Systems and methods for concealed object store in a virtualized information handling system

1. An information handling system, comprising:

a processor subsystem configured to execute a hypervisor, wherein the hypervisor is configured to host a plurality of virtual machines; and

a memory subsystem communicatively coupled to the processor subsystem, the memory subsystem configured to:

implement namespaces for the hypervisor and the plurality of virtual machines; and

implement for each of the namespaces a concealed namespace object store as a hidden metadata area of the memory subsystem unexposed to the hypervisor and the plurality of virtual machines, each concealed namespace object store comprising metadata for an associated namespace;

wherein, for each namespace, the concealed namespace object store is inaccessible to the hypervisor, but a remainder of the namespace is accessible to the hypervisor.

2. The information handling system of claim 1 , wherein the processor subsystem is further configured to execute a concealed real time service executing on the hypervisor, wherein the concealed real time service is configured to control access to each concealed namespace object store by validating access of the hypervisor and the plurality of virtual machines to the concealed namespace object stores.

3. The information handling system of claim 2 , wherein the concealed real time service is configured to validate access of one of the hypervisor and the plurality of virtual machines by validating a signature of the one of the hypervisor and the plurality of virtual machines.

4. The information handling system of claim 2 , wherein each concealed namespace object store is defined by a concealed namespace object table maintained by the hypervisor.

5. The information handling system of claim 4 , wherein the memory subsystem comprises a persistent memory comprising one or more non-volatile dual-inline memory modules, and wherein the concealed namespace object table is maintained within a non-volatile dual-inline memory firmware interface table.

6. A method comprising, in an information handling system comprising a processor subsystem configured to execute a hypervisor, wherein the hypervisor is configured to host a plurality of virtual machines and comprising a memory subsystem communicatively coupled to the processor subsystem:

implementing, within the memory subsystem, namespaces for the hypervisor and the plurality of virtual machines; and

implementing, within the memory subsystem, for each of the namespaces a concealed namespace object store as a hidden metadata area of the memory subsystem unexposed to the hypervisor and the plurality of virtual machines, each concealed namespace object store comprising metadata for an associated namespace;

wherein, for each namespace, the concealed namespace object store is inaccessible to the hypervisor, but a remainder of the namespace is accessible to the hypervisor.

7. The method of claim 6 , further comprising executing, by the processor subsystem, a concealed real time service executing on the hypervisor, wherein the concealed real time service is configured to control access to each concealed namespace object store by validating access of the hypervisor and the plurality of virtual machines to the concealed namespace object stores.

8. The method of claim 7 , wherein the concealed real time service is configured to validate access of one of the hypervisor and the plurality of virtual machines by validating a signature of the one of the hypervisor and the plurality of virtual machines.

9. The method of claim 7 , wherein each concealed namespace object store is defined by a concealed namespace object table maintained by the hypervisor.

10. The method of claim 9 , wherein the memory subsystem comprises a persistent memory comprising one or more non-volatile dual-inline memory modules, and wherein the concealed namespace object table is maintained within a non-volatile dual-inline memory firmware interface table.

11. An article of manufacture comprising:

a non-transitory computer-readable medium; and

computer-executable instructions carried on the computer-readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to, in an information handling system comprising a processor subsystem configured to execute a hypervisor, wherein the hypervisor is configured to host a plurality of virtual machines and comprising a memory subsystem communicatively coupled to the processor subsystem:

implement, within the memory subsystem, namespaces for the hypervisor and the plurality of virtual machines; and

implement, within the memory subsystem, for each of the namespaces a concealed namespace object store as a hidden metadata area of the memory subsystem unexposed to the hypervisor and the plurality of virtual machines, each concealed namespace object store comprising metadata for an associated namespace;

wherein, for each namespace, the concealed namespace object store is inaccessible to the hypervisor, but a remainder of the namespace is accessible to the hypervisor.

12. The article of claim 11 , the instructions further configured to execute, within the processor subsystem, a concealed real time service executing on the hypervisor, wherein the concealed real time service is configured to control access to each concealed namespace object store by validating access of the hypervisor and the plurality of virtual machines to the concealed namespace object stores.

13. The article of claim 12 , wherein the concealed real time service is configured to validate access of one of the hypervisor and the plurality of virtual machines by validating a signature of the one of the hypervisor and the plurality of virtual machines.

14. The article of claim 12 , wherein each concealed namespace object store is defined by a concealed namespace object table maintained by the hypervisor.

15. The article of claim 14 , wherein the memory subsystem comprises a persistent memory comprising one or more non-volatile dual-inline memory modules, and wherein the concealed namespace object table is maintained within a non-volatile dual-inline memory firmware interface table.