Securing virtual machines in computer systems
AssigneeRed Hat Israel, Ltd.
InventorsMichael Tsirkin, Amnon Ilan
Life of this patent
Estimating the term…
Abstract
Aspects of the disclosure provide for mechanisms for securing virtual machines in a computer system. A method of the disclosure includes: receiving a first resource request initiated by an application running on a virtual machine during initialization of the application; allocating, by a hypervisor, a resource to the application in view of the first resource; and in response to receiving a message indicating completion of the initialization of the application, blocking, by the hypervisor, at least one hypercall initiated by the virtual machine. The completion of the initialization of the application may correspond to initiation of execution of the application using the allocated resource.
Claims18
A method comprising:
- receiving a first request for a first resource, wherein the first request is initiated by an application running on a virtual machine during initialization of the application;
- allocating, by a hypervisor, the first resource to the application in view of the first request;
- receiving a message sent by the application running on the virtual machine, the message indicating that the initialization of the application is completed and that packet processing by the application is initiated;
- receiving a second request for a second resource;
- determining whether the second request is initiated by the application running on the virtual machine;
- and
- responsive to determining that the second request is initiated by the application running on the virtual machine, blocking, in view of the received message, at least one hypercall initiated by the virtual machine to reject execution of the second request for the second resource.
A system comprising:
- a memory;
- and
- a processing device operatively coupled to the memory, the processing device to:
- receive a first request for a first resource, wherein the first request is initiated by an application running on a virtual machine during initialization of the application;
- allocate, via a hypervisor, the first resource to the application in view of the first request;
- receive a message sent by the application running on the virtual machine, the message indicating that the initialization of the application is completed and that packet processing by the application is initiated;
- receiving a second request for a second resource;
- determine whether the second request is initiated by the application running on the virtual machine;
- and
- responsive to determining that the second request is initiated by the application running on the virtual machine, blocking, in view of the received message, at least one hypercall initiated by the virtual machine to reject execution of the second request for the second resource.
A non-transitory machine-readable storage medium including instructions that, when accessed by a processing device, cause the processing device to:
- receive a first request for a first resource, wherein the first request is initiated by an application running on a virtual machine during initialization of the application;
- allocate, via a hypervisor, the first resource to the application in view of the first request;
- receive a message sent by the application running on the virtual machine, the message indicating that the initialization of the application is completed and that packet processing by the application is initiated;
- receive a second request for a second resource;
- determine whether the second request is initiated by the application running on the virtual machine;
- and
- responsive to determining that the second request is initiated by the application running on the virtual machine, reject, in view of the received message, execution of the second request for the second resource.
Dependencies are inferred from the claim text.