Patching host OS structures for hardware isolation of virtual machines
AssigneeParallels IP Holding GmbH
InventorsSerguei M. Beloussov, Maxim A. Kuzkin, Andrey A. Omelyanchuk, Stanislav S. Protassov, Alexander G. Tormasov
Life of this patent
Estimating the term…
Abstract
A system and method for implementing direct attachment of VMs, implemented on a computer system, to hardware devices attached to the computer system. Direct attachment architecture is implemented. The direct attachment is an exclusive dedication of a hardware device to a VM, where a particular hardware device is assigned to a particular VM. When the VM is not activated, the hardware device can be re-assigned to another VM. At system start up, hardware devices are masked from a host OS of a computer system and are automatically attached to the assigned VMs.
Claims13
A method for assigning a dedicated hardware device to a Virtual Machine (VM), the method comprising:
- implementing at least one VM with a guest OS, running under control of a Virtual Machine Monitor (VMM) on a computer system with a host operating system (OS);
- isolating a hardware device from the host OS;
- assigning the hardware device to the VM,
- wherein the VM takes exclusive control of the hardware device by bypassing the VMM when interfacing with the hardware device;
- the isolation of the hardware device comprising allocation of devices of the computer system so that the host OS operative access to the hardware device is essentially limited,
- wherein the isolation of the hardware device is provided at boot time by a hypervisor (a) patching of BIOS of the computer system or (b) patching an EFI of the computer system, and
- wherein the hardware device is visible to the host OS, but becomes inactive for the host OS.
A method for assigning a dedicated hardware device to a Virtual Machine (VM), the method comprising:
- implementing at least one VM with a guest OS on a host OS of a computer system;
- isolating a hardware device from the host OS;
- assigning the hardware device to the VM,
- wherein the VM takes exclusive control of the hardware device;
- the isolation of the hardware device comprising allocation of devices of the computer system so that the host OS operative access to the hardware device is essentially limited,
- wherein the isolation of the hardware device is provided by (a) patching of BIOS of the computer system or (b) patching an EFI of the computer system, and
- wherein the hardware device is visible to the host OS, but becomes inactive for the host OS,
- wherein, after the patching of the BIOS or the patching of the EFI, structures of the host operating system are patched, including a table of devices or a registry of the host operating system, thereby making the hardware device absent or inactive.
A virtualization system for allocating dedicated hardware devices, the system comprising:
- a computer system having a host OS and a Virtual Machine Monitor (VMM);
- at least one Virtual Machine (VM) implemented under control of the VMM;
- at least one hardware device connected to the computer system,
- wherein the hardware device is masked out from the host OS and the VM takes exclusive control of the hardware device at start up by bypassing the VMM when interfacing with the hardware device;
- the hardware device is masked by allocation of address space of the computer system so that the host OS does not have access to an address of the hardware device,
- wherein the masking of the hardware device is provided at boot time by a hypervisor (a) patching of BIOS of the computer system or (b) dynamically patching an EFI of the computer system.
A method for assigning a dedicated hardware device to a Virtual Machine (VM), the method comprising:
- implementing at least one VM with a guest OS on a host OS of a computer system;
- isolating a hardware device from the host OS;
- assigning the hardware device to the VM,
- wherein the VM takes exclusive control of the hardware device;
- the isolation of the hardware device comprising allocation of the device's address space so that the host OS does not have access to the hardware device, including patching structures of the host operating system at boot time, including patching a table of devices or a registry of the host operating system, thereby making the hardware device absent or inactive to the host OS,
- wherein the isolation of the hardware device is provided by a stopper driver which makes device non-accessible to the host OS processes.
A method for assigning a dedicated hardware device to a Virtual Machine (VM), the method comprising:
- implementing at least one VM with a guest OS on a host OS of a computer system;
- masking a hardware device from the host OS;
- assigning the hardware device to the VM for direct access,
- wherein the VM takes exclusive control of the hardware device at start up and bypasses access verification procedures enforced by the host OS;
- the masking of the hardware device comprising allocation of address space of the computer system so that a device access procedure of the host OS is unaware of the hardware device,
- wherein the hardware device is excluded from a list of visible devices used for mounting the devices at the host OS launch by boot-time patching structures of the host operating system, including patching a table of devices or a registry of the host operating system, thereby making the hardware device absent or inactive to the host OS.
Dependencies are inferred from the claim text.