Abstract: One embodiment of the present invention is a method of operating a virtualization system, the method including: (a) instantiating a virtualization system on an underlying hardware machine, the virtualization system exposing a virtual machine in which multiple execution contexts of a guest execute; (b) monitoring the execution contexts from the virtualization system; and (c) selectively impeding computational progress of a particular one of the execution contexts.

Abstract: At least one guest system, for example, a virtual machine, is connected to a host system, which includes a system resource such as system machine memory. Each guest system includes a guest operating system (OS). A resource requesting mechanism, preferably a driver, is installed within each guest OS and communicates with a resource scheduler included within the host system. If the host system needs any one the guest systems to relinquish some of the system resource it currently is allocated, then the resource scheduler instructs the driver within that guest system's OS to reserve more of the resource, using the guest OS's own, native resource allocation mechanisms. The driver thus frees this resource for use by the host, since the driver does not itself actually need the requested amount of the resource. The driver in each guest OS thus acts as a hollow “balloon” to “inflate” or “deflate,” that is, reserve more or less of the system resource via the corresponding guest OS.

Abstract: Upon occurrence of a trigger condition, writes of allocation units of data (including code) to a device, such as writes of blocks to a disk, are first encrypted. Each allocation unit is preferably a predetermined integral multiple number of minimum I/O units. A data structure is marked to indicate which units are encrypted. Upon reads from the device, only those allocation units marked as encrypted are decrypted. The disk protected by selective encryption is preferably the virtual disk of a virtual machine (VM). The trigger condition is preferably either that the virtual disk has been initialized or that the VM has been powered on. Mechanisms are also provided for selectively declassifying (storing in unencrypted form) already-encrypted, stored data, and for determining which data units represent public, general-use data units that do not need to be encrypted. The “encrypt-on-write” feature of the invention may be used in conjunction with a “copy-on-write” technique.

Abstract: At least one guest system, for example, a virtual machine, is connected to a host system, which includes a system resource such as system machine memory. Each guest system includes a guest operating system (OS). A resource requesting mechanism, preferably a driver, is installed within each guest OS and communicates with a resource scheduler included within the host system. If the host system needs any one the guest systems to relinquish some of the system resource it currently is allocated, then the resource scheduler instructs the driver within that guest system's OS to reserve more of the resource, using the guest OS's own, native resource allocation mechanisms. The driver thus frees this resource for use by the host, since the driver does not itself actually need the requested amount of the resource. The driver in each guest OS thus acts as a hollow “balloon” to “inflate” or “deflate,” that is, reserve more or less of the system resource via the corresponding guest OS.

Abstract: In a method of optimizing utilization of a shared cache, a set of locations in the cache is probed. The probing takes place while an observed process is running, descheduled, or interrupted. It is determined which portions of the cache are utilized by the observed process. Utilization of the cache is optimized based on result of the determination of which portions of the cache are utilized by the observed process.

Abstract: Upon occurrence of a trigger condition, writes of allocation units of data (including code) to a device, such as writes of blocks to a disk, are first encrypted. Each allocation unit is preferably a predetermined integral multiple number of minimum I/O units. A data structure is marked to indicate which units are encrypted. Upon reads from the device, only those allocation units marked as encrypted are decrypted. The disk protected by selective encryption is preferably the virtual disk of a virtual machine (VM). The trigger condition is preferably either that the virtual disk has been initialized or that the VM has been powered on. Mechanisms are also provided for selectively declassifying (storing in unencrypted form) already-encrypted, stored data, and for determining which data units represent public, general-use data units that do not need to be encrypted. The “encrypt-on-write” feature of the invention may be used in conjunction with a “copy-on-write” technique.

Abstract: Units of a resource are allocated among a plurality of clients by a system-level management module using a proportional share resource allocation scheme. For each client, a metric is evaluated that is a function both of a non-usage-based, client-specific factor and of a usage-based factor. The usage-based factor is in turn a function of, as separate variables, a first and a second measure of resource units currently allocated to the respective client that the client is actively using and that are idle, respectively. At least one resource unit is then reclaimed for reallocation from the client whose metric meets a predetermined criterion. Examples of the resource include system memory, processors in a multi-processor system, I/O bandwidth, etc. Examples of clients include processes, virtual machines, remote systems connected to the management module via a network, which may be in a server, etc.

Abstract: A method and tangible medium embodying code for allocating resource units of an allocatable resource among a plurality of clients in a computer is described. In the method, resource units are initially distributed among the clients by assigning to each of the clients a nominal share of the allocatable resource. For each client, a current allocation of resource units is determined. A metric is evaluated for each client, the metric being a function both of the nominal share and a usage-based factor, the usage-based factor being a function of a measure of resource units that the client is actively using and a measure of resource units that the client is not actively using. A resource unit can be reclaimed from a client when the metric for that client meets a predetermined criterion.

Abstract: I/O operations between a virtual machine (VM) and a device external to the VM are monitored by a virtual machine monitor (VMM). Data passing between the VM and the external device is transformed by the VMM, in some cases only when a predetermined filtering or triggering condition is met. Because the VMM, and thus the transformation operation, is transparent to the VM, the transformation cannot be prevented or undone or even affected by any action by a user of the VM. Examples of the non-defeatable transformation of I/O data include generating display overlays such as banners, masking out portions of a display, encryption, compression and network shaping such as bandwidth limiting.

Abstract: The performance of an executing computer program on a computer system is monitored using latency sampling. The program has object code instructions and is executing on the computer system. At intervals, the execution of the computer program is interrupted including delivering a first interrupt. In response to at least a subset of the first interrupts, a latency associated with a particular object code instruction is identified, and the latency is stored in a first database. The particular object code instruction is executed by the computer such that the program remains unmodified.

Abstract: A computer has a hardware memory arranged into portions that are separately addressable using first identifiers, which are represented using a first number of address bits. A subsystem that is able to address a second space of the hardware memory using second identifiers initiates I/O requests directed to a device that is able to address a different, first memory space using first identifiers, which are represented using a second number of address bits. The second identifiers are initially mapped into the second memory space, but for any I/O request that meets a remapping criterion, the corresponding second identifier is remapped to one of the first identifiers that identifies a portion of the memory in the first memory space. The second space is different from the first space and the second number of address bits is greater less than the first number of address bits.

Abstract: A computer system has one or more software context that share use of a memory that is divided into units such as pages. In the preferred embodiment of the invention, the context are, or include, virtual machines running on a common hardware platform. The context, as opposed to merely the addresses or page numbers, of virtual memory pages that accessible to one or more contexts are examined. If two or more context pages are identical, then their memory mappings are changed to point to a single, shared copy of the page in the hardware memory, thereby freeing the memory space taken up by the redundant copies. The shared copy is ten preferable marked copy-on-write. Sharing is preferably dynamic, whereby the presence of redundant copies of pages is preferably determined by hashing page contents and performing full content comparisons only when two or more pages hash to the same key.

Abstract: A subsystem that is able to address a second memory region initiates I/O requests directed to a device that is able to address a first memory region that is different from the second memory region. Requests for memory are mapped at least once, for example from virtual to physical page numbers. The I/O requests are conditionally remapped to pages in the first region as a function of how often they are involved in the I/O operations and would normally otherwise need to be copied. Remapping may also be made conditional on a function of availability of memory in the first region. In a preferred embodiment of the invention, the I/O requests are initiated by a subsystem within a virtual machine, which runs via an intermediate software layer such as a virtual machine monitor on an underlying hardware and software platform. A typical application of the invention is DMA.

Abstract: The present invention performs energy usage profiling of computing resources using an energy-based interrupt source for sampling. The present invention uses energy consumption as an event to be monitored by specialized profiling hardware. An energy consumption counter tracks the energy consumed by the computing resources and generates an interrupt after a specific energy count is attained. Profiling software uses the counter to statistically estimate the amount of energy used by regions of code at various levels of abstraction. Code that uses more energy to execute will accumulate proportionally more samples, producing an energy usage profile that is both detailed and accurate, as desired.

Abstract: A method is provided for scheduling execution of a plurality of threads executed in a multithreaded processor. Resource utilizations of each of the plurality of threads are measured while the plurality of threads are concurrently executing in the multithreaded processor. Each of the plurality of threads is scheduled according to the measured resource utilizations using a thread scheduler.

Abstract: A method schedules execution contexts in a computer system based on memory interactions. The computer system includes a processor and a hierarchical memory arranged in a plurality of levels. Memory transactions are randomly sampled for a plurality of contexts. The contexts can be threads, processes, or hardware contexts. Resource interactions of the plurality of contexts is estimated, and particular contexts are chosen to be scheduled based on the estimated resource interactions.

Abstract: A method for sampling the performance of a computer system is provided. The computer system includes a plurality of functional units. The method selects transactions to be processed by a particular functional unit of the computer system. State information is stored while the selected transactions are processed by the functional unit. The state information is analyzed to guide optimization.

Abstract: A method estimates statistics of properties of transactions processed by a memory sub-system of a computer system. The method randomly selects memory transactions processed by the memory sub-system. States of the system are recorded as samples while the selected transaction are processed by the memory sub-system. The recorded states from a subset of the selected transactions are statistically analyzed to estimate statistics of the memory transactions.

Abstract: A method analyzes memory transaction processed by memories of a computer system. The method selects a set of addresses of the memories. State information from a plurality of consecutive predetermined memory transactions to the selected addresses are recorded while the selected transactions are processed by the memories. The selecting and the recording steps are repeated until a termination condition is reached. Then, the recorded state information is statistically analyzed to estimate statistics of properties of the memory interactions among contexts in the computer system.

Abstract: An apparatus for sampling states of a computer system having a hierarchical memory arranged at a plurality of levels, the hierarchical memory storing data at addresses. The apparatus includes a selector for selecting memory transactions based on first state and transaction information. The memory transactions are to be processed by the hierarchical memory. A trigger activates the selector based on second state and transaction information. A sampler stores states of the computer system that are identified with the selected instructions while processing the selected memory transactions in the hierarchical memory.