Controlling access to groups of memory pages in a virtualized environment

Patent metadata

Field	Value
Publication number	US-9298639-B2
Application number	US-201514755355-A
Country	US
Kind code	B2
Filing date	Jun 30, 2015
Priority date	Dec 17, 2012
Publication date	Mar 29, 2016
Grant date	Mar 29, 2016

Abstract

Embodiments of an invention for controlling access to groups of memory pages in a virtualized environment are disclosed. In one embodiment, a processor includes a virtualization unit and a memory management unit. The virtualization unit is to transfer control of the processor to a virtual machine. The memory management unit is to perform, in response to an attempt to execute on the virtual machine an instruction stored on a first page, a page walk through a paging structure to find a second page and to allow access to the second page without exiting the virtual machine based at least in part on a bit being set in a leaf level entry corresponding to the second page in the paging structure and a corresponding bit being set in each entry corresponding to the first page in each level of the paging structure.

First claim

What is claimed is:

1. A processor comprising:
a virtualization unit to transfer control of the processor to a virtual machine;
a memory management unit, including a translation unit to translate linear addresses to guest physical addresses and guest physical addresses to host physical addresses using nested page tables (NPT) and to perform, in response to a first attempt to execute on the virtual machine a first instruction stored on a first page, a first page walk through a first NPT paging structure to find a second page and to allow access to the second page without exiting the virtual machine based at least in part on a first bit being set in a first leaf level entry corresponding to the second page in the first NPT paging structure and a corresponding second bit being set in each entry corresponding to the first page in each level of the first NPT paging structure.

2. The processor of claim 1 , wherein the memory management unit is also to perform, in response to a second attempt to execute on the virtual machine a second instruction stored on a third page, a second page walk through the first NPT paging structure to find the second page and to deny access to the second page without exiting the virtual machine based at least in part on the first bit being set in the first leaf level entry corresponding to the second page in the first NPT paging structure and a corresponding third bit being set in each entry corresponding to the third page in each level of the first NPT paging structure.

3. The processor of claim 2 , wherein the memory management unit is also to perform, in response to a third attempt to execute on the virtual machine a third instruction stored on a fourth page, a third page walk through the first NPT paging structure to find a fifth page and to allow access to the fifth page without exiting the virtual machine based at least in part on a fourth bit being set in a second leaf level entry corresponding to the fifth page in the first NPT paging structure and a corresponding fifth bit being set in each entry corresponding to the fourth page in each level of the first NPT paging structure.

4. The processor of claim 3 , wherein the memory management unit is also to perform, in response to a fourth attempt to execute on the virtual machine a fourth instruction stored on a sixth page, a fourth page walk through the first NPT paging structure to find the fifth page and to deny access to the fifth page without exiting the virtual machine based at least in part on the fourth bit being set in the second leaf level entry corresponding to the fifth page in the first NPT paging structure and a corresponding sixth bit being set in each entry corresponding to the sixth page in each level of the first NPT paging structure.

5. The processor of claim 4 , wherein the memory management unit is also to perform, in response to a fifth attempt to execute on the virtual machine a fifth instruction stored on a seventh page, a fifth page walk through the first NPT paging structure to find the eighth page and to perform a view switch to a second NPT paging structure without exiting the virtual machine based at least in part on logical OR of a group of bits in a third leaf level entry corresponding to the eighth page in the first NPT paging structure being ‘1’.

6. The processor of claim 5 , wherein the first group of bits does not include the first bit or the fourth bit.

7. The processor of claim 6 , further comprising a storage location to indicate the number of bits in the group.

8. A method comprising:
entering a virtual machine;
performing a first page walk through a first nested page table (NPT) paging structure in response to a first attempt to execute in the virtual machine a first instruction stored on a first page;
finding a second page through the first page walk;
determining that a first bit in a first leaf level entry corresponding to the second page in the first NPT paging structure is set;
determining that a corresponding second bit in each entry corresponding to the first page in each level of the first NPT paging structure is set; and
allowing access to the second page without exiting the virtual machine.

9. The method of claim 8 , further comprising, after entering the virtual machine:
performing a second page walk through the first NPT paging structure in response to a second attempt to execute in the virtual machine a second instruction stored on a third page;
finding the second page through the second page walk;
determining that a third bit in a first leaf level entry corresponding to the second page in the first NPT paging structure is set;
determining that a corresponding fourth bit in each entry corresponding to the third page in each level of the first NPT paging structure is set; and
denying access to the second page without exiting the virtual machine.

10. The method of claim 9 , further comprising, after entering the virtual machine:
performing a third page walk through the first NPT paging structure in response to a third attempt to execute in the virtual machine a third instruction stored on a fourth page;
finding a fifth page through the third page walk;
determining that a fifth bit in a second leaf level entry corresponding to the fifth page in the first NPT paging structure is set;
determining that a corresponding sixth bit in each entry corresponding to the fourth page in each level of the first NPT paging structure is set; and
allowing access to the fifth page without exiting the virtual machine.

11. The method of claim 10 , further comprising, after entering the virtual machine:
performing a fourth page walk through the first NPT paging structure in response to a fourth attempt to execute in the virtual machine a fourth instruction stored on a sixth page;
finding the fifth page through the fourth page walk;
determining that a seventh bit in the second leaf level entry corresponding to the fifth page in the first NPT paging structure is set;
determining that a corresponding eighth bit in each entry corresponding to the sixth page in each level of the first NPT paging structure is set; and
denying access to the fifth page without exiting the virtual machine.

12. The method of claim 11 , further comprising, after entering the virtual machine:
performing a fifth page walk through the first NPT paging structure in response to a fifth attempt to execute in the virtual machine a fifth instruction stored on a seventh page;
finding an eighth page through the fifth page walk;
performing a logical OR on a group of bits in a third leaf level entry corresponding to the eighth page;
determining that the result of the logical OR is ‘1’; and
performing a view switch to a second NPT paging structure without exiting the virtual machine.

13. The method of claim 12 , wherein the first group of bits does not include the first bit or the fourth bit.

14. The method of claim 13 , further comprising programming a control structure for the virtual machine with the number of bits in the group.

15. The method of claim 14 , further comprising finding in a control structure for the virtual machine a pointer to a table storing a pointer to the second NPT paging structure.

16. The method of claim 15 , further comprising finding the pointer to the second NPT paging structure using a value stored in the group of bits.

17. The method of claim 9 , further comprising, after entering the virtual machine:
performing a third page walk through the first NPT paging structure in response to a third attempt to execute in the virtual machine a third instruction

Assignees

• Intel Corp

Inventors

• Liu Baohong
• Sood Ritu
• Tseng Kuo-Lang
• Tallam Madhukar

Classifications

• G06F12/145

  the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism · CPC title

• G06F2212/151

  Emulated environment, e.g. virtual machine · CPC title

• G06F12/1009 Primary

  using page tables, e.g. page table structures · CPC title

• G06F2212/657

  Virtual address space management · CPC title

• G06F2009/45583

  Memory management, e.g. access or allocation · CPC title