Virtual machine memory lock-down
AssigneeRed Hat Israel, Ltd.
InventorMichael Tsirkin
Life of this patent
Estimating the term…
Abstract
A hypervisor receives, from a guest virtual machine, a request to disable access to a memory range. The hypervisor disables access to the memory range. The hypervisor detects a prohibited access attempt. The prohibited access attempt is an access attempt to the memory range. Responsive to detecting the prohibited access attempt, the hypervisor stops the guest virtual machine. The hypervisor receives a request to reboot the guest virtual machine. The hypervisor reboots the guest virtual machine. Responsive to rebooting the guest virtual machine, the hypervisor enables access to the memory range.
Claims20
A method of memory lock-down, the method comprising:
- storing, by a guest virtual machine, a secure datum at a location within a memory range;
- responsive to storing the secure datum, sending, by the guest virtual machine, a request to disable access to the memory range;
- receiving, by a hypervisor from the guest virtual machine, the request to disable access to the memory range;
- disabling, by the hypervisor, access to the memory range;
- detecting, by the hypervisor, a prohibited access attempt, wherein the prohibited access attempt is an access attempt to the memory range;
- receiving, by the hypervisor, a request to reboot the guest virtual machine;
- rebooting, by the hypervisor, the guest virtual machine;
- and
- responsive to rebooting the guest virtual machine, enabling, by the hypervisor, access to the memory range.
A computer-readable non-transitory storage medium comprising executable instructions that, when executed, are configured to cause a hypervisor to:
- receive a lock-down request from a guest virtual machine, wherein the lockdown request is sent by the guest virtual machine in response to storage, by the guest virtual machine, of a secure datum at a location within a memory range;
- disable access to the memory range associated with the lock-down request;
- detect an access attempt to the memory range;
- receive a reboot request for the guest virtual machine;
- reboot the guest virtual machine;
- and
- responsive to rebooting the guest virtual machine, enable access to the memory range associated with the lock-down request.
A system comprising:
- a memory;
- one or more processors, in communication with the memory;
- a guest virtual machine, configured to execute on the one or more processors to store a secure datum at a location within a memory range, and responsive to storing the secure datum, send a request to disable access to the memory range;
- and
- a hypervisor, configured to execute on the one or more processors, to:
- receive, from the guest virtual machine, the request to disable access to the memory range;
- disable access to the memory range;
- detect a prohibited access attempt, wherein the prohibited access attempt is an access attempt to the memory range;
- receive a request to reboot the guest virtual machine;
- reboot the guest virtual machine;
- and
- responsive to rebooting the guest virtual machine, enable access to the memory range.
Dependencies are inferred from the claim text.