Abstract: A computing system running a host operating system and a virtual machine (VM). The computing system includes at least one device that is directly assigned to the VM. The computing system is configured to execute one or more first VM components and one or more second VM components. The one or more first VM components are configured to manage the one or more second VM components via one or more identification pointers. While the one or more second VM components remain loaded in a system memory, and the directly assigned device remains attached to the VM and remains configured to communicate with the one or more second VM component, the one or more first VM components are shut down and restored.

Abstract: A computing system running a host operating system and a virtual machine (VM). The computing system includes at least one device that is directly assigned to the VM. The computing system is configured to execute one or more first VM components and one or more second VM components. The one or more first VM components are configured to manage the one or more second VM components via one or more identification pointers. While the one or more second VM components remain loaded in a system memory, and the directly assigned device remains attached to the VM and remains configured to communicate with the one or more second VM component, the one or more first VM components are shut down and restored.

Abstract: A computing system running a host operating system and a virtual machine (VM). The computing system includes at least one device that is directly assigned to the VM. The computing system is configured to execute one or more first VM components and one or more second VM components. The one or more first VM components are configured to manage the one or more second VM components via one or more identification pointers. While the one or more second VM components remain loaded in a system memory, and the directly assigned device remains attached to the VM and remains configured to communicate with the one or more second VM component, the one or more first VM components are shut down and restored.

Abstract: A computing system running a host operating system and a virtual machine (VM). The computing system includes at least one device that is directly assigned to the VM. The computing system is configured to execute one or more first VM components and one or more second VM components. The one or more first VM components are configured to manage the one or more second VM components via one or more identification pointers. While the one or more second VM components remain loaded in a system memory, and the directly assigned device remains attached to the VM and remains configured to communicate with the one or more second VM component, the one or more first VM components are shut down and restored.

Abstract: Techniques for graphics processing unit (GPU) partitioning for virtualization are described herein. In one or more implementations, a GPU partitioning manager of a host device obtains a request for a virtual machine having GPU functionality. In particular, the request specifies the GPU functionality in terms of different GPU capabilities. These different capabilities correspond to segments of a GPU model that represents GPU functionality and is used to govern interactions between virtual machines and GPUs. The GPU partitioning manager determines whether GPUs of the host device are available to satisfy the request based on the specified capabilities. If so, the GPU partitioning manager allocates a portion of the determined available GPUs to the virtual machine to configure the virtual machine with a GPU partition having the functionality. The virtual machine configured with the GPU partition can then be exposed to provide GPU-processed data to a GPU partition requestor.

Abstract: An operation of a VM running first and second VM components is suspended so that a servicing operation for the VM can be performed. The VM has devices directly attached to it. A state of the first VM components is saved. An identification pointer for the second VM components is saved in a portion of the computing system physical memory without removing any underlying data structures of second VM components from computing system physical hardware. The directly attached devices remain configured as attached to the VM and remain configured to communicate with the VM while the VM is suspended and while the servicing operation is performed. The first VM components are shut down and then restored at the completion of the servicing operation using the saved state. The restored first VM components are reconnected to the second VM components using the identification pointers. The operation of the VM is restored.

Abstract: Techniques for graphics processing unit (GPU) partitioning for virtualization are described herein. In one or more implementations, a GPU partitioning manager of a host device obtains a request for a virtual machine having GPU functionality. In particular, the request specifies the GPU functionality in terms of different GPU capabilities. These different capabilities correspond to segments of a GPU model that represents GPU functionality and is used to govern interactions between virtual machines and GPUs. The GPU partitioning manager determines whether GPUs of the host device are available to satisfy the request based on the specified capabilities. If so, the GPU partitioning manager allocates a portion of the determined available GPUs to the virtual machine to configure the virtual machine with a GPU partition having the functionality. The virtual machine configured with the GPU partition can then be exposed to provide GPU-processed data to a GPU partition requestor.

Abstract: Techniques for graphics processing unit (GPU) partitioning for virtualization are described herein. In one or more implementations, a GPU partitioning manager of a host device obtains a request for a virtual machine having GPU functionality. In particular, the request specifies the GPU functionality in terms of different GPU capabilities. These different capabilities correspond to segments of a GPU model that represents GPU functionality and is used to govern interactions between virtual machines and GPUs. The GPU partitioning manager determines whether GPUs of the host device are available to satisfy the request based on the specified capabilities. If so, the GPU partitioning manager allocates a portion of the determined available GPUs to the virtual machine to configure the virtual machine with a GPU partition having the functionality. The virtual machine configured with the GPU partition can then be exposed to provide GPU-processed data to a GPU partition requestor.

Abstract: An operation of a VM running first and second VM components is suspended so that a servicing operation for the VM can be performed. The VM has devices directly attached to it. A state of the first VM components is saved. An identification pointer for the second VM components is saved in a portion of the computing system physical memory without removing any underlying data structures of second VM components from computing system physical hardware. The directly attached devices remain configured as attached to the VM and remain configured to communicate with the VM while the VM is suspended and while the servicing operation is performed. The first VM components are shut down and then restored at the completion of the servicing operation using the saved state. The restored first VM components are reconnected to the second VM components using the identification pointers. The operation of the VM is restored.

Abstract: Embodiments relate to enabling state manipulation of virtual machines (VMs) that have directly assigned hardware devices. A hypervisor manages execution of a VM with a guest operating system. The hypervisor directly assigns a physical (non-virtual) hardware device to the VM, such that the VM has exclusive use of the hardware device and the guest operating system uses the hardware without needing virtualization abstraction/mapping by the hypervisor. When the VM needs to be pauses, suspended, restored, or similarly manipulated, the hypervisor communicates with the VM to cause the guest operating system to perform whatever operations might be necessary by the hardware device. The hypervisor and VM/guest may communicate with a variety of mechanisms, such as a host driver communicating with a guest driver, a virtual bus service backed by a hardware bus of the computer, a virtual bus channel, or the like.

Abstract: Techniques for field-programmable gate array (FPGA) virtualization are described herein. In one or more implementations, an FPGA virtualization manager of a host device receives a request from a virtual machine for a device, such as for a compression engine. The FPGA virtualization manager identifies an FPGA program associated with the request and configured to program FPGAs of the host as the requested device. The FPGA virtualization manager also checks the FPGA program against security policies of the host to determine whether to allow the FPGA program to program the FPGAs. If the programming is allowed, the FPGA virtualization manager allocates at least a portion of the FPGAs to the requested device and loads the FPGA program to program the allocated portion of FPGAs. The FPGA virtualization manager generates a virtual device to furnish the functionality of the programmed device to the requesting virtual machine.

Abstract: Techniques are disclosed for securing communication from an unprotected hardware bus. The described techniques may be implemented by placing a secure hardware bus between the unprotected hardware bus and a host computing device. The secure hardware bus acts as a filter to prevent delivery of unsafe data packets to the host computing device. The filtering may be particularly useful for preventing delivery of a data packet that would trigger a reboot of the host computing device.

Abstract: Techniques for signature verification of field-programmable gate array (FPGA) programs are described herein. In one or more implementations, an FPGA virtualization manager of a host device receives a request from a virtual machine for an FPGA program to program FPGAs of the host. The FPGA program is configured to program the FPGAs to provide functionality of a hardware-implementation of a respective program (e.g., a machine-learning algorithm) or of a respective device (e.g., a graphics processing unit). Before allowing the FPGA program to program the FPGAs, however, the FPGA virtualization manager determines whether the FPGA program is trusted to do so. To do so, the FPGA virtualization manager verifies a digital signature associated with the FPGA program. When the signature is verified the FPGA program is determined to be trusted. Based on such a determination, the FPGA virtualization manager loads the FPGA program to program the FPGAs to provide the functionality.

Abstract: A computing device includes a host, one or more guest partitions, and one or more physical devices. A physical device can be virtualized, at least in part, by the host and made available to the guest partitions. A physical device includes both a control plane and a data plane. The host provides direct access to at least part of the data plane of a physical device to a guest partition. However, the host virtualizes the control plane of the physical device, exposing a control plane for the physical device to the guest partition that is not the actual control plane of the physical device. Requests to access (e.g., read, write, modify, etc.) the control plane of the physical device are received by the host from the guest partition, and converted as appropriate to the control plane for the physical device.

Abstract: Techniques for graphics processing unit (GPU) partitioning for virtualization are described herein. In one or more implementations, a GPU partitioning manager of a host device obtains a request for a virtual machine having GPU functionality. In particular, the request specifies the GPU functionality in terms of different GPU capabilities. These different capabilities correspond to segments of a GPU model that represents GPU functionality and is used to govern interactions between virtual machines and GPUs. The GPU partitioning manager determines whether GPUs of the host device are available to satisfy the request based on the specified capabilities. If so, the GPU partitioning manager allocates a portion of the determined available GPUs to the virtual machine to configure the virtual machine with a GPU partition having the functionality. The virtual machine configured with the GPU partition can then be exposed to provide GPU-processed data to a GPU partition requestor.

Abstract: Embodiments relate to enabling state manipulation of virtual machines (VMs) that have directly assigned hardware devices. A hypervisor manages execution of a VM with a guest operating system. The hypervisor directly assigns a physical (non-virtual) hardware device to the VM, such that the VM has exclusive use of the hardware device and the guest operating system uses the hardware without needing virtualization abstraction/mapping by the hypervisor. When the VM needs to be pauses, suspended, restored, or similarly manipulated, the hypervisor communicates with the VM to cause the guest operating system to perform whatever operations might be necessary by the hardware device. The hypervisor and VM/guest may communicate with a variety of mechanisms, such as a host driver communicating with a guest driver, a virtual bus service backed by a hardware bus of the computer, a virtual bus channel, or the like.

Abstract: Embodiments relate to removing, or replacing with an emulator, a physical hardware device that backs a virtual device of a virtual machine (VM), and doing so while the VM and a guest operating system therein remain live and continue executing. In the case of removing the physical hardware device, the physical hardware device stops backing the virtual hardware device while the guest operating system continues to execute and have access to the virtual device. Disruption of the guest operating system may be avoided using techniques described herein. In the case of replacing the physical hardware device with an emulator, the emulator serves as a placeholder for the physical hardware device and allows the guest operating system to continue interacting with the virtual device without degradation of functionality. Removal of the physical hardware device and/or remapping the virtual device to an emulator may be transparent to the guest operating system.

Abstract: Techniques for graphics processing unit (GPU) partitioning for virtualization are described herein. In one or more implementations, a GPU partitioning manager of a host device obtains a request for a virtual machine having GPU functionality. In particular, the request specifies the GPU functionality in terms of different GPU capabilities. These different capabilities correspond to segments of a GPU model that represents GPU functionality and is used to govern interactions between virtual machines and GPUs. The GPU partitioning manager determines whether GPUs of the host device are available to satisfy the request based on the specified capabilities. If so, the GPU partitioning manager allocates a portion of the determined available GPUs to the virtual machine to configure the virtual machine with a GPU partition having the functionality. The virtual machine configured with the GPU partition can then be exposed to provide GPU-processed data to a GPU partition requestor.

Abstract: A computing device includes a host, one or more guest partitions, and one or more physical devices. A physical device can be virtualized, at least in part, by the host and made available to the guest partitions. A physical device includes both a control plane and a data plane. The host provides direct access to at least part of the data plane of a physical device to a guest partition. However, the host virtualizes the control plane of the physical device, exposing a control plane for the physical device to the guest partition that is not the actual control plane of the physical device. Requests to access (e.g., read, write, modify, etc.) the control plane of the physical device are received by the host from the guest partition, and converted as appropriate to the control plane for the physical device.

Abstract: Techniques are disclosed for securing communication from an unprotected hardware bus. The described techniques may be implemented by placing a secure hardware bus between the unprotected hardware bus and a host computing device. The secure hardware bus acts as a filter to prevent delivery of unsafe data packets to the host computing device. The filtering may be particularly useful for preventing delivery of a data packet that would trigger a reboot of the host computing device.