Red Hat, Inc.

Vivek Goyal

Daniel J Walsh

Miklos Szeredi

David Alan Gilbert

Stefan Hajnoczi

Steven John Whitehouse

Shishir Mahajan

Jeremy John Eder

Eric Sandeen

Huamin Chen

Henri Han Van Riel

Neil R T Horman

Jeffrey E Moyer

Mrunal Patel

David Howells

RuiRui Yang

Secure and efficient access to host memory for guests is disclosed. For example, a system includes (i) a processor, (ii) a host memory, (iii) a hypervisor including a filesystem daemon, (iv) a guest including a storage controller, and (v) a first filesystem queue. The storage controller is configured to receive a file request, translate the file request, and add the translated file request to a filesystem queue. The filesystem daemon is configured to retrieve the translated file request from the filesystem queue and provide access to a file in the host memory identified in the file request to the guest.

Secure and efficient access to host memory for guests

Direct access to host memory for guests is disclosed. For example, a system includes a processor, a host memory, a filesystem daemon, a guest including a storage controller, and a filesystem queue accessible to the filesystem daemon and the storage controller. The storage controller receives a file retrieval request associated with a file stored in the host memory and forwards the file retrieval request to the filesystem daemon by adding the file retrieval request to the filesystem queue. The filesystem daemon retrieves the file retrieval request from the filesystem queue, determines a host memory address (HMA) associated with the file, and causes the HMA to be mapped to a guest memory address (GMA). The guest accesses the file in the host memory with the GMA, and later terminates access to the file, where the filesystem daemon is then configured cause the GMA to be unmapped.

Direct access to host memory for guests

A filesystem can be shared between containers. For example, a computing device having a host filesystem can launch a first container from an image file. Launching the first container can include creating an initialization directory for the first container on the host filesystem. The initialization directory can include a filesystem to be shared between containers. Launching the first container can also include creating a first filesystem directory for the first container on the host filesystem and mounting the initialization directory to the first filesystem directory. The computing device can also launch a second container from the image file. Launching the second container can include creating a second filesystem directory for the second container on the host filesystem and mounting the initialization directory to the second filesystem directory to enable the second container to access the filesystem.

Sharing filesystems between containers

Shared filesystem metadata caching is disclosed. For example, a system includes a guest with a storage controller (SC) and a metadata cache on a host with a filesystem daemon (FSD), and a host memory storing a registration table (RT). The SC receives a first metadata request associated with a file stored in the host memory. A first version identifier (VID) of metadata associated with the file is retrieved from the metadata cache and validated against a corresponding second VID in the RT. Upon determining the first VID matches the second VID, the SC responds to the first metadata request based on the metadata. Upon determining the first VID fails to match the second VID, the SC requests the FSD to update the metadata. The first VID is updated to match the second VID and the SC responds to the first metadata request based on the updated metadata.

Shared filesystem metadata caching

Implementations of the disclosure provide for size adjustable volumes for containers. A method of the disclosure includes determining, by a processing device of a Platform-as-a-Service (PaaS) system, a size limitation of a container, where the size limitation is associated with disk space usage of a storage volume group. The amount of disk space used by applications of the container is monitored in view of the size limitation of the container. Responsive to determining that the amount of the disk space used by the applications of the container satisfies a threshold, a storage volume of the storage volume group is allocated to the container in view of the size limitation of the container.

Size adjustable volumes for containers

An access control engine can enable a host operating system to propagate a private resource of an isolated virtual environment, such as a container, running on the host operating system outside of the isolated virtual environment. The private resource can include, for example, a file system mounted within the isolated virtual environment. The access control engine can receive a command and launch the isolated virtual environment in response to the command. Also, in response to the command, the access control engine can interface with a kernel of the host operating system to configure the isolated virtual environment so that the private resource is accessible outside the isolated virtual environment.

Accessing file systems in a virtual environment

Mirrored byte addressable storage is disclosed. For example, first and second persistent memories store first and second pluralities of pages, both associated with a plurality of page states in a mirror state log in a third persistent memory. A mirror engine executing on a processor with a processor cache detects a write fault associated with the first page of the first plurality of pages and in response, updates a first page state to a dirty-nosync state. A notice of a flush operation of the processor cache associated with first data is received. The first data becomes persistent in the first page of the first plurality of pages after the flush operation; then the first page state is updated to a clean-nosync state. The first data is then copied to the first page of the second plurality of pages; then the first page state is updated to a clean-sync state.

Mirrored byte addressable storage

An implementation of this disclosure provides a system comprising memory to store a plurality of layers and a processing device coupled to that memory to set up the layers and to mount them into an overlay. The layers comprise an upper and one or more lower layers. The overlay provides access to a plurality files stored in the overlay filesystem. A request from an application to access a file in the mounted overlay is received. An access policy for the mounter that mounted the layers is identified in view of the mounter's credentials. The processing device checks, in view of the access policy, whether a security context label for the file provides access to the application and to the mounter of the overlay in at least one lower layer comprising the file. An instruction to provide the application with access to the file is issued in view of the check.

Supporting security access controls in an overlay filesystem

Disclosed are systems and methods for determining task scores reflective of memory access statistics in NUMA systems. An example method may comprise: determining, by a processing device, a first memory access score of a task with respect to a first node of a Non-Uniform Memory Access (NUMA) system; adjusting the first memory access score using memory access scores of the task with respect to one or more nodes of the NUMA system; and migrating, in view of the adjusting, at least one of: the task or a memory page associated with the task.

Determining task scores reflective of memory access statistics in NUMA systems

Implementations of the disclosure provide for size adjustable volumes for containers. A method of the disclosure includes determining, by a processing device of the PaaS system, a size used space in a storage volume with respect to a container associated with an execution of an application. The size is a summation of current usage of disk space for the storage volume by the application. This size of the used space is compared to a threshold size. The threshold size indicates a determined amount of the storage volume allocated to the container. Responsive to the size meeting the threshold size, an increase in the allocated amount of the storage volume associated with the container is regulated by the processing device.

A system for applying security label on a kernel core crash file is disclosed. A method of the disclosure includes accessing, by a processing device, a crash recovery configuration file, parsing the crash recovery configuration file to determine a storage location of a core file, the core file comprising an image of a kernel of an operating system (OS), the image being captured when the OS fails, locating the core file at the determined storage location, and upon determining that a security label is not associated with the core file, sending a command to apply the security label to the core file.

Applying security label on kernel core crash file

A computing system stores actual memory usage data in a user memory space. The actual memory usage data represents memory usage of a plurality of device drivers that are loaded by a first kernel. The computing system generates an estimate of memory space to be reserved for a second kernel based on the actual memory usage data for the plurality of device drivers that are loaded by the first kernel and reserves memory space for the second kernel using the estimate.

Growing community of inventors

Westford, MA, United States of America

Vivek Goyal