Emulating mode-based execute control for memory pages in virtualized computing systems

A non-transitory computer readable medium having instructions stored thereon that when executed by a processor cause the processor to perform a method of emulating nested page table (NPT) mode-based execute control in a virtualized computing system, comprising:

• providing NPT mode-based execute control from a hypervisor to a virtual machine (VM) executing in the virtualized computing system, the NPT mode-based execute control having NPT fields that mark each of a plurality of memory pages as executable in combination with a privilege level of the execution of a plurality of privilege levels of the processor;
• generating a plurality of shadow NPT hierarchies at the hypervisor based on an NPT mode-based execute policy obtained from the VM;
• configuring the processor to exit from the VM to the hypervisor in response to an escalation from a user privilege level to a supervisor privilege level caused by guest code of the VM;
• exposing a first shadow NPT hierarchy of the plurality of shadow NPT hierarchies to the processor in response to an exit from the VM to the hypervisor due to the escalation from the user privilege level to the supervisor privilege level;
• receiving an exit from the VM to the hypervisor due to an NPT access violation by the guest code of the VM;
• and
• searching the plurality of shadow NPT hierarchies for an alternative shadow NPT hierarchy permitted based on a current privilege level of the guest code of the VM.

A virtualized computer system, comprising:

• a hardware platform including a processor and a memory, the processor configured to support nested page table (NPT) mode-agnostic execute control;
• and
• a software platform executing on the hardware platform, the software platform including a hypervisor supporting a virtual machine (VM), the VM including guest code, the hypervisor configured to:
• provide NPT mode-based execute control to the VM, the NPT mode-based execute control having NPT fields that mark each of a plurality of memory pages as executable in combination with a privilege level of the execution of a plurality of privilege levels of the processor;
• generate a plurality of shadow NPT hierarchies based on an NPT mode-based execute policy obtained from the VM;
• configure the processor to exit from the VM to the hypervisor in response to an escalation from a user privilege level to a supervisor privilege level caused by the guest code;
• expose a first shadow NPT hierarchy of the plurality of shadow NPT hierarchies to the processor in response to an exit from the VM to the hypervisor due to the escalation from the user privilege level to the supervisor privilege level;
• receive an exit from the VM to the hypervisor due to an NPT access violation by the guest code of the VM;
• and
• search the plurality of shadow NPT hierarchies for an alternative shadow NPT hierarchy permitted based on a current privilege level of the guest code of the VM.