Abstract: Each program thread running on a computing device has an associated data stack and control stack. A stack displacement value is generated, which is the difference between the memory address of the base of the data stack and the memory address of the base of the control stack, and is stored in a register of a processor of the computing device that is restricted to operating system kernel use. For each thread on which return flow guard is enabled, prologue and epilogue code is added to each function of the thread (e.g., by a memory manager of the computing device). The data stack and the control stack each store a return address for the function, and when the function completes the epilogue code allows the function to return only if the return addresses on the data stack and the control stack match.

Abstract: Processing faults in a virtual computing environment. A method includes receiving a request to perform a memory access for a virtual machine. The method further includes identifying that that the memory access is unable to be performed without taking a fault. The method further includes identifying that a virtual fault can be taken to service the fault. The virtual fault is taken by servicing the fault asynchronously with respect to the virtual machine. The method further includes identifying that a virtual fault should be taken by evaluating criteria to weigh taking a virtual fault for servicing the fault asynchronously versus servicing the fault synchronously. As a result of identifying that a virtual fault should be taken, the method farther includes notifying the virtual machine that a virtual fault should be taken for the memory access. The method further includes servicing the fault asynchronously with respect to the virtual machine.

Abstract: A computing system includes one or more processors and a storage device that stores computer executable instructions that can be executed by the processors to cause the computing system to perform the following. The system generates a work tracking information ticket for a first system entity. The system assigns the work tracking information ticket to the first system entity. The system passes the work tracking information ticket to one or more second system entities. The system validates the work tracking information ticket. The validated work tracking information ticket informs that the one or more second system entities are performing work on behalf of the first system entity.

Abstract: Embodiments disclosed herein are related to systems and methods for attributing disk Input/Output (IO) to one or more system entities. A disk IO attribution context is generated that defines disk IO utilization parameters for a system entity. A pointer is attached to the system entity that points to the disk IO attribution context. The pointer is exposed to system components of an underlying computer system. The pointer prompts the system components to report the disk IO utilization parameters when the system components have performed a disk IO operation for the system entity. The disk IO utilization parameters reported by the one or more system components are recorded in the disk IO attribution context.

Abstract: An operating system running on a computing device, also referred to herein as a host device, uses containers for hardware resource partitioning. A container can include one or more of various different components, such as a base operating system, a user-mode environment, an application, virtual devices, combinations thereof, and so forth. One or more container templates are maintained for a computing device, and in response to a request to create a new container, a template container is copied into memory of the computing device to create the new container. The template container includes the various components of the container, and these components are copied into memory of the computing device rather than being launched or started one after the other. Thus, time need not be expended starting the various components included in the container—the components are just copied into memory as a new container.

Abstract: An operating system running on a computing device uses containers for hardware resource partitioning. Using the techniques discussed herein, pausing and resuming of containers is managed to reduce the pressure a container exerts on system resources when paused. Resuming of containers can further be managed to reduce the startup time for containers. This managing of containers can implemented various different techniques, such as stopping scheduling of virtual processors, stopping scheduling of processes or threads, compressing memory, swapping pages of memory for the container to a page file on a hard drive, and so forth.

Abstract: When a process is swapped out of memory, a record of the sharable memory pages of the process is maintained. The sharable memory pages can then be repurposed. When the process is subsequently swapped back into memory, concurrently with the process running the sharable memory pages of the process are prefetched. If during this prefetching the process requests a memory page that is not currently in physical memory, a high priority I/O request is issued for that memory page. The high priority I/O request is placed at the front of an I/O queue, so the high priority I/O request is processed before the pending prefetch requests.

Abstract: Mapping files in host virtual address backed virtual machines. A method includes receiving a request from a guest virtual machine for a file from a host. The method further includes, at the host determining that the file can be directly mapped to a physical memory location for virtual machines requesting access to the file. The method further includes, at the host, providing guest physical memory backed by the file flapping in host virtual memory.

Abstract: A memory manager in a computing device allocates memory to programs running on the computing device, the amount of memory allocated to a program being a memory commit for the program. When a program is in a state where the program can be terminated, the content of the memory pages allocated to the program is compressed, and an amount of the memory commit for the program that can be released is determined. This amount of memory commit is the amount that was committed to the program less any amount still storing (in compressed format) information (e.g., data or instructions) for the program. The determined amount of memory commit is released, allowing that amount of memory to be consumed by other programs as appropriate.

Abstract: A hybrid drive includes multiple parts: a performance part (e.g., a flash memory device) and a base part (e.g., a magnetic or other rotational disk drive). A drive access system, which is typically part of an operating system of a computing device, issues input/output (I/O) commands to the hybrid drive to store data to and retrieve data from the hybrid drive. The drive access system supports multiple priority levels and obtains priority levels for groups of data identified by logical block addresses (LBAs). The LBAs read while the device is operating in a power saving mode are assigned a priority level that is at least the lowest of the multiple priority levels supported by the device, increasing the likelihood that LBAs read while the device is operating in the power saving mode are stored in the performance part of the hybrid drive.

Abstract: Various systems and methods for translating operating system processes are described herein. In one example, a method includes intercepting a process of a foreign operating system through a proxy driver. The method can also include translating the process to a native operating system within which the foreign operating system is operating. Furthermore, the method can include sharing memory between the native operating system and the foreign operating system for translation.

Abstract: A set of memory pages from a working set of a program process, such as at least some of the memory pages that have been modified, are compressed into a compressed store prior to being written to a page file, after which the memory pages can be repurposed by a memory manager. The memory commit charge for the memory pages compressed into the compressed store is borrowed from the program process by a compressed storage manager, reducing the memory commit charge of the compressed storage manager. Subsequent requests from the memory manager for memory pages that have been compressed into a compressed store are satisfied by accessing the compressed store memory pages (including retrieving the compressed store memory pages from the page file if written to the page file), decompressing the requested memory pages, and returning the requested memory pages to the memory manager.

Abstract: A host machine having guest virtual machine physical memory backed by host virtual memory is described. The host machine includes host physical memory. The host machine further includes one or more guest virtual machines. Each of the guest virtual machines includes guest physical memory. The host machine further includes host virtual memory. The host machine further includes a data structure having a correlation of guest physical memory addresses to host virtual memory addresses and a data structure having a correlation of host virtual memory addresses to host physical memory addresses.

Abstract: A memory manager in a computing device allocates memory to programs running on the computing device, the amount of memory allocated to a program being a memory commit for the program. When a program is in a state where the program can be terminated, the content of the memory pages allocated to the program is compressed, and an amount of the memory commit for the program that can be released is determined. This amount of memory commit is the amount that was committed to the program less any amount still storing (in compressed format) information (e.g., data or instructions) for the program. The determined amount of memory commit is released, allowing that amount of memory to be consumed by other programs as appropriate.

Abstract: A hybrid drive includes multiple parts: a performance part (e.g., a flash memory device) and a base part (e.g., a magnetic or other rotational disk drive). A drive access system, which is typically part of an operating system of a computing device, issues input/output (I/O) commands to the hybrid drive to store data to and retrieve data from the hybrid drive. The drive access system assigns, based on various available information, a priority level to groups of data identified by logical block addresses (LBAs). With each I/O command, the drive access system includes an indication of the priority level of the LBA(s) associated with the I/O command. The hybrid drive determines, based on the priority level indications received from the drive access system, which LBAs are stored on which part or parts of the hybrid drive.

Abstract: Techniques for memory image capture via memory write from a running system are described. In at least some embodiments, a request is received for an image of a portion of memory. Images of memory can be used for a variety of purposes, such as diagnosing and repairing error conditions for hardware and/or software, detecting unwanted and/or malicious processes (e.g., malware), general systems maintenance, and so forth. According to one or more embodiments, various techniques can be implemented to capture an image of a portion of memory. For example, an intermediate write to memory can be employed to write the image of the portion of memory to a memory buffer. Alternatively or additionally, an image of a portion of memory can be captured directly to storage.

Abstract: A hybrid drive includes multiple parts: a performance part (e.g., a flash memory device) and a base part (e.g., a magnetic or other rotational disk drive). A drive access system, which is typically part of an operating system of a computing device, issues input/output (I/O) commands to the hybrid drive to store data to and retrieve data from the hybrid drive. The drive access system assigns, based on various available information, a priority level to groups of data identified by logical block addresses (LBAs). With each I/O command, the drive access system includes an indication of the priority level of the LBA(s) associated with the I/O command. The hybrid drive determines, based on the priority level indications received from the drive access system, which LBAs are stored on which part or parts of the hybrid drive.

Abstract: When a process is swapped out of memory, a record of the sharable memory pages of the process is maintained. The sharable memory pages can then be repurposed. When the process is subsequently swapped back into memory, concurrently with the process running the sharable memory pages of the process are prefetched. If during this prefetching the process requests a memory page that is not currently in physical memory, a high priority I/O request is issued for that memory page. The high priority I/O request is placed at the front of an I/O queue, so the high priority I/O request is processed before the pending prefetch requests.

Abstract: A set of memory pages from a working set of a program process, such as at least some of the memory pages that have been modified, are compressed into a compressed store prior to being written to a page file, after which the memory pages can be repurposed by a memory manager. The compressed store is made up of multiple memory pages, and the compressed store memory pages can be repurposed by the memory manager after being written to the page file. Subsequent requests from the memory manager for memory pages that have been compressed into a compressed store are satisfied by accessing the compressed store memory pages (including retrieving the compressed store memory pages from the page file if written to the page file), decompressing the requested memory pages, and returning the requested memory pages to the memory manager.

Abstract: A system described herein includes a receiver component that receives an indication that at least one page in virtual memory is free and the at least one page in virtual memory is classified as short-lived memory, wherein the virtual memory is accessible to at least one virtual machine executing on a computing device. The system also includes a cache updater component that dynamically updates a cache to include the at least one page, wherein the cache is accessible to the at least one virtual machine.