second storage location to be encrypted using a location dependent cryptographic input corresponding to the second storage location; and updating a reference of the storage block from the first storage location to the second storage location.

A system for CPU overcommit with guest idle-polling includes a memory, a plurality of host CPUs in communication with the memory, a virtual machine, and a hypervisor. The plurality of host CPUs include a first host CPU and a second host CPU. The virtual machine includes a virtual central processing unit (VCPU) and a guest. In an example, the VCPU executes on the first host CPU. The guest records in a location of guest memory a value indicating that the VCPU is in an idle-polling state. Then, when the hypervisor detects that a new task needs to be executed, the hypervisor reads the value in the location of the guest memory and determines that the VCPU is in the idle-polling state. Then, the hypervisor schedules the new task to the first host CPU.

CPU overcommit with guest idle polling

Systems and methods for batched storage hinting with fast guest storage allocation. An example method may involve: detecting, by a hypervisor, that storage has been released by a guest operating system and remains allocated to a virtual machine executing the guest operating system; accessing, by the hypervisor, one or more sets of storage blocks, wherein a set of the one or more sets comprises an identifier associated with the storage and is associated with the virtual machine; receiving, by a processing device executing the hypervisor, a request to allocate a storage block to the virtual machine; identifying, by the hypervisor, at least one storage block of the one or more sets that is associated with the virtual machine; and allocating the at least one storage block to the virtual machine.

Batched storage hinting with fast guest storage allocation

An example method of allocating memory pages for a guest includes receiving, by a hypervisor, a request to allocate a plurality of guest memory pages for a guest running on a virtual machine. The virtual machine and the hypervisor run on a host machine. The method also includes in response to the request: (i) allocating, by the hypervisor, a plurality of host memory pages, and (ii) mapping the plurality of guest memory pages to the plurality of host memory pages.

Memory overcommit by speculative fault

A system and method are disclosed for managing idle processors in virtualized systems. A hypervisor executing on a host comprising one or more physical processors receives an anticipated idle time for a physical processor of the one or more physical processors of the host from a guest operating system of a virtual machine executing on the host. In response to determining that a function of the anticipated idle time exceeds an exit time of a first power state of the physical processor, the physical processor is caused to be halted and placed in the first power state.

Idle processor management in virtualized systems via paravirtualization

Systems and methods for moving encrypted storage blocks in a security enhanced manner. An example method may comprise: selecting, by a processing device, a storage block stored by a storage device, wherein the storage block comprises encrypted content and is associated with a computing process; causing the encrypted content of the storage block to be decrypted using a first cryptographic input that is location dependent and encrypted using a second cryptographic input that is location independent; and copying the storage block comprising the encrypted content from a first location within the storage device to a second location within the storage device.

Virtual machine page movement for encrypted memory

A hypervisor deduplcation system includes a memory, a processor in communication with the memory, and a hypervisor executing on the processor. The hypervisor is configured to scan a first page, detect that the first page is an unchanged page, check a first free page hint, and insert the unchanged page into a tree. Responsive to inserting the unchanged page into the tree, the hypervisor compares the unchanged page to other pages in the tree and determine a status of the unchanged page as matching one of the other pages or mismatching the other pages in the tree. Responsive to determining the status of the page as matching another page, the hypervisor deduplicates the unchanged page. Additionally, the hypervisor is configured to scan a second page of the memory, check a second free page hint, deduplicate the second page if the free page hint indicates the page is unused.

Hypervisor deduplication page comparison speedup

Embodiments pertain generally to a method for providing subscription services in view of virtual machines. The method includes determining that a user is enrolled for a continuous availability service and determining, in view of the continuous availability service, that the service provider is to instantiate a virtual machine for the user to continue execution of operations executed on a client machine. The method further includes causing the virtual machine to be instantiated in view of the continuous availability service and causing the instantiated virtual machine to be configured to restore a state of the client machine that corresponds to a previous update of the client machine. The previous update may correspond to client activity data of the client machine.

Web-based support subscriptions

Systems and methods for fast storage allocation for encrypted storage are disclosed. An example method may include receiving, by a processing device executing an operating system, an identification of a first storage block that has been released by a first virtual machine; tracking, by the operating system, an encryption status corresponding to the first storage block to indicate whether the first storage block contains encrypted content; receiving a request to allocate storage to a second virtual machine; analyzing, by the operating system, the first storage block to determine that the first storage block contains encrypted content in view of the encryption status corresponding the first storage block; and allocating the first storage block containing the encrypted content to the second virtual machine without clearing the encrypted content of the first storage block.

Fast virtual machine storage allocation with encrypted storage

Systems and methods for memory page hints that account for multiple page sizes. An example method may comprise: determining, by a processing device executing a guest operating system, that a memory page size of the guest operating system is different from a memory page size of a hypervisor; adding, by the guest operating system, a guest memory page released by the guest operating system to a set of guest memory pages; determining in view of the memory page size of the hypervisor that the set of guest memory pages fills a hypervisor memory page; and providing an indication to the hypervisor that the hypervisor memory page is available for reuse.

Free page hinting with multiple page sizes

Processes being executed by a host system and associated with a first address space layout may be identified. An indication of abnormal behavior from at least one of the processes that are being executed by the host system may be received. A request for a new process to be executed by the host system may be received. In response to the indication of the abnormal behavior and the request to provide the new process, a second address space layout may be generated for the new process that is different than the first address space layout. The new process may be generated in view of the second address space layout.

Generation of a random value for a child process

Systems and methods for embedding emulation support for a hardware feature into a virtual machine to enhance the security of the hypervisor and host system. An example method may comprise: receiving, by a processing device executing a hypervisor, a message indicating a hardware feature is unavailable; determining, by the hypervisor, whether a virtual machine is capable of emulating the hardware feature; and causing, by the hypervisor, the virtual machine to emulate the hardware feature in response to determining the virtual machine is capable of emulating the hardware feature.

Virtual machine security through guest-side emulation

Systems and methods for migrating encrypted storage blocks in a security enhanced manner. An example method may comprise: selecting, by the hypervisor, a first storage block and a second storage block, the first storage block being associated with a virtual machine; associating the second storage block with the virtual machine; and providing, by the hypervisor, an instruction for the virtual machine to copy content of the first storage block to the second storage block.

Physical memory migration for secure encrypted virtual machines

A system includes a hypervisor, virtual machine(s), and virtual processor(s). The virtual processor(s) includes a real time virtual processor and a housekeeping virtual processor. The housekeeping virtual processor is configured to initiate a non-preemptible task and responsive to initiating the non-preemptible task, increment a counter value from an initial counter value. The housekeeping virtual processor is also configured to complete the non-preemptible task and responsive to completing the non-preemptible task, decrement the counter value towards the initial counter value. Responsive to the counter value reaching the initial counter value, the virtual housekeeping processor is configured to check a flag set by the hypervisor. Responsive to checking the flag, the housekeeping process is configured to execute a hypercall to yield a processor associated with the housekeeping virtual processor.

Growing community of inventors

Merrimack, NH, United States of America

Henri Han Van Riel