Determining policy actions for the handling of data read/write extended page table violations

Patent metadata

Field	Value
Publication number	US-9372812-B2
Application number	US-201113995131-A
Country	US
Kind code	B2
Filing date	Dec 22, 2011
Priority date	Dec 22, 2011
Publication date	Jun 21, 2016
Grant date	Jun 21, 2016

Abstract

Embodiments of systems, apparatuses, and methods for determining if an instruction of a virtual machine is allowed to modify a protected memory region are described. In some embodiments, a system detects an indication of an attempt by the instruction to write to the protected memory region. In addition, the system determines if the instruction is allowed to write to the protected memory region based on a starting address and data length of the instruction. Furthermore, if the instruction is allowed to write to the protected memory region, the system updates the protected memory region with the instruction results.

First claim

What is claimed is:

1. A method of determining that an instruction is allowed
to modify a memory region, comprising:
detecting an indication of an attempt by an instruction to write to a protected memory region of a virtual machine, wherein the protected memory region is in a memory page that is covered by an extended page table and the memory page includes an allowed memory region and an unallowed memory region for the instruction;
fetching a data length of the instruction from a virtual machine control structure of the virtual machine;
determining if the instruction is allowed to write to the protected memory region based on a starting address and data length of the instruction; and
in response to the determining the instruction is allowed to write to the protected memory region, updating the protected memory region with the instruction results.

2. The method of claim 1 , wherein the determining comprises:
determining if the instruction is allowed to write into the starting address; and
in response to the determining the instruction is allowed to write into the starting address, determining if the instruction is allowed to write into a data range based on the starting address and the data length.

3. The method of claim 1 , wherein the protected memory region is read-only memory.

4. The method of claim 1 , wherein the indication is an extended page table violation of the protected memory region.

5. The method of claim 1 , further comprising: storing the data length in the virtual machine control structure.

6. The method of claim 5 , wherein storing the data length comprises:
detecting the indication prior to a VMEXIT;
retrieving the data length from the instruction;
storing the data length in a field in the virtual machine control structure; and
raising the VMEXIT.

7. The method of claim 1 , wherein the virtual machine is a virtual system that is running on a host.

8. A device comprising:
a detect violation module configured to detect an indication of an attempt by an instruction to write to a protected memory region;
an access allowed data range module adapted to determine if the instruction is allowed to write to the protected memory region based on a starting address and data length of the instruction, wherein the protected memory region is in a memory page that is covered by an extended page table and the memory page includes an allowed memory region and an unallowed memory region for the instruction;
a fetch data length module adapted to fetch the data length from a virtual machine control structure; and
in response to the determining the instruction is allowed to write to the protected memory region, an update module adapted to update the protected memory region with the instruction results.

9. The device of claim 8 , wherein the further comprises an access allowed data address module adapted to determine if the instruction is allowed to write into the starting address.

10. The device of claim 8 , wherein the protected memory region is read-only memory.

11. The device of claim 10 , wherein the memory page includes an allowed memory region and an unallowed memory region for the instruction.

12. The device of claim 8 , wherein the protected memory region is in a memory page that is covered by an extended page table.

13. The device of claim 8 , wherein the indication is an extended page table violation of the protected memory region.

14. The device of claim 8 , wherein the device further comprises a store data length module configured to store the data length in the virtual machine control structure.

15. A non-transitory machine-readable, medium having executable instructions to cause one or more processing units to perform a method to determine that an instruction is allowed to modify a memory region, the method comprising:
detecting an indication of an attempt by an instruction to write to a protected memory region of a virtual machine, wherein the protected memory region is in a memory page that is covered by an extended page table and the memory page includes an allowed memory region and an unallowed memory region for the instruction;
fetching the data length from a virtual machine control structure of the virtual machine;
determining if the instruction is allowed to write to the protected memory region based on a starting address and data length of the instruction; and
in response to the determining the instruction is allowed to write to the protected memory region, updating the protected memory region with the instruction results.

16. The non-transitory machine-readable medium of claim 15 , wherein the determining comprises:
determining if the instruction is allowed to write into the starting address; and
in response to the determining the instruction is allowed to write into the starting address, determining if the instruction is allowed to write into a data range based on the starting address and the data length.

Assignees

• Tseng Kuo-Lang
• Liu Baohong
• Sood Ritu
• Castelino Manohar Ruben
• Tallam Madhukar
• Intel Corp

Inventors

• Tseng Kuo-Lang
• Liu Baohong
• Sood Ritu
• Castelino Manohar Ruben
• Tallam Madhukar

Classifications

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F12/1441 Primary

  for a range · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F12/1458

  by checking the subject access rights · CPC title

• G06F12/0292

  using tables or multilevel address translation means (G06F12/023 takes precedence; address translation in virtual memory systems G06F12/10) · CPC title