Red Hat, Inc.

Red Hat Israel, Ltd.

Stefan Hajnoczi

Michael Tsirkin

David Alan Gilbert

Vivek Goyal

Miklos Szeredi

Steven John Whitehouse

Secure and efficient access to host memory for guests is disclosed. For example, a system includes (i) a processor, (ii) a host memory, (iii) a hypervisor including a filesystem daemon, (iv) a guest including a storage controller, and (v) a first filesystem queue. The storage controller is configured to receive a file request, translate the file request, and add the translated file request to a filesystem queue. The filesystem daemon is configured to retrieve the translated file request from the filesystem queue and provide access to a file in the host memory identified in the file request to the guest.

Secure and efficient access to host memory for guests

Direct access to host memory for guests is disclosed. For example, a system includes a processor, a host memory, a filesystem daemon, a guest including a storage controller, and a filesystem queue accessible to the filesystem daemon and the storage controller. The storage controller receives a file retrieval request associated with a file stored in the host memory and forwards the file retrieval request to the filesystem daemon by adding the file retrieval request to the filesystem queue. The filesystem daemon retrieves the file retrieval request from the filesystem queue, determines a host memory address (HMA) associated with the file, and causes the HMA to be mapped to a guest memory address (GMA). The guest accesses the file in the host memory with the GMA, and later terminates access to the file, where the filesystem daemon is then configured cause the GMA to be unmapped.

Direct access to host memory for guests

Shared filesystem metadata caching is disclosed. For example, a system includes a guest with a storage controller (SC) and a metadata cache on a host with a filesystem daemon (FSD), and a host memory storing a registration table (RT). The SC receives a first metadata request associated with a file stored in the host memory. A first version identifier (VID) of metadata associated with the file is retrieved from the metadata cache and validated against a corresponding second VID in the RT. Upon determining the first VID matches the second VID, the SC responds to the first metadata request based on the metadata. Upon determining the first VID fails to match the second VID, the SC requests the FSD to update the metadata. The first VID is updated to match the second VID and the SC responds to the first metadata request based on the updated metadata.

Shared filesystem metadata caching

In an example embodiment, a hypervisor exposes a first guest device to a first virtual machine. The hypervisor exposes a virtual host device and a pass-through device to a second virtual machine. The hypervisor maps a first memory and a second memory into the second virtual machine at a first base address register and a second base address register associated with the virtual host device and pass-through device. The hypervisor sends a mapping from the first virtual machine to the second virtual machine. The hypervisor sends a first address of a first ring of the first guest device and a second address of a second ring of an assigned device to the second virtual machine.

Sharing data via virtual machine to host device bridging

Secure and efficient memory sharing for guests is disclosed. For example, a host has a host memory storing first and second guests whose memory access is managed by a hypervisor. A request to map an IOVA of the first guest to the second guest is received, where the IOVA is mapped to a GPA of the first guest, which is is mapped to an HPA of the host memory. The HPA is mapped to a second GPA of the second guest, where the hypervisor controls access permissions of the HPA. The second GPA is mapped in a second page table of the second guest to a GVA of the second guest, where a supervisor of the second guest controls access permissions of the second GPA. The hypervisor enables a program executing on the second guest to access contents of the HPA based on the access permissions of the HPA.

Secure and efficient memory sharing for guests

Virtual machine to host device bridging

In an example embodiment, a hypervisor exposes a first guest device to a first virtual machine and a second guest device to a second virtual machine. The hypervisor exposes a first virtual host device and a second virtual host device to a third virtual machine. The hypervisor maps a first memory and a second memory into the third virtual machine at a first base address register and a second base address register associated with each virtual host device. The hypervisor sends a first mapping from a first virtual machine and a second mapping from a second virtual machine to the third virtual machine. The hypervisor sends a first address of a first ring of the first guest device and a second address of a second ring of the second guest device to the third virtual machine through the respective virtual host devices.

Growing community of inventors

St. Neots, United Kingdom

Stefan Hajnoczi