Microsoft Technology Licensing, LLC

Aditya Bhandari

Bruce John Sherwin, Jr

Xin Zhang

Shuvabrata Ganguly

Dmitry Meshchaninov

Thomas Moscibroda

Steve Pronovost

Marcus Felipe Fontoura

Ke Wang

Jason Stewart Wohlgemuth

Yimin Deng

Michael Bishop Ebersol

Jin Lin

Sameh Elnikety

Ricardo Gouvêa Bianchini

Chandrasekhar Pasupuleti

Brian Jacob Corell

Kapil Vaswani

Inigo Goiri Presa

Attilio Mainetti

Antoine Jean Denis Delignat-lavaud

Steven Adrian West

Alexander Daniel Grest

Emily Cara Clemens

Kapil Arya

Alper Gun

Dexuan Cui

Michael Halstead Kelley

Sarah Elizabeth Stephenson

Carolina Cecilia Perez-vargas

Luis Hernandez

Bruce J Sherwin

Xin David Zhang

This disclosure generally relates to securely launching a hypervisor and subsequently validating that the hypervisor was securely launched. As is described herein, once a hypervisor has been initialized or has otherwise launched, a verification operation is performed. The verification operation may be used to ensure that the hypervisor was securely launched. When it is determined that the hypervisor was securely launched, one or more platform details are obtained. These platform details may then be stored in a memory device.

Secure launch for a hypervisor

Methods, systems, and computer program products for direct assignment of physical devices to confidential virtual machines (VMs). At a first guest privilege context of a guest partition, a direct assignment of a physical device associated with a host computer system to the guest partition is identified. The guest partition includes the first guest privilege context and a second guest privilege context, which is restricted from accessing memory associated with the first guest privilege context. The guest partition corresponds to a confidential VM, such that a memory region associated with the guest partition is inaccessible to a host operating system. It is determined, based on a policy, that the physical device is allowed to be directly assigned to the guest partition. Communication between the physical device and the second guest privilege context is permitted, such as by exposing the physical device on a virtual bus and/or forwarding an interrupt.

Direct assignment of physical devices to confidential virtual machines

The present disclosure describes a type of virtual machine, which the present disclosure may refer to as a harvest virtual machine, that may allow improved utilization of physical computing resources on a cloud-computing system. First, the harvest virtual machine may be evictable. In other words, higher priority virtual machines may preempt the harvest virtual machine's access to physical computing resources. Second, the harvest virtual machine may receive access to a dynamic amount of physical computing resources during the course of its operating life. Third, the harvest virtual machine may have a minimum size (in terms of an amount of physical computing resources) and may terminate whenever the harvest virtual machine has access to an amount of physical computing resources less than the minimum size.

Harvest virtual machine for utilizing cloud-computing resources

This disclosure generally relates to enabling a hypervisor of a host machine to provide virtual interrupts to select virtual processors or a set of virtual processors. More specifically, the present disclosure describes how interrupts may be provided to targeted virtual processors, regardless of where the virtual processors are currently executing. That is, when an interrupt is received, the interrupt may be delivered to a specified virtual processor regardless of which logical processor is currently hosting the virtual processor.

Targeted interrupts for virtual processors

This disclosure generally relates to enabling a hypervisor of a host machine to provide virtual interrupts to select virtual processors or a set of virtual processors. More specifically, the present disclosure describes how a hypervisor of a host machine may monitor the status of one or more virtual processors that are executing on the host machine and deliver interrupts to the virtual processors based on a number of factors including, but not limited to, a priority of the interrupt, a priority of the virtual processor, a current workload of the virtual processor and so on.

Interrupt management for a hypervisor

This disclosure generally relates to time and timer techniques that may be used to virtualize one or more virtual machines. In an example, it may be possible to save and restore a timer of a virtual machine while preserving timer information associated with the timer (e.g., an expiration time, whether the most recent expiration has been signaled, and the enable bit, etc.). For example, a first mode may enable restoring a timer based on a previously-existing enable bit, thereby retaining the state of the timer (e.g., whether the timer is programmed to fire and/or whether the most recent expiration has been signaled). By contrast, a second mode of setting a timer may automatically set the enable bit, thereby automatically enabling the timer to fire, as may be expected by a virtual machine when setting a timer.

Hypervisors timer techniques

This disclosure generally relates to hypervisor memory virtualization. Techniques disclosed herein improve peripheral component interconnect express (PCI-e) device interoperability with a virtual machine. As an example, when a direct-memory access request is received from a PCI-e device but the target memory is currently unmapped, an indication may be provided to a memory paging processor so as to page-in the memory, such that the PCI-e device may continue to function normally. In some examples, the access request may be buffered and replayed once the memory is paged-in, or the access request may be retried, among other examples.

Hypervisor direct memory access

This disclosure generally relates to hypervisor memory virtualization. In an example, multiple page table stages may be used to provide a page table that may be used by a processor when processing a workload for a nested virtual machine. An intermediate (e.g., nested) hypervisor may request an additional page table stage from a parent hypervisor, which may be used to virtualize memory for one or more nested virtual machines managed by the intermediate hypervisor. Accordingly, a processor may use the additional page table stages to ultimately translate a virtual memory address for a nested virtual machine to a physical memory address.

Nested hypervisor memory virtualization

In a virtual machine environment, a hypervisor is configured to expose a virtual cache topology to a guest operating system, such that the virtual cache topology may be provided by corresponding physical cache topology. The virtual cache topology may be determined by the hypervisor or, in the case of a datacenter environment, may be determined by the datacenter's management system. The virtual cache topology may be calculated from the physical cache topology of the system such that virtual machines may be instantiated with virtual processors and virtual cache that may be mapped to corresponding logical processors and physical cache.

Exposure of virtual cache topology to a guest operating system

Techniques for configuring a hypervisor scheduler to make use of cache topology of processors and physical memory distances between NUMA nodes when making scheduling decisions. In the same or other embodiments the hypervisor scheduler can be configured to optimize the scheduling of latency sensitive workloads. In the same or other embodiments a hypervisor can be configured to expose a virtual cache topology to a guest operating system running in a virtual machine.

Hypervisor scheduler

Growing community of inventors

Seattle, WA, United States of America

Aditya Bhandari