Abstract: A host in a virtualization system pings one or more storage domains. When the host determines that a storage domain in inaccessible and later determines that the storage domain is once again accessible, the host may determine a set of virtual machines associated with the storage domain that are paused. The host may, then, resume at least one of those virtual machines.

Abstract: A method of managing a database including creating an initial counting bloom filter (CBF) instance having an array of counters and hash functions that map an inserted value to the array of counters, and designating the initial CBF instance as a current CBF instance, and sequentially inserting each value of a sample data set of a table column into the hash functions of the current CBF instance and incrementing counters of the array of counters to which the value is mapped. The method further includes, prior to inserting each value into the hash functions of the current CBF instance, when a number of counters of the array of counters having non-zero values is at least at a threshold level, designating the current CBF instance as an old CBF instance, creating a new CBF instance having an array of counters and hash functions that map an inserted value to the array counters, and designating the new CBF instance as the current CBF instance.

Abstract: Using stored information about the compilation environment during compilation of a code segment to improve performance of just-in-time compilers. A set of characteristic(s) of a compilation environment is measured during compilation of a code segment. Information that may be relevant to how the compilation is performed is derived from at least one of the measured characteristics and stored in a persistent storage device. Upon a subsequent request to compile that code segment, the information is retrieved and used to change compilation behavior. The set of characteristic(s) relate to at least either compilation backlog or peak memory usage. The changed compilation behavior involves at least adjusting the scheduling of the subsequent compilation request or adjusting the compiler optimization level.

Abstract: Standard nested virtualization allows a hypervisor to run other hypervisors as guests, i.e. a level-0 (L0) hypervisor can run multiple level-1 (L1) hypervisors, each of which can run multiple level-2 (L2) virtual machines (VMs), with each L2 VM is restricted to run on only one L1 hypervisor. Span provides a Multi-hypervisor VM in which a single VM can simultaneously run on multiple hypervisors, which permits a VM to benefit from different services provided by multiple hypervisors that co-exist on a single physical machine. Span allows (a) the memory footprint of the VM to be shared across two hypervisors, and (b) the responsibility for CPU and I/O scheduling to be distributed among the two hypervisors. Span VMs can achieve performance comparable to traditional (single-hypervisor) nested VMs for common benchmarks.

Abstract: Systems and methods for virtual machine based huge page balloon support are provided. A guest operating system (OS) receives a request from a hypervisor for guest memory to be made available to a host operating system (OS). The guest OS further receives a huge page size of a host page and a quantity of requested guest memory. The guest OS then allocates unused guest memory and transmits at least one address of the allocated guest memory to the hypervisor, where the allocated guest memory is a contiguous block of memory that is at least the size of the huge page size and aligned to the size of the huge page size.

Abstract: Systems, methods, and software described herein facilitate the allocation of large scale processing jobs to host computing systems. In one example, a method of operating an administration node to allocate processes to a plurality of host computing systems includes identifying a job process for a large scale processing environment (LSPE), and identifying a data repository associated with the job process. The method further includes obtaining data retrieval performance information related to the data repository and the host systems in the LSPE. The method also provides identifying a host system in the host systems for the job process based on the data retrieval performance information, and initiating a virtual node for the job process on the identified host system.

Abstract: A migration system includes a memory, a physical processor, first and second hypervisors, first and second virtual machines, and first and second networking devices. The first hypervisor is located at a migration source location and the second hypervisor is located at a migration destination location. The first virtual machine includes a guest OS which includes a first agent. The second virtual machine includes the guest OS which includes a second agent. The first hypervisor is configured to request the guest OS executing on the first hypervisor to copy a configuration of the first networking device and to store the configuration in a place-holder networking device. The second hypervisor is configured to start the second virtual machine at a destination location, request the guest OS executing on the second virtual machine to copy the configuration from the place-holder networking device and to store the configuration in the second networking device.

Abstract: Techniques are disclosed for maintaining high availability (HA) for virtual machines (VMs) running on host systems of a host cluster, where each host system executes a HA module in a plurality of HA modules and a storage module in a plurality of storage modules, where the host cluster aggregates, via the plurality of storage modules, locally-attached storage resources of the host systems to provide logical data store, and where persistent data for the VMs is stored across the locally-attached storage resources comprising the logical data store.

Abstract: A system and method for managing images in a cloud including providing a uniform image management interface for receiving from a user uniform image descriptions for building images in a cloud, and receiving a uniform image description for building an image from the user. The uniform image description is provided to an application to create a cloud-specific image description to provide to an image builder for building the image, and the uniform image description is stored in a local data store.

Abstract: A cloud-based storage server is interfaced with one or more storage devices that store shared content accessible over a network by two or more users. A virtual file system module is delivered to a user device associated with the users. The virtual file system module provides file access facilities that are not available by either the file system on the user device or the file system on the storage server. A virtual file system cache system manager allocates multiple local memory areas on a user device. The multiple local memory areas are managed differently under multiple cache regimes. The management of the cache regime spaces depend from a set of cache access response directives that serve to direct cache management operations pertaining to the movement of data blocks to and/or from the multiple cache regimes. One cache regime space stores shared data that can be used in an offline mode.

Abstract: In case of network isolation of a host executing one or more virtual machines, the state of the one of more virtual machines is saved using a variety of isolation response mechanisms. Isolation responses may include a live migration to another host using a shared storage system connected to both hosts, a virtual machine suspend and resume operation, and a snapshot reversion operation. The execution state of the virtual machine(s) running on the isolated host, which includes the state of the guest operating system and any running applications, are maintained in the other host, even after host isolation has occurred.

Abstract: Method, system, and computer program product for dynamic address translation for a virtual machine are disclosed. The method includes obtaining a memory portion from a memory space, in response to a request for building a shadow dynamic address translation table, wherein the memory space is allocated for at least one guest operation system and wherein the shadow dynamic address translation table includes a mapping between at least one guest logic memory address and at least one host physical memory address. The method further includes building the shadow dynamic address translation table and storing the shadow dynamic address translation table in the memory portion.

Abstract: Systems, methods, and computer programs are disclosed for detecting high-level functionality of an application executing on a computing device. One method comprises storing, in a secure memory on a computing device, a virtual address mapping table for an application. The virtual address mapping table comprises a plurality of virtual addresses in the application binary code mapped to corresponding target application functionalities. The application is registered with a high-level operating system (HLOS). During execution of the application binary code, the HLOS detects when one or more of the virtual addresses corresponding to the target application functionalities are executed based on the virtual address mapping table.

Abstract: A method of initializing a secondary processor pursuant to a soft reboot of system software comprises storing code to be executed by the secondary processor in memory, building first page tables to map the code into a first address space and second page tables to identically map the code into a second address space, fetching a first instruction of the code based on a first virtual address in the first address space and the first page tables, and executing the code beginning with the first instruction to switch from the first to the second page tables. The method further comprises, fetching a next instruction of the code using a second virtual address, which is identically mapped to a corresponding machine address, turning off a memory management unit of the secondary processor, and executing a waiting loop until a predetermined location in the physical memory changes in value.

Abstract: Embodiments relate to an intra-level privilege separation method for managing system software on an ARM processor, including dividing the system software into an inner domain and an outer domain having different privilege levels, determining whether to permit the access to a memory region of the inner domain based on the type of domain that is currently in control among the inner domain and the outer domain, setting the memory region of the inner domain outside of valid virtual address range when the outer domain is in control, and setting memory regions of the inner domain and the outer domain inside of valid virtual address range when the inner domain is in control.

Abstract: Systems and methods for discovering changes of network interface controller (NIC) names are disclosed. An example method may comprise receiving new network configuration data comprising first network interface controller (NIC) configuration data for a NIC device that is identified by a permanent identifier (ID), identifying the permanent ID of the NIC device in current network configuration data comprising second NIC configuration data for the NIC device, responsive to a first NIC name corresponding to the permanent ID in the new network configuration data being different than a second NIC name corresponding to the permanent ID in the current network configuration data, updating, by a processing device, the first NIC configuration data in the new network configuration data to be the same as the second NIC configuration data, and saving, by the processing device, the updated new network configuration data as the current network configuration data.

Abstract: An information pushing method and apparatus, and a terminal and server are provided. The method includes: acquiring a key frame of a currently-played video; acquiring an characteristic value of the key frame according to picture information of the key frame; acquiring, according to the characteristic value of the key frame, pushing information corresponding to the characteristic value; and displaying the pushing information in a process of playing the currently-played video. After the key frame of the currently-played video is acquired, the characteristic value of the key frame is acquired according to the picture information of the key frame, and the pushing information corresponding to the characteristic value is acquired according to the characteristic value of the key frame, so as to display the pushing information in the process of playing the currently-played video.

Abstract: A method and apparatus for providing an operating system based on a lightweight hypervisor. An electronic device includes a hypervisor, an operating system monitor, and a virtualized operating system. The hypervisor enables the virtualized operating system and a physical machine to share the resources of the physical machine. If the virtualized operating system accesses the resource, the operating system monitor determines whether to allow the access to the resource. Also, the operating system monitor verifies the integrity of the virtualized operating system and determines whether a threat to the virtualized operating system exists.

Abstract: Mail server migration. For each mailbox, a migration utility is started on a target server to get a list of message IDs that have already been migrated. The command “list-message-ids” is executed. The migration utility is started on the source server in a backup mode. The “backup” command is executed. Then, the migration utility is started on the target server in a restore mode. A “restore” command is executed. The migration utility on the source server provides mail messages to a standard output. The migration utility on the target server accepts mail messages on the standard input and restores them. An RPC agent transfers data via TCP once it gets it from the migration utility on the source server. The migration module receives data from the RPC agent and puts data to the standard input of the migration utility on the target server as soon as it receives it.

Abstract: An apparatus including a physical memory partitioned into areas, a flag storage unit to store flags wherein a flag is set as indicating an area being updated when storage information stored in the area is updated, the area being associated with the flag, and a processor. The processor executes a first process of recording, when any fault does not occur, storage information stored in a first area to a recording device, the first area being associated with a first flag indicating the first area being updated, a process of saving, in a saving device, the storage information stored in the first area, and clearing the first flag so as to indicate the first area not being updated, and a second process of recording, to the recording device, storage information stored in a second area associated with a second flag indicating being updated when the fault occurs.

Abstract: A virtual trusted platform module function implementation method is provided, the method is executed at an exception level EL3 of a processor that uses an ARM V8 architecture, and the method includes: generating, according to requirements of one or more VMs, one or more vTPM instances corresponding to each VM, and storing the generated one or more vTPM instances in preset secure space, where each vTPM instance has a dedicated instance communication queue for a VM corresponding to itself to use, and a physical address is allocated to each instance communication queue; and interacting with a VMM and the VM, so that the VM acquires a VM communication queue virtual address, in VM virtual address space, corresponding to a communication queue physical address of the vTPM instance, and the VM communicates with a vTPM instance communication queue by using the VM communication queue virtual address.

Abstract: A virtual machine cache provides for maintaining a working set of the cache during a transfer between virtual machine hosts. In response to a virtual machine transfer, the previous host of the virtual machine is configured to retain cache data of the virtual machine, which may include both cache metadata and data that has been admitted into the cache. The cache data may be transferred to the destination host via a network (or other communication mechanism). The destination host populates a virtual machine cache with the transferred cache data to thereby reconstruct the working state of the cache.

Abstract: A chat messaging service provided for a chat user is migrated. At a second chat server from a first chat server, static information associated with a chat user is received. At the second chat server from the first chat server, dynamic information associated with the chat user is received. At least a portion of the dynamic information is received after the chat user is indicated as being associated with the migration state. After the chat user is no longer indicated as being associated with the migration state, a chat message for the chat user is received at the second chat server.

Abstract: Methods, systems, computer-readable media, and apparatuses for performing, providing, managing, executing, and/or running a spatially-optimized simulation are presented. In one or more embodiments, the spatially-optimized simulation may comprise a plurality of worker modules performing the simulation, a plurality of entities being simulated among the plurality of worker modules, a plurality of bridge modules facilitating communication between workers and an administrative layer including a plurality of chunk modules, at least one receptionist module, and at least one oracle module. The spatially-optimized simulation may be configured to provide a distributed, persistent, fault-tolerate and spatially-optimized simulation environment. In some embodiments, load balancing and fault tolerance may be performed using transfer scores and/or tensile energies determined among the candidates for transferring simulation entities among workers.

Abstract: The systems described herein are configured to enhance the efficiency of memory in a host file system with respect to hosted virtual file systems. In situations when the hosted virtual file systems use smaller file block sizes than the file block sizes of the host file system. During storage of a file, a file block is assigned a block address and unmapping bits. The block address and unmapping bits are stored in a pointer block or other similar data structure associated with the file. Particularly, the block address is stored in a first address block and the unmapping bits are stored in at least one additional address block located in proximity to the block address, such that the unmap granularity of the file is not limited by the fixed size of address blocks in the system.

Abstract: Embodiments of an invention for virtualization exceptions are disclosed. In one embodiment, a processor includes instruction hardware, control logic, and execution hardware. The instruction hardware is to receive a plurality of instructions, including an instruction to enter a virtual machine. The control logic is to determine, in response to a privileged event occurring within the virtual machine, whether to generate a virtualization exception. The execution hardware is to generate a virtualization exception in response to the control logic determining to generate a virtualization exception.

Abstract: A snapshot analysis system analyzes a plurality of data snapshots taken in connection with data stored on a block device allocated by a data storage system. The snapshot analysis system may include an ingestor capable of initially detecting new snapshots and adding a root node for the snapshots. The system may include a block device analyzer that analyzes each snapshot to determine its contents, the relationship within data structures extant within the snapshot, and the snapshot's relationship to other snapshots and/or that of other block devices. The system may also include a clustering analyzer capable of determining whether snapshots are associated with multipart block devices, such as LVM or MD RAID devices. The system may further include a block device emulator that exposes data associated with a given snapshot as an addressable block device without necessitating retrieval or exposure of the full block device to which the snapshot is associated.

Abstract: VDI sessions and virtualized devices can be prioritized in Software-Defined Networks. A server-side agent can communicate with a management server to provide VDI session details indicative of how the VDI session is being employed. The management server can then update a flow table in a Software-Defined Network based on the VDI session details. In this way, the network traffic pertaining to a VDI session can be prioritized based on how the VDI session is being used. A flow table can also be updated in conjunction with commencing or completing an imaging process.

Abstract: Technologies are provided for automatically performing multiple integrated circuit implementation runs with variations of input design constraints. Input design constraints can be automatically adjusted to create multiple modified versions of the design constraints. The multiple modified design constraints can be used to perform separate integrated circuit implementation runs for a given circuit design. Results of the multiple implementation runs can be analyzed, and a circuit implementation report can be generated based on the results of the runs performed with the various modified design constraints. In some embodiments, a circuit implementation recommendation can be generated based on the implementation run results. In at least some scenarios, the multiple implementation runs can be performed using multiple synthesis and implementation processes. The multiple synthesis and implementation processes can be distributed across one or more host computing devices.

Abstract: Selective purging of entries of structures associated with address translation. A request to purge entries of a structure associated with address translation is obtained. Based on obtaining the request, a determination is made as to whether selective purging of the structure associated with address translation is to be performed. Based on determining that selective purging is to be performed, one or more entries of the structure associated with address translation are purged. The selectively purging includes clearing the one or more entries of the structure associated with address translation for a host of the computing environment and leaving one or more entries of one or more guest operating systems in the structure associated with address translation. The one or more guest operating systems are managed by the host.

Abstract: An apparatus includes a first processor to execute a user-level application to operate in a virtual address, and a co-processor to execute a computing kernel associated with user-level application elements to be performed on the co-processor. The computing kernel is to operate in the virtual address. A memory includes physical addresses, and a partition used to map the virtual address associated with the first processor and to map the virtual address associated with the co-processor. A packet processor manages communications between the first processor and the co-processor. The packet processor receives packets from the first processor, with the packets including memory addresses identifying code and data of the computing kernel. The packet processor stores the packets in a queue associated with the user-level application, and outputs the packets to the co-processor, such that the co-processor is enabled to execute the computing kernel.

Abstract: A system for executing a workload that includes a plurality of transactions for a first time slot determines whether a metered cloud service has a sufficient quota of operations available to execute respective metered transactions. For the first time slot, the system determines whether a non-metered cloud service has a sufficient processing load to execute respective non-metered transactions. The system executes the plurality of transactions during the first time slot when each metered cloud service has the sufficient quota and each non-metered cloud service has the sufficient processing load. Further, the system waits to execute the plurality of transactions of the workload during a time slot subsequent to the first time slot when any of the metered cloud services does not have the sufficient quota or any of the non-metered cloud services does not have a sufficient processing load.

Abstract: Example methods are described to provide fault tolerance for a container in a virtualized computing environment that includes a first virtual machine and a second virtual machine. The method may comprise detecting a failure at the first virtual machine. The container may be supported by the first virtual machine to run an application on a first operating system of the first virtual machine. The method may further comprise providing data relating to the container to the second virtual machine; and based on the data relating to the container, resuming the container in the second virtual machine to run the application on a second operating system of the second virtual machine.

Abstract: A hypervisor generates first and second page views, where a guest physical address points to a first page of the first page view and a second page of the second page view. A first pointer value is written to the first page and a second pointer value is written to the second page. A guest operating system executes a first task and if a determination to switch to the second task is made, the guest operating system reads a current pointer value and determines what the current page view is. If the guest operating system determines that the current page view is the first page view, the guest operating system saves the first pointer value in a first memory of the first task, loads the second pointer value from a second memory of the second task, and executes a virtual machine function to switch to the second page view.

Abstract: A table walker receives, from a requesting entity, a request to translate a first address into a second address associated with a page of memory. During a corresponding table walk, when a lock indicator in an entry in a reverse map table (RMT) for the page is set to mark the entry in the RMT as locked, the table walker halts processing the request and performs a remedial action. In addition, when the request is associated with a write access of the page and an immutable indicator in the entry in the RMT is set to mark the page as immutable, the table walker halts processing the request and performs the remedial action. Otherwise, when the entry in the RMT is not locked and the page is not marked as immutable for a write access, the table walker continues processing the request.

Abstract: A method includes a trusted component of a host computing system, obtaining, from a client, via a hypervisor of the host, a request to run an instance of a guest image within the hypervisor. The request includes a unique identifier of the guest image, contents of the guest image, and a communication key. The request is encrypted with a request key accessible to the owner and the trusted component and not accessible to the hypervisor. The trusted component generates an authorization request to an authorizing entity of the client requesting authorization for the hypervisor to run the instance. The authorization request includes the unique identifier, a use counter, and a unique challenge. The trusted component encrypts the authorization request with the communication key and communicates the authorization request to the authorizing entity, via the hypervisor.

Abstract: According to one embodiment, a hardware-based processing node of a plurality of hardware-based processing nodes in an object memory fabric can comprise a memory module storing and managing a plurality of memory objects in a hierarchy of the object memory fabric. Each memory object can be created natively within the memory module, accessed using a single memory reference instruction without Input/Output (I/O) instructions, and managed by the memory module at a single memory layer. The object memory fabric can distribute and track the memory objects across the hierarchy of the object memory fabric and the plurality of hardware-based processing nodes on a per-object basis. Distributing the memory objects across the hierarchy of the object memory fabric and the plurality of hardware-based processing nodes can comprise storing, on a per-object basis, each memory object on two or more nodes of the plurality of hardware-based processing nodes of the object memory fabric.

Abstract: Methods and apparatus for post data synchronization in live migration of domains. Host devices on a network may implement virtual machines (VMs) as domains in an execution environment, and may provide local persistent storage for data of the VMs. A migration technique for moving a domain including the persistent data from one host device to another host device is described in which the VM is instantiated on the target device, and the domain is switched to the target device. Synchronization of the VM's data from the persistent storage on the source device to the target device is then initiated, for example according to a distributed replicated storage technique that makes the target device's persistent storage the primary storage and the source device's persistent storage the secondary storage for the VM. Once the data is synchronized, the VM and its respective storage on the source device are released.

Abstract: Management of storage used by pageable guests of a computing environment is facilitated. A query instruction is provided that details information regarding the storage location indicated in the query. It specifies whether the storage location, if protected, is protected by host-level protection or guest-level protection.

Abstract: One embodiment provides an apparatus. The apparatus includes a linear address space, metadata logic and enhanced address space layout randomization (ASLR) logic. The linear address space includes a metadata data structure. The metadata logic is to generate a metadata value. The enhanced ASLR logic is to combine the metadata value and a linear address into an address pointer and to store the metadata value to the metadata data structure at a location pointed to by a least a portion of the linear address. The address pointer corresponds to an apparent address in an enhanced address space. A size of the enhanced address space is greater than a size of the linear address space.

Abstract: An example method of preserving a modification to an internal state of a computer system includes applying an overlay on a target container. The overlay includes a set of events corresponding to a first set of modifications to a computer system. The method also includes after applying the overlay, receiving a set of user requests corresponding to a second set of modifications to the computer system. The method further includes changing, based on the set of user requests, the third set of internal states of the computer system to the fourth set of internal states. The method also includes removing the overlay from the target container, while preserving the second set of modifications to the computer system.

Abstract: Applications may request persistent storage in nonvolatile memory. The persistent storage is maintained across power events and application instantiations. Persistent storage may be maintained by systems with or without memory management units.

Abstract: Embodiments relate to application-level processor parameter management. An aspect includes granting, by a hypervisor of a computer system, access to an operating parameter of a processor of the computer system to an application that is running on the computer system. Another aspect includes, based on the granting of access to the operating parameter, receiving, by an optimization function in the computer system from the application, a request to adjust the operating parameter. Another aspect includes determining an adjusted value for the operating parameter during execution of the application. Another aspect includes setting the operating parameter to the adjusted value in a parameter register of the processor. Another aspect includes executing the application according to the parameter register by the processor.

Abstract: An information processing device includes a processor that executes a process. The process includes: identifying a cause of a shift from non-privileged mode to privileged mode that has occurred in processing by a guest program in an upper level virtual machine in a nested virtualization environment in which a first level virtual machine monitor operates in privileged mode, and an upper level virtual machine monitor and the guest program operate in non-privileged mode; and when the identified cause is setting or updating a virtual translation table employed in a virtual translation mechanism provided to the guest program by virtualizing an address translation mechanism for hardware that uses a set translation table to translate addresses of DMA by an input/output device assigned to the upper level virtual machine, setting the translation table employed by the translation mechanism based on a correspondence relationship between guest memory space and host memory space.

Abstract: A system for enabling input/out virtualization for a device is disclosed. In one embodiment, the system includes a plurality of host CPUs; a multi-root switch connected to each of the plurality of host CPUs via respective buses; and an inline PCI virtualizing device connected to the multi-root switch via a front-side bus and the device via a back-side bus, the inline PCI virtualizing device including a plurality sets of registers, each of the plurality sets of registers accessible by a corresponding host CPU of the plurality of host CPUs and implementing functionalities of the device.

Abstract: A method and system for monitoring a virtual machine cluster comprising sending, by physical machine, state parameter query instruction to a virtual machine in the virtual machine cluster at a first preset time interval; sending response information to the physical machine in response to receiving the query; the physical machine determining that the virtual machine is faulty, in response to the response information beyond a second preset time, judging whether the faulty machine satisfies a restart condition, and sending a restart instruction to a second machine on which the faulty machine runs, if the faulty machine satisfies the restart condition, by the virtual machine; and restarting, the second physical machine, the faulty virtual machine according to the restart instruction. The disclosure can be used to monitor virtual machines and recover a faulty virtual machine, thereby improving the availability of the virtual machine cluster and shortening service intervals.

Abstract: Techniques for implementing trapless shadow page tables in a virtualized host system are provided. In one embodiment, an SPT accelerator device of the host system can intercept a memory write operation originating from a virtual machine (VM) and directed to a guest OS page table of the VM, where the guest OS page table is stored in a device memory of the SPT accelerator device. The SPT accelerator device can further extract a guest virtual address (GVA)-to-guest physical address (GPA) mapping in the memory write instruction and can translate the GVA-to-GPA mapping into a GVA-to-host physical address (HPA) mapping. The SPT accelerator device can then write the GVA-to-HPA mapping to a shadow page table of the host system.

Abstract: Systems, methods, apparatuses, and software for data storage systems are provided herein. In one example, a data storage assembly is provided that includes a plurality of storage drives each comprising a PCIe host interface and solid state storage media. The data storage assembly includes a PCIe switch circuit coupled to the PCIe host interfaces of the storage drives and configured to receive storage operations issued by one or more host systems over a shared PCIe interface and transfer the storage operations for delivery to the storage drives over selected ones of the PCIe host interfaces. The data storage assembly includes a control processor configured to monitor usage statistics of the storage drives, and power control circuitry configured to selectively remove the power from ones of the storage drives based at least on the usage statistics of the storage drives.

Abstract: One embodiment of the present invention provides a system for managing storage space in a mobile device. During operation, the system detects a decrease in available disk space in a host file system, wherein an image file for a guest system is stored in the host file system. In response to the detected decrease, the system increases a size of a balloon file in a storage of a guest system. The system then receives an indication of a TRIM or discard communication and intercepts the TRIM or discard communication. Next, the system determines that at least one block is free based on the intercepted TRIM or discard communication. Subsequently, the system frees a physical block corresponding to the at least one block in a storage of the host system and reduces a size of the image file for the guest system in accordance with the intercepted TRIM or discard communication.

Abstract: A system for executing code with blind hypervision mechanism comprises: at least one addressable physical memory, a processor operating in at least two modes, a mode termed initialization making it possible to define at least one partition in the memory and at least one second mode termed nominal, a memory bus linking the processor to the memory, a memory partitioning unit positioned on the memory bus, the unit being adapted for restricting memory access to the partition currently executing when the processor is in a mode other than the initialization mode.