Management of Supervisor Mode Execution Protection (SMEP) by a Hypervisor
AssigneeBromium, Inc.
InventorsIan Pratt, Rafal Wojtczuk
Life of this patent
Estimating the term…
Abstract
Approaches for enabling Supervisor Mode Execution Protection (SMEP) for a guest operating system which does not support SMEP. A guest operating system (OS), which does not support SMEP, is executed within a virtual machine. A hypervisor instructs hardware to enable SMEP for the virtual machine executing the guest operating system. When the hypervisor is notified that the hardware has detected the guest operating system instructing a central processing unit (CPU) to execute code stored in virtual memory accessible by user space while the CPU is in supervisor mode, the hypervisor may consult a policy to identify what, if any, responsive action the hypervisor should perform.
Claims27
One or more computer-readable storage mediums storing one or more sequences of instructions, which when executed by one or more processors, cause:
- executing, within a virtual machine, a guest operating system which does not support Supervisor Mode Execution Protection (SMEP);
- and
- a hypervisor instructing hardware to enable Supervisor Mode Execution Protection (SMEP) for the virtual machine executing the guest operating system.
An apparatus, comprising:
- one or more processors;
- and
- one or more computer-readable storage mediums storing one or more sequences of instructions, which when executed by the one or more processors, cause:
- executing, within a virtual machine, a guest operating system which does not support Supervisor Mode Execution Protection (SMEP);
- and
- a hypervisor instructing hardware to enable Supervisor Mode Execution Protection (SMEP) for the virtual machine executing the guest operating system.
A method, comprising:
- executing, within a virtual machine, a guest operating system which does not support Supervisor Mode Execution Protection (SMEP);
- and
- a hypervisor instructing hardware to enable Supervisor Mode Execution Protection (SMEP) for the virtual machine executing the guest operating system.
Dependencies are inferred from the claim text.