Policy enforcement by hypervisor paravirtualized ring copying

Patent metadata

Field	Value
Publication number	US-9904564-B2
Application number	US-201113296422-A
Country	US
Kind code	B2
Filing date	Nov 15, 2011
Priority date	Nov 15, 2011
Publication date	Feb 27, 2018
Grant date	Feb 27, 2018

Abstract

Methods and systems for executing a request between a virtual machine and a paravirtualized machine are provided. The request is received from the virtual machine at a first shared memory of a hypervisor. The first shared memory is accessible to the virtual machine but not the paravirtualized machine. The request is transferred by the hypervisor from the first shared memory to a second shared memory of the hypervisor. The second shared memory is accessible to the paravirtualized machine but not the virtual machine. The request is intended for execution by the paravirtualized machine.

First claim

What is claimed is:

1. A method comprising:
providing, by a hypervisor executed by a processing device of a host system, a first memory location shared between a virtual machine executed by the processing device and the hypervisor for exclusive use by the virtual machine;
providing, by the hypervisor, a second memory location shared between a paravirtualized machine executed by processing device and the hypervisor for exclusive use by the paravirtualized machine, wherein the paravirtualized machine is assigned a first level of privileges, and wherein the virtual machine is assigned a second level of privileges that is lower than the first level of privileges assigned to the paravirtualized machine;
receiving a request from the virtual machine at the first memory location, wherein the request is to be executed by the paravirtualized machine, wherein the first memory location is accessible to the virtual machine but not to the paravirtualized machine, wherein the request from the virtual machine is received from an application of the virtual machine, and wherein a corresponding request from the paravirtualized machine is received from the processing device of the host system that is executing the virtual machine;
in response to a length of the request exceeding a maximum transmission size of the host system executing the virtual machine, determining to not transfer the request from the first memory location to the second memory location and providing a notification to a guest operating system associated with the virtual machine in view of the determination to not transfer the request; and
in response to the length of the request not exceeding the maximum transmission size of the host system executing the virtual machine, transferring, by the hypervisor, the request from the first memory location to the second memory location when the request from the first memory location, the second memory location accessible to the paravirtualized machine but not to the virtual machine.

2. The method of claim 1 , wherein the transferring is performed without modification of the request.

3. The method of claim 1 , further comprising executing the request by the paravirtualized machine.

4. The method of claim 3 , wherein said executing the request comprises modifying a state of a device associated with a host operating system of a host computer system.

5. The method of claim 4 , wherein modifying the state of the device comprises modifying a location in memory associated with the host operating system.

6. The method of claim 4 , wherein modifying the state of the device comprises at least one of transmitting a packet to a network device or receiving a packet from a network device.

7. The method of claim 4 , further comprising notifying the guest operating system of the modification of the state of the device.

8. The method of claim 1 , further comprising filtering the request, the filtering comprising dropping the request.

9. The method of claim 8 , wherein the filtering is in view of at least one of a source of the request, a destination of the request, a length of the request, a type of the request, or a specification of a device associated with the request.

10. The method of claim 1 , wherein determining to not transfer the request from the first memory location to the second memory location is further in response to a source address of the request not matching a corresponding source address that has been assigned to the virtual machine.

11. The method of claim 1 , further comprising dropping, if necessary, the request in view of a source address associated with the request, a specific destination port of the request, the length of the request exceeding a host maximum transmission unit (MTU), a type of the request, and a privilege of a device associated with the request, wherein the type of request comprises domain name system (DNS) and address resolution protocol (ARP).

12. A method comprising:
providing, by a hypervisor executed by a processing device of a host system, a first memory location shared between a paravirtualized machine executed by the processing device and the hypervisor for exclusive use by the paravirtualized machine;
providing, by the hypervisor, a second memory location shared between a virtual machine executed by a host computer system and the hypervisor for exclusive use by the virtual machine, wherein the paravirtualized machine is assigned a first level of privileges, and wherein the virtual machine is assigned a second level of privileges that is lower than the first level of privileges assigned to the paravirtualized machine;
transmitting, by the paravirtualized machine, a request to the first memory location, wherein the request is from the processing device associated with a host operating system and is to be executed by the virtual machine, wherein the first memory location is accessible to the paravirtualized machine but not to the virtual machine, wherein the request transmitted from the paravirtualized machine is received from the processing device associated with the host operating system that is executing the virtual machine, and wherein a corresponding request from the virtual machine is received from an application of the virtual machine;
in response to a length of the request exceeding a maximum transmission size of the host system executing the paravirtualized machine, determining to not transfer the request from the first memory location to the second memory location and providing a notification to a guest operating system associated with the paravirtualized machine in view of the determination to not transfer the request; and
in response to the length of the request not exceeding the maximum transmission size of the host system executing the paravirtualized machine, transferring, by the hypervisor, the request from the first memory location to the second memory location, the second memory location accessible to the virtual machine but not to the paravirtualized machine.

13. The method of claim 12 , wherein the transferring is performed without modification of the request.

14. The method of claim 13 , further comprising executing the request by the virtual machine.

15. The method of claim 12 , further comprising filtering the request.

16. The method of claim 12 , further comprising monitoring the request.

17. The method of claim 12 , further comprising notifying the guest operating system of a modification of a state of the device.

18. A system, comprising:
a memory; and
a processing device, operatively coupled with the memory, to:
provide, by a hypervisor executed by the processing device of a host system, a first memory location shared between a virtual machine executed by the processing device and the hypervisor for exclusive use by the virtual machine;
provide, by the hypervisor executed by the processing device, a second memory location shared between a paravirtualized machine executed by the processing device and the hypervisor for exclusive use by the paravirtualized machine, wherein the paravirtualized machine is assigned a first level of privileges, and wherein the virtual machine is assigned a second level of privileges that is lower than the first level of privileges assigned to the paravirtualized machine;
receiving, by the hypervisor executed by the processing device, a request from the virtual machine at the first memory location, wherein the request is to be executed by the paravirtualized machine, wherein the first memory location is accessible to the virtual machine but not to the paravirtualized machine, wherein the

Assignees

• Tsirkin Michael S
• Kivity Avi
• Red Hat Israel Ltd

Inventors

• Tsirkin Michael S
• Kivity Avi

Classifications

• G06F2009/45583

  Memory management, e.g. access or allocation · CPC title

• G06F11/3072

  where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F11/301

  where the computing system is a virtual computing platform, e.g. logically partitioned systems (virtual machines G06F9/45533; logical partitioning of resources G06F9/5077) · CPC title

• G06F9/4555

  Para-virtualisation, i.e. guest operating system has to be modified · CPC title