Abstract: A method includes receiving a memory access request comprising a first memory address and translating the first memory address to a second memory address using a first page table associated with the first virtual machine. The first page table indicates whether the memory of the first virtual machine is encrypted. The method further includes determining that the first virtual machine is nested within a second virtual machine and translating the second memory address to a third memory address using a second page table associated with the second virtual machine. The second page table indicates whether the memory of the second virtual machine is encrypted.

Abstract: Systems and methods for encryption support for virtual machines. An example method may comprise maintaining, by a virtual machine running on a host computer system, a list of free memory pages, wherein each entry in the list references a set of memory pages that are contiguous in a guest address space; receiving, from a hypervisor of the host computer system, a request for guest memory to be made available to the hypervisor, wherein the request comprises a minimum size of guest memory requested and a maximum size of guest memory; and responsive to identifying, in the list of free memory pages, a set of contiguous guest memory pages that is greater than or equal to the minimum size of memory requested, and less than or equal to the maximum size of memory requested, releasing the set of contiguous guest memory pages to the hypervisor.

Abstract: System and method for reducing latency for nested virtual machines. An example method may include: running, by a host computer system, a hypervisor managing a first virtual machine associated with a first virtual processor (vCPU) implemented by a first processing thread, wherein the first virtual machine manages a second virtual machine; creating, by the hypervisor, a second processing thread implementing a second vCPU associated with the second virtual machine; and responsive to receiving an interrupt directed to the second virtual machine, causing, by the hypervisor, the second processing thread to process the interrupt.

Abstract: A migration process for migration of a virtual machine from a source host to a destination host has initiated is determined. The source host and the destination host are part of a network. A multicast address that is mapped to a group comprising the source host and the destination host is obtained. Host in the network to begin encapsulating packets addressed to the virtual machine and send the encapsulated packets using the multicast address in a destination address field of the encapsulated packets is notified.

Abstract: Aspects of the disclosure provide for mechanisms for memory protection of virtual machines in a computer system. A method of the disclosure includes: determining a plurality of host latency times for a plurality of processor power states of a processor of a host computer system; comparing, by a hypervisor executed on the host computer system, each of the host latency times to a target latency time associated with a virtual machine running on the host computer system; mapping the plurality of processor power states to a plurality of host power states in view of the comparison; and providing the host power states to the virtual machine.

Abstract: Implementations for scheduling a sub-idle thread priority class are described. An example method may include assigning, by a scheduler of a computer system, a sub-idle execution priority class to a code optimization thread; responsive to determining that a central processing unit has been idle for at least a threshold period of time, running the code optimization thread; and generating, by the code optimization thread, an optimized code of a program executable by the computer system. The method may further execute the optimized code.

Abstract: A system and method for input/output communication is disclosed. In one embodiment, a device identifies a queue including a plurality of input/output (I/O) descriptors, each of the plurality of I/O descriptors representing one of: an active descriptor associated with an active I/O request or an executed descriptor that is associated with an executed I/O request. The device retrieves, from a first index in the queue, one or more active descriptors associated with an I/O request. The device executes the I/O request. The device writes a first executed descriptor to a second index in the queue, where the first executed descriptor indicates the I/O request has been executed.

Abstract: Systems and methods for memory management for nested virtual machines. An example method may comprise running, by a host computer system, a Level 0 hypervisor managing a Level 1 virtual machine running a Level 1 hypervisor, wherein the Level 1 hypervisor manages a Level 2 virtual machine, wherein the Level 2 virtual machine is associated with a Peripheral Component Interconnect (PCI) device; generating, by the Level 0 hypervisor, a Level 1 page table by combining records from the guest page table with records from a host page table maintained by the Level 0 hypervisor; generating a Level 2 page table comprising a plurality of Level 2 page table entries; and causing a device driver of the Level 2 virtual machine to use the Level 2 page table for second level address translation.

Abstract: Technology for performing data duplication on data that was previously consolidated (e.g., deduplicated or merged). An example method may involve receiving a request to modify a memory page; causing the data at a first storage location to be decrypted using location dependent cryptographic input and then encrypted using a location independent cryptographic input; copying the encrypted data of the memory page from the first storage location to a second storage location; causing the encrypted data at the first and second storage locations to be decrypted using location independent cryptographic input and to each be encrypted using a different location dependent cryptographic input; updating, by the supervisor, one of the references of the plurality of memory pages from pointing to the first storage location in the physical memory to pointing to the second storage location; and modifying the memory page by altering data in the physical memory.

Abstract: A system includes a memory including a plurality of rings, an endpoint associated with a ring of the plurality of rings, and a gateway. The gateway is configured to receive a notification from the endpoint regarding a packet made available in the ring associated with the endpoint, access the ring with an RDMA read request, retrieve the packet made available in the ring, and forward the packet on an external network.

Abstract: Systems and methods for supporting page faults for virtual machine network accelerators. In one implementation, a processing device may receive, at a network accelerator device of a computer system, a first incoming packet from a network. The processing device may select a first buffer from a plurality of buffers associated with the network device, and may attempt to store the first incoming packet at the first buffer. Responsive to receiving a notification that the attempt to store the first incoming packet at the first buffer caused a page fault, the processing device may store the first incoming packet at a second buffer. The processing device may receive a second incoming packet, and store the second incoming packet at the first buffer. The processing device may forward, to a driver of the network accelerator device, a first identifiers of the second buffer and a second identifier of the first buffer.

Abstract: Systems and methods for managing library-based memory deduplication are disclosed. In one implementation, a processing device may start a first instance of an application on a host computer system. Responsive to detecting that the first instance completed an initialization stage, the processing device may create a data structure referencing a first plurality of memory pages created by the first instance of the application. The processing device may further identify, among a second plurality of memory pages associated with the application, a first memory page. The processing device may also identify, among the first plurality of memory pages referenced by the data structure, a second memory page identical to the first memory page. The processing device may further modify a pointer referencing the first memory page to reference the second memory page and may release the first memory page.

Abstract: Systems and methods for memory management for virtual machines. An example method may include receiving, by a host computing system, a memory access request initiated by a peripheral component interconnect (PCI) device, wherein the memory access request comprises a memory address and an address translation flag specifying an address space associated with the memory address; and responsive to determining that the address translation flag is set to a first value indicating a host address space, causing a host system input/output memory management unit (IOMMU) to pass-through the memory access request.

Abstract: Systems and methods for virtual machine memory migration by storage are provided. A method includes receiving a request to migrate a virtual machine from a source host to a destination host. The method further includes mapping, by the source host, a memory of the virtual machine to a storage device accessible over a network by the source host and by the destination host. The method further includes caching, by the source host, a portion of a state of the virtual machine. The method further includes issuing a synchronization command to synchronize the portion of the state of the virtual machine with the storage device. Responsive to determining that a time period to complete the synchronization command is below a threshold time period, the method further includes stopping the virtual machine on the source host. The method further includes starting the virtual machine on the destination host.

Abstract: Systems and methods for supporting memory page fault handling for network devices are disclosed. In one implementation, a processing device may receive, at a network interface device of a host computer system, an incoming packet from a network. The processing device may also select a first buffer from a plurality of buffers associated with a receiving queue of the network interface device. The processing device may attempt to store the incoming packet at the first buffer of the plurality of buffers. Responsive to receiving a notification that attempting to store the incoming packet at the first buffer encountered a page fault, the processing device may assign the first buffer to a wait queue of the network interface device. The processing device may further store the incoming packet at a second buffer of the plurality of buffers associated with the receiving queue.

Abstract: A balloon memory fragmentation reduction system includes a memory, at least one processor in communication with the memory, a guest operating system (OS) including a device driver, and a hypervisor executing on the at least one processor. The hypervisor is configured to record an amount of memory allocated by the device driver of the guest OS, locate a contiguous region of guest memory addresses according to the amount of memory allocated by the device driver, reserve the contiguous region of guest memory addresses, and notify the guest OS that the contiguous region of guest memory addresses is reserved.

Abstract: A system includes a hypervisor, a memory, and boot firmware stored in the memory. The boot firmware is configured to execute on a processor to load a trusted code that includes a condition checker from the hypervisor, check a signature of the trusted code, and verify the signature is trusted by a guest. The boot firmware is also configured to load the trusted code into an encrypted memory at a known guest address. The hypervisor is configured to protect the known guest address. The trusted code includes a first instruction, one or more intermediate instructions, and a final instruction. The first instruction and the final instruction are exits to the hypervisor. The hypervisor is also configured to execute the condition checker and detect an inconsistency in guest memory.

Abstract: A hypervisor on a destination host receives a request to migrate a virtual machine (VM) from a source host to the destination host and determines a total amount of memory associated with the VM on the source host. The hypervisor on the destination host allocates one or more memory pages in a page table on the destination host to satisfy the total amount of memory associated with the VM on the source host, where the one or more memory pages are to be associated with the VM on the destination host. Responsive to determining that the one or more memory pages have been allocated on the destination host, the hypervisor on the destination host initiates migration of the VM from the source host to the destination host.

Abstract: Aspects of the disclosure provide for implementing host address space identifiers for non-uniform memory access (NUMA) locality in virtual machines. A method of the disclosure includes determining, by a virtual machine (VM) executed by a processing device and managed by a hypervisor, that a memory page of the guest is to be moved from a first virtual non-uniform memory access (NUMA) node of the VM to a second virtual NUMA node of the VM. The method further includes updating, by the VM in a guest page table, upper bits of a guest physical address (GPA) of the memory page to include a host address space identifier (HASID) of the second virtual NUMA node, and causing an execution control to be transferred from the VM to the hypervisor due to a page fault resulting from attempting to access the updated GPA.

Abstract: A system includes a memory including a plurality of memory pages, a processor in communication with the memory, and a supervisor. The supervisor is configured to locate at least two duplicate memory pages of the plurality of memory pages, write-protect the at least two duplicate memory pages, and add the at least two duplicate memory pages to a list. Responsive to a first page of the at least two duplicate memory pages changing, the supervisor is configured to remove the first page from the list. Responsive to a memory pressure-triggering event, the supervisor is configured to remove a second page of the at least two duplicate memory pages from the list. The second page is reused after removal from the list.