Abstract: In virtualized computer system in which a guest operating system runs on a virtual machine of a virtualized computer system and has direct access to a hardware device coupled to the virtualized computer system via a communication interface, a computer-implemented method of handling interrupts from the hardware device to the guest operating system includes: (a) receiving a physical interrupt from the hardware device on a shared interrupt line of an interrupt controller; (b) masking the shared interrupt line of the interrupt controller; (c) generating a virtual interrupt corresponding to the physical interrupt to the guest operating system; and (d) the guest operating system executing an interrupt service routine.

Abstract: Autonomous selection between multiple virtualization techniques implemented in a virtualization layer of a virtualized computer system. The virtual machine monitor implements multiple virtualization support subsystems that each provide for the comprehensive handling of potential virtualization exceptions. A virtual machine monitor resident performance monitor computes relative virtualization overhead costs that are and would be incurred in using different virtualization support subsystems for virtualization exceptions that occur in executing a guest operating system within a defined interval. Dependent on the relative virtualization overhead costs determined, the virtual machine monitor resident virtualization selection control switches the virtual machine monitor to use the optimal virtualization support subsystem for handling virtualization exceptions that occur over a second defined interval.

Abstract: Autonomous selection between multiple virtualization techniques implemented in a virtualization layer of a virtualized computer system. The virtual machine monitor implements multiple virtualization support processors that each provide for the comprehensive handling of potential virtualization exceptions. A virtual machine monitor resident virtualization selection control is operable to select between use of first and second virtualization support processors dependent on identifying a predetermined pattern of temporally local privilege dependent instructions within a portion of an instruction stream as encountered in the execution of a guest operating system.

Abstract: A method for executing on a local user system a body of computer-executable code that resides on a provider system is described. A modified image of the computer executable code is installed to a virtual disk on the local user system, the modified image comprising file structure information. The installing comprises creating each of the local files to the virtual disk with null data, wherein upon installation of the modified image, a plurality of disk blocks assigned to the local files contain a null indicator and do not contain any processable content. A streaming control module senses a request to access the virtual disk, determines whether streaming is indicated to satisfy the request, and transfers to the user system the processable content corresponding to the requested disk block. Streaming is indicated when the request corresponds to one of the disk blocks that does not contain any processable content.

Abstract: A mechanism is provided to maintain multiple copies of a virtual disk associated with a virtual machine by a synchronization function. The content of a first virtual disk is maintained, as a copy, at a second virtual disk by maintaining a record of the changes made to the first virtual disk and transferring only the changed data to the second. A disk change map represents the changed portions of the first virtual disk and is used to determine the content that must be transferred. Only data that differs between the two virtual disks is transferred thereby reducing the amount of data that needs to be transmitted.

Abstract: The amount of virtual disk space that is available for use by software executing within a virtual machine may be dynamically adjusted while the virtual machine is running in a virtual computer system. According to one aspect, a method for flexible run-time reservation of disk space from a virtual machine is provided. The method includes designating for use by a first virtual machine, a fixed portion of disk space accessible by a computing system. The first virtual machine is activated. During operation of the first virtual machine, a portion of the fixed portion of the disk space designated for use by the first virtual machine is reserved from within the first virtual machine. Use of the reserved portion is controlled from outside of the first virtual machine.

Abstract: In a method of optimizing utilization of a shared cache, a set of locations in the cache is probed. The probing takes place while an observed process is running, descheduled, or interrupted. It is determined which portions of the cache are utilized by the observed process. Utilization of the cache is optimized based on result of the determination of which portions of the cache are utilized by the observed process.

Abstract: At least one guest system, for example, a virtual machine, is connected to a host system, which includes a system resource such as system machine memory. Each guest system includes a guest operating system (OS). A resource requesting mechanism, preferably a driver, is installed within each guest OS and communicates with a resource scheduler included within the host system. If the host system needs any one the guest systems to relinquish some of the system resource it currently is allocated, then the resource scheduler instructs the driver within that guest system's OS to reserve more of the resource, using the guest OS's own, native resource allocation mechanisms. The driver thus frees this resource for use by the host, since the driver does not itself actually need the requested amount of the resource. The driver in each guest OS thus acts as a hollow “balloon” to “inflate” or “deflate,” that is, reserve more or less of the system resource via the corresponding guest OS.

Abstract: Methods for logging and replaying input/output (I/O) events for a virtual machine (VM). The I/O events may be asynchronous or synchronous. In particular, one embodiment is a computer-implemented method for logging input/output (I/O) events for a virtual machine, the method including: executing the virtual machine from a checkpoint; and logging external events, including I/O events; wherein logging an I/O event comprises logging the event, and then, logging I/O data relating to the I/O event.

Abstract: One embodiment entails delivering a software payload to guest software in a virtual machine so that the software payload is part of a file system accessible by the guest software, wherein delivery avoids a data path involving a network stack of the virtual machine.

Abstract: A computer implemented method for maintaining synchronization between a master computer disk and a clone disk that includes cloning the clone disk from the master computer disk, the clone disk having a customization portion; and customizing the customization portion with information relevant to a clone computer that uses the clone disk.

Abstract: A system and method for maintaining processing order while permitting parallelism. Processing of a piece of work is divided into a plurality of stages. At each stage, a task advancing the work towards completion is performed. By performing processing as a sequence of tasks, processing can be done in parallel, with progress being made simultaneously on different pieces of work in different stages by a plurality of threads of execution.

Abstract: A system and method for detecting changes of memory state. In accordance with one embodiment, memory locations to be observed are determined, and pages of these locations are marked as read-only. Then, guest instructions execute during a trial period. During the trial period, guest instructions attempting to write to the identified memory locations cause page faults which result in identifying the instructions. At the end of the trial period, the pages are returned to a writable status, and attempts to modify the memory locations by the guest code are detected based on the instruction identifier. The system and method can be used for efficient frame list topology monitoring, such as in a virtual USB controller of a virtual machine.

Abstract: A method and system is provided for initializing files such as, for example and without limitation, pre-allocated files or raw device mapping (RDM) files, by delaying initializing file blocks. In accordance with one or more embodiments of the present invention, file blocks are associated with corresponding indicators to track un-initialized blocks.

Abstract: Upon occurrence of a trigger condition, writes of allocation units of data (including code) to a device, such as writes of blocks to a disk, are first encrypted. Each allocation unit is preferably a predetermined integral multiple number of minimum I/O units. A data structure is marked to indicate which units are encrypted. Upon reads from the device, only those allocation units marked as encrypted are decrypted. The disk protected by selective encryption is preferably the virtual disk of a virtual machine (VM). The trigger condition is preferably either that the virtual disk has been initialized or that the VM has been powered on. Mechanisms are also provided for selectively declassifying (storing in unencrypted form) already-encrypted, stored data, and for determining which data units represent public, general-use data units that do not need to be encrypted. The “encrypt-on-write” feature of the invention may be used in conjunction with a “copy-on-write” technique.

Abstract: An engine (TOE) is provided in a virtualized computer system for offloading I/O tasks using any defined protocol such as TCP/IP. The system includes a virtual machine (VM), which has a guest operating system (OS) that runs via a virtual machine monitor (VMM) on a system-level software platform (vmkernel), which also forms the software interface layer to at least one physical network connection device. A TCP/IP stack is included in vmkernel. During normal I/O operation, for sockets associated with TOE, processes in an application layer in the guest OS are able to communicate directly with vmkernel's TCP/IP stack, thereby bypassing the guest OS kernel.

Abstract: Mechanisms have been developed for securing computational systems against certain forms of attack. Taint status for data accessible by processes is selectively maintained and propagated in correspondence with information flows of instructions executed by a computing system, so that a security (or other appropriate) response can be provided if and when a control transfer (or other restricted use) is attempted based on tainted data. One response that may be triggered is a change in the privilege level (root and guest) that is used to process code executing in a virtual environment, so as to allow remediation to be performed. The triggering events may be specified in a control block.

Abstract: Units of a resource are allocated among a plurality of clients by a system-level management module using a proportional share resource allocation scheme. For each client, a metric is evaluated that is a function both of a non-usage-based, client-specific factor and of a usage-based factor. The usage-based factor is in turn a function of, as separate variables, a first and a second measure of resource units currently allocated to the respective client that the client is actively using and that are idle, respectively. At least one resource unit is then reclaimed for reallocation from the client whose metric meets a predetermined criterion. Examples of the resource include system memory, processors in a multi-processor system, I/O bandwidth, etc. Examples of clients include processes, virtual machines, remote systems connected to the management module via a network, which may be in a server, etc.

Abstract: A computer architecture includes a first operating system (COS), which may be a commodity operating system, and a kernel, which acts as a second operating system. The COS is used to boot the system as a whole. After booting, the kernel is loaded and displaces the COS from the system level, meaning that the kernel itself directly accesses predetermined physical resources of the computer. All requests for use of system resources then pass via the kernel. System resources are divided into those that, in order to maximize speed, are controlled exclusively by the kernel, those that the kernel allows the COS to handle exclusively, and those for which control is shared by the kernel and COS. In the preferred embodiment of the invention, at least one virtual machine (VM) runs via a virtual machine monitor, which is installed to run on the kernel. Each VM, the COS, and even each processor in a multiprocessor embodiment, are treated as separately schedulable entities that are scheduled by the kernel.

Abstract: One embodiment of the present invention is a system including: (a) plural virtualization systems configured as a cluster; (b) a failover system that, responsive to an interruption of, or on, a particular one of the virtualization systems, transitions at least one virtual machine to another virtualization system of the cluster and resumes thereon computations of the transitioned virtual machine; and (c) a management system that tracks, for each virtual machine, a set of resource requirements, the management system admitting virtual machine computations to the cluster based on an admission control policy that, consonant with the resource requirements of virtual machines provisioned to any particular set of virtualization systems, assures sufficient excess capacity on other virtualization systems of the cluster to support, in the event of interruption of the particular set, transition of all virtual machines operative thereon to the other virtualization systems of the cluster.