Enabling efficient nested virtualization

Patent metadata

Field	Value
Publication number	US-10467033-B2
Application number	US-201113997888-A
Country	US
Kind code	B2
Filing date	Dec 22, 2011
Priority date	Dec 22, 2011
Publication date	Nov 5, 2019
Grant date	Nov 5, 2019

Abstract

Embodiments of the invention enable dynamic level boosting of operations across virtualization layers to enable efficient nested virtualization. Embodiments of the invention execute a first virtual machine monitor (VMM) to virtualize system hardware. A nested virtualization environment is created by executing a plurality of upper level VMMs via virtual machines (VMs). These upper level VMMs are used to execute an upper level virtualization layer including an operating system (OS).
During operation of the above described nested virtualization environment, a privileged instruction issued from an OS is trapped and emulated via the respective upper level VMM (i.e., the VMM that creates the VM for that OS). Embodiments of the invention enable the emulation of the privileged instruction via a lower level VMM. In some embodiments, the emulated instruction is executed via the first VMM with little to no involvement of any intermediate virtualization layers residing between the first and upper level VMMs.

First claim

The invention claimed is:

1. A method for enabling efficient nested virtualization, comprising:
executing a host virtual machine monitor (VMM) to virtualize system hardware;
executing a plurality of nested VMMs via virtual machines (VMs) to create a nested virtualization environment, wherein the plurality of nested VMMs comprises an upper level VMM, and at least one lower level VMM as an intermediate virtualization layer residing between the host VMM and the upper level VMM, wherein the host VMM is the bottom level of the nested virtualization environment and operates in a super-privileged root mode;
trapping a privileged instruction issued from an upper level Operating System (OS) via the upper level VMM;
copying a VM execution context from the upper level VMM to the lower level VMM, including:
copying a physical-to-machine (P2M) mapping table stored in the upper level VMM, wherein the P2M mapping table maps guest physical addresses in the upper level OS to machine addresses in the lower level VMM; and
transferring the P2M mapping table from the upper level VMM to the lower level VMM;
creating a shadow Virtual Machine Control Structure (VMCS) based on captured settings for the upper level OS and settings of the lower level VMM which enable the upper level OS to run under the shadow VMCS;
creating a lower level P2M mapping table for the lower level VMM using the P2M mapping table from the upper level VMM;
merging a Service Level Agreement (SLA) policy of the upper level VMM with an SLA policy of the upper level OS carried in a level boost request issued by the upper level VMM; and
emulating the privileged instruction via the lower level VMM, the lower level VMM to receive an indication of the trapped privileged instruction from one of a physical processor of the system hardware or a parent VMM that is hosting the lower level VMM.

2. The method of claim 1 , wherein the nested virtualization environment comprises a plurality of intermediate virtualization layers included between the host VMM and the upper level VMM, the host VMM to receive the indication of the trapped privileged instruction directly from the physical processor.

3. The method of claim 1 , wherein the upper level VMM to store the execution context in a network file server (NFS), the NFS accessible to the VMMs.

4. The method of claim 3 , wherein the NFS is included in a host machine, the host machine further including the nested virtualization environment.

5. The method of claim 1 , further comprising:
copying VM configuration parameters from the upper level VMM to the lower level VMM.

6. A non-transitory computer readable storage medium including instructions that, when executed by a processor, cause the processor to perform a method comprising:
executing a host virtual machine monitor (VMM) to virtualize system hardware;
executing a plurality of nested VMMs via virtual machines (VMs) to create a nested virtualization environment, wherein the plurality of nested VMMs comprises an upper level VMM, and at least one lower level VMM as an intermediate virtualization layer residing between the host VMM and the upper level VMM, wherein the host VMM is the bottom level of the nested virtualization environment and operates in a super-privileged root mode;
trapping a privileged instruction issued from an upper level Operating System (OS) via the upper level VMM;
copying a VM execution context from the upper level VMM to the lower level VMM, including:

copying a physical-to-machine (P2M) mapping table stored in the upper level VMM, wherein the P2M mapping table maps guest physical addresses in the upper level OS to machine addresses in the lower level VMM; and
transferring the P2M mapping table from the upper level VMM to the lower level VMM;

creating a shadow Virtual Machine Control Structure (VMCS) based on captured settings for the upper level OS and settings of the lower level VMM which enable the upper level OS to run under the shadow VMCS;
creating a lower level P2M mapping table for the lower level VMM using the P2M mapping table from the upper level VMM;
merging a Service Level Agreement (SLA) policy of the upper level VMM with an SLA policy of the upper level OS carried in a level boost request issued by the upper level VMM; and
emulating the privileged instruction via the lower level VMM, the lower level VMM to receive an indication of the trapped privileged instruction from one of a physical processor of the system hardware or a parent VMM that is hosting the lower level VMM.

7. The non-transitory computer readable storage medium of claim 6 , wherein the nested virtualization environment comprises one or more intermediate virtualization layers included between the host VMM and the upper level VMM, and the host VMM to receive the indication of the trapped privileged instruction directly from the physical processor.

8. The non-transitory computer readable storage medium of claim 6 , wherein the upper level VMM to store an execution context in a network file server (NFS), and the NFS is accessible to the VMMs.

9. The non-transitory computer readable storage medium of claim 8 , wherein the NFS is included in a host machine, the host machine further including the nested virtualization environment.

10. The non-transitory computer readable storage medium of claim 6 , the method further comprising:
copying VM configuration parameters from the upper level VMM to the lower level VMM.

11. A system for enabling efficient nested virtualization, comprising:
platform hardware including a processor and a memory;
a host virtual machine monitor (VMM) to present virtualized platform hardware to one or more virtualization layers, wherein the host VMM operates in a super-privileged root mode and is the bottom level of the one or more virtualization layers; and
a plurality of nested VMMs executed via virtual machines (VMs) to create a nested virtualization environment, wherein the plurality of nested VMMs comprises an upper level VMM, and at least one lower level VMM as an intermediate virtualization layer residing between the host VMM and the upper level VMM;
wherein the upper level VMM to further
trap a privileged instruction issued from an Operating System (OS) operating on the upper level VMM, and
copy an execution context to the lower level VMM including:

copying a physical-to-machine (P2M) mapping table stored in the upper level VMM, wherein the P2M mapping table maps guest physical addresses in the upper level OS to machine addresses in the lower level VMM,
transferring the P2M mapping table from the upper level VMM to the lower level VMM,
creating a shadow Virtual Machine Control Structure (VMCS) based on captured settings for the upper level OS and settings of the host lower level VMM which enable the upper level OS to run under the shadow VMCS;
creating a lower level P2M mapping table for the lower level VMM using the P2M mapping table from the upper level VMM;
merging Service Level Agreement (SLA) policy of the upper level VMM with an SLA policy of the upper level OS carried in a level boost request issued by the upper level VMM; and
wherein the lower level VMM to further
receive an indication of the trapped privileged instruction from one of the processor of the platform hardware or a parent VMM that is hosting the lower level VMM,
reconstruct the execution context based on the copied execution context, and emulate the privileged instruction.

12. The system of claim 11 , further comprising:
wherein the root mode VMM to receive an indication of the trapped privileged instruction directly from the processor of the platform hardware.

13. The system o

Assignees

• Tian Kun
• Dong Yao Zu
• Intel Corp

Inventors

• Tian Kun
• Dong Yao Zu

Classifications

• G06F2009/45566

  Nested virtual machines · CPC title

• G06F9/45533 Primary

  Hypervisors; Virtual machine monitors · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title