US 2020/0050364 A1Published application

Memory protection in virtualized computer systems using shadow page tables

AssigneeRed Hat, Inc.

InventorsDavid Gilbert, Paolo Bonzini

Life of this patent

Estimating the term…

Loading patent…

Abstract

Aspects of the disclosure provide for mechanisms for memory protection of virtual machines in a computer system. A method of the disclosure includes: obtaining, by a hypervisor, a guest page table associated with a virtual machine, wherein the guest page table comprises a first guest page table entry associated with a privilege flag indicating that a first virtual page of a guest memory of the virtual machine is accessible to unprivileged code; and in view of a determination that the virtual machine is running in a kernel mode, generating a first host page table in view of the guest page table, wherein the first host page table comprises a first host page table entry corresponding to the first guest page table entry, and wherein the first host page table entry is associated with a privilege flag indicating that the first virtual page is not accessible to the unprivileged code.

Claims20

Dependent claims

A method comprising:

obtaining, by a processing device running a hypervisor, a guest page table associated with a virtual machine, wherein the guest page table comprises a first guest page table entry and a second guest page table entry, wherein the first guest page table entry is associated with a first privilege flag indicating that a first virtual page of a guest memory of the virtual machine is accessible to unprivileged code, and wherein the second guest page table entry is associated with a second privilege flag indicating that a second virtual page of the guest memory is accessible to privileged code;
and
in view of a determination that the virtual machine is running in a kernel mode, generating a first host page table in view of the guest page table, wherein the first host page table comprises a first host page table entry corresponding to the first guest page table entry and a second host page table entry corresponding to the second guest page table entry, and wherein the first host page table entry is associated with a third privilege flag indicating that the first virtual page is not accessible to the unprivileged code.

A system comprising:

a memory;
and
a processing device operatively coupled to the memory, the processing device to:
obtain, via a hypervisor, a guest page table associated with a virtual machine, wherein the guest page table comprises a first guest page table entry and a second guest page table entry, wherein the first guest page table entry is associated with a first privilege flag indicating that a first virtual page of a guest memory of the virtual machine is accessible to unprivileged code, and wherein the second guest page table entry is associated with a second privilege flag indicating that a second virtual page of the guest memory is accessible to privileged code;
and
in view of a determination that the virtual machine is running in a kernel mode, generate a first host page table in view of the guest page table, wherein the first host page table comprises a first host page table entry corresponding to the first guest page table entry and a second host page table entry corresponding to the second guest page table entry, and wherein the first host page table entry is associated with a third privilege flag indicating that the first virtual page is not accessible to the unprivileged code.

3 more elements

A non-transitory machine-readable storage medium including instructions that, when accessed by a processing device, cause the processing device to:

obtain, via a hypervisor, a guest page table associated with a virtual machine, wherein the guest page table comprises a first guest page table entry and a second guest page table entry, wherein the first guest page table entry is associated with a first privilege flag indicating that a first virtual page of a guest memory of the virtual machine is accessible to unprivileged code, and wherein the second guest page table entry is associated with a second privilege flag indicating that a second virtual page of the guest memory is accessible to privileged code;
and
in view of a determination that the virtual machine is running in a kernel mode, generate a first host page table in view of the guest page table, wherein the first host page table comprises a first host page table entry corresponding to the first guest page table entry and a second host page table entry corresponding to the second guest page table entry, and wherein the first host page table entry is associated with a third privilege flag indicating that the first virtual page is not accessible to the unprivileged code.

Dependencies are inferred from the claim text.