Red Hat Israel, Ltd.

Red Hat, Inc.

Mellanox Technologies, Ltd.

Michael Tsirkin

Paolo Bonzini

Andrea Arcangeli

Amnon Ilan

Dor Laor

Henri Han Van Riel

Karen Lee Noel

David Alan Gilbert

Uri Lublin

Avi Kivity

Marcel Apfelbaum

David Hildenbrand

Gleb Natapov

Alex Williamson

Izik Eidus

Ronen Hod

Thomas Graf

Michael Kagan

Benny Koren

Dror Goldenberg

Stefan Hajnoczi

Jesper Dangaard Brouer

Veaceslav Falico

Michael Hingston McLaughlin Bursell

Giuseppe Scrivano

Victor Kaplansky

Nathaniel Philip McCallum

Gal Hammer

Sergio Lopez Pascual

Francisco Javier Martinez Canillas

Alberto Carlos Ruiz Ruiz

Christopher M Wright

Petr Matousek

Henri Van Riel

Gerd Hoffman

Orit Luba Wasserman

Francesco Fusco

Roni Luxenberg

Bandan Das

Michael Bursell

Aaron Patrick Conole

Jiri Benc

Stephen Tweedie

Eduardo Pereira Habkost

Igor Mammedov

Radim Krcmár

Vladislav Yasevich

Gieb Natapov

Zhe Xu

Michael Hingston Mclaughlin Bursell

Systems and methods for enabling a Virtual Machine (VM) and hypervisor to communicate are disclosed. An example method includes sending data from a hypervisor to a virtual machine (VM) by storing, by the hypervisor, the data to an encrypted memory page of the VM, wherein the data stored by the hypervisor to the encrypted memory page is not encrypted. The method also includes processing, by the VM, the data stored to the encrypted memory page according to a decryption routine to generate scrambled data. The method also includes looking up, by the VM, the scrambled data in a translation table to obtain unscrambled data, wherein the unscrambled data is the data as it was originally stored to the encrypted memory page by the hypervisor.

Encrypted memory guest/host communication

Systems and methods for efficient peripheral device software request queue shadowing for virtual machines can include creating a virtual machine and assigning a peripheral device to it. They can also include assigning, to the peripheral device, a first process address space identifier (PASID) associated with a shadow memory buffer and a second PASID associated with a device data buffer. They can further include causing a host input/output memory management unit (IOMMU) to identify a software request in the shadow memory buffer, and fetching, from the shadow memory buffer, the software request and a guest memory address of data requested to be accessed. They can also include, causing the host IOMMU to identify the data in the device data buffer, and transmitting the data, from the guest memory, to the peripheral device.

Efficient queue shadowing for virtual machines

The technology disclosed herein enables receiving, by an operating system running on a host computer system, a request to map a physical address associated with a peripheral device, identifying, based on the request, a mapping type, wherein the mapping type is one of: a first mapping type or a second mapping type, mapping, based on the mapping type of the request, the physical address to a virtual address referencing a memory page having one of: a first page size or a second page size, wherein the second page size exceeds the first page size, and storing a mapping of physical address to the virtual address in an input/output memory management unit (IOMMU) page table associated with the peripheral device.

Dynamic direct memory access mapping for peripheral devices

Efficient central processing unit overcommit for virtual machines with symmetric multi-processing may be provided by, in response to receiving a preemption-disable request on behalf of a virtual machine (VM) running on a physical central processing unit (PCPU), initiating a counter on the PCPU; in response to receiving a preempting task from a hypervisor to perform on the PCPU, checking a counter status for the counter; in response to the counter status being active: performing an ongoing task from the VM on the PCPU; and delaying performance of the preempting task until the counter status is inactive.

Efficient central processing unit overcommit for virtual machines with symmetric multi-processing

Systems and method for automated efficient memory migration in Non-uniform Memory Access (NUMA) based virtual machines are introduced, comprising exporting one or more informative data objects, from a host machine to at least one virtual machine, wherein the informative data objects include references to pages that have been migrated from a physical source memory node (source node) on the host machine to a new source location on the host machine; inspecting, the informative data objects, by the at least one virtual machine; detecting, by the at least one virtual machine, the pages that have been migrated to the new source location; sending a request, by the at least one virtual machine, to the host machine via the hypervisor, to map the pages to a physical destination memory node (destination node) corresponding to a desired virtual destination memory node (destination vNode); and undertaking at least one efficient data migration operation.

Copyless NUMA balancing hypervisor memory migration

Systems and methods for ensuring that data received from a virtual device is random are provided. A processing device may be used to generate, by a virtual device executing on a hypervisor, data intended for a virtual machine (VM) having a guest memory that includes one or more encrypted pages and one or more unencrypted pages. Data written to an encrypted page of the guest memory by the VM is encrypted using an encryption key assigned to the VM and information read from the encrypted page by the VM is decrypted using the encryption key. The hypervisor may write the data to the encrypted page, wherein the data is not encrypted by the encryption key assigned to the VM because it is written by the hypervisor. The VM reads the data from the encrypted page as randomized data because it cannot be properly decrypted by the encryption key.

Safe entropy source for encrypted virtual machines

Systems and methods for zero-copy forwarding for network function virtualization (NFV). An example method comprises: receiving, by a supervisor of a host computer system, a definition of a packet filter originated by a virtual execution environment running on the host computer system; responsive to validating the packet filter, associating the packet filter with a vNIC of the virtual execution environment; receiving, by the supervisor, a network packet originated by the vNIC; and responsive to matching the network packet to a network connection specified by the packet filter, causing the packet filter to forward the network packet via the network connection.

Zero-copy forwarding for network function virtualization

Systems and methods for enhancing efficient memory swap for virtual machines. An example method may comprise: receiving, by a hypervisor running on a host computer system, a request, from a virtual machine managed by the hypervisor, to write to a virtual disk a content of a memory page identified by a guest physical address (GPA); detecting, by the hypervisor, that the content of the memory page is stored on a storage device; storing, on the virtual disk, an identifier of a location of the content of the memory page on the storage device; and un-mapping the GPA from the storage device.

Efficient memory swap for virtual machines

The technology disclosed herein enables efficient launching of trusted execution environments. An example method can include: receiving, by a processing device of a first computing device, a first request from a second computing device to establish a first trusted execution environment (TEE) in the first computing device; establishing the first TEE in the first computing device, wherein the first TEE comprises an encrypted memory area and executable code; receiving, by the processing device, a second request to establish a second TEE in the first computing device; establishing, by the first TEE, the second TEE in the first computing device, wherein the second TEE comprises a second executable code; receiving, by the first TEE, cryptographic key data from the second computing device; validating, by the first TEE, the second TEE; providing, by the first TEE, the cryptographic key data to the second TEE; and causing, by the processing device, the second TEE to execute, using the cryptographic key data, the second executable code.

Efficient launching of trusted execution environments

An authentication code for an authentication process such as multifactor authentication can be automatically inputted according to some examples described herein. In one example, a computing device can execute an authenticator application to generate an authentication code for use during an authentication process associated with a user logging into an account. The computing device can establish a connection with a target device that is separate from the computing device. The target device may be configured to display a graphical user interface that includes an input box into which the user is to manually type the authentication code as part of the authentication process. The computing device can transmit the authentication code to the target device via the connection. The target device can be configured to receive the authentication code and automatically enter the authentication code into the input box on behalf of the user.

Automatically inputting an authentication code for an authentication process

Safe critical section operations for virtual machines with virtual central processing unit overcommit are provided by: in response to identifying a preempting task to run on a first physical central processing unit (PCPU) from a second PCPU, setting a status of a flag in a virtual memory used by a first virtual central processing unit (VCPU) running on the first PCPU to indicate that the preempting task will interrupt the first VCPU; in response to initiating execution of a read-side critical section operation scheduled by the first VCPU to run on the first PCPU, checking the status of the flag in the virtual memory; and in response to the status of the flag being positive: exiting the first VCPU to a hypervisor; executing, by the hypervisor, the preempting task on the first PCPU; and after completing the preempting task, continuing execution of the read-side critical section operation.

Safe critical section operations for virtual machines with virtual central processing unit overcommit

Systems and methods for duplication avoidance are disclosed. In one implementation, a VM can receive a request to perform a file access operation with respect to a file and determine a hash value corresponding to a content of the file. The VM can search the file identified by the hash value in in a host file system. Responsive to failing to find the hash value in the host file system, the VM can search the hash value in a guest file system of the VM and responsive to finding the file identified by the hash value in the guest file system, can perform the file access operation with respect to the file.

Virtual machine storage system for duplication avoidance

Systems and methods for virtual machine networking can include creating, by a hypervisor running on a host computer system, a first virtual machine (VM) using a first set of computing resources, where the first set of computing resources includes a portion of a second set of computing resources allocated to a second VM managed by the hypervisor. They can further include assigning a first vNIC (virtual Network Interface Controller) to the first VM and setting up a second vNIC to receive data packets transmitted by the first vNIC. Additionally, they can include associating the second vNIC with an identifier of the first VM and assigning the second vNIC to the second VM.

Virtual networking for special types of nested virtual machines

An input/output memory management unit (IOMMU) can assign input/output virtual addresses (IOVA) using a predetermined randomness algorithm according to some examples. For instance, the IOMMU can determine an input/output virtual address (IOVA) using the pre-defined randomness algorithm. Then, the IOMMU can store, in a translation table, an entry which maps the IOVA to a physical memory address of a storage device. Subsequent to storing the entry in the translation table the IOMMU can receive a request from an input/output (IO) device, where the request is to access data at the IOVA. In response to receiving the request, the IOMMU can identify the physical memory address that is mapped to the IOVA in the entry. The IOMMU can then allow the IO device to access the data at the physical memory address.

Assigning input/output virtual addresses using a pre-defined randomness algorithm

Embodiments of the present disclosure relate to determining modification bounds that identify portions of a packet that are safe to modify so that modified portions of the packet may be flushed from a cache to a memory of a network interface card (NIC) of a host system when the entire packet is synchronized from the NIC. A modification bound of the filter may be determined, and a network packet may be received from the NIC. In response to determining that the network packet is to be modified, a portion of the network packet that is safe to modify may be identified based on the modification bound of the filter and modifications may be made thereto. The modified portion of the network packet may be synchronized to the NIC.

Efficient packet re-transmission for express data paths

Growing community of inventors

Tamra, Israel

Michael Tsirkin