Red Hat Israel, Ltd.

Red Hat, Inc.

Mellanox Technologies, Ltd.

Michael Tsirkin

Paolo Bonzini

Andrea Arcangeli

Amnon Ilan

Dor Laor

Henri Han Van Riel

Karen Lee Noel

David Alan Gilbert

Uri Lublin

Avi Kivity

Marcel Apfelbaum

David Hildenbrand

Gleb Natapov

Alex Williamson

Izik Eidus

Ronen Hod

Thomas Graf

Jesper Dangaard Brouer

Michael Kagan

Benny Koren

Dror Goldenberg

Stefan Hajnoczi

Veaceslav Falico

Michael Hingston McLaughlin Bursell

Giuseppe Scrivano

Victor Kaplansky

Nathaniel Philip McCallum

Gal Hammer

Sergio Lopez Pascual

Francisco Javier Martinez Canillas

Alberto Carlos Ruiz Ruiz

Christopher M Wright

Gerd Hoffman

Henri Van Riel

Petr Matousek

Orit Luba Wasserman

Francesco Fusco

Roni Luxenberg

Bandan Das

Michael Bursell

Aaron Patrick Conole

Jiri Benc

Eduardo Pereira Habkost

Stephen Tweedie

Radim Krcmár

Vladislav Yasevich

Igor Mammedov

Gieb Natapov

Zhe Xu

Michael Hingston Mclaughlin Bursell

Memory deduplication for encrypted virtual machines can be performed according to some examples. In one example, a virtual machine can select a target memory page stored in an encrypted memory of the virtual machine. The encrypted memory can be inaccessible to a hypervisor configured to manage the virtual machine. The virtual machine can store a copy of the target memory page to a shared memory that is accessible to the hypervisor. The hypervisor can then execute a deduplication process with respect to the copy of the target memory page stored in the shared memory. Subsequent to storing the copy of the target memory page to the shared memory, the virtual machine can remove the target memory page from the encrypted memory. The virtual machine can also prompt the hypervisor to reallocate the memory space of the encrypted memory that was previously used to store the target memory page.

Memory deduplication for encrypted virtual machines

Systems and methods for secured peripheral device communication via a bridge device in virtualized computer systems. An example method may comprise receiving, by a virtualized execution environment running on a computing system, a state measurement associated with a bridge device of the computing system; generating an ephemeral key; responsive to validating the state measurement, transmitting, to the bridge device, the ephemeral key encrypted using a device key associated with the bridge device; and transmitting, to the bridge device, an access request directed to a peripheral device accessible via the bridge device, wherein the access request is encrypted using a value derived from the ephemeral key.

Secured peripheral device communication via bridge device in virtualized computer system

Implementations for scheduling a sub-idle thread priority class are described. An example method may include assigning, by a scheduler of a computer system, a sub-idle execution priority class to a processing thread associated with a request queue of an input/output (I/O) device; identifying, by a processing device, a work completion request in the request queue; and responsive to predicting, for a processor of the computer system, an idle time exceeding a threshold idle period, running the processing thread.

Sub-idle thread priority class

An example method may include: receiving, by a hypervisor, a data packet, identifying a memory location associated with a guest virtual machine and accessible to the guest virtual machine and the hypervisor, wherein a program mapping table comprising one or more mapping table entries is stored at the memory location, each mapping table entry specifying a program selection criterion and a packet processing program. The example method may further include identifying, among the one or more mapping table entries in the program mapping table stored at the memory location, a mapping table entry comprising a particular program selection criterion that is satisfied by the data packet, wherein the identified mapping table entry specifies a first packet processing program, and executing the first packet processing program, wherein the data packet is provided to the first packet processing program as input.

Secure control of packet filter programs by user space processes in virtual machines

A network device driver (NDD) associated with a network interface device (NID) of a computing device processes a tunnel packet received by the NID and originating from a source device. The tunnel packet includes a tunnel packet header, a user datagram protocol (UDP) header, and a payload including a Transmission Control Protocol/Internet Protocol (TCP/IP) packet. The NDD accesses a data structure that corresponds to the NID. The NDD extracts a value from a field of the tunnel packet based on information in the tunnel packet and on information in the data structure. The NDD selects, based on the value, a first downstream destination from a plurality of downstream destinations operable to further process the tunnel packet, and causes the tunnel packet to be subsequently processed by the first downstream destination.

Downstream destination selection for tunnel packets based on fixed header packet values

Systems and methods for accelerating hypercalls for nested virtual machines. An example method comprises: executing, by a host computer system, a Level 0 hypervisor managing a Level 1 virtual machine (VM); receiving, by a Level 1 hypervisor managing a Level 2 VM, a first function component from a Level 2 hypervisor managing a Level 3 VM, wherein the first function component performs a first functionality associated with a hypercall issued by the Level 3 VM; generating, by the Level 1 hypervisor, a second function component that performs a second functionality associated with the hypercall issued by the Level 2 VM; and responsive to detecting the hypercall issued by the Level 3 VM, causing the Level 0 hypervisor to execute at least one of: the first function component or the second function component.

Hypercall acceleration for nested virtual machines

Peripheral component interface (PCI) cards can be used to coordinate timer access for virtual machines. For example, a computing device can send, by a virtual machine deployed by a hypervisor, a request for a timer. A guest driver can write a timer for the virtual machine into a first portion of memory on a PCI card. The first portion of memory can be mapped to the virtual machine by the hypervisor. The computing device can receive a card interrupt for the timer. The computing device can translate the card interrupt into a timer interrupt. For example, the card interrupt may be received and translated by the hypervisor or the guest driver. The computing device can inject the timer interrupt to the virtual machine. In some examples, the virtual machine may receive the timer interrupt without exiting to the hypervisor.

Coordinating timer access for virtual machines using peripheral component interface cards

Single-root input-output virtualization (SR-IOV) can be enabled for nested virtual machines using mapping. In one example, a host hypervisor can assign at least two guest virtual functions to a guest virtual machine such that each guest virtual function maps to a respective host virtual function executed by a SR-IOV device. The first guest virtual function of the at least two guest virtual functions can be configured to act as a guest physical function. The host hypervisor can receive a request generated by a nested virtual function assigned to a nested virtual machine hosted by the guest virtual machine. In response to receiving the request, the host hypervisor can translate a guest memory address of the guest physical function to a host memory address for the guest physical function. The host hypervisor can forward the request to the guest physical function for fulfillment using the translated host memory address.

Passing single-root input-output virtualization functions to nested virtual machines

Memory deduplication for encrypted virtual machines is provided by identifying a page in a private memory of an encrypted virtual machine to place into a public memory in a virtualization environment; calculating a checksum for the page and storing the checksum in the private memory of the encrypted virtual machine; passing the page to a hypervisor of the virtualization environment to place into the public memory; calling the page via an application running in the encrypted virtual machine; and in response to verifying the page received from the public memory against the checksum stored in the private memory, proceeding with operation of the application using the page.

Systems and methods for virtual machine networking can include detecting, by a virtual machine (VM), a primary virtual Network Interface Controller (vNIC) configured with a first media access control (MAC) address assigned to the VM by a hypervisor running on a host computer system, and detecting a standby vNIC configured with a second MAC address. They can further include binding a software Network Interface Controller (NIC) configured with a third MAC address to the primary vNIC and the standby vNIC, and selecting a vNIC from among those two vNICs for use by the software NIC for communicating network data packets. Additionally, they can include assigning the third MAC address to the selected vNIC, and communicating network data packets through the software NIC using the third MAC address.

Efficient network device failover management for virtual machines

Systems and methods for virtual machine communication in a virtualized environment can include identifying an encrypted guest memory location of a virtual machine (VM), the encrypted guest memory location associated with a virtual device, and copying a first set of encrypted data from the encrypted guest memory location to hypervisor memory to create a copied set of encrypted data. They can also include comparing a second set of encrypted data from the encrypted guest memory location with the copied set of encrypted data, and responsive to detecting a difference between the second set of encrypted data and the copied set of encrypted data, requesting, unencrypted data comprising a request related to the virtual device.

Scalable asynchronous communication for encrypted virtual machines

Systems and methods for enabling a Virtual Machine (VM) and hypervisor to communicate are disclosed. An example method includes sending data from a hypervisor to a virtual machine (VM) by storing, by the hypervisor, the data to an encrypted memory page of the VM, wherein the data stored by the hypervisor to the encrypted memory page is not encrypted. The method also includes processing, by the VM, the data stored to the encrypted memory page according to a decryption routine to generate scrambled data. The method also includes looking up, by the VM, the scrambled data in a translation table to obtain unscrambled data, wherein the unscrambled data is the data as it was originally stored to the encrypted memory page by the hypervisor.

Encrypted memory guest/host communication

Systems and methods for efficient peripheral device software request queue shadowing for virtual machines can include creating a virtual machine and assigning a peripheral device to it. They can also include assigning, to the peripheral device, a first process address space identifier (PASID) associated with a shadow memory buffer and a second PASID associated with a device data buffer. They can further include causing a host input/output memory management unit (IOMMU) to identify a software request in the shadow memory buffer, and fetching, from the shadow memory buffer, the software request and a guest memory address of data requested to be accessed. They can also include, causing the host IOMMU to identify the data in the device data buffer, and transmitting the data, from the guest memory, to the peripheral device.

Efficient queue shadowing for virtual machines

The technology disclosed herein enables receiving, by an operating system running on a host computer system, a request to map a physical address associated with a peripheral device, identifying, based on the request, a mapping type, wherein the mapping type is one of: a first mapping type or a second mapping type, mapping, based on the mapping type of the request, the physical address to a virtual address referencing a memory page having one of: a first page size or a second page size, wherein the second page size exceeds the first page size, and storing a mapping of physical address to the virtual address in an input/output memory management unit (IOMMU) page table associated with the peripheral device.

Dynamic direct memory access mapping for peripheral devices

Efficient central processing unit overcommit for virtual machines with symmetric multi-processing may be provided by, in response to receiving a preemption-disable request on behalf of a virtual machine (VM) running on a physical central processing unit (PCPU), initiating a counter on the PCPU; in response to receiving a preempting task from a hypervisor to perform on the PCPU, checking a counter status for the counter; in response to the counter status being active: performing an ongoing task from the VM on the PCPU; and delaying performance of the preempting task until the counter status is inactive.

Efficient central processing unit overcommit for virtual machines with symmetric multi-processing

Growing community of inventors

Tamra, Israel

Michael Tsirkin