Virtual machine block substitution

• US 8,819,660 B2
• Filed: 06/29/2011
• Issued: 08/26/2014
• Est. Priority Date: 06/29/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Fries, Robert, Parthasarathy, Srivatsan
• Primary Examiner(s): Chen, Xi D
• Application Number:
  US13/171,443
• Publication Number:
  US 20130007733A1
• Time in Patent Office: 1,154 Days
• Field of Search: None
• US Class Current: 717/168
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/658 Incremental updates; Differential updates
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

Techniques are described to allow substation of blocks into a virtual machine image of an executing virtual machine. A patch may be applied to a first virtual machine image. One or more blocks modified by the patch are identified and copied to a host having a virtual machine executing from a virtual machine image that is based on the first virtual machine image (prior to the patch). While the virtual machine is executing, the substitution blocks are applied (supersede) corresponding original blocks in the virtual machine image. A guest operating system in the virtual machine may either begin using an executable file in a substitution block. In addition, the guest operating system may be forced to flush from memory and cache executable code replaced by the substitution block.

Claims

1. A computer-implemented method of updating a virtual machine, the method comprising:

executing a hypervisor on a host computer, the hypervisor managing execution of the virtual machine on the host computer, wherein a guest operating system is currently executing on the virtual machine, the hypervisor providing the virtual machine with block-based access to a virtual machine image, the virtual machine image comprised of blocks;

receiving a substitution block at the host computer; and

while the virtual machine is executing, replacing, by the hypervisor, a target block in the virtual machine image with the substitution block, the target block comprising one of the blocks of the virtual machine image, the hypervisor managing the blocks of the virtual machine image and presenting the blocks of the virtual machine image, including the substitution block, to the virtual machine as a virtualized disk.

2. A method according to claim 1, further comprising receiving a list of tainted blocks, and using the list of tainted blocks to identify the target block.

3. A method according to claim 1, wherein the substitution block was obtained from a base virtual machine image to which a patch was applied, and wherein the virtual machine image was derived from the base virtual machine image before the patch was applied.

4. A method according to claim 1, wherein the target block contains a first version of a portion of a binary machine code file executable by the guest operating system, the substitute block comprises a second version of the binary machine code file, and when the substitute block replaces the target lock in the virtual machine image, the second version of the binary machine executable file is available for execution by the guest operating system.

5. A method according to claim 4, wherein the first version of the binary machine code file is being executed in the virtual machine when substitute block replaces the target block, and the method further comprises forcing the guest operating system to load the second version of the binary machine code file.

6. A method according to claim 5, wherein the forcing the guest operating system is performed by using information relating the first version of the binary machine code file with a portion of physical and/or virtual memory.

7. A method according to claim 5, the method further comprising forcing a page fault in the guest operating system that corresponds to the first version of the binary machine code file.

8. One or more computer-readable storage devices storing information to enable a computer to perform a process, the process performed by a virtualization layer executing on the computer, the process comprising:

executing the virtualization layer on the computer, the virtualization layer managing execution of a virtual machine on the computer, wherein a guest operating system is executing on the virtual machine, the virtualization providing the virtual machine with block-based access to a first virtual machine image, the first virtual machine image comprised of first blocks that the virtualization layer presents as a virtualized disk;

while the virtual machine is being executed with the first virtual machine image on the computer by the virtualization layer that manages virtual machines on the computer, receiving a second block obtained from a second virtual machine image; and

while the virtual machine continues to be executed, replacing one of the first blocks with the second block.

9. One or more computer-readable storage devices according to claim 8, wherein the second block contains customization information and when the second block replaces the one of the first blocks, a setting or state of a guest operating system of the virtual machine is updated according to the customization information.

10. One or more computer-readable storage devices according to claim 9, wherein the replacing is performed such that the process is specific to the guest operating system.

11. One or more computer-readable storage devices according to claim 8, wherein a guest operating system is executing in the virtual machine and the virtual machine has physical memory of the computer that is managed by the virtualization layer, and prior to the replacing, the physical memory contains first binary executable code from the first block, the process further comprising:

after the replacing of the first block with the second block, functionally removing the first binary executable code from the physical memory and loading into the physical memory second executable code in the first block within the first virtual machine image.

12. One or more computer-readable storage devices according to claim 8, further comprising receiving a tainted block list and identifying the first block, among the plurality of first blocks, according to the tainted block list.

13. One or more computer-readable storage devices according to claim 8, the process further comprising a guest operating system in the virtual machine, the guest operating system having a component to communicate with the virtualization layer, the process further comprising the virtualization layer communicating with the component to cause the guest operating system to page into memory a portion of the second block, the portion being obtained from the first virtual machine image by the virtualization layer.

14. A method performed by one or more computers, the method comprising:

applying a patch to a first virtual machine image to generate a second virtual machine image;

identifying blocks of the second virtual machine image that differ from the first virtual machine image;

distributing the identified blocks to a plurality of hosts, each host having a hypervisor and one or more virtual machines managed thereby, each virtual machine having a virtual machine image comprised of blocks and presented as a virtual disk by the corresponding hypervisor; and

applying the blocks to the virtual machines as they are running on the hosts, the applying performed by respective hypervisors replacing blocks of the virtual machine images managed by the hypervisors.

15. A method according to claim 14, wherein one of the hosts makes the blocks available to a virtual machine running thereon while the virtual machine continues executing on the host.

16. A method according to claim 15, further comprising restarting a guest operating system of a virtual machine on one of the host to cause the guest operating system to have content of one of the identified blocks available for execution.

17. A method according to claim 15, further comprising using a file-to-block mapping on one of the hosts to identify a file in a block at the host.

18. A method according to claim 17, further comprising forcing a page fault to force executable code in one of the blocks into memory of a guest operating system executing in a virtual machine on one of the hosts.

19. A method according to claim 15, wherein the blocks comprise read-only content.

20. A method according to claim 15, wherein a hypervisor at one of the hosts comprises a block-based device driver that handles access to virtual machine images of virtual machines on the host by mapping blocks of the virtual machine images to virtual disks of the virtual machines.