Abstract: A snapshot analysis system analyzes a plurality of data snapshots taken in connection with data stored on a block device allocated by a data storage system. The snapshot analysis system may include an ingestor capable of initially detecting new snapshots and adding a root node for the snapshots. The system may include a block device analyzer that analyzes each snapshot to determine its contents, the relationship within data structures extant within the snapshot, and the snapshot's relationship to other snapshots and/or that of other block devices. The system may also include a clustering analyzer capable of determining whether snapshots are associated with multipart block devices, such as LVM or MD RAID devices. The system may further include a block device emulator that exposes data associated with a given snapshot as an addressable block device without necessitating retrieval or exposure of the full block device to which the snapshot is associated.

Abstract: VDI sessions and virtualized devices can be prioritized in Software-Defined Networks. A server-side agent can communicate with a management server to provide VDI session details indicative of how the VDI session is being employed. The management server can then update a flow table in a Software-Defined Network based on the VDI session details. In this way, the network traffic pertaining to a VDI session can be prioritized based on how the VDI session is being used. A flow table can also be updated in conjunction with commencing or completing an imaging process.

Abstract: Technologies are provided for automatically performing multiple integrated circuit implementation runs with variations of input design constraints. Input design constraints can be automatically adjusted to create multiple modified versions of the design constraints. The multiple modified design constraints can be used to perform separate integrated circuit implementation runs for a given circuit design. Results of the multiple implementation runs can be analyzed, and a circuit implementation report can be generated based on the results of the runs performed with the various modified design constraints. In some embodiments, a circuit implementation recommendation can be generated based on the implementation run results. In at least some scenarios, the multiple implementation runs can be performed using multiple synthesis and implementation processes. The multiple synthesis and implementation processes can be distributed across one or more host computing devices.

Abstract: Selective purging of entries of structures associated with address translation. A request to purge entries of a structure associated with address translation is obtained. Based on obtaining the request, a determination is made as to whether selective purging of the structure associated with address translation is to be performed. Based on determining that selective purging is to be performed, one or more entries of the structure associated with address translation are purged. The selectively purging includes clearing the one or more entries of the structure associated with address translation for a host of the computing environment and leaving one or more entries of one or more guest operating systems in the structure associated with address translation. The one or more guest operating systems are managed by the host.

Abstract: A system for executing a workload that includes a plurality of transactions for a first time slot determines whether a metered cloud service has a sufficient quota of operations available to execute respective metered transactions. For the first time slot, the system determines whether a non-metered cloud service has a sufficient processing load to execute respective non-metered transactions. The system executes the plurality of transactions during the first time slot when each metered cloud service has the sufficient quota and each non-metered cloud service has the sufficient processing load. Further, the system waits to execute the plurality of transactions of the workload during a time slot subsequent to the first time slot when any of the metered cloud services does not have the sufficient quota or any of the non-metered cloud services does not have a sufficient processing load.

Abstract: An apparatus includes a first processor to execute a user-level application to operate in a virtual address, and a co-processor to execute a computing kernel associated with user-level application elements to be performed on the co-processor. The computing kernel is to operate in the virtual address. A memory includes physical addresses, and a partition used to map the virtual address associated with the first processor and to map the virtual address associated with the co-processor. A packet processor manages communications between the first processor and the co-processor. The packet processor receives packets from the first processor, with the packets including memory addresses identifying code and data of the computing kernel. The packet processor stores the packets in a queue associated with the user-level application, and outputs the packets to the co-processor, such that the co-processor is enabled to execute the computing kernel.

Abstract: Example methods are described to provide fault tolerance for a container in a virtualized computing environment that includes a first virtual machine and a second virtual machine. The method may comprise detecting a failure at the first virtual machine. The container may be supported by the first virtual machine to run an application on a first operating system of the first virtual machine. The method may further comprise providing data relating to the container to the second virtual machine; and based on the data relating to the container, resuming the container in the second virtual machine to run the application on a second operating system of the second virtual machine.

Abstract: A hypervisor generates first and second page views, where a guest physical address points to a first page of the first page view and a second page of the second page view. A first pointer value is written to the first page and a second pointer value is written to the second page. A guest operating system executes a first task and if a determination to switch to the second task is made, the guest operating system reads a current pointer value and determines what the current page view is. If the guest operating system determines that the current page view is the first page view, the guest operating system saves the first pointer value in a first memory of the first task, loads the second pointer value from a second memory of the second task, and executes a virtual machine function to switch to the second page view.

Abstract: A table walker receives, from a requesting entity, a request to translate a first address into a second address associated with a page of memory. During a corresponding table walk, when a lock indicator in an entry in a reverse map table (RMT) for the page is set to mark the entry in the RMT as locked, the table walker halts processing the request and performs a remedial action. In addition, when the request is associated with a write access of the page and an immutable indicator in the entry in the RMT is set to mark the page as immutable, the table walker halts processing the request and performs the remedial action. Otherwise, when the entry in the RMT is not locked and the page is not marked as immutable for a write access, the table walker continues processing the request.

Abstract: According to one embodiment, a hardware-based processing node of a plurality of hardware-based processing nodes in an object memory fabric can comprise a memory module storing and managing a plurality of memory objects in a hierarchy of the object memory fabric. Each memory object can be created natively within the memory module, accessed using a single memory reference instruction without Input/Output (I/O) instructions, and managed by the memory module at a single memory layer. The object memory fabric can distribute and track the memory objects across the hierarchy of the object memory fabric and the plurality of hardware-based processing nodes on a per-object basis. Distributing the memory objects across the hierarchy of the object memory fabric and the plurality of hardware-based processing nodes can comprise storing, on a per-object basis, each memory object on two or more nodes of the plurality of hardware-based processing nodes of the object memory fabric.

Abstract: A method includes a trusted component of a host computing system, obtaining, from a client, via a hypervisor of the host, a request to run an instance of a guest image within the hypervisor. The request includes a unique identifier of the guest image, contents of the guest image, and a communication key. The request is encrypted with a request key accessible to the owner and the trusted component and not accessible to the hypervisor. The trusted component generates an authorization request to an authorizing entity of the client requesting authorization for the hypervisor to run the instance. The authorization request includes the unique identifier, a use counter, and a unique challenge. The trusted component encrypts the authorization request with the communication key and communicates the authorization request to the authorizing entity, via the hypervisor.

Abstract: Methods and apparatus for post data synchronization in live migration of domains. Host devices on a network may implement virtual machines (VMs) as domains in an execution environment, and may provide local persistent storage for data of the VMs. A migration technique for moving a domain including the persistent data from one host device to another host device is described in which the VM is instantiated on the target device, and the domain is switched to the target device. Synchronization of the VM's data from the persistent storage on the source device to the target device is then initiated, for example according to a distributed replicated storage technique that makes the target device's persistent storage the primary storage and the source device's persistent storage the secondary storage for the VM. Once the data is synchronized, the VM and its respective storage on the source device are released.

Abstract: Management of storage used by pageable guests of a computing environment is facilitated. A query instruction is provided that details information regarding the storage location indicated in the query. It specifies whether the storage location, if protected, is protected by host-level protection or guest-level protection.

Abstract: One embodiment provides an apparatus. The apparatus includes a linear address space, metadata logic and enhanced address space layout randomization (ASLR) logic. The linear address space includes a metadata data structure. The metadata logic is to generate a metadata value. The enhanced ASLR logic is to combine the metadata value and a linear address into an address pointer and to store the metadata value to the metadata data structure at a location pointed to by a least a portion of the linear address. The address pointer corresponds to an apparent address in an enhanced address space. A size of the enhanced address space is greater than a size of the linear address space.

Abstract: An example method of preserving a modification to an internal state of a computer system includes applying an overlay on a target container. The overlay includes a set of events corresponding to a first set of modifications to a computer system. The method also includes after applying the overlay, receiving a set of user requests corresponding to a second set of modifications to the computer system. The method further includes changing, based on the set of user requests, the third set of internal states of the computer system to the fourth set of internal states. The method also includes removing the overlay from the target container, while preserving the second set of modifications to the computer system.

Abstract: Applications may request persistent storage in nonvolatile memory. The persistent storage is maintained across power events and application instantiations. Persistent storage may be maintained by systems with or without memory management units.

Abstract: Embodiments relate to application-level processor parameter management. An aspect includes granting, by a hypervisor of a computer system, access to an operating parameter of a processor of the computer system to an application that is running on the computer system. Another aspect includes, based on the granting of access to the operating parameter, receiving, by an optimization function in the computer system from the application, a request to adjust the operating parameter. Another aspect includes determining an adjusted value for the operating parameter during execution of the application. Another aspect includes setting the operating parameter to the adjusted value in a parameter register of the processor. Another aspect includes executing the application according to the parameter register by the processor.

Abstract: An information processing device includes a processor that executes a process. The process includes: identifying a cause of a shift from non-privileged mode to privileged mode that has occurred in processing by a guest program in an upper level virtual machine in a nested virtualization environment in which a first level virtual machine monitor operates in privileged mode, and an upper level virtual machine monitor and the guest program operate in non-privileged mode; and when the identified cause is setting or updating a virtual translation table employed in a virtual translation mechanism provided to the guest program by virtualizing an address translation mechanism for hardware that uses a set translation table to translate addresses of DMA by an input/output device assigned to the upper level virtual machine, setting the translation table employed by the translation mechanism based on a correspondence relationship between guest memory space and host memory space.

Abstract: A method and system for monitoring a virtual machine cluster comprising sending, by physical machine, state parameter query instruction to a virtual machine in the virtual machine cluster at a first preset time interval; sending response information to the physical machine in response to receiving the query; the physical machine determining that the virtual machine is faulty, in response to the response information beyond a second preset time, judging whether the faulty machine satisfies a restart condition, and sending a restart instruction to a second machine on which the faulty machine runs, if the faulty machine satisfies the restart condition, by the virtual machine; and restarting, the second physical machine, the faulty virtual machine according to the restart instruction. The disclosure can be used to monitor virtual machines and recover a faulty virtual machine, thereby improving the availability of the virtual machine cluster and shortening service intervals.

Abstract: A system for enabling input/out virtualization for a device is disclosed. In one embodiment, the system includes a plurality of host CPUs; a multi-root switch connected to each of the plurality of host CPUs via respective buses; and an inline PCI virtualizing device connected to the multi-root switch via a front-side bus and the device via a back-side bus, the inline PCI virtualizing device including a plurality sets of registers, each of the plurality sets of registers accessible by a corresponding host CPU of the plurality of host CPUs and implementing functionalities of the device.

Abstract: Techniques for implementing trapless shadow page tables in a virtualized host system are provided. In one embodiment, an SPT accelerator device of the host system can intercept a memory write operation originating from a virtual machine (VM) and directed to a guest OS page table of the VM, where the guest OS page table is stored in a device memory of the SPT accelerator device. The SPT accelerator device can further extract a guest virtual address (GVA)-to-guest physical address (GPA) mapping in the memory write instruction and can translate the GVA-to-GPA mapping into a GVA-to-host physical address (HPA) mapping. The SPT accelerator device can then write the GVA-to-HPA mapping to a shadow page table of the host system.

Abstract: Systems, methods, apparatuses, and software for data storage systems are provided herein. In one example, a data storage assembly is provided that includes a plurality of storage drives each comprising a PCIe host interface and solid state storage media. The data storage assembly includes a PCIe switch circuit coupled to the PCIe host interfaces of the storage drives and configured to receive storage operations issued by one or more host systems over a shared PCIe interface and transfer the storage operations for delivery to the storage drives over selected ones of the PCIe host interfaces. The data storage assembly includes a control processor configured to monitor usage statistics of the storage drives, and power control circuitry configured to selectively remove the power from ones of the storage drives based at least on the usage statistics of the storage drives.

Abstract: One embodiment of the present invention provides a system for managing storage space in a mobile device. During operation, the system detects a decrease in available disk space in a host file system, wherein an image file for a guest system is stored in the host file system. In response to the detected decrease, the system increases a size of a balloon file in a storage of a guest system. The system then receives an indication of a TRIM or discard communication and intercepts the TRIM or discard communication. Next, the system determines that at least one block is free based on the intercepted TRIM or discard communication. Subsequently, the system frees a physical block corresponding to the at least one block in a storage of the host system and reduces a size of the image file for the guest system in accordance with the intercepted TRIM or discard communication.

Abstract: A system for executing code with blind hypervision mechanism comprises: at least one addressable physical memory, a processor operating in at least two modes, a mode termed initialization making it possible to define at least one partition in the memory and at least one second mode termed nominal, a memory bus linking the processor to the memory, a memory partitioning unit positioned on the memory bus, the unit being adapted for restricting memory access to the partition currently executing when the processor is in a mode other than the initialization mode.

Abstract: Embodiments of apparatus, computer-implemented methods, systems, and computer-readable media are described herein for a virtual machine manager, wherein the virtual machine manager is configured to selectively employ different views with different permissions to map guest physical memory of a virtual machine of the apparatus to host physical memory of the apparatus, to regulate access to and protect different portions of an application of the virtual machine that resides in different portions of the physical memory. Other embodiments may be described and/or claimed.

Abstract: Latency reduction for direct memory access operations involving address translation is disclosed. Example methods disclosed herein to perform direct memory access (DMA) operations include initializing a ring of descriptors, the descriptors to index respective buffers for storing received data in a first memory. Such example methods also include causing prefetching of a first address translation associated with a second descriptor in the ring of descriptors to be performed after a first DMA operation is performed to store first received data in a first buffer indexed by a first descriptor in the ring of descriptors and before second received data to be stored in the first memory is received, the first address translation being associated with a second DMA operation for storing the second received data in the first memory.

Abstract: A system, method, and computer program product are provided for managing hierarchy and optimization in network function virtualization based networks. In use, a first hardware unit of a plurality of hardware units associated with a network function virtualization (NFV) based communication network is identified, the first hardware unit being identified based on a first load characteristic associated with the first hardware unit. Further, a first virtual network function (VNF) instance associated with the first hardware unit is identified, the first VNF instance being associated with usage of at least one service. Additionally, at least one traffic route associated with the first VNF instance is identified, the at least one traffic route being associated with usage of the at least one service.

Abstract: Mechanisms are provided for automatically expanding a virtual storage of a virtual machine. The virtual machine monitors a usage of the virtual storage of the virtual machine. The virtual machine determines, based on the monitoring of the usage of the virtual storage, whether to expand the virtual storage of the virtual machine. In response to the virtual machine determining to expand the virtual storage of the virtual machine, a virtual machine manager executes one or more operations to expand the virtual storage. The monitoring and determining may be performed by a virtual storage management agent executing within the virtual machine and which may send an expansion request to an authorization engine to request expansion of the virtual storage.

Abstract: Systems, methods, apparatuses, and software for data storage systems are provided herein. In one example, a data storage assembly is provided. The data storage assembly includes a plurality of storage drives each comprising a PCIe host interface and solid state storage media, with each of the storage drives configured to store and retrieve data responsive to storage operations received over an associated PCIe host interface. The data storage assembly includes a PCIe switch circuit coupled to the PCIe host interfaces of the storage drives and configured to receive the storage operations issued by a plurality of host systems over a shared PCIe interface and transfer the storage operations for delivery to the storage drives over selected ones of the PCIe host interfaces. The data storage assembly includes holdup circuitry configured to provide power to at least the storage drives after input power is lost to the data storage assembly.

Abstract: A keyword spotting system includes a decoder having a storage device and a decoding circuit. The storage device is used to store a log-likelihood table and a plurality of dynamic programming (DP) tables generated for recognition of a designated keyword. The decoding circuit is used to refer to features in one frame of an acoustic data input to calculate the log-likelihood table and refer to at least the log-likelihood table to adjust each of the DP tables when recognition of the designated keyword is not accepted yet, where the DP tables are reset by the decoding circuit at different frames of the acoustic data input, respectively.

Abstract: Techniques are described for performing an offline domain join and login on behalf of a computing device in order to enable the device to access corporate resources without local access to the domain controller. A slave service is described that can start a virtual machine on a local network of the enterprise, perform an offline domain join of the virtual machine, perform a first login to the virtual machine using credentials of a remote user and then capture the changes made on the virtual machine and deliver those changes to the remote user's device. These changes can then be applied on the user's device to add the credentials and configuration changes necessary for the user to access the private enterprise resources remotely.

Abstract: A system for designing Network-on-Chip interconnect arrangements includes a Network-on-Chip backbone with a plurality of backbone ports and a set of functional clusters of aggregated IPs providing respective sets of System-on-Chip functions. The functional clusters include respective sub-networks attachable to any of the backbone ports and to any other functional cluster in the set of functional clusters independently of the source map of the Network-on-Chip backbone.

Abstract: A computer system transitions a virtual machine from a host computer to a target computer having a security key. The host computer transfers a security phrase to the target computer. The target computer applies the security key to the security phrase to generate a security response. That target computer transfers the security response to the host computer. The host computer determines whether the target computer can support the virtual machine based on the security response from the target computer. If the target computer is capable of supporting the virtual machine, then the host computer initiates a transition of the virtual machine from the host computer to the target computer. The determination of whether the target computer can support the virtual machine may be further based on resource availability, time-slice availability, and the other virtual machines executing on the target computer.

Abstract: A remote memory swapping method, an apparatus, and a system, that relate to the communications field and can improve a running speed of a system and reduce power consumption. The method, executed by a local node, includes obtaining a base address of a memory page that needs to be dumped; querying, according to the base address, a routing table to obtain routing information of the memory page; sending the routing information and dumping signaling to a cloud controller, so that the cloud controller forwards the routing information and the dumping signaling to a remote node in which the memory page is located; further, the remote node dumps, according to the dumping signaling and the routing information, from memory of the remote node into a hard disk of the remote node or the backward, data in the memory page.

Abstract: A computing environment includes a computing system, where the computing system includes a plurality of logical partitions, a hypervisor supporting the plurality of logical partitions, a plurality of SR-IOV adapters, where at least one of the logical partitions is mapped to a virtual function on a first SR-IOV adapter of the plurality of adapters, and where migrating an SR-IOV adapter configuration in the computing environment includes: cloning, on a second SR-IOV adapter, a configuration of the first SR-IOV adapter; placing the second SR-IOV adapter and the virtual function in an error state; remapping the virtual function from the first SR-IOV adapter to the second SR-IOV adapter; and placing the second SR-IOV adapter and the virtual function in an error recovery state.

Abstract: A method for setting a compression ratio for utilizing a compressed memory pool (which is backed by pinned memory) by a virtual memory manager (VMM). Compression of pages of corresponding segments can be tracked as part of a VMM paging algorithm that compresses pages to store in a compressed memory pool. A segment having pages with an average compression ratio below a threshold is identified. The identified segment pages are prevented from utilizing the compressed memory pool resulting in optimizing the use of the compressed memory pool.

Abstract: Systems, methods, and computer program products to perform an operation comprising creating, by a kernel, a temporary effective address associated with a virtual segment identifier (VSID), wherein the VSID is received by a processor in an asynchronous interrupt generated by a coherent accelerator in response to a page fault generated by the coherent accelerator in executing an instruction, accessing the temporary effective address by the processor to recreate the page fault on the processor, and resolving the page fault by an operating system executing on the processor.

Abstract: Techniques are described for migrating virtual machines (VMs) across virtual switches. To migrate a VM, a destination distributed virtual switch module may, prior to migration, instantiate a distributed virtual port on a destination VM host and reserve the distributed virtual port for each virtual network adapter of the VM. Further, a configuration file for the VM specifying the distributed virtual ports reserved for the virtual network adapters may be copied from a source VM host to the destination VM host or created in the destination VM host. As part of the migration, network state data of the distributed virtual ports used by the VM at the source VM host is copied and applied to the appropriate reserved distributed virtual ports on the destination host. Then, when the migrated VM is powered on at the destination host, the VM configuration specifying the reserved distributed virtual ports is used to attach the virtual network adapters of the VM to the reserved distributed virtual ports.

Abstract: A processor-implemented method for copying a source file to a destination file using a virtual memory manager (VMM) of a computer operating system is provided. The method includes receiving, by the VMM, a request to copy the source file to a destination file. The method further provides that based on the status of the virtual page, performing at least one of moving the virtual page to the destination file, copying the virtual page to the destination file, reading the virtual page into memory, and ignoring the virtual page.

Abstract: The invention relates to a data processing system including at least two disk emulators operating in parallel. Each of the at least two disk emulators emulates a disk subsystem and is associated with a respective file in a file system for any data stored on a physical disk. The data processing system further includes a de-duplicator for de-duplicating the data stored in the respective files associated with the at least two disk emulators. The de-duplicator operates in parallel to the disk emulators and is associated with an additional disk emulator emulating an additional disk subsystem. The additional disk emulator is associated with an additional file in a file system configured to store data shared between the respective disk subsystems emulated by the at least two disk emulators.

Abstract: A resource management system and method for automatically creating affinity-type rules for resource management in a distributed computer system uses association inference information for at least one resource to determine resource association between resources, which is used to automatically create an affinity-type rule for the resources. The affinity-type rule is considered when executing a resource management operation.

Abstract: A computer implemented method includes monitoring activity on the virtual machine. A plurality of activities being performed at the virtual machine is identified. Each of the activities includes an activity source, an activity target, and an association between the activity source and the activity target. The activity information is stored in the memory. The one or more of the activity sources, activity targets, and associations are transmitted to prevent future attacks.

Abstract: A method and apparatus for optimizing resource utilization within a cluster and facilitating high availability for an application is described. In one embodiment, the method for optimizing resource utilization within a cluster and facilitating high availability for an application includes accessing configuration information regarding virtual machine nodes within the cluster to identify an active node and at least one passive node that are associated with the application and configuring the at least one passive node to be in a suspended state, wherein a passive node of the at least one passive node is to be in a running state and the active node is to be in a suspended state upon migration of the application to the passive node of the at least one passive node.

Abstract: Techniques are described for allocating computing storage capacity to customers of a provider network. Storage capacity that is allocated to a customer is backed up with a replica of the allocated storage capacity. A request is received for a copy of contents of the allocated storage capacity. Responsive to the indication, the requested copy is provided and is configured to reference the replica when the requested copy is accessed.

Abstract: A system and methods for migrating a virtual machine (VM). In one embodiment, a hypervisor receives a request to migrate the contents of a memory of a source VM in a first physical memory area to a destination VM in a second physical memory area, where the first and second physical memory areas are disjoint. The hypervisor executes the destination VM in response to the request, and detects an access of a page of memory of the destination VM. The hypervisor determines, in view of a data structure maintained by a guest operating system executing in the destination VM, that a first page of a memory of the source VM in the first physical memory area is currently in use by the destination VM.

Abstract: In a virtual computing environment, a system configured to switch between isolated virtual contexts. A system includes a physical processor. The physical processor includes an instruction set architecture. The instruction set architecture includes an instruction included in the instruction set architecture for the physical processor that when invoked indicates that a virtual processor implemented using the physical processor should switch directly from a first virtual machine context to a second virtual machine context. The first and second virtual machine contexts are isolated from each other.

Abstract: A plurality of virtual machines (VMs) is migrated from a source group to a destination group in such as way as to achieve consistency and either availability or group preservation. Execution of VMs in the source group is selectively delayed during state migration so that memory transfer of all the VMs in the group will converge roughly at the same time. After VM state transfer to the destination group, execution switch-over is coordinated using different handshake and acknowledgement messages, passed either through a “leader” VM in each group, or directly between source-destination VM pairs.

Abstract: Techniques for tracking, by a host system, virtual machine (VM) memory modified by a physical input/output (I/O) device that supports I/O virtualization are provided. In one embodiment, a hypervisor of the host system can receive a hardware interrupt from the physical I/O device, where the hardware interrupt indicates that a virtual function (VF) of the physical I/O device has completed a direct memory access (DMA) write to a guest memory space of a VM running on the host system. In response to the hardware interrupt, the hypervisor can invoke a function implemented by a physical function (PF) driver of the physical I/O device, where the function is configured to inspect the VF's state in order to identify memory portions modified by the DMA write. The hypervisor can then mark, in a hypervisor-level page table, one or more memory pages corresponding to the identified memory portions as dirty pages.

Abstract: Techniques for dynamic selection and generation of detonation location of suspicious content with a honey network are disclosed. In some embodiments, a system for dynamic selection and generation of detonation location of suspicious content with a honey network includes a virtual machine (VM) instance manager that manages a plurality of virtual clones executed in an instrumented VM environment, in which the plurality of virtual clones executed in the instrumented VM environment correspond to the honey network that emulates a plurality of devices in an enterprise network; and an intelligent malware detonator that detonates a malware sample in at least one of the plurality of virtual clones executed in the instrumented VM environment.

Abstract: A hypervisor provides a guest operating system with a plurality of protection domains, including a root protection domain and one or more secure protection domains, and mechanisms for controlling the transitions between the protection domains. The guest physical memory region of a secure protection domain, which is mapped to host physical memory by secure nested page tables, stores secure guest code and data, and guest page tables for the secure guest code. When executing secure guest code, the guest page tables stored in the secure protection domain region are used for guest virtual to guest physical address translations, and the secure nested page tables are used for guest physical to host physical address translations.