Intel Corporation

Arumugam Thiyagarajah

Vedvyas Shanbhogue

Gilbert A Neiger

Ravi L Sahita

Barry E Huntley

David M Durham

Baiju V Patel

Andrew V Anderson

Michael Lemay

David A Koufaty

Asit K Mallick

Deepak K Gupta

Joseph Frank Cihula

Baruch Chaikin

Dror Caspi

Jason W Brandt

Rajesh M Sankaran

Wei Wang

Vincent R Scarlata

Raanan Sade

Stalinselvaraj Jeyasingh

Gaurav Khanna

Arie Aharon

Jun Nakajima

Gur Hildesheim

Ron Rais

Isaku Yamahata

Haidong Xia

Thomas Adelmeyer

Sharon Yaniv

Sean Christopherson

Vinay Awasthi

Sohil Mehta

Mukesh J Jagasia

Dharmendra Thakkar

This disclosure is directed to a system for address mapping and translation protection. In one embodiment, processing circuitry may include a virtual machine manager (VMM) to control specific guest linear address (GLA) translations. Control may be implemented in a performance sensitive and secure manner, and may be capable of improving performance for critical linear address page walks over legacy operation by removing some or all of the cost of page walking extended page tables (EPTs) for critical mappings. Alone or in combination with the above, certain portions of a page table structure may be selectively made immutable by a VMM or early boot process using a sub-page policy (SPP). For example, SPP may enable non-volatile kernel and/or user space code and data virtual-to-physical memory mappings to be made immutable (e.g., non-writable) while allowing for modifications to non-protected portions of the OS paging structures and particularly the user space.

System for address mapping and translation protection

Techniques for migration of a source protected virtual machine from a source platform to a destination platform are descried. A method of an aspect includes enforcing that bundles of state, of a first protected virtual machine (VM), received at a second platform over a stream, during an in-order phase of a migration of the first protected VM from a first platform to the second platform, are imported to a second protected VM of the second platform, in a same order that they were exported from the first protected VM. Receiving a marker over the stream marking an end of the in-order phase. Determining that all bundles of state exported from the first protected VM prior to export of the marker have been imported to the second protected VM. Starting an out-of-order phase of the migration based on the determination that said all bundles of the state exported have been imported.

Methods, apparatus, systems, and instructions to migrate protected virtual machines

A processor may include a register to store a bus-lock-disable bit and an execution unit to execute instructions. The execution unit may receive an instruction that includes a memory access request. The execution may further determine that the memory access request requires acquiring a bus lock, and, responsive to detecting that the bus-lock-disable bit indicates that bus locks are disabled, signal a fault to an operating system.

Detecting bus locking conditions and avoiding bus locks

A processor includes a processor core, a processor cache to store reporting data structures including a queue structure, and an interrupt posting circuit coupled to the processor core and the processing cache. The interrupt posting circuit receives an interrupt request directed to a virtual processor (VP) of a virtual machine (VM) executed by the processor core. The VM is managed by a virtual machine monitor (VMM) executed by the processor core. The interrupt posting circuit determines the VP is in an inactive state and records the interrupt request in a first posted data structure allocated by the VMM for the VP in main memory coupled to the processor. The interrupt posting circuit updates location information stored in the reporting data structures based on recording the interrupt request in the first posted data structure to generate updated location information that identifies a location of the interrupt request.

Posted interrupt processing in virtual machine monitor

A processing system includes a processing core to execute a virtual machine (VM) comprising a guest operating system (OS) and a memory management unit, communicatively coupled to the processing core, comprising a storage device to store an extended page table entry (EPTE) comprising a mapping from a guest physical address (GPA) associated with the guest OS to an identifier of a memory frame, a first plurality of access right flags associated with accessing the memory frame in a first page mode referenced by an attribute of a memory page identified by the GPA, and a second plurality of access right flags associated with accessing the memory frame in a second page mode referenced by the attribute of the memory page identified by the GPA.

Defining virtualized page attributes based on guest page attributes

Examples include a processor including at least one untrusted extended page table (EPT), circuitry to execute a set of instructions of the instruction set architecture (ISA) of the processor to manage at least one secure extended page table (SEPT), and a physical address translation component to translate a guest physical address of a guest physical memory to a host physical address of a host physical memory using one of the at least one untrusted EPT and the at least one SEPT.

Scalable processor-assisted guest physical address translation

Virtual machine manager for address mapping and translation protection

Apparatuses, methods and storage medium associated with virtual machine application processor startup, are disclosed herein. In embodiments, an apparatus for computing may include a plurality of processor cores; and a plurality of OS modules of an OS. The OS modules may include a BSP module and an AP module. The BSP module may be configured to write into a storage area a start state of an AP of a VM, while the VM is being started up; and the AP module may be configured to start the AP at the start state, directly in a protected mode of execution without first going through a real mode of execution. Other embodiments may be described and/or claimed.

Starting application processors of a virtual machine

Growing community of inventors

Folsom, CA, United States of America

Arumugam Thiyagarajah