Software isolation of virtual machine resources

A computer system for isolating resources of a virtual machine (VM) guest from a host operating system (OS), comprising:

• a processor;
• and
• a computer storage media that stores computer-executable instructions that are executable by the processor to cause the computer system to at least:
• receive an acceptance request from a guest partition corresponding to an isolated VM guest, the acceptance request identifying:
• a guest memory page that is mapped into a guest physical address (GPA) space of the guest partition, and
• a memory page visibility class;
• and
• set a page acceptance indication for the guest memory page from an unaccepted state to an accepted state based on a physical memory page mapped to the guest memory page meeting the memory page visibility class.

A computer program product comprising a computer storage media that stores computer-executable instructions that are executable by a processor to cause a computer system to isolate resources of a virtual machine (VM) guest from a host operating system (OS), the computer-executable instructions including instructions that are executable by the processor to cause the computer system to at least:

• receive an acceptance request from a guest partition corresponding to an isolated VM guest, the acceptance request identifying a guest memory page that is mapped into a guest physical address space of the guest partition;
• determine that a physical memory page that is mapped to the guest memory page meets a memory page visibility class, including:
• verifying, via one or more guest second-level address translation tables (SLATs), that the physical memory page is exclusively mapped to the guest memory page, and
• verifying, via a host OS SLAT, that the host OS is denied access to the physical memory page;
• and
• set a page acceptance indication for the guest memory page from an unaccepted state to an accepted state based on the physical memory page meeting the memory page visibility class.