Abstract: A set of techniques is described for performing input/output (I/O) between a guest domain and a host domain in a virtualized environment. A pool of memory buffers is reserved for performing virtualized I/O operations. The reserved pool of memory buffers has static mappings that grant access to both the guest domain and the host domain. When a request to perform an I/O operation is received, the system can determine whether the memory buffers allocated to the I/O operation belong to the reserved pool. If the buffers are in the reserved pool, the host domain executes the I/O operation using the buffers without the need to map/unmap the buffers and perform TLB flushes. If the buffers are not in the reserved pool, the system can either copy the data into the reserved pool or perform the mapping and unmapping of the memory buffers to the address space of the host domain.

Abstract: Architectures and techniques for substantially maintaining performance of hyperthreads within processing cores of processors. One technique can include determining that a first thread is scheduled for execution on one of two or more hyperthreads, where the first instruction thread has a first priority. Such a technique also includes determining that a second instruction thread is one of executing or scheduled for execution on another of the two or more hyperthreads, where the second instruction thread has a second priority that is less than the first priority The technique can further include preempting execution of the second instruction thread based at least in part on the second instruction thread having the second priority that is less than the first priority.

Abstract: Processes and systems are disclosed for selecting a producer system from a number of producer systems to lease to a consumer system. A leasing agent, in response to a request from the consumer system for access to a service at a producer system, can identify a producer system to lease to the lease requestor based, at least in part, on a selection weight associated with each producer system that the leasing agent is assigned. The selection weights can be modified based on status information associated with each of the producer systems. This status information may be obtain from the producer systems and/or from a consumer system that has previously accessed the producer system. The consumer system may provide the status information to the leasing agent as part of the consumer system's lease request.

Abstract: Processes and systems are disclosed for leasing a producer virtual machine on behalf of a consumer virtual machine in an overlay network. The consumer host of the consumer virtual machine can communicate with a set of leasing agents to obtain the identity of a number of producer virtual machines capable of providing the consumer virtual machine with access to a service. When the consumer virtual machine attempts to communicate with a producer system, the consumer host can identify a producer host that hosts a target producer virtual machine and redirect a service request to the producer host.

Abstract: Approaches are described for reducing the number of memory address cache (e.g. TLB) flushes that need to be performed during the course of performing virtualized I/O. A device driver residing in a host domain registers a CPU that will be used for I/O processing and requests the hypervisor to pre-allocate a number of slots in the page tables to map memory pages during I/O operations. Upon receiving an I/O operation, when memory needs to be mapped, the driver provides the hypervisor with information about the registered CPU. The hypervisor uses the pre-allocated page table slots to create the new mapping and flushes the TLB cache corresponding to the CPU that will perform the I/O. The TLB cache belonging to other CPUs may not need to be flushed. The host driver ensures that the mapped memory page is used exclusively on the CPU or performs additional TLB flushes.

Abstract: High-speed processing of packets to, and from, a virtualization environment can be provided while utilizing hardware-based segmentation offload and other such functionality. A hardware vendor such as a network interface card (NIC) manufacturer can enable the hardware to support open and proprietary stateless tunneling in conjunction with a protocol such as single root I/O virtualization (SR-IOV) in order to implement a virtualized overlay network. The hardware can utilize various rules, for example, that can be used by the NIC to perform certain actions, such as to encapsulate egress packets and decapsulate packets.

Abstract: Technologies are described herein for regulating memory bandwidth usage in virtual machines via CPU scheduling. A virtual machine monitor (“VMM”) executing on a host computer detects excessive memory bandwidth usage by programs executing in a virtual machine on a processor of the host computer. The VMM may detect excessive memory bandwidth usage by monitoring cache-misses occurring in the processor, for example. Upon detecting excessive memory bandwidth usage, the VMM penalizes the virtual machine currently executing on the processor through the CPU-scheduling algorithm utilized to allocate processor time among the virtual machines.

Abstract: Systems and methods for managing imaging of computing devices are provided. A device image manager enables selection of one or more device images on the basis of various computing device criteria. The device image manager may obtain hardware qualification information associated with one or more device images, and obtain device configuration information associated with a computing device. The device image manager may select a set of appropriate device images for the computing device based on the hardware qualification information, device configuration information, or various device image selection criteria.

Abstract: In this disclosure, techniques are described for more efficiently sharing resources across multiple virtual machine instances. For example, techniques are disclosed for allowing additional virtual machine instances to be supported by a single computing system by more efficiently allocating memory to virtual machine instances by providing page swapping in a virtualized environment and/or predictive page swapping. In one embodiment, a virtual memory manager swaps pages predicatively in and/or out of a paging pool based on information from a central processing unit (“CPU”) scheduler. In one embodiment, the CPU scheduler provides scheduling information for virtual machine instances to the virtual memory manager, where the scheduling information allows the virtual memory manager to determine when a virtual machine is scheduled to become active or inactive. The virtual memory manager can then swap-in or swap-out memory pages.

Abstract: High-speed processing of packets to, and from, a virtualization environment can be provided while utilizing hardware-based segmentation offload and other such functionality. A hardware vendor such as a network interface card (NIC) manufacturer can enable the hardware to support open and proprietary stateless tunneling in conjunction with a protocol such as single root I/O virtualization (SR-IOV) in order to implement a virtualized overlay network. The hardware can utilize various rules, for example, that can be used by the NIC to perform certain actions, such as to encapsulate egress packets and decapsulate packets.

Abstract: Some embodiments facilitate high performance packet-processing by enabling one or more processors that perform packet-processing to determine whether to enter an idle state or similar state. As network packets usually arrive or are transmitted in batches, the processors of some embodiments determine that more packets may be coming down a multi-stage pipeline upon receiving a first packet for processing. As a result, the processors may stay awake for a duration of time in anticipation of an incoming packet. Some embodiments keep track of the last packet that entered the first stage of the pipeline and compare that with a packet that the processor just processed in a pipeline stage to determine whether there may be more packets coming that need processing. In some embodiments, a processor may also look at a queue length of a queue associated with an upstream stage to determine whether more packets may be coming.

Abstract: A system and method for performing address translation for packets entering or leaving a network. In some embodiments, a private network that may be fully or partially virtualized can use a stateless tunneling mechanism to communicate with external networks, such as the Internet, without using an external IP address for every host on the private network. For example, a packet forwarding device using a stateless Port Address Translation (PAT) implementation can route the packets subject to PAT by using forwarding rules rather than by storing connection-tracking state. Connection state information can be maintained at the hosts rather than at the packet forwarding device.

Abstract: Systems and methods for managing imaging of computing devices are provided. A device image manager enables selection of one or more device images on the basis of various computing device criteria. The device image manager may obtain hardware qualification information associated with one or more device images, and obtain device configuration information associated with a computing device. The device image manager may select a set of appropriate device images for the computing device based on the hardware qualification information, device configuration information, or various device image selection criteria.

Abstract: Various embodiments disclosed herein including systems and methods for improving allocation of computing resources in a virtual machine (VM) environment. Embodiments maintain data relating to how VM image data is stored in storage devices and loaded into volatile memory such as random access memory (RAM). The data is then used to identify common content in the volatile memory that can be shared across VM instances. In some embodiments, multiple VM instances can share at least a portion of a single common VM image loaded into a shared volatile memory.

Abstract: Some embodiments facilitate high performance packet-processing by enabling one or more processors that perform packet-processing to determine whether to enter an idle state or similar state. As network packets usually arrive or are transmitted in batches, the processors of some embodiments determine that more packets may be coming down a multi-stage pipeline upon receiving a first packet for processing. As a result, the processors may stay awake for a duration of time in anticipation of an incoming packet. Some embodiments keep track of the last packet that entered the first stage of the pipeline and compare that with a packet that the processor just processed in a pipeline stage to determine whether there may be more packets coming that need processing. In some embodiments, a processor may also look at a queue length of a queue associated with an upstream stage to determine whether more packets may be coming.

Abstract: Networking speed in a virtualized environment can be improved by utilizing an enhanced protocol and parallel stack to bypass restrictions of a conventional network stack that complies with standard networking protocols. In one embodiment, an enhanced TCP protocol enables large packets received from a guest application to bypass the guest networking stack and be received to a bottom conversion layer of the enhanced stack, which is able to segment the packet into appropriately sized segments that conform to the conventional protocol. These segments can be passed to a network interface card (NIC) or other device for encapsulation, framing, or other such processing to be transmitted to the destination as Ethernet frames or other such packets.

Abstract: Secure networking processes, such as packet encapsulation and decapsulation, can be executed upstream of a user or guest operating system provisioned on a host machine, where the user has substantially full access to that machine. The processing can be performed on a device such as a network interface card (NIC), which can have a separate network port for communicating with mapping systems or other devices across a cloud or secure network. A virtual image of the NIC can be provided to the user such that the user can still utilize at least some of the NIC functionality. In some embodiments, the NIC can work with a standalone processor or control host in order to offload much of the processing to the control host. The NIC can further handle headers and payload separately where possible, in order to improve the efficiency of processing the various packets.

Abstract: Systems and method for the management of migrations of virtual machine instances are provided. A migration manager monitors the resource usage of a virtual machine instance over time in order to create a migration profile. When migration of a virtual machine instance is desired, the migration manager schedules the migration to occur such that the migration conforms to the migration profile.

Abstract: Attempts to update confirmation information or firmware for a hardware device can be monitored using a secure counter that is configured to monotonically adjust a current value of the secure counter for each update or update attempt. The value of the counter can be determined every time the validity of the firmware is confirmed, and this value can be stored to a secure location. At subsequent times, such as during a boot process, the actual value of the counter can be determined and compared with the expected value. If the values do not match, such that the firmware may be in an unexpected state, an action can be taken, such as to prevent access to, or isolate, the hardware until such time as the firmware can be validated or updated to an expected state.

Abstract: Various embodiments disclosed herein including systems and methods for improving allocation of computing resources in a virtual machine (VM) environment. Embodiments maintain data relating to how VM image data is stored in storage devices and loaded into volatile memory such as random access memory (RAM). The data is then used to identify common content in the volatile memory that can be shared across VM instances. In some embodiments, multiple VM instances can share at least a portion of a single common VM image loaded into a shared volatile memory.