Sun Microsystems, Inc.

Vmware, Inc.

Oracle America, Inc.

Bracket Computing, Inc.

Netapp, Inc.

Andrew G Tucker

Ozgur C Leonard

Jason Ansel Lango

Yousef A Khalidi

Madhusudhan Talluri

Declan J Murphy

Daniel J Scales

Michael Nelson

Daniel B Price

John K Edwards

Nitin Bahadur

William McGovern

Krishna Yadappanavar

Andrei Dorofeev

James J Voll

Christian Czezatke

Bart Smaalders

Jose M Bernabeu-Auban

Kevin George

David S Comay

Adam Cain

John T Beck

Subramaniam Periyagaram

Nicolai Kosche

Vladimir Matena

Eric P Forgette

Jose Mathew

Eric Christopher Saxe

Mohit Gupta

Varun Jobanputra

Stephen Charles Hahn

Sisir Shekhar

Jonathan Chew

Tim P Marsland

Eric E Lowe

Casper H Dik

Vishwajith Shivappa

Liane Praza

Andrew D Gabriel

Dave Singleton

Andrei V Dorofeev

In an embodiment, a secure boot method comprises writing a wrapped data encryption key (DEK) and a wrapped key encryption key (KEK) onto a label of a wrapped operating system image prior to uploading the wrapped operating system image to a virtual data center using one or more computing devices.

Secure boot of virtualized computing instances

In an approach, a secure boot process includes two phases. In the first phase an on premises device generates a data encryption key (DEK) with which to encrypt an operating system image and a key encryption key (KEK) with which to wrap the DEK. The on-premises device then utilizes a key management service to wrap the KEK with an account root key and writes the wrapped DEK and wrapped KEK onto a label of the encrypted operating system image. The encrypted operating system image is then uploaded to a virtual data center and merged with an intermediary guest manager image. When the encrypted machine image is used to generate a virtual machine instance, the intermediary guest manager utilizes the key management service to unwrap the KEK. The unwrapped KEK is then used to unwrap the wrapped DEK which is then used to launch the encrypted guest operating system.

One or more services for enhancing guest utilization of a virtual machine and other VDC resources may be provided at the intermediary manager. In an embodiment, the intermediary manager intercepts a hypercall from a guest operating system that is separate from the intermediary manager. The intermediary manager determines that a particular intermediary service is associated with the hypercall and causes execution of service instructions associated with the particular intermediary service. The intermediary manager and guest operating systems may operate within a virtual machine hosted by a host machine and managed by a hypervisor. Embodiments may be useful in any of a virtualized enterprise computer system; a virtual machine infrastructure in a private data center; computing, storage or networking resources in a private cloud; computing, storage or networking resources of cloud service provider; and a hybrid cloud computing environment.

Expansion of services for a virtual data center guest

Systems and methods for tracking changes and performing backups to a storage device are provided. For virtual disks of a virtual machine, changes are tracked from outside the virtual machine in the kernel of a virtualization layer. The changes can be tracked in a lightweight fashion with a bitmap, with a finer granularity stored and tracked at intermittent intervals in persistent storage. Multiple backup applications can be allowed to accurately and efficiently backup a storage device. Each backup application can determine which block of the storage device has been updated since the last backup of a respective application. This change log is efficiently stored as a counter value for each block, where the counter is incremented when a backup is performed. The change log can be maintained with little impact on I/O by using a coarse bitmap to update the finer grained change log.

Method for tracking changes in virtual disks

In one embodiment, the present invention provides techniques for managing activities of processes using a fine grained privilege model in an operating system environment partitioned into a global zone and one or more non-global zones for isolating processes from processes executing in association with other non-global zones under control of a single operating kernel instance.

Fine-grained privileges in operating system partitions

One or more techniques and/or systems are provided for non-disruptively addressing misalignment between a virtual data format and an underlying data format. Virtual data, such as a guest operating system of a virtual machine, may be stored within a virtual structure, such as a virtual machine disk, according to a virtual data format. The virtual structure may be stored within a storage device according to a storage data format. If misalignment is detected, then a new data container may be created within the storage device. A shim, sized according to a misalignment offset, may be inserted into the new data container in order to align the new data container with the storage device. Virtual data may be migrated from the virtual structure to the new data container to achieve alignment. During the migration, the virtual data may remain available from the virtual structure (e.g., a virtual machine may still execute).

Non-disruptive realignment of virtual data

Techniques for creating a fault tolerant system in a virtual machine environment utilize a primary VM and a backup VM. To initialize the fault tolerant system, the backup VM and primary VM start from the same state. To achieve this in one embodiment, the primary VM is suspended and the state of the primary VM is copied to the backup VM. Once the backup VM has received all the primary VM's state, the primary VM is resumed. Subsequent state changes of the primary VM are buffered until the backup VM resumes, connects to the primary VM, and starts consuming the buffered content. Thereafter, synchronization is maintained by the primary VM's writing relevant state changes to a log and the backup VM's reading such relevant state changes from the log.

Using virtual machine cloning to create a backup virtual machine in a fault tolerant system

A fault-tolerant virtualized computer system comprises a primary host executing a primary virtual machine (VM) and a backup host executing a backup VM. In one embodiment, each VM includes a virtual disk mapped to a shared disk image on physical disk accessible to both hosts. A virtual disk IO request is received by virtualization software executing on the backup host from a backup VM. When the virtual disk IO request is a read request, the virtual disk IO request is mapped to a physical read IO request of a virtual disk image stored on a physical disk, the physical read IO request is issued to the physical disk. However, when the virtual disk IO request is a write request, it is assumed to be completed without mapping the virtual disk IO request or issuing a mapped physical IO request to the physical disk.

Storage handling for fault tolerance in virtual machines

A mechanism is provided for implementing multi-level resource control in operating system partitions. In one implementation, one or more non-global partitions may be established within a global operating system environment provided by an operating system. Each non-global partition may have one or more projects executing therein, and each project may comprise one or more processes. Each non-global partition may have associated therewith a first resource limit. This resource limit indicates how much of a particular resource has been allocated to the non-global partition as a whole. Each project executing within a non-global partition may have associated therewith a second resource limit. This limit indicates what amount of the particular resource allocated to the non-global partition has been allocated to that project. By setting multiple limits in this manner, it is possible to control resource allocation at multiple levels.

Multi-level resource limits for operating system partitions

A mechanism is disclosed for system accounting in an operating system environment that has been partitioned into a global zone and one or more non-global zones. Each zone is associated with one or more processes that execute in association with that zone. Each zone contains a separate system accounting log file. When a process terminates, the process invokes an exit function implemented by a kernel that controls all of the zones. In response, the kernel determines in which zone the process executed. The kernel adds, to the system accounting log file of the zone in which the process executed, a first record that indicates accounting information for the process. The kernel also may add a second record to a global system accounting log file. The first record may contain details specified by a non-global zone's settings, while the second record may contain different details specified by the global zone's settings.

System accounting for operating system partitions

An abstraction layer is comprised in the operating system that represents the particulars of the PPMs. The abstractions in the abstraction layer are differentiated from one another by parameters representing the characteristics of the PPMs. The dispatcher uses the abstraction to balance processing loads when assigning execution threads to the PPMs. The assigning of the execution threads and the balancing of the processing loads is performed while taking account of the characteristics of the PPMs, such as shared resources and clock speed.

Processor specific dispatching in a heterogeneous configuration

A mechanism is disclosed for implementing a sparse file system for an operating system partition. In one implementation, a non-global partition is created within a global operating system environment. A file system is then established for the non-global partition. This file system may comprise one or more virtual directories, which reference other directories. Referencing other directories in this manner makes it is possible to avoid having to copy all of the files used by processes running in the non-global partition into the file system. As a result, storage and other system resources can be saved.

Mechanism for implementing a sparse file system for an operating system partition

Growing community of inventors

Menlo Park, CA, United States of America

Andrew G Tucker