Abstract: A method is provided for creating and maintaining the validity of a cache group including one or more cache elements. Each of the cache elements corresponds to a different address space in a virtual memory of a computer system. Each of the cache elements include one or more caches that store mappings from virtual addresses to data or values that are functions of or dependent upon physical addresses that correspond to the virtual addresses. When there is an address space switch from a first address space to a second address space, the cache group is searched to find the cache element corresponding to the second address space, and that found cache element is made the current cache element for virtual memory access through the cache element. Changes in the page tables are also detected and reflected in the caches of the cache group to maintain the caches up-to-date.

Abstract: A component manages and minimizes latency introduced by virtualization. The virtualization component determines that a currently scheduled guest process has executed functionality responsive to which the virtualization component is to execute a virtualization based operation, wherein the virtualization based operation is one that is not visible to the guest operating system. The virtualization component causes the guest operating system to de-schedule the currently scheduled guest process and schedule at least one separate guest process. The virtualization component then executes the virtualization based operation concurrently with the execution of the at least one separate guest process. Responsive to completing the execution of the virtualization based operation, the virtualization component causes the guest operating system to re-schedule the de-scheduled guest process.

Abstract: A computer system has secondary data that is derived from primary data, such as entries in a TLB being derived from entries in a page table. When an actor changes the primary data, a producer indicates the change in a set data structure, such as a data array, in memory that is shared by the producer and a consumer. There may be multiple producers and multiple consumers and each producer/consumer pair has a separate channel. At coherency events, at which incoherencies between the primary data and the secondary data should be removed, consumers read the channels to determine the changes, and update the secondary data accordingly. The system may be a multiprocessor virtual computer system, the actor may be a guest operating system, and the producers and consumers may be subsystems within a virtual machine monitor, wherein each subsystem exports a separate virtual central processing unit.

Abstract: To generate a checkpoint for a virtual machine (VM), first, while the VM is still running, a copy-on-write (COW) disk file is created pointing to a parent disk file that the VM is using. Next, the VM is stopped, the VM' s memory is marked COW, the device state of the VM is saved to memory, the VM is switched to use the COW disk file, and the VM begins running again for substantially the remainder of the checkpoint generation. Next, the device state that was stored in memory and the unmodified VM memory pages are saved to a checkpoint file. Also, a copy may be made of the parent disk file for retention as part of the checkpoint, or the original parent disk file may be retained as part of the checkpoint. If a copy of the parent disk file was made, then the COW disk file may be committed to the original parent disk file.

Abstract: For a virtual memory of a virtualized computer system in which a virtual page is mapped to a guest physical page which is backed by a machine page and in which a shadow page table entry directly maps the virtual page to the machine page, reverse mappings of guest physical pages are optimized by removing the reverse mappings of certain immutable guest physical pages. An immutable guest physical memory page is identified, and existing reverse mappings corresponding to the immutable guest physical page are removed. New reverse mappings corresponding to the identified immutable guest physical page are no longer added.

Abstract: For a virtual memory of a virtualized computer system in which a virtual page is mapped to a guest physical page which is backed by a machine page and in which a shadow page table entry directly maps the virtual page to the machine page, reverse mappings of guest physical pages are optimized by removing the reverse mappings of certain immutable guest physical pages. An immutable guest physical memory page is identified, and existing reverse mappings corresponding to the immutable guest physical page are removed. New reverse mappings corresponding to the identified immutable guest physical page are no longer added.

Abstract: A provisioning server automatically configures a virtual machine (VM) according to user specifications and then deploys the VM on a physical host. The user may either choose from a list of pre-configured, ready-to-deploy VMs, or he may select which hardware, operating system and application(s) he would like the VM to have. The provisioning server then configures the VM accordingly, if the desired configuration is available, or it applies heuristics to configure a VM that best matches the user's request if it isn't. The invention also includes mechanisms for monitoring the status of VMs and hosts, for migrating VMs between hosts, and for creating a network of VMs.

Abstract: A provisioning server automatically configures a virtual machine (VM) according to user specifications and then deploys the VM on a physical host. The user may either choose from a list of pre-configured, ready-to-deploy VMs, or he may select which hardware, operating system and application(s) he would like the VM to have. The provisioning server then configures the VM accordingly, if the desired configuration is available, or it applies heuristics to configure a VM that best matches the user's request if it isn't. The invention also includes mechanisms for monitoring the status of VMs and hosts, for migrating VMs between hosts, and for creating a network of VMs.

Abstract: To generate a checkpoint for a virtual machine (VM), first, while the VM is still running, a copy-on-write (COW) disk file is created pointing to a parent disk file that the VM is using. Next, the VM is stopped, the VM's memory is marked COW, the device state of the VM is saved to memory, the VM is switched to use the COW disk file, and the VM begins running again for substantially the remainder of the checkpoint generation. Next, the device state that was stored in memory and the unmodified VM memory pages are saved to a checkpoint file. Also, a copy may be made of the parent disk file for retention as part of the checkpoint, or the original parent disk file may be retained as part of the checkpoint. If a copy of the parent disk file was made, then the COW disk file may be committed to the original parent disk file.

Abstract: A virtual-machine-based system that identifies an application or process in a virtual machine in order to locate resources associated with the identified application. Access to the located resources is then controlled based on a context of the identified application. Those applications without the necessary context will have a different view of the resource.

Abstract: A virtual-machine-based system that may protect the privacy and integrity of application data, even in the event of a total operating system compromise. An application is presented with a normal view of its resources, but the operating system is presented with an encrypted view. This allows the operating system to carry out the complex task of managing an application's resources, without allowing it to read or modify them. Different views of “physical” memory are presented, depending on a context performing the access. An additional dimension of protection beyond the hierarchical protection domains implemented by traditional operating systems and processors is provided.

Abstract: A virtual-machine-based system provides a mechanism to implement application file I/O operations of protected data by implementing the I/O operations semantics in a shim layer with memory-mapped regions. The semantics of these I/O operations are emulated in a shim layer with memory-mapped regions by using a mapping between a process' address space and a file or shared memory object. Data that is protected from viewing by a guest OS running in a virtual machine may nonetheless be accessed by the process.

Abstract: A virtual-machine-based system provides a mechanism for a virtual machine monitor (VMM) to process a hypercall received from an application running in the virtual machine (VM). A hypercall interface causes the virtual memory pages, needed by the VMM to process the hypercall, to be available to the VMM. In one embodiment, when virtual memory pages needed by the VMM to process the hypercall are not available to the VMM, the application is caused to access the needed pages, in response to which the required virtual memory becomes available to the VMM.

Abstract: A virtual-machine-based system provides a control-transfer mechanism to invoke a user-mode application handler from existing virtual hardware directly, without going through an operating system kernel running in the virtual machine. A virtual machine monitor calls directly to the guest user-mode handler and the handler transfers control back to the virtual machine monitor, without involving the guest operating system.

Abstract: One embodiment of the present invention is a method of operating a virtualization system, the method including: (a) instantiating a guest in a virtual machine of the virtualization system; and (b) monitoring execution of code registered for monitored execution in an execution context of the guest, wherein the monitoring is performed by the virtualization system and is hidden from computations of the guest.

Abstract: One embodiment of the present invention includes a method for: (a) executing guest computations in a virtual machine of the virtualization system; and (b) forcing execution of registered code into an execution context of the guest, wherein the forcing is performed from the virtualization system based on an execution trigger monitored without reliance on functionality of the guest software.

Abstract: A method for executing on a local user system a body of computer-executable code that resides on a provider system is described. A modified image of the computer executable code is installed to a virtual disk on the local user system, the modified image comprising file structure information. The installing comprises creating each of the local files to the virtual disk with null data, wherein upon installation of the modified image, a plurality of disk blocks assigned to the local files contain a null indicator and do not contain any processable content. A streaming control module senses a request to access the virtual disk, determines whether streaming is indicated to satisfy the request, and transfers to the user system the processable content corresponding to the requested disk block. Streaming is indicated when the request corresponds to one of the disk blocks that does not contain any processable content.

Abstract: System and method are described for program analysis with data caching. Briefly described, in architecture, the system can be implemented as follows. The present invention for program analysis with data caching includes a counter for tracking each time on of a plurality of blocks of code in the computer program is executed. A counter cache stores the plurality of counters of the plurality of blocks of code that are most recently executed. A storage area stores a plurality of counters of the plurality of blocks of code that are not most recently executed code.

Abstract: A computer system has secondary data that is derived from primary data, such as entries in a TLB being derived from entries in a page table. When an actor changes the primary data, a producer indicates the change in a set data structure, such as a data array, in memory that is shared by the producer and a consumer. There may be multiple producers and multiple consumers and each producer/consumer pair has a separate channel. At coherency events, at which incoherencies between the primary data and the secondary data should be removed, consumers read the channels to determine the changes, and update the secondary data accordingly. The system may be a multiprocessor virtual computer system, the actor may be a guest operating system, and the producers and consumers may be subsystems within a virtual machine monitor, wherein each subsystem exports a separate virtual central processing unit.

Abstract: A computer system includes at least one virtual machine that has a plurality of virtual processors all running on an underlying hardware platform. A software interface layer such as a virtual machine monitor establishes traces on primary structures located in a common memory space as needed for the different virtual processors. Whenever any one of the virtual processors generates a trace event, such as accessing a traced structure, then a notification is sent to at least the other virtual processors that have a trace on the accessed primary structure. In some applications, the VMM derives and maintains secondary structures corresponding to the primary structures, such as where the VMM converts, through binary translation, original code intended to run on a virtual processor into code that can be run on an underlying physical processor of the hardware platform. In these applications, the VMM may rederive or invalidate the secondary structures as needed upon receipt of the notification of the trace event.