Vmware, Inc.

Compaq Computer Corporation, Inc.

Digital Equipment Corporation

Facebook, Inc.

Nutanix, Inc.

Cloud Physics, Inc.

Qualcomm Incorporated

Microsoft Technology Licensing, LLC

Hewlett-packard Development Company, L.p.

Other

Carl Alan Waldspurger

Xiaoxin Chen

Pratap Subrahmanyam

Jeffrey Adgate Dean

Irfan Ahmad

William Edward Weihl

James E Hicks, Jr

John R Zedlewski

Anil Rao

Ajay Gulati

Alexander T Garthwaite

Oded Horovitz

George Z Chrysos

Rajesh Venkatasubramanian

Michael Nelson

Tal Garfinkel

Sahil Rihan

Stephen A Weis

Daniel J Scales

Puneet Zaroo

Nohhyun Park

Ole Agesen

Haoqiang Zheng

Andrei Dorofeev

Jyothir Ramanan

Florian Anselm Johannes Schmidt

Richard West

Xiao Zhang

Ganesha Shanmuganathan

Edward J McLellan

Dan Boneh

Yury Baskakov

Daniel Lawrence Leibholz

Edouard Bugnion

Osten Kit Colbert

Derek Robert Hower

Vivek Pandey

Dmitriy Budko

Jonathan James Davies

Daniel R K Ports

Harold Wade Cain, Iii

Kiran Tati

Matthew Eccleston

Minwen Ji

Kinshuk Govil

Robert A Eustace

Balaji Parimi

Jennifer-Ann M Anderson

Venkata Adusumilli

Dilpreet S Bindra

Patrick Tullmann

Parag Bajaria

Colin Beaton Verrilli

Sanjay Ghemawat

Natarajan Vaidhyanathan

Michael Burrows

Richard Lee Sites

Keith Farkas

Monika Hildegard Henzinger

Ryan Donovan Wells

Jeffrey Todd Bridges

Boris Weissman

Shivam Priyadarshi

Vyacheslav Vladimirovich Malyugin

Vikramjit Sethi

Felipe Franciosi

Mattheus Cornelis Antonius Adrianus Heddes

Ishan Banerjee

Jesse Pool

Timothy P Mann

Ramesh Dharan

Sanjay Bhikhubhai Patel

Stephen C Root

Gabriel Martel Tarr

Tongping Liu

Rajit S Kambo

Maya Neelakandhan

Koustav Bhattacharya

Alex Garthwaite

Stephen Muckle

Pin Lu

Lance M Berc

Naveen Teja Jangalapalli

Gregory T Harmon

Chethan Kumar

Gregory T Harm

SeyedMajid Zahedi

Michael Craig

Chih Kang Lin

Shaun Applegate-Swanson

Bijan Mottahedeh

Ivan Teterevkov

Christopher Joel Riches

Shaun Robert Applegate-swanson

Naga Venkata Naveen Teja Jangalapalli

Nicholas James Barretta

Guruprasad Ramprakash

In some aspects, an apparatus includes a processor and a memory. In some embodiments, the memory includes programmed instructions that, when executed by the processor, cause the apparatus to intercept an I/O transaction between a virtual machine and an I/O device, determine whether data in the I/O transaction indicates a security misconfiguration, and perform a remedial action in response to identifying the security misconfiguration.

Systems and methods for transparently detecting unencrypted virtual machine I/O

In some aspects, a non-transitory computer readable storage medium includes instructions stored thereon that, when executed by a processor, cause the processor to detect that system software is proceeding to swap memory content of a virtual machine (VM) from memory to storage, wherein the memory is allocated to the VM; buffer the memory content; and perform alternative memory reclamation of the memory.

VM memory reclamation by buffering hypervisor-swapped pages

Methods, systems, apparatuses, and computer-readable storage mediums are described for assigning a security risk score to a resource. In one example, resource access data is collected for a resource. Based at least on the resource access data, a data risk index (DRI) score is generated for the resource. The DRI score comprises a value that is indicative of a level of risk that the resource will be compromised. At least one of the DRI score, an alert based at least on the DRI score, or a policy change for the resource based at least on the generated DRI score is reported to an administrator.

Determining data risk and managing permissions in computing environments

In some aspects, a non-transitory computer readable storage medium includes instructions stored thereon that, when executed by a processor, cause the processor to create a virtual swap space that is exposed to a core system software, intercept a first page selected by the core system software to be swapped out to the virtual swap space, map the virtual swap space to a physical swap space that is allocated to a type of page associated with first swap metadata, and write the first page to the physical swap space based on the first page having the first swap metadata. In some embodiments, the first page is associated with the first swap metadata.

Systems and methods for transparent swap-space virtualization

Various embodiments disclosed herein are related to a non-transitory computer readable storage medium. In some embodiments, the medium includes instructions stored thereon that, when executed by a processor, cause the processor to receive, from a user-space application, a request to detect swapping activity satisfying a threshold condition, detect the swapping activity satisfying the threshold condition, and, in response to occurrence of the threshold condition, send a response that indicates that the swapping activity satisfies the threshold condition.

Early event-based notification for VM swapping

Access privileges of at least one identity to resources are adjusted within an authorization system of a computing environment. Over a detection period, accesses by the identity to the resources are detected and a usage score is computed as a usage function of a measure of use by the identity of access privilege(s) it has been granted to at least one of the resources relative to a measure of a set of possible grantable privileges. In accordance with a least privilege security policy, and according to the usage score, the set of access privileges granted to the identity may then be adjusted.

Method and system for quantifying and improving conformance to least privilege security policies

Various embodiments disclosed herein are related to a non-transitory computer readable storage medium. In some embodiments, the medium includes instructions stored thereon that, when executed by a processor, cause the processor to send an indication of a first storage location to a destination host. In some embodiments, the first storage location includes content that is swapped out from a memory location in a source host. In some embodiments, the indication includes one or more of a logical address and a first physical address. In some embodiments, the medium includes instructions stored thereon that, when executed by a processor, cause the processor to map the logical address of the first storage location to a second physical address of a second storage location. In some embodiments, the destination host accesses the content of the first storage location.

Just-in-time virtual per-VM swap space

Systems and methods are directed to managing access to a shared memory. A request received at a memory controller, for access to the shared memory from a client of one or more clients configured to access the shared memory, is placed in at least one queue in the memory controller. A series of one or more timeout values is assigned to the request, based, at least in part on a priority associated with the client which generated the request. The priority may be fixed or based on a Quality-of-Service (QoS) class of the client. A timer is incremented while the request remains in the first queue. As the timer traverses each one of the one or more timeout values in the series, a criticality level of the request is incremented. A request with a higher criticality level may be prioritized for servicing over a request with a lower criticality level.

QoS-class based servicing of requests for a shared resource

A method and tangible medium embodying code for allocating resource units of an allocatable resource among a plurality of clients in a computer is described. In the method, resource units are initially distributed among the clients by assigning to each of the clients a nominal share of the allocatable resource. For each client, a current allocation of resource units is determined. A metric is evaluated for each client, the metric being a function both of the nominal share and a usage-based factor, the usage-based factor being a function of a measure of resource units that the client is actively using and a measure of resource units that the client is not actively using. A resource unit can be reclaimed from a client when the metric for that client meets a predetermined criterion.

Resource allocation in computers

A virtual-machine-based system that identifies an application or process in a virtual machine in order to locate resources associated with the identified application. Access to the located resources is then controlled based on a context of the identified application. Those applications without the necessary context will have a different view of the resource.

Secure identification of execution contexts

To generate a checkpoint for a virtual machine (VM), first, while the VM is still running, a copy-on-write (COW) disk file is created pointing to a parent disk file that the VM is using. Next, the VM is stopped, the VM's memory is marked COW, the device state of the VM is saved to memory, the VM is switched to use the COW disk file, and the VM begins running again for substantially the remainder of the checkpoint generation. Next, the device state that was stored in memory and the unmodified VM memory pages are saved to a checkpoint file. Also, a copy may be made of the parent disk file for retention as part of the checkpoint, or the original parent disk file may be retained as part of the checkpoint. If a copy of the parent disk file was made, then the COW disk file may be committed to the original parent disk file.

Generating and using checkpoints in a virtual computer system

Allocating power between multiple central processing units (CPUs) in a multi-CPU processor based on total current availability and individual CPU quality-of-service (QoS) requirements is disclosed. Current from a power rail is allocated to CPUs by a global current manger (GCM) circuit related to performance criteria set by CPUs. The CPUs can request increased current allocation from the GCM circuit, such as in response to executing a higher performance task. If the increased current allocation request keeps total current on the power rail within its maximum rail current limit, the GCM circuit approves the request to allow the CPU increased current allocation. This can allow CPUs executing higher performance tasks to have a larger current allocation than CPUs executing lower performance tasks without the maximum rail current limit being exceeded, and without having to necessarily lower voltage of the power rail, which could unnecessarily lower performance of all CPUs.

Allocating power between multiple central processing units (CPUs) in a multi-CPU processor based on total current availability and individual CPU quality-of-service (QoS) requirements

Providing fine-grained Quality of Service (QoS) control using interpolation for partitioned resources in processor-based systems is disclosed. In this regard, in one aspect, a processor-based system provides a partitioned resource (such as a system cache or memory access bandwidth to a shared system memory) that is subdivided into a plurality of partitions, and that is configured to service a plurality of resource clients. A resource allocation agent of the processor-based system provides a plurality of allocation indicators corresponding to each combination of resource client and partition, and indicating an allocation of each partition for each resource client. The resource allocation agent allocates the partitioned resource among the resource clients based on an interpolation of the plurality of allocation indicators. Because each allocation indicator may be different for each combination of resource client and partition, interpolation of the allocation indicators provides a higher-resolution aggregate resource allocation for each resource client.

Providing fine-grained quality of service (QoS) control using interpolation for partitioned resources in processor-based systems

Techniques for implicit coscheduling of CPUs to improve corun performance of scheduled contexts are described. One technique minimizes skew by implementing corun migrations, and another technique minimizes skew by implementing a corun bonus mechanism. Skew between schedulable contexts may be calculated based on guest progress, where guest progress represents time spent executing guest operating system and guest application code. A non-linear skew catch-up algorithm is described that adjusts the progress of a context when the progress falls far behind its sibling contexts.

Implicit co-scheduling of CPUs

In a virtualized computer system, guest memory pages are mapped to disk blocks that contain identical contents and the mapping is used to improve management processes performed on virtual machines, such as live migration and snapshots. These processes are performed with less data being transferred because the mapping data of those guest memory pages that have identical content stored on disk are transmitted instead of the their contents. As a result, live migration and snapshots can be carried out more quickly. The mapping of the guest memory pages to disk blocks can also be used to optimize other tasks, such as page swaps and memory error corrections.

Mapping guest pages to disk blocks to improve virtual machine management processes

Growing community of inventors

Palo Alto, CA, United States of America

Carl Alan Waldspurger