Hardware protection of virtual machine monitor runtime integrity watcher

Patent metadata

Field	Value
Publication number	US-9566158-B2
Application number	US-201113995742-A
Country	US
Kind code	B2
Filing date	Dec 31, 2011
Priority date	Dec 31, 2011
Publication date	Feb 14, 2017
Grant date	Feb 14, 2017

Abstract

An apparatus and method for hardware protection of a virtual machine monitor (VMM) runtime integrity watcher is described. A set of one or more hardware range registers that protect a contiguous memory space that is to store the VMM runtime integrity watcher. The set of hardware range registers are to protect the VMM runtime integrity watcher from being modified when loaded into the contiguous memory space. The VMM runtime integrity watcher, when executed, performs an integrity check on a VMM during runtime of the VMM.

First claim

What is claimed is:

1. An apparatus, comprising:
a set of one or more hardware range registers to protect a contiguous memory space that is to store a virtual machine monitor (VMM) runtime integrity watcher, wherein the set of hardware range registers are to protect the VMM runtime integrity watcher from being modified when loaded into the contiguous memory space; and
the VMM runtime integrity watcher, when executed, is to perform an integrity check on a VMM during runtime of the VMM.

2. The apparatus of claim 1 , further comprising:
a hardware timer to generate an event to invoke execution of the VMM runtime integrity watcher during runtime of the VMM.

3. The apparatus of claim 2 , wherein execution of the VMM is preempted upon the event being generated.

4. The apparatus of claim 1 , wherein the VMM runtime integrity watcher is further to, when executed, report results of the integrity check.

5. The apparatus of claim 4 , wherein the VMM runtime integrity watcher is to report results of the integrity check to one of a system management application and a cloud management application.

6. The apparatus of claim 4 , further comprising:
a set of one or more hardware reporting registers; and
wherein the VMM runtime integrity watcher is to write to the set of hardware reporting registers to indicate whether the VMM has been compromised.

7. The apparatus of claim 6 , wherein the set of hardware reporting registers are writable only by the VMM runtime integrity watcher and readable by any entity.

8. The apparatus of claim 7 , wherein the apparatus comprises a multiprocessor system to incorporate the set of one or more hardware range registers, the VMM runtime integrity watcher, and the set of one or more hardware reporting registers.

9. The apparatus of claim 7 , wherein the apparatus comprises a microprocessor to incorporate the set of one or more hardware range registers, the VMM runtime integrity watcher, and the set of one or more hardware reporting registers.

10. The apparatus of claim 7 , wherein the apparatus comprises a digital signal processor to incorporate the set of one or more hardware range registers, the VMM runtime integrity watcher, and the set of one or more hardware reporting registers.

11. The apparatus of claim 7 , wherein the apparatus comprises an application specific integrated circuit to incorporate the set of one or more hardware range registers, the VMM runtime integrity watcher, and the set of one or more hardware reporting registers.

12. The apparatus of claim 7 , wherein the apparatus comprises a System on a Chip to incorporate the set of one or more hardware range registers, the VMM runtime integrity watcher, and the set of one or more hardware reporting registers.

13. A computer-implemented method in a computing system, comprising:
loading a virtual machine monitor (VMM) runtime integrity watcher into a contiguous memory space of the computing system, wherein the contiguous memory space is in a location defined by a set of one or more hardware range registers that indicate that the contiguous memory space holding the loaded VMM runtime integrity watcher is not to be-modified;
detecting an event to invoke execution of the VMM runtime integrity watcher;
responsive to the detected event, executing the VMM runtime integrity watcher; and
performing, by the VMM runtime integrity watcher, an integrity check on a VMM during runtime of the VMM.

14. The computer-implemented method of claim 13 , wherein event is generated by a hardware timer that is configured to periodically generate events.

15. The computer-implemented method of claim 13 , wherein responsive to the detected event, preempting execution of the VMM.

16. The computer-implemented method of claim 13 , further comprising:
reporting, by the VMM runtime integrity watcher, a result of the integrity check.

17. The computer-implemented method of claim 16 , wherein reporting includes writing the result of the integrity check to a set of one or more hardware reporting registers.

18. The computer-implemented method of claim 16 , wherein reporting includes reporting the result of the integrity check to one of a system management application and a cloud management application.

Assignees

• Datta Shamanna M
• Munoz Albert J
• Natu Mahesh S
• Durrant Scott T
• Intel Corp

Inventors

• Datta Shamanna M
• Munoz Albert J
• Natu Mahesh S
• Durrant Scott T

Classifications

• A61F2002/30331

  made by longitudinally pushing a protrusion into a complementarily-shaped recess, e.g. held by friction fit · CPC title

• A61F2/30734

  Modular inserts, sleeves or augments, e.g. placed on proximal part of stem for fixation purposes or wedges for bridging a bone defect · CPC title

• A61F2002/30736

  Augments or augmentation pieces, e.g. wedges or blocks for bridging a bone defect · CPC title

• G06F2009/45583

  Memory management, e.g. access or allocation · CPC title

• A61F2002/3082

  Grooves · CPC title