Abstract: A system for CPU overcommit with guest idle-polling includes a memory, a plurality of host CPUs in communication with the memory, a virtual machine, and a hypervisor. The plurality of host CPUs include a first host CPU and a second host CPU. The virtual machine includes a virtual central processing unit (VCPU) and a guest. In an example, the VCPU executes on the first host CPU. The guest records in a location of guest memory a value indicating that the VCPU is in an idle-polling state. Then, when the hypervisor detects that a new task needs to be executed, the hypervisor reads the value in the location of the guest memory and determines that the VCPU is in the idle-polling state. Then, the hypervisor schedules the new task to the first host CPU.

Abstract: An example method of allocating memory pages for a guest includes receiving, by a hypervisor, a request to allocate a plurality of guest memory pages for a guest running on a virtual machine. The virtual machine and the hypervisor run on a host machine. The method also includes in response to the request: (i) allocating, by the hypervisor, a plurality of host memory pages, and (ii) mapping the plurality of guest memory pages to the plurality of host memory pages.

Abstract: A hypervisor deduplcation system includes a memory, a processor in communication with the memory, and a hypervisor executing on the processor. The hypervisor is configured to scan a first page, detect that the first page is an unchanged page, check a first free page hint, and insert the unchanged page into a tree. Responsive to inserting the unchanged page into the tree, the hypervisor compares the unchanged page to other pages in the tree and determine a status of the unchanged page as matching one of the other pages or mismatching the other pages in the tree. Responsive to determining the status of the page as matching another page, the hypervisor deduplicates the unchanged page. Additionally, the hypervisor is configured to scan a second page of the memory, check a second free page hint, deduplicate the second page if the free page hint indicates the page is unused.

Abstract: A hypervisor deduplcation system includes a memory, a processor in communication with the memory, and a hypervisor executing on the processor. The hypervisor is configured to scan a first page, detect that the first page is an unchanged page, check a first free page hint, and insert the unchanged page into a tree. Responsive to inserting the unchanged page into the tree, the hypervisor compares the unchanged page to other pages in the tree and determine a status of the unchanged page as matching one of the other pages or mismatching the other pages in the tree. Responsive to determining the status of the page as matching another page, the hypervisor deduplicates the unchanged page. Additionally, the hypervisor is configured to scan a second page of the memory, check a second free page hint, deduplicate the second page if the free page hint indicates the page is unused.

Abstract: A system includes a hypervisor, virtual machine(s), and virtual processor(s). The virtual processor(s) includes a real time virtual processor and a housekeeping virtual processor. The housekeeping virtual processor is configured to initiate a non-preemptible task and responsive to initiating the non-preemptible task, increment a counter value from an initial counter value. The housekeeping virtual processor is also configured to complete the non-preemptible task and responsive to completing the non-preemptible task, decrement the counter value towards the initial counter value. Responsive to the counter value reaching the initial counter value, the virtual housekeeping processor is configured to check a flag set by the hypervisor. Responsive to checking the flag, the housekeeping process is configured to execute a hypercall to yield a processor associated with the housekeeping virtual processor.

Abstract: A method includes, with a computing system, exiting a context of a virtual machine, the exiting in response to a request from a guest operating system of the virtual machine to switch from a first encryption key identifier for the virtual machine to a second encryption key identifier for the virtual machine. The method further includes, with the computing system, loading the second encryption key identifier into a virtual machine control module of a virtual processor of the virtual machine and after loading the second encryption key identifier, entering the context of the virtual machine.

Abstract: A hypervisor deduplcation system includes a memory, a processor in communication with the memory, and a hypervisor executing on the processor. The hypervisor is configured to scan a first page, detect that the first page is an unchanged page, check a first free page hint, and insert the unchanged page into a tree. Responsive to inserting the unchanged page into the tree, the hypervisor compares the unchanged page to other pages in the tree and determine a status of the unchanged page as matching one of the other pages or mismatching the other pages in the tree. Responsive to determining the status of the page as matching another page, the hypervisor deduplicates the unchanged page. Additionally, the hypervisor is configured to scan a second page of the memory, check a second free page hint, deduplicate the second page if the free page hint indicates the page is unused.

Abstract: Systems and methods for copy and decrypt support for encrypted virtual machines are disclosed. An example method may include receiving, at a source host machine hosting a virtual machine (VM), a request to migrate the VM to a destination host machine, identifying a first page of memory of the VM on the source host machine for migration, write-protecting the first page, the first page of memory encrypted with a VM-specific encryption key, allocating a second page, executing a copy-and-reencrypt command using the first page and the second page as parameters for the copy-and-reencrypt command, the copy-and-reencrypt command to output the second page comprising contents of the first page re-encrypted with a migration key, and transmitting contents of the second page to the destination host machine.

Abstract: Disclosed are systems and methods of implementing per-thread granular memory access permissions. An example method may include: initializing a plurality of memory protection keys associated with a plurality of page table entries associated with an address space of a processing thread; loading, to a protection key rights register associated with the processing thread, a plurality of memory access permissions referenced by the memory protection keys; initializing a system call filter to prevent the processing thread from modifying the protection key rights register; and causing the processing thread to be executed.

Abstract: Systems and methods for data storage management technology that enables a guest module of a virtual machine to indicate an order in which a host module should write data from physical memory to a secondary storage. An example method may comprise: identifying, by a processing device executing a host module, a plurality of modifications to direct access excited (DAX) memory made by a plurality of direct access operations executed by a guest module of a virtual machine; determining, by the host module, an order of the plurality of modifications to DAX memory; receiving, by the host module, a synchronization request from the guest module; and responsive to the synchronization request, copying, by the host module, data from the DAX memory to a secondary storage in view of the order of the plurality of modifications.

Abstract: A system for CPU overcommit with guest idle-polling includes a memory, a plurality of host CPUs in communication with the memory, a virtual machine, and a hypervisor. The plurality of host CPUs include a first host CPU and a second host CPU. The virtual machine includes a virtual central processing unit (VCPU) and a guest. In an example, the VCPU executes on the first host CPU. The guest records in a location of guest memory a value indicating that the VCPU is in an idle-polling state. Then, when the hypervisor detects that a new task needs to be executed, the hypervisor reads the value in the location of the guest memory and determines that the VCPU is in the idle-polling state. Then, the hypervisor schedules the new task to the first host CPU.

Abstract: A hypervisor deduplcation system includes a memory, a processor in communication with the memory, and a hypervisor executing on the processor. The hypervisor is configured to scan a first page, detect that the first page is an unchanged page, check a first free page hint, and insert the unchanged page into a tree. Responsive to inserting the unchanged page into the tree, the hypervisor compares the unchanged page to other pages in the tree and determine a status of the unchanged page as matching one of the other pages or mismatching the other pages in the tree. Responsive to determining the status of the page as matching another page, the hypervisor deduplicates the unchanged page. Additionally, the hypervisor is configured to scan a second page of the memory, check a second free page hint, deduplicate the second page if the free page hint indicates the page is unused.

Abstract: A system for CPU overcommit with guest idle-polling includes a memory, a plurality of host CPUs in communication with the memory, a virtual machine, and a hypervisor. The plurality of host CPUs include a first host CPU and a second host CPU. The virtual machine includes a virtual central processing unit (VCPU) and a guest. In an example, the VCPU executes on the first host CPU. The guest records in a location of guest memory a value indicating that the VCPU is in an idle-polling state. Then, when the hypervisor detects that a new task needs to be executed, the hypervisor reads the value in the location of the guest memory and determines that the VCPU is in the idle-polling state. Then, the hypervisor schedules the new task to the first host CPU.

Abstract: A system includes a hypervisor, virtual machine(s), and virtual processor(s). The virtual processor(s) includes a real time virtual processor and a housekeeping virtual processor. The housekeeping virtual processor is configured to initiate a non-preemptible task and responsive to initiating the non-preemptible task, increment a counter value from an initial counter value. The housekeeping virtual processor is also configured to complete the non-preemptible task and responsive to completing the non-preemptible task, decrement the counter value towards the initial counter value. Responsive to the counter value reaching the initial counter value, the virtual housekeeping processor is configured to check a flag set by the hypervisor. Responsive to checking the flag, the housekeeping process is configured to execute a hypercall to yield a processor associated with the housekeeping virtual processor.

Abstract: Systems and methods for copy and decrypt support for encrypted virtual machines are disclosed. An example method may include receiving, at a source host machine hosting a virtual machine (VM), a request to migrate the VM to a destination host machine, identifying a first page of memory of the VM on the source host machine for migration, write-protecting the first page, the first page of memory encrypted with a VM-specific encryption key, allocating a second page, executing a copy-and-reencrypt command using the first page and the second page as parameters for the copy-and-reencrypt command, the copy-and-reencrypt command to output the second page comprising contents of the first page re-encrypted with a migration key, and transmitting contents of the second page to the destination host machine.

Abstract: A system, methods, and apparatus for determining memory distribution across multiple non-uniform memory access processing nodes are disclosed. An apparatus includes processing nodes, each including processing units and main memory serving as local memory. A bus connects the processing units of each processing node to different main memory of a different processing node as shared memory. Access to local memory has lower memory access latency than access to shared memory. The processing nodes execute threads distributed across the processing nodes, and detect memory accesses made from each processing node for each thread. The processing nodes determine locality values for the thread that represent the fraction of memory accesses made from the processing nodes, and determine processing time values for the threads for a sampling period. The processing nodes determine weighted locality values for the threads, and determine a memory distribution across the processing nodes based on the weighted locality values.

Abstract: A method includes, with a computing system, exiting a context of a virtual machine, the exiting in response to a request from a guest operating system of the virtual machine to switch from a first encryption key identifier for the virtual machine to a second encryption key identifier for the virtual machine. The method further includes, with the computing system, loading the second encryption key identifier into a virtual machine control module of a virtual processor of the virtual machine and after loading the second encryption key identifier, entering the context of the virtual machine.

Abstract: Methods, systems, and computer program products for receiving a memory access request, the memory access request including a virtual memory address; locating a page entry in a page entry structure, the page entry corresponding to the virtual memory address; identifying that a page corresponding to the page entry includes a sub-page, the sub-page included within a subset of a memory space allocated to the page; determining a page frame number corresponding to the sub-page and an offset corresponding to the sub-page; and accessing the offset within the sub-page.

Abstract: Disclosed are systems and methods of implementing per-thread granular memory access permissions. An example method may include: initializing a plurality of memory protection keys associated with a plurality of page table entries associated with an address space of a processing thread; loading, to a protection key rights register associated with the processing thread, a plurality of memory access permissions referenced by the memory protection keys; initializing a system call filter to prevent the processing thread from modifying the protection key rights register; and causing the processing thread to be executed.

Abstract: Methods, systems, and computer program products for receiving a memory allocation request; comparing a memory size corresponding to the memory allocation request to a memory size threshold; allocating a memory page that has a size larger than the memory size threshold, the memory page having a page entry in a page management data structure; and allocating a portion of the memory page, the portion of the memory page corresponding to a sub-page of the memory page.