Nested virtualization for virtual machine exits

Patent metadata

Field	Value
Publication number	US-10146570-B2
Application number	US-201515118844-A
Country	US
Kind code	B2
Filing date	Sep 25, 2015
Priority date	Sep 25, 2015
Publication date	Dec 4, 2018
Grant date	Dec 4, 2018

Abstract

Memory security technologies are described. An example processing device includes a processor core and a memory controller coupled to the processor core and a memory. The processor core can determine that an exit condition to transfer control of a resource for a processor core from a first virtual machine monitor (VMM) to a second VMM has occurred. The processor core can also determine whether a control virtual machine control structure (VMCS) link pointer is valid. The processor core can also determine whether a reason value corresponding to the control VMCS link pointer is set. The processor core can also determine whether the reason value is set to zero. The processor core can also determining whether an exception bit corresponding to a specific exception type of a reason value is set. The processor core can also transfer a control of the resource from the first VMM to the second VMM.

First claim

What is claimed is:

1. A processing device comprising:
a processor core; and
a memory controller coupled between the processor core and a memory, wherein the processor core is to perform the following:
determine that an exit condition to transfer resource control of the processor core from a first virtual machine monitor (VMM) to a second VMM has occurred;
determine that a control virtual machine control structure (VMCS) link pointer of a VMCS for the first VMM is valid;
determine, in response to the control VMCS link pointer being valid, when a reason value corresponding to the control VMCS link pointer is set;
determine, in response to the reason value being set, that the reason value is set to zero;
determine, in response to the reason value being set to zero, that an exception bit corresponding to the reason value is set; and
transfer, in response to the exception bit being set, a control of a resource from the first VMM to the second VMM.

2. The processing device of claim 1 , wherein the first VMM operates in a non-root mode and the second VMM operates in the non-root mode.

3. The processing device of claim 1 , wherein the processor core is to transfer the resource control from the first VMM to a third VMM in response to at least one of:
the control VMCS link pointer being invalid;
the reason value not being set; or
the exception bit not being set.

4. The processing device of claim 3 , wherein the first VMM operates in a non-root mode and the third VMM operates in a root mode.

5. The processing device of claim 1 , wherein the processor core is to transfer, in response to the reason value not being set to zero, the resource control from the first VMM to the second VMM.

6. The processing device of claim 1 , wherein
the VMCS comprises: a guest field; a host field; control fields; a VM entry field; and a VM exit field, and
the control fields comprises: a VMCS link pointer; a state VMCS link pointer; a control VMCS link pointer; a reason bitmap; and an exception bitmap.

7. The processing device of claim 6 , wherein the processor core is to:
save, to the guest field, a first processor state that is pointed to by the state VMCS link pointer;
load, to the host field, a second processor state that is pointed to by the state VMCS link pointer;
copy, to the control fields, data from control fields of a second VMCS pointed to by the control VMCS link pointer; and
clear a validity bit at a VM entry interruption information field of the VM entry field.

8. The processing device of claim 6 , wherein the processor core is to:
set the state VMCS link pointer to a first predefined fixed value to disable the state VMCS link pointer;
set the control VMCS link pointer to a second predefined fixed value to disable the control VMCS link pointer;
set the reason bitmap to a predefined fixed value to disable the reason bitmap; and
set the exception bitmap to zero to disable the exception bitmap.

9. The processing device of claim 1 , wherein the processor core is to:
determine that the second VMM has completed an event associated with the exit condition; and
transfer the resource control from the first VMM to a third VMM operating in a root mode.

10. A method comprising:
determining that an exit condition to transfer control of a resource for a processor core from a first virtual machine monitor (VMM) to a second VMM has occurred;
determining that a control virtual machine control structure (VMCS) link pointer is valid;
determining, in response to control VMCS link pointer being valid, that a reason value corresponding to the control VMCS link pointer is set;
determining, in response to the reason value being set, that the reason value is set to zero;
determining, in response to the reason value being set to zero, that an exception bit corresponding to a specification exception type of a reason value is set; and
transferring, in response to the exception bit being set, a control of the resource from the first VMM to the second VMM.

11. The method of claim 10 , wherein the first VMM operates in a non-root mode and the second VMM operates in the non-root mode.

12. The method of claim 10 , further comprising transferring the control of the resource from the first VMM to a third VMM in response to at least one of:
the control VMCS link pointer being invalid;
the reason value not being set; or
the exception bit not being set.

13. The method of claim 12 , wherein the first VMM operates in a non-root mode and the third VMM operates in a root mode.

14. The method of claim 10 , further comprising transferring, in response to the reason value not being set to zero, the control of the resource from the first VMM to the second VMM.

Assignees

• Intel Corp
• Wang Kai
• Zhu Bing
• Zou Peng
• Castelino Manohar

Inventors

• Wang Kai
• Zhu Bing
• Zou Peng
• Castelino Manohar

Classifications

• G06F2009/45566

  Nested virtual machines · CPC title

• G06F9/5027

  the resource being a machine, e.g. CPUs, Servers, Terminals · CPC title

• G06F2009/4557

  Distribution of virtual machine instances; Migration and load balancing · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F9/50

  Allocation of resources, e.g. of the central processing unit [CPU] · CPC title