Abstract: A data storage architecture is composed of an array of a flash memory solid state disk and a hard disk drive or any nonvolatile random access storage that are intelligently coupled by an intelligent processing unit such as a multi-core graphic processing unit. The solid state disk stores seldom-changed and mostly read reference data blocks while the hard disk drive stores compressed deltas between currently accessed I/O blocks and their corresponding reference blocks in the solid state disk so that random writes are not performed on the solid state disk during online I/O operations. The solid state disk and hard disk drive are controlled by the intelligent processing unit, which carries out high speed computations including similarity detection and delta compression/decompression.

Abstract: Techniques to prelink software to improve memory de-duplication in a virtual system are described. An apparatus may comprise a processor circuit, a memory unit coupled to the processor circuit to store private memory pages for multiple virtual machines, and a dynamic linker application operative on the processor circuit to link a binary version of a software program with associated program modules at run-time of the binary version on a virtual machine. The dynamic linker application may comprise a master prelink component operative on the processor circuit to relocate a first set of program modules for a first binary version of the software program for a first virtual machine using a first set of virtual memory addresses from a first private memory page allocated to the first virtual machine, and store relocation information for the first set of program modules in a global prelink layout map for use by a second virtual machine. Other embodiments are described and claimed.

Abstract: A lightweight technique for sharing memory pages within a virtual machine (VM) is provided. This technique can be used on its own to implement intra-VM page sharing or it can be augmented with sharing across VMs. Memory pages whose content can be described by some succinct grammar, such as a regular expression or simple pattern, are identified for sharing within a VM. If the content of a page matches some simple pattern, it is proposed to share such a page, but only in the scope of the VM to which it belongs, i.e., intra-VM sharing. All other pages, i.e., those that are not simple patterns, can be candidates for sharing in the scope of all currently active VMs, i.e., inter-VM sharing. Either fully functional page sharing across VMs and/or page sharing in the context of each VM can be implemented.

Abstract: A method used by a virtual machine in communication with an external machine includes providing a single sharing page that is shared between a plurality of virtual machines and a particular virtual machine, wherein the particular virtual machine and the plurality of virtual machines run on a same physical machine; writing into the single sharing page a data packet to be sent by the virtual machine to the external machine; scheduling a page swap between the single sharing page and a blank memory page of the particular virtual machine; and sending, to the external machine, the data packet in the memory page of the particular virtual machine subsequent to the page swap.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for measuring virtual machine metrics. In one aspect, a method includes initializing a virtual machine, the virtual machine being associated with virtual hardware comprising a virtual metrics device, the virtual metrics device being configured to report values of a virtual machine metric that measures the performance of the virtual machine; receiving data identifying the virtual machine metric and a virtual machine memory address to which the virtual machine writes values of the virtual machine metric; reading one or more values of the virtual machine metric from the virtual machine memory address; and generating a report based on the one or more metric values.

Abstract: In an environment in which a processor operates a hypervisor and multiple guest partitions operating under the hypervisor's control, it is desirable to allow a guest partition access to a physical memory device without decreasing system performance. Accordingly, a conversion instruction for converting a logical address to a real address, i.e., an LTOR instruction, executable from a guest partition, is added to the processor. Upon the guest partition's execution of the conversion instruction with the logical address specified, the processor converts the logical address to an encrypted real address, and returns it to the guest partition. The guest partition is then able to pass the encrypted real address to an accelerator that converts the encrypted real address to a real address in order to access the memory device using the real address.

Abstract: Mitigating eviction of the memory pages of virtualized machines. Upon detecting that a request to perform an I/O operation has been issued against a block stored a disk, a determination is made as to whether a pristine copy of the contents of the block is stored in memory. If a pristine copy of the contents of the block is stored in memory, then the request may be performed by updating mapping data that maps a page of memory to a location in memory at which the pristine copy is stored. In this way, the request is performed without performing the I/O operation against the block stored on disk. Various approaches for resharing memory, including memory of a template virtual machine, are discussed.

Abstract: Embodiments of an invention for controlling access to groups of memory pages in a virtualized environment are disclosed. In one embodiment, a processor includes a virtualization unit and a memory management unit. The virtualization unit is to transfer control of the processor to a virtual machine. The memory management unit is to perform, in response to an attempt to execute on the virtual machine an instruction stored on a first page, a page walk through a paging structure to find a second page and to allow access to the second page without exiting the virtual machine based at least in part on a bit being set in a leaf level entry corresponding to the second page in the paging structure and a corresponding bit being set in each entry corresponding to the first page in each level of the paging structure.

Abstract: A non-transitory computer-readable storage medium may comprise instructions for managing a server template stored thereon. When executed by at least one processor, the instructions may be configured to cause at least one computing system to at least convert the server template to a corresponding virtual machine, manage the corresponding virtual machine, and convert the corresponding virtual machine back into a template format.

Abstract: An enhanced dynamic address translation facility product is created such that, in one embodiment, a virtual address to be translated and an initial origin address of a translation table of the hierarchy of translation tables are obtained. Dynamic address translation of the virtual address proceeds. In response to a translation interruption having occurred during dynamic address translation, bits are stored in a translation exception qualifier (TXQ) field to indicate that the exception was either a host DAT exception having occurred while running a host program or a host DAT exception having occurred while running a guest program. The TXQ is further capable of indicating that the exception was associated with a host virtual address derived from a guest page frame real address or a guest segment frame absolute address. The TXQ is further capable of indicating that a larger or smaller host frame size is preferred to back a guest frame.

Abstract: Aspects of the present invention provide a solution for managing memory in a shared virtual computing environment. A page that is to be stored in the memory of the host in the virtual computing environment is obtained from a guest. The page is analyzed to compute an identifier for the page. This identifier is compared with other identifiers of other pages that are currently stored in the memory to determine whether the identical page is already stored in the memory. If the identical page is currently stored in the memory, a link to that page is stored in the portion of the memory that is allocated to the guest.

Abstract: Virtualized Shared Use Environment—database driven selector of specific a) company software, b) equipment location, and c) peripherals available. The selected elements together create a Virtualized Hypercart (VH) which carries all the variable elements necessary to select the appropriate running virtual machine. Derived from the above information, the system control software (SCS) selects from a table of available virtual machines that match the requirements of company software, equipment location, peripherals available and from the company software selection, the IP addressing schemes required and available for use by the virtual machine. Dynamic IP Address Injection—based on the VH, the IP addressing scheme is injected into the virtual machine that contains the appropriate company software for the type of location that made the request with the peripherals available for use by the virtual machine.

Abstract: Systems and methods for virtual machine live migration. An example method may comprise: identifying, by a first computer system executing a virtual machine undergoing live migration to a second computer system, a plurality of stable memory pages comprised by an execution state of the virtual machine, wherein the plurality of stable memory pages comprises memory pages that have not been modified within a defined period of time; transmitting the plurality of stable memory pages to the second computer system; determining that an amount of memory comprised by a plurality of unstable memory pages is below a threshold value, wherein the plurality of unstable memory pages comprises memory pages that have been modified within the defined period of time; and transmitting the plurality of unstable memory pages to the second computer system.

Abstract: Some embodiments provide a method for managing a logical switching element that includes several logical ports. The logical switching element receives and sends data packets through the logical ports. The logical switching element is implemented in a set of managed switching elements that forward data packets in a network. The method provides a set of tables for specifying forwarding behaviors of the logical switching element. The method performs a set of database join operations on the tables to specify in the tables that the logical forwarding element drops a data packet received through a first logical port when the data packet is headed to a second logical port different than the first logical port.

Abstract: An apparatus, method, system, computer program and product, which are capable of controlling an operating system message. The operating system message, generated by an operating system, is obtained. When a destination application, which has requested or may request for the operating system message is found, the operating system is converted to an application message readable to or executable by the destination application. The application message may be sent to the destination application.

Abstract: The present disclosure provides systems and methods for hardware-enforced protection from malicious software. A device may include at least a security validator module and a security initiator module. A call from a process requesting access to information stored in the device may be redirected to the security initiator module, which may cause the device to change from an unsecured view to a secured view. In the secured view the security validator module may determine whether the call came from malicious software. If the call is determined to be valid, then access to the stored information may be permitted. If the call is determined to be invalid (e.g., from malware), the security software may cause the device to return to the unsecured view without allowing the stored information to be accessed, and may take further measures to identify and/or eliminate process code associated with the process that made the invalid call.

Abstract: A physical host executes a hypervisor or virtual machine monitor (VMM) that instantiates at least one virtual machine (VM) and a virtual input/output server (VIOS). The VIOS determines by reference to a policy data structure a disposition of a packet of network communication with the VM, where the disposition includes one of dropping the packet and forwarding the packet. Thereafter, the determined disposition is applied to a subsequent packet in a same packet flow as the packet.

Abstract: A method and software is described for recreating on a target datastore a set of hierarchical files that are present on a source datastore. A content identifier (ID) is maintained for each component of the set of hierarchical files. The content ID of a component is updated when its contents are modified. The child component is copied from the source datastore to the target datastore. The content ID corresponding to the parent component on the source datastore is compared with content IDs corresponding to files present on the target datastore. When a matching content ID is discovered, it infers a copy of the parent component. The matching file on the target datastore is associated with the copied child component so that the matching file becomes a new parent component to the copied child component, thereby recreating the set of hierarchical files on the target.

Abstract: One embodiment of the present invention is a system including: (a) plural virtualization systems configured in a cluster; (b) storage accessible to each virtualization system of the cluster, wherein for each virtual machine operative in a virtualization system of the cluster, the storage maintains a representation of virtual machine state that includes at least a description of a hardware system virtualized and an image of virtualized memory state for the virtual machine; and (c) a failover system that, responsive to an interruption of, or on, a particular one of the virtualization systems, transitions at least one affected virtual machine to another virtualization system of the cluster and resumes computations of the transitioned virtual machine based on state encoded by a corresponding one of the virtual machine states represented in the storage.

Abstract: The present disclosure includes a method for migration of a first virtual function of a first device located on a PCI bus and accessible by a device driver using a virtual address. A second virtual function is created on a second device. A base address is determined for the second virtual function as a function of a logical location of the second device within the PCI structure. An offset is determined for the second virtual function as a function of the base address and the virtual address. The device driver is notified that the first virtual function is on hold. The offset is stored in a translation table. The device driver is notified that the hold has been lifted. Accesses to the virtual address and by the device driver to memory of the second virtual function are routed based upon the offset in the translation table.

Abstract: A data processing system facilitates virtual machine migration with direct physical access control. The illustrative data processing system comprises a software-programmable trap control associated with hardware registers of a computer that selectively vectors execution control of a virtual machine (VM) between a host and a guest. The data processing system further comprises a logic which is configured for execution on the computer that programs the trap control to enable the virtual machine to directly access the hardware registers when the virtual machine is not migrated and to revoke direct access of the hardware registers in preparation for virtual machine migration.

Abstract: Activity level of memory pages is classified in virtual machine environment, so that processes such as live VM migration and checkpointing, among others, can be carried out more efficiently. The method includes the steps of scanning page table entries of hypervisor-managed page tables continuously over repeating scan periods to determine whether memory pages have been accessed or not, and for each memory page, determining an activity level of the memory page based on whether the memory page has been accessed or not since a prior scan and storing the activity level of the memory page. The activity level of the memory page may be represented by one or more bits of its page table entry and may be classified as having at least two states ranging from hot to cold.

Abstract: Disclosed are computers and methods employing a mechanism for eliminating a race condition between a hypervisor-performed emulation process and a concurrent translation table entry invalidation. Specifically, on a host machine, a hypervisor controls any guest operating systems. In doing so, the hypervisor emulates an instruction by performing a translation operation to acquire a physical address from a virtual address and, if applicable, further from an effective address using translation table(s) (e.g., page tables and, if applicable, segment tables); accesses the physical address; and completes the instruction. During emulation, flagged address table(s) are used to eliminate the race condition. For example, upon receiving an invalidate translation instruction associated with a virtual address, a determination is made as to whether or not the virtual address appears in a flagged virtual address table and, if so, additional action is taken to prevent an error in the translation.

Abstract: A method, apparatus, and computer program product for virtualizing baseboard management controller (‘BMC’) operation in a host computer comprising a base BMC is provided. Example embodiments include executing, by the host computer, a virtual BMC; registering, by the virtual BMC, with the base BMC of the host computer; and processing BMC requests sent to the base BMC by the virtual BMC. In some example embodiments, prior to registration of the virtual BMC, BMC requests are processed by the base BMC. Some other example embodiments include determining, by the base BMC, periodically at a predefined period of time, whether the virtual BMC is active; and upon the base BMC determining that the virtual BMC is not active: deregistering, by the base BMC, the virtual BMC; and processing subsequently received BMC requests by the base BMC.

Abstract: Methods, systems, and computer programs for managing memory in a host where virtual machines (VMs) execute are presented. In one example, a method includes an operation for determining which amount of heap memory has been reserved in a Java virtual machine (JVM) that is in excess of the heap memory needed by the JVM. If there is excess heap memory, a Java balloon agent reserves a Java object in the heap memory. Typically, the Java object will be the size of one or more memory pages in the host. Further, the Java balloon agent loads the Java object with a certain value, for example, by zeroing out the page of memory. When a virtual machine monitor (VMM) in the host detects that a machine physical memory page associated with the Java object has the first value, then the VMM frees the machine physical memory page to make the memory available to other VMs or to other processes executing in the host.

Abstract: A computer system and a method are provided that reduce the amount of time and computing resources that are required to perform a hardware table walk (HWTW) in the event that a translation lookaside buffer (TLB) miss occurs. If a TLB miss occurs when performing a stage 2 (S2) HWTW to find the PA at which a stage 1 (S1) page table is stored, the MMU uses the IPA to predict the corresponding PA, thereby avoiding the need to perform any of the S2 table lookups. This greatly reduces the number of lookups that need to be performed when performing these types of HWTW read transactions, which greatly reduces processing overhead and performance penalties associated with performing these types of transactions.

Abstract: A method and system for self-sizing dynamic cache for virtualized environments is disclosed. The preferred embodiment self sizes unequal portions of the total amount of cache and allocates to a plurality of active virtualized machines (VM) according to VM requirements and administrative standards. As a new VM may emerge and request an amount of cache, the cache controller reclaims currently used cache from the active VM and reallocates the unequal portions of cache required by each VM. To ensure cache availability, a quick reclamation amount of cache is immediately available to each new VM as it makes the request begins operation. After reallocation, the newly created VM may rely on a guaranteed minimum quota of cache to ensure performance.

Abstract: A system includes a memory device including a real memory and a tracking mechanism configured to track relationships between multiple virtual memory addresses and real memory. The system further includes a processor configured to perform the below method and/or execute the below computer program product. One method includes mapping a first virtual memory address to a real memory in a memory device and mapping a second virtual memory address to the real memory. Here, the first virtual memory address is authorized to modify data in the real memory and the second virtual memory address is not authorized to modify the data in the real memory. One computer storage medium includes a computer program product for performing the above method.

Abstract: A system is described herein that includes a predictor component that predicts accesses to portions of asymmetric memory pools in a computing system by a virtual machine, wherein the asymmetric memory pools comprise a first memory and a second memory, and wherein performance characteristics of the first memory are non-identical to performance of the second memory. The system also includes a memory management system that allocates portions of the first memory to the virtual machine based at least in part upon the accesses to the asymmetric memory pools predicted by the predictor component.

Abstract: The disclosed embodiments provide a system that uses broadcast-based TLB-sharing techniques to reduce address-translation latency in a shared-memory multiprocessor system with two or more nodes that are connected by an electrical interconnect. During operation, a first node receives a memory operation that includes a virtual address. Upon determining that one or more TLB levels of the first node will miss for the virtual address, the first node uses the electrical interconnect to broadcast a TLB request to one or more additional nodes of the shared-memory multiprocessor in parallel with scheduling a speculative page-table walk for the virtual address. If the first node receives a TLB entry from another node of the shared-memory multiprocessor via the electrical interconnect in response to the TLB request, the first node cancels the speculative page-table walk. Otherwise, if no response is received, the first node instead waits for the completion of the page-table walk.

Abstract: At least one virtual machine implemented on a given physical machine in an information processing system is able to detect the presence of one or more other virtual machines that are also co-resident on that same physical machine. More particularly, at least one virtual machine is configured to avoid usage of a selected portion of a memory resource of the physical machine for a period of time, and to monitor the selected portion of the memory resource for activity during the period of time. Detection of a sufficient level of such activity indicates that the physical machine is also being shared by at least one other virtual machine. The memory resource of the physical machine may comprise, for example, a cache memory, and the selected portion of the memory resource may comprise one or more randomly selected sets of the cache memory.

Abstract: Techniques are disclosed for performing input/output (I/O) requests to two or more physical adapters in parallel. One method for performing an input/output (I/O) request includes mapping an address for at least a first page associated with a virtual I/O request to an entry in a virtual TCE table and identifying a plurality of physical adapters required to service the virtual I/O request. For each of the identified physical adapters, the entry in the virtual TCE table is mapped to an entry in a physical TCE table corresponding to the physical adapter. This method may also include, in parallel, issuing physical I/O requests to the physical adapters.

Abstract: A processor including a virtualization system of the processor with a memory virtualization support system to map a reference to guest-physical memory made by guest software executable on a virtual machine which in turn is executable on a host machine in which the processor is operable to a reference to host-physical memory of the host machine.

Abstract: A first virtual memory address is mapped to a real memory in a memory device, and a second virtual memory address is mapped to the real memory. Here, the first virtual memory address is authorized to modify data in the real memory and the second virtual memory address is not authorized to modify the data in the real memory.

Abstract: When a guest of a virtual machine attempts to accesses an address that causes an exit from the guest to the hypervisor of a host, the hypervisor receives an indication of an exit by a guest to the hypervisor. The received address is associated with a memory-mapped input-output (MMIO) instruction. The hypervisor determines, based on the received indication, that the exit is associated with the memory-mapped input-output (MMIO) instruction. The hypervisor identifies the address that caused the exit as a fast access address. The hypervisor identifies one or more memory locations associated with the fast access address, where the one or more memory locations store information associated with the MMIO instruction. The hypervisor identifies the MMIO instruction based on the stored information. The hypervisor executes the MMIO instruction on behalf of the guest.

Abstract: Techniques for deduplication of virtual machine files in a virtualized desktop environment are described, including receiving data into a page cache, the data being received from a virtual machine and indicating a write operation, and deduplicating the data in the page cache prior to committing the data to storage, the data being deduplicated in-band and in substantially real-time.

Abstract: Each node in a clustered array is the owner of a set of zero logical disks (LDs). Thinly-provisioned VVs (TPVVs) are partitioned so each is mapped to a group of zero LDs from different sets of zero LDs. When there is a change in ownership, the affected zero LDs are switched one at a time so only a group of the TPVVs is affected each time.

Abstract: A data processing system comprising a host computer system and a network interface device for connection to a network, the host computer system and network interface device being coupled together by means of a data bus, and: the network interface device comprising: a controller unit having a first data port for connection to a network, a second data port, and a data bus interface connected to said data bus, the controller unit being operable to perform, in dependence on the network endpoints to which data packets received at the network interface device are directed, switching of data packets between the first and second data ports and the data bus interface; and an accelerator module having a first medium access controller coupled to said second data port of the controller unit and a processor operable to perform one or more functions in hardware on data packets received at the accelerator module, the said first medium access controller being operable to support one or more first network endpoints; the host

Abstract: A computer system that supports virtualization may maintain multiple address spaces. Each guest operating system employs guest virtual addresses (GVAs), which are translated to guest physical addresses (GPAs). A hypervisor, which manages one or more guest operating systems, translates GPAs to root physical addresses (RPAs). A merged translation lookaside buffer (MTLB) caches translations between the multiple addressing domains, enabling faster address translation and memory access. The MTLB can be logically addressable as multiple different caches, and can be reconfigured to allot different spaces to each logical cache.

Abstract: A technique for transferring data in a digital signal processing system is described. In one example, the digital signal processing system comprises a number of fixed function accelerators, each connected to a memory access controller and each configured to read data from a memory device, perform one or more operations on the data, and write data to the memory device. To avoid hardwiring the fixed function accelerators together, and to provide a configurable digital signal processing system, a multi-threaded processor controls the transfer of data between the fixed function accelerators and the memory. Each processor thread is allocated to a memory access channel, and the threads are configured to detect an occurrence of an event and, responsive to this, control the memory access controller to enable a selected fixed function accelerator to read data from or write data to the memory device via its memory access channel.

Abstract: A data storage device includes a NAND flash memory, an executable interface and a controller for receiving, from a host, via the executable interface, an instruction to access the NAND flash memory at a virtual address and for translating the virtual address to a physical address of the volatile memory. Preferably, the controller also provides boot functionality to the host.

Abstract: Activity level of memory pages is classified in virtual machine environment, so that processes such as live VM migration and checkpointing, among others, can be carried out more efficiently. Because each such hypervisor-based service may desire classification of activity levels of memory pages at different frequencies and different time granularities, the hypervisor supports methods to classify activity levels of memory pages for a plurality of time intervals.

Abstract: Various mechanisms are disclosed herein for the saving and restoring of virtual machine environment state. For example, virtual machine state can be either be saved or (multiple) snapshots can be taken of the virtual machine state. In the latter case, virtual processors can be allowed to run while the memory of the virtual machine state is being saved. In either case, virtual devices associated with the virtual machine environment can be quiesced such that these devices can prepare themselves to be saved. Once such virtual devices and memory are saved, they can also be restored. For example, restoration of memory can occur while virtual processors are running at the same time. And, moreover, restoration can occur in batches of pages, thus optimizing the response time for restoring saved data.

Abstract: In one embodiment, the present invention is directed to a system with multiple computing hosts each having a hypervisor to provide a virtual environment for the host and one or more containers each including a database instance and at least one database. These databases, and the database instance can be provided as a service to a user of a multi-tenant environment.

Abstract: The present invention is directed to making a guest operating system aware of the topology of the subset of host resources currently assigned to it. At virtual machine boot time a Static Resource Affinity Table (SRAT) will be used by the virtualizer to group guest physical memory and guest virtual processors into virtual nodes. Thereafter, in one embodiment, the host physical memory behind a virtual node can be changed by the virtualizer as necessary, and the virtualizer will provide physical processors appropriate for the virtual processors in that node.

Abstract: Provided are techniques for allocating logical memory corresponding to a logical partition in a computing system; generating a S/W PFT data structure corresponding to a first page of the logical memory, wherein the S/W PFT data structure comprises a field indicating that the corresponding first page of logical memory is a klock page; transmitting a request for a page of physical memory and the corresponding S/W PFT data structure to a hypervisor; allocating physical memory corresponding to the request; and, in response to a pageout request, paging out available logical memory corresponding to the logical partition that does not indicate that the corresponding page is a klock page prior to paging out the first page.

Abstract: Management of storage used by pageable guests of a computing environment is facilitated. A query instruction is provided that details information regarding the storage location indicated in the query. It specifies whether the storage location, if protected, is protected by host-level protection or guest-level protection.

Abstract: Provided are techniques for allocating logical memory corresponding to a logical partition in a computing system; generating, a S/W PFT data structure corresponding to a first page of the logical memory, wherein the S/W PFT data structure comprises a field indicating that the corresponding first page of logical memory is a klock page; transmitting a request for a page of physical memory and the corresponding S/W PFT data structure to hypervisor, allocating physical memory corresponding to the request; and, in response to a pageout request, paging out available logical memory corresponding to the logical partition that does not indicate that the corresponding page is a klock page prior to paging out the first page.

Abstract: Interfaces to storage devices that employ storage space optimization technologies, such as thin provisioning, are configured to enable the benefits gained from such technologies to be sustained. Such an interface may be provided in a hypervisor of a virtualized computer system to enable the hypervisor to discover features of a logical unit number (LUN), such as whether or not the LUN is thinly provisioned, and also in a virtual machine (VM) of the virtualized computer system to enable the VM to discover features of a virtual disk, such as whether or not the virtual disk is thinly provisioned. The discovery of these features enables the hypervisor or the VM to instruct the underlying storage device to carry out certain operations such as an operation to deallocate blocks previously allocated to a logical block device, so that the storage device can continue to benefit from storage space optimization technologies implemented therein.

Abstract: Embodiments described herein identify hot pages associated with a virtual machine that is selected for hibernation or for migration from one computing system to another. For example, before hibernating a virtual machine, a hypervisor monitors the entries in a page table (i.e., a virtual translation table) to see what data pages have corresponding entries in the page table. If a data page has a corresponding entry in the page table, the hypervisor may designate that page as hot. In one embodiment, the hypervisor may update a page map that lists the data pages associated with the virtual machine and whether those data pages are designated as hot. The page map may then be stored during the hibernation process. Before the hibernated virtual machine is resumed, the hypervisor may use the page map to load the hot pages into memory and begin executing the virtual machine.