Abstract: Memory deduplication for encrypted virtual machines can be performed according to some examples. In one example, a virtual machine can select a target memory page stored in an encrypted memory of the virtual machine. The encrypted memory can be inaccessible to a hypervisor configured to manage the virtual machine. The virtual machine can store a copy of the target memory page to a shared memory that is accessible to the hypervisor. The hypervisor can then execute a deduplication process with respect to the copy of the target memory page stored in the shared memory. Subsequent to storing the copy of the target memory page to the shared memory, the virtual machine can remove the target memory page from the encrypted memory. The virtual machine can also prompt the hypervisor to reallocate the memory space of the encrypted memory that was previously used to store the target memory page.

Abstract: An example system includes a memory, a processor in communication with the memory, and a supervisor. The supervisor is configured to allocate a memory space in the memory to a workload executing on the processor. The supervisor is configured to store data written by the workload as dirty memory in the memory space at least until the data is written back to a data storage. Based on a type of the workload being a first type, the supervisor is configured to trigger write back of at least a portion of the dirty memory into the data storage in response to the dirty memory exceeding a threshold level. Based on the type of the workload being a second type, the supervisor is configured to delay write back of the dirty memory into the data storage in response to the dirty memory exceeding the threshold level.

Abstract: Systems and method for automated efficient memory migration in Non-uniform Memory Access (NUMA) based virtual machines are introduced, comprising exporting one or more informative data objects, from a host machine to at least one virtual machine, wherein the informative data objects include references to pages that have been migrated from a physical source memory node (source node) on the host machine to a new source location on the host machine; inspecting, the informative data objects, by the at least one virtual machine; detecting, by the at least one virtual machine, the pages that have been migrated to the new source location; sending a request, by the at least one virtual machine, to the host machine via the hypervisor, to map the pages to a physical destination memory node (destination node) corresponding to a desired virtual destination memory node (destination vNode); and undertaking at least one efficient data migration operation.

Abstract: Systems and methods for enhancing efficient memory swap for virtual machines. An example method may comprise: receiving, by a hypervisor running on a host computer system, a request, from a virtual machine managed by the hypervisor, to write to a virtual disk a content of a memory page identified by a guest physical address (GPA); detecting, by the hypervisor, that the content of the memory page is stored on a storage device; storing, on the virtual disk, an identifier of a location of the content of the memory page on the storage device; and un-mapping the GPA from the storage device.

Abstract: Systems and methods for enhancing memory management for virtual machines. An example method may comprise: accessing, by a hypervisor running on a host computer system, a data structure exposed by a virtual machine managed by the hypervisor, wherein the data structure includes an estimated next access time for one or more memory pages of a plurality of memory pages associated with the virtual machine; estimating a read latency time associated with the virtual machine; identifying, using the data structure, a memory page associated with an estimated next access time that satisfies a predefined condition with respect to the read latency time; and swapping out the memory page.

Abstract: An example system includes a memory, a processor in communication with the memory, and a hypervisor. The hypervisor is configured to store, as dirty memory, data from a virtual machine (VM) at least until the data is written back into a data storage. The hypervisor is also configured to assign a persistence setting for managing write back of the dirty memory of the VM into the data storage. The hypervisor is also configured to periodically trigger writing at least a portion of the dirty memory of the VM into the data storage based on the persistence setting being a first setting. The hypervisor is also configured to disable periodic triggering, by the hypervisor, of the writing of the dirty memory of the VM into the data storage based on the persistence setting being a second setting.

Abstract: Systems and methods for enabling efficient communication between the hypervisor and the virtual machine to reduce the transition events between the virtual machine and the hypervisor. An example method may include: identifying, by a hypervisor running on a host computer system, a guest memory page referenced by a guest memory page address in a guest memory space of a virtual machine managed by the hypervisor; making the guest memory page inaccessible by the virtual machine; notifying the virtual machine of the guest memory page address; and responsive to receiving, from the virtual machine, a page fault notification with respect to the guest memory page, mapping a host memory page to the guest memory page.

Abstract: Systems and methods are disclosed for establishing controlled remote access to debug logs. An example method may comprise: receiving, by a first computing device, from a second computing device, an encrypted file comprising a debug log; running, within a trusted execution environment of the first computing device, a log access application; sending, to the second computing device, a request for access to the debug log by the log access application, wherein the request comprises a validation measurement generated by the trusted execution environment with respect to the log access application; receiving, from the second computing device, an access key; and accessing the debug log using the access key.

Abstract: Systems and methods are disclosed for establishing secure remote access to debug logs. An example method may comprise: receiving, by a processing device, from a computing device, an encrypted virtual disk image comprising a set of debug logs; initiating, by the processing device, instantiation of a virtual machine (VM) using the encrypted virtual disk image, wherein the VM is to execute a log access application to analyze the set of debug logs; sending, to the computing device, a request for access to the set of debug logs by the log access application; receiving, from the computing device, an indication granting access to the set of debug logs by the log access application, wherein having access to the set of debug logs allows the log access application to analyze the set of debug logs to identify an issue associated with the set of debug logs.

Abstract: A processing device executing a guest receives a request from an application to disable memory deduplication for a memory page associated with the application; identifies a non-mergeable memory range for memory space of the guest, where the non-mergeable memory range is associated with guest memory pages not to be deduplicated; maps, in a page table of the guest, an entry for the memory page to a memory address within the non-mergeable memory range; and causes a host to disable memory deduplication for the memory page responsive to detecting an access of the memory page by the application.

Abstract: An example system includes a memory, a processor in communication with the memory, and a supervisor. The supervisor is configured to allocate a memory space in the memory to a workload executing on the processor. The supervisor is configured to store data written by the workload as dirty memory in the memory space at least until the data is written back to a data storage. Based on a type of the workload being a first type, the supervisor is configured to trigger write back of at least a portion of the dirty memory into the data storage in response to the dirty memory exceeding a threshold level. Based on the type of the workload being a second type, the supervisor is configured to delay write back of the dirty memory into the data storage in response to the dirty memory exceeding the threshold level.

Abstract: A method includes receiving a request to migrate a virtual machine executing on a source host computer system to a first destination host computer system. The method further includes receiving, from the virtual machine executing on the source host computer system, an encryption key specific to the virtual machine. One or more memory pages associated with the virtual machine are encrypted using the encryption key specific to the virtual machine. The method further includes causing the one or more memory pages associated with the virtual machine to be copied to the first destination host computer system.

Abstract: A guest operating system (OS) of a virtual machine (VM) receives a first request from an application to enable memory deduplication for a memory page associated with the application, identifies a mergeable memory range for memory space of the guest OS, where the mergeable memory rage is associated with guest OS memory pages to be deduplicated, and maps, in a page table of the guest OS, a page table entry for the memory page to a memory address within the mergeable memory range. The guest OS causes a hypervisor to enable deduplication for the memory page responsive to detecting an access of the memory page by the application.

Abstract: Systems and methods are described for resource-efficient memory deduplication and write-protection. In an example, a method includes receiving, by a computing device having a processor, a request to assess deduplication for a plurality of candidate files. The computing device may perform one or more iterative steps for deduplication. The iterative steps may include: receiving, from the plurality of candidate files, a candidate file that is not write-protected; determining, based on a predetermined Bernoulli distribution, a decision to write-protect the candidate file; rendering the candidate file as a write-protected candidate file; determining, based on a review of other candidate files from the plurality of candidate files, that the write-protected candidate file can be deduplicated; and deduplicating the write-protected candidate file.

Abstract: A supervisor on a destination host receives a request to migrate an application from a source host to the destination host and determines a total amount of memory associated with the application on the source host. The supervisor on the destination host allocates one or more memory pages in a page table on the destination host to satisfy the total amount of memory associated with the application on the source host, where the one or more memory pages are to be associated with the application on the destination host. Responsive to determining that the one or more memory pages have been allocated on the destination host, the supervisor on the destination host initiates migration of the application from the source host to the destination host.

Abstract: Systems and methods providing efficient dirty memory page expiration. In one implementation, a processing device may identify a storage device. The processing device may determine a value of an indicator associated with the storage device. The indicator may indicate a level of consistency between a volatile memory device and a non-volatile memory device of the storage device. In view of the value of the indicator, the processing device may modify a synchronization timeout value associated with the volatile memory device.

Abstract: Aspects of the disclosure provide for implementing host address space identifiers for non-uniform memory access (NUMA) locality in virtual machines. A method of the disclosure includes determining, by a virtual machine (VM), that a guest memory page is to be moved from a first virtual NUMA node of the VM to a second virtual NUMA node of the VM. The method also includes updating, one or more designated bits of a guest physical address (GPA) of the memory page to include a host address space identifier (HASID) of the second virtual NUMA node, where the guest page table maps the GPA of the memory page to a corresponding guest virtual address (GVA) of the VM and where the HASID associates the GPA of the memory page with a corresponding virtual NUMA node locality, and accessing by the VM, the updated GPA.

Abstract: Systems and methods are described for resource-efficient memory deduplication and write-protection. In an example, a method includes receiving, by a computing device having a processor, a request to assess deduplication for a plurality of candidate files. The computing device may perform one or more iterative steps for deduplication. The iterative steps may include: receiving, from the plurality of candidate files, a candidate file that is not write-protected; determining, based on a predetermined Bernoulli distribution, a decision to write-protect the candidate file; rendering the candidate file as a write-protected candidate file; determining, based on a review of other candidate files from the plurality of candidate files, that the write-protected candidate file can be deduplicated; and deduplicating the write-protected candidate file.

Abstract: Systems and methods for memory management for virtual machines. An example method may comprise running, by a host computer system, a Level 0 hypervisor managing a Level 1 virtual machine running a Level 1 hypervisor which manages a Level 2 virtual machine. The Level 1 hypervisor may detecting execution of an operation that prevents modification to a set of entries in a Level 2 page table and generate a shadow page table where each shadow page table entry of the plurality of shadow page table entries maps a Level 2 guest virtual address of a Level 2 address space associated with the Level 2 virtual machine to a corresponding Level 1 guest physical address of a Level 1 address space associated with the Level 1 virtual machine. The Level 0 hypervisor may generate a Level 0 page table.

Abstract: A system includes a memory, at least one physical processor in communication with the memory, and a plurality of threads executing on the at least one physical processor. A first thread of the plurality of threads is configured to execute a plurality of instructions that includes a restartable sequence. Responsive to a different second thread in communication with the first thread being pre-empted while the first thread is executing the restartable sequence, the first thread is configured to restart the restartable sequence prior to reaching a memory barrier.