Red Hat Israel, Ltd.

Red Hat, Inc.

Mellanox Technologies, Ltd.

Michael Tsirkin

Paolo Bonzini

Andrea Arcangeli

Amnon Ilan

Dor Laor

Henri Han Van Riel

Karen Lee Noel

David Alan Gilbert

Uri Lublin

Avi Kivity

Marcel Apfelbaum

David Hildenbrand

Gleb Natapov

Alex Williamson

Izik Eidus

Ronen Hod

Thomas Graf

Michael Kagan

Benny Koren

Dror Goldenberg

Stefan Hajnoczi

Jesper Dangaard Brouer

Veaceslav Falico

Michael Hingston McLaughlin Bursell

Giuseppe Scrivano

Victor Kaplansky

Nathaniel Philip McCallum

Gal Hammer

Sergio Lopez Pascual

Francisco Javier Martinez Canillas

Alberto Carlos Ruiz Ruiz

Christopher M Wright

Petr Matousek

Henri Van Riel

Gerd Hoffman

Orit Luba Wasserman

Francesco Fusco

Roni Luxenberg

Bandan Das

Michael Bursell

Aaron Patrick Conole

Jiri Benc

Stephen Tweedie

Eduardo Pereira Habkost

Igor Mammedov

Radim Krcmár

Vladislav Yasevich

Gieb Natapov

Zhe Xu

Michael Hingston Mclaughlin Bursell

Memory deduplication for encrypted virtual machines is provided by identifying a page in a private memory of an encrypted virtual machine to place into a public memory in a virtualization environment; calculating a checksum for the page and storing the checksum in the private memory of the encrypted virtual machine; passing the page to a hypervisor of the virtualization environment to place into the public memory; calling the page via an application running in the encrypted virtual machine; and in response to verifying the page received from the public memory against the checksum stored in the private memory, proceeding with operation of the application using the page.

Memory deduplication for encrypted virtual machines

Systems and methods for virtual machine networking can include detecting, by a virtual machine (VM), a primary virtual Network Interface Controller (vNIC) configured with a first media access control (MAC) address assigned to the VM by a hypervisor running on a host computer system, and detecting a standby vNIC configured with a second MAC address. They can further include binding a software Network Interface Controller (NIC) configured with a third MAC address to the primary vNIC and the standby vNIC, and selecting a vNIC from among those two vNICs for use by the software NIC for communicating network data packets. Additionally, they can include assigning the third MAC address to the selected vNIC, and communicating network data packets through the software NIC using the third MAC address.

Efficient network device failover management for virtual machines

Systems and methods for virtual machine communication in a virtualized environment can include identifying an encrypted guest memory location of a virtual machine (VM), the encrypted guest memory location associated with a virtual device, and copying a first set of encrypted data from the encrypted guest memory location to hypervisor memory to create a copied set of encrypted data. They can also include comparing a second set of encrypted data from the encrypted guest memory location with the copied set of encrypted data, and responsive to detecting a difference between the second set of encrypted data and the copied set of encrypted data, requesting, unencrypted data comprising a request related to the virtual device.

Scalable asynchronous communication for encrypted virtual machines

Systems and methods for enabling a Virtual Machine (VM) and hypervisor to communicate are disclosed. An example method includes sending data from a hypervisor to a virtual machine (VM) by storing, by the hypervisor, the data to an encrypted memory page of the VM, wherein the data stored by the hypervisor to the encrypted memory page is not encrypted. The method also includes processing, by the VM, the data stored to the encrypted memory page according to a decryption routine to generate scrambled data. The method also includes looking up, by the VM, the scrambled data in a translation table to obtain unscrambled data, wherein the unscrambled data is the data as it was originally stored to the encrypted memory page by the hypervisor.

Encrypted memory guest/host communication

Systems and methods for efficient peripheral device software request queue shadowing for virtual machines can include creating a virtual machine and assigning a peripheral device to it. They can also include assigning, to the peripheral device, a first process address space identifier (PASID) associated with a shadow memory buffer and a second PASID associated with a device data buffer. They can further include causing a host input/output memory management unit (IOMMU) to identify a software request in the shadow memory buffer, and fetching, from the shadow memory buffer, the software request and a guest memory address of data requested to be accessed. They can also include, causing the host IOMMU to identify the data in the device data buffer, and transmitting the data, from the guest memory, to the peripheral device.

Efficient queue shadowing for virtual machines

The technology disclosed herein enables receiving, by an operating system running on a host computer system, a request to map a physical address associated with a peripheral device, identifying, based on the request, a mapping type, wherein the mapping type is one of: a first mapping type or a second mapping type, mapping, based on the mapping type of the request, the physical address to a virtual address referencing a memory page having one of: a first page size or a second page size, wherein the second page size exceeds the first page size, and storing a mapping of physical address to the virtual address in an input/output memory management unit (IOMMU) page table associated with the peripheral device.

Dynamic direct memory access mapping for peripheral devices

Efficient central processing unit overcommit for virtual machines with symmetric multi-processing may be provided by, in response to receiving a preemption-disable request on behalf of a virtual machine (VM) running on a physical central processing unit (PCPU), initiating a counter on the PCPU; in response to receiving a preempting task from a hypervisor to perform on the PCPU, checking a counter status for the counter; in response to the counter status being active: performing an ongoing task from the VM on the PCPU; and delaying performance of the preempting task until the counter status is inactive.

Efficient central processing unit overcommit for virtual machines with symmetric multi-processing

Systems and method for automated efficient memory migration in Non-uniform Memory Access (NUMA) based virtual machines are introduced, comprising exporting one or more informative data objects, from a host machine to at least one virtual machine, wherein the informative data objects include references to pages that have been migrated from a physical source memory node (source node) on the host machine to a new source location on the host machine; inspecting, the informative data objects, by the at least one virtual machine; detecting, by the at least one virtual machine, the pages that have been migrated to the new source location; sending a request, by the at least one virtual machine, to the host machine via the hypervisor, to map the pages to a physical destination memory node (destination node) corresponding to a desired virtual destination memory node (destination vNode); and undertaking at least one efficient data migration operation.

Copyless NUMA balancing hypervisor memory migration

Systems and methods for ensuring that data received from a virtual device is random are provided. A processing device may be used to generate, by a virtual device executing on a hypervisor, data intended for a virtual machine (VM) having a guest memory that includes one or more encrypted pages and one or more unencrypted pages. Data written to an encrypted page of the guest memory by the VM is encrypted using an encryption key assigned to the VM and information read from the encrypted page by the VM is decrypted using the encryption key. The hypervisor may write the data to the encrypted page, wherein the data is not encrypted by the encryption key assigned to the VM because it is written by the hypervisor. The VM reads the data from the encrypted page as randomized data because it cannot be properly decrypted by the encryption key.

Safe entropy source for encrypted virtual machines

Systems and methods for zero-copy forwarding for network function virtualization (NFV). An example method comprises: receiving, by a supervisor of a host computer system, a definition of a packet filter originated by a virtual execution environment running on the host computer system; responsive to validating the packet filter, associating the packet filter with a vNIC of the virtual execution environment; receiving, by the supervisor, a network packet originated by the vNIC; and responsive to matching the network packet to a network connection specified by the packet filter, causing the packet filter to forward the network packet via the network connection.

Zero-copy forwarding for network function virtualization

Systems and methods for enhancing efficient memory swap for virtual machines. An example method may comprise: receiving, by a hypervisor running on a host computer system, a request, from a virtual machine managed by the hypervisor, to write to a virtual disk a content of a memory page identified by a guest physical address (GPA); detecting, by the hypervisor, that the content of the memory page is stored on a storage device; storing, on the virtual disk, an identifier of a location of the content of the memory page on the storage device; and un-mapping the GPA from the storage device.

Efficient memory swap for virtual machines

The technology disclosed herein enables efficient launching of trusted execution environments. An example method can include: receiving, by a processing device of a first computing device, a first request from a second computing device to establish a first trusted execution environment (TEE) in the first computing device; establishing the first TEE in the first computing device, wherein the first TEE comprises an encrypted memory area and executable code; receiving, by the processing device, a second request to establish a second TEE in the first computing device; establishing, by the first TEE, the second TEE in the first computing device, wherein the second TEE comprises a second executable code; receiving, by the first TEE, cryptographic key data from the second computing device; validating, by the first TEE, the second TEE; providing, by the first TEE, the cryptographic key data to the second TEE; and causing, by the processing device, the second TEE to execute, using the cryptographic key data, the second executable code.

Efficient launching of trusted execution environments

An authentication code for an authentication process such as multifactor authentication can be automatically inputted according to some examples described herein. In one example, a computing device can execute an authenticator application to generate an authentication code for use during an authentication process associated with a user logging into an account. The computing device can establish a connection with a target device that is separate from the computing device. The target device may be configured to display a graphical user interface that includes an input box into which the user is to manually type the authentication code as part of the authentication process. The computing device can transmit the authentication code to the target device via the connection. The target device can be configured to receive the authentication code and automatically enter the authentication code into the input box on behalf of the user.

Automatically inputting an authentication code for an authentication process

Safe critical section operations for virtual machines with virtual central processing unit overcommit are provided by: in response to identifying a preempting task to run on a first physical central processing unit (PCPU) from a second PCPU, setting a status of a flag in a virtual memory used by a first virtual central processing unit (VCPU) running on the first PCPU to indicate that the preempting task will interrupt the first VCPU; in response to initiating execution of a read-side critical section operation scheduled by the first VCPU to run on the first PCPU, checking the status of the flag in the virtual memory; and in response to the status of the flag being positive: exiting the first VCPU to a hypervisor; executing, by the hypervisor, the preempting task on the first PCPU; and after completing the preempting task, continuing execution of the read-side critical section operation.

Safe critical section operations for virtual machines with virtual central processing unit overcommit

Systems and methods for duplication avoidance are disclosed. In one implementation, a VM can receive a request to perform a file access operation with respect to a file and determine a hash value corresponding to a content of the file. The VM can search the file identified by the hash value in in a host file system. Responsive to failing to find the hash value in the host file system, the VM can search the hash value in a guest file system of the VM and responsive to finding the file identified by the hash value in the guest file system, can perform the file access operation with respect to the file.

Virtual machine storage system for duplication avoidance

Growing community of inventors

Tamra, Israel

Michael Tsirkin