Split-control of page attributes between virtual machines and a virtual machine monitor

A system comprising:

• a memory comprising a plurality of virtual memory pages corresponding to a virtual machine (VM);
• a processor coupled to the memory to execute the VM and to:
• receive, from the VM, an indication that a proper subset of the plurality of virtual memory pages of the VM are secure memory pages;
• determine whether the VM is attempting to access a first memory page;
• and
• responsive to determining the VM is attempting to access the first memory page, determine whether the proper subset comprises the first memory page;
• determine whether an ignore page attribute table (IPAT) entry for the first memory page in an extended page table (EPT) of a virtual machine monitor (VMM) is set to zero, the VMM executed by the processor to manage the VM;
• and
• responsive to determining the proper subset comprises the first memory page and that the IPAT entry in the EPT is set to zero, use first attributes specified by the VM for the first memory page and ignore second attributes specified by the VMM for the first memory page.

A processor comprising:

• a memory unit to:
• store first attributes specified by a virtual machine (VM) for a first memory page, the VM to be executed by the processor;
• and
• store second attributes specified by a virtual machine monitor (VMM) for the first memory page, the VMM to be executed by the processor to manage the VM;
• and
• an execution unit communicably coupled to the memory unit, the execution unit comprising enforcing logic to:
• receive, from the VM, an indication that a proper subset of a plurality of virtual memory pages of the VM are secure memory pages;
• determine whether the VM is attempting to access the first memory page;
• and
• responsive to determining the VM is attempting to access the first memory page, determine whether the proper subset comprises the first memory page;
• determine whether an ignore page attribute table (IPAT) entry for the first memory page in an extended page table (EPT) of the VMM is set to zero;
• and
• responsive to determining the proper subset comprises the first memory page and that the IPAT entry in the EPT is set to zero, enforce use of the first attributes specified by the VM for the first memory page and ignore the second attributes specified by the VMM for the first memory page.