Patent Application
20060122821
1. Field of the Invention
The invention relates to a method for detecting and processing sensitive non-privileged processor instructions in a virtual machine computer system running computer guest system processes in a virtualized manner on a central processing means.
2. Background Art
In the field of virtual machine computer systems the virtual machine monitor controls and handles concurrently running guest processes. In this connection commonly a subset of the complete instruction set of a CPU architecture is to be emulated. The instructions of said subset are called “sensitive instructions”. Within the entirety of the instructions of a certain processor said sensitive instructions are potentially disruptive of the virtual machine monitor or host operating system within a virtualized environment.
Another type of instructions is commonly relevant as concerns the question whether or not a processor is virtualizable. These are the so-called “privileged instructions” which are machine code instructions that may only be executed when the processor is running in the supervisor mode. Privileged instructions include operations such as input/output and memory management. As a general rule a processor is virtualizable, if all sensitive instructions are privileged, because the execution of a privileged instruction creates an exception if the processor does not run in the highest privileged mode, which is used by common virtual machine monitors to detect these instructions.
One common problem designing virtual machines, however, lies in the fact that many CPU architectures contain sensitive instructions which are not privileged. This fact makes them difficult to detect what is especially critical if a certain CPU state is emulated for the guest and the execution of the instruction depends on the state of the virtual central processing means.
An example for such a critical instruction is the so-called “cover stack frame” instruction (in the following abbreviated as “cover instruction”) of the Intel® Itanium® IA 64 architecture. Said cover instruction of the Itanium® architecture is in fact sensitive, non-privileged and critical to the CPU state, respectively. Reference is made to the “Intel® IA 64 Architecture Software Developer's Manual”, volume 3: IA-64 instruction reference (rev 1.1 July 2000), page 2-34. This cover instruction modifies the registered stack frame and writes a control register depending on the state of the processor status. The latter is represented by the so-called “interrupt collection” flag (=PSR.ic) which takes the value “0” if interruption collection is disabled and the value “1” if interruption collection is enabled.
Since the virtual machine always has to run guest processes with interrupt collection enabled (PSR.ic=1), the cover instruction would not write the control register, so information about the size of the register stack frame would get lost.
Starting from the aforementioned problems of the prior art the object of the invention is to provide a method for detecting and processing sensitive non-privileged processor instructions in a virtual machine computer system running computer guest system processes in a virtualized manner on a central processing means, by which method a save and uncritical processing of such sensitive non-privileged processor instructions in a virtualized environment is ensured.
This object is achieved by a method for detecting and processing sensitive non-privileged processor instructions in a virtual machine computer system comprising
using the restricted mode being used according to a specific critical state of the virtualized processor, wherein in the restricted mode sensitive non-privileged instructions are detected.
In a preferred embodiment of the invention the restricted mode uses emulation of instructions including the emulation of sensitive instructions.
In another preferred embodiment of the invention said method for detecting and processing sensitive non-privileged processor instructions in a virtual machine computer system comprises following method steps:
D2) in case the state is not critical continuing normal virtual machine operation with step A).
Aforesaid method and preferred embodiments represent the straight forward technique for handling sensitive, non-privileged instructions as said instructions are not detected per se, but all instructions are emulated when the virtual central processing unit is in its critical state. Doing so any such sensitive non-privileged instructions are also emulated rather than executed by the central processing unit directly. Inasmuch the overall behavior of the central processing unit including the managing of sensitive non-privileged instructions can easily be virtualized by emulation. Said emulation of an instruction code is finalized when the virtual central processing means leaves the critical state. From this time on normal virtual machine operation continues until the virtual central processing means enters the critical state again.
In another preferred embodiment of the invention the restricted mode uses single stepping to intercept before the execution of each instruction to allow the detection and emulation of sensitive non-privileged instructions. In more detail said method preferably comprises following method steps:
This preferred embodiment of the invention makes use of the fact that the problem of sensitive but non-privileged instructions as a rule only appears in a certain critical state of the virtual central processing means, e.g. whether or not the virtual central processing system is in the interruption collection enabled (=“interrupt enabled”) state or the interruption collection disabled (=“interrupt disabled”) state. The interrupt disabled state is the critical state in which e.g. the so-called cover instruction is sensitive but non-privileged. To filter out such problematic instruction it is only necessary to switch to single-stepping in case the virtual central processing unit is in said critical state. Otherwise single-stepping a complete routine of a plurality of instructions would lead to a high performance loss. To bring such overhead down to a negligible level single-stepping is only used for guest instruction sequences which run in a critical CPU state to detect above-mentioned non-privileged sensitive instructions.
According to a further preferred embodiment of the invention the restricted mode analyzes code sequences and uses instruction breakpoints to intercept after execution of that code sequence. Preferably the code sequence is analyzed for an occurrence of sensitive non-privileged instructions and branch instructions.
Finally in a further preferred embodiment of the invention above mentioned object is achieved by a novel method for detecting and processing sensitive non-privileged processor instructions in a virtual machine computer system comprising following method steps:
This method again is based on a first distinguishing fact which is the state of the virtual central processing means being critical or not. Now in the critical state a code of instructions is analyzed to find non-privileged sensitive instructions or branch instructions. By setting a breakpoint in front of said instruction the overall code sequence is foreshortened to a sub-sequence which is executed until reaching the breakpoint. In case the breakpoint is followed by a branch instruction, the latter is emulated and the next sub-sequence is analyzed starting from the branch target if the branch is taken. In case the instruction following the breakpoint is a non-privileged, sensitive instruction said instruction is emulated and the next sub-sequence is analyzed starting after that instruction.
In a preferred embodiment of aforementioned method including breakpoint setting, if non-branch instructions or non-sensitive instructions are selected, analyzing of memory modifying instructions takes place. Inasmuch each following instruction of a sequence is checked whether or not it is a store instruction and a breakpoint is set after that instruction. Afterwards the sub-sequence of instructions up to the breakpoint is executed. This breakpoint ensures that an analysis of following instruction sequences accesses the currently relevant set of instructions, which cannot be changed by a store instruction in an undiscovered manner. By doing so so-called “self modifying code” cannot disturb the function of the virtual machine monitor by dynamically replacing one instruction by a sensitive non-privileged instruction.
Since the detection of branch instruction is necessary to prevent code sequences (after a branch) to be wrongly analyzed without actually being executed because of that branch the detection of the branch instruction can be alternatively done by the so-called “taken branch” trap that intercepts on each branch of the program flow. Conditional branches that are not taken would indeed not disturb the function since the program flow continues with the instruction following the branch. After occurrence of the “taken branch” trap however the sequence is to be started from new at the location of the branch target.
Again the overhead of the code analyzing and the according performance loss can be minimized as only these portions of a code running with a critical CPU state are analyzed.
Further features, details and advantages of the invention are disclosed in the following description in which embodiments of the method for detecting and processing sensitive non-privileged processor instructions according to the invention are described in more detail with reference to the accompanying drawings.
Turning to
In case the state of the virtual CPU is critical—branch Y after step 20—following instruction is emulated (step 40) to ensure that each sensitive, non-privileged instruction is emulated. This step, however, does not take care whether or not it is really necessary to emulate the instruction, i.e. even non-sensitive and/or privileged instructions are unnecessarily emulated.
After that step 40 the state of the virtual CPU is again checked whether it is still in a critical mode—step 50—and the checking of the critical state and emulating each instruction is continued—branch Y after step 50—until the virtual CPU state is found to be non-critical. Then the process via branch N after step 50 continues with normal virtual operation (step 60). This again means that the process continues with the check of the virtual CPU (step 20).
In
Turning to the embodiment of
In case that branch step 20 detects that the virtual CPU state is critical e.g. PSR.ic disabled in step 41—single-stepping mode is enabled. In this single-stepping mode there is a step 42 of checking whether or not the following instruction in the guest code sequence is sensitive. If yes—branch Y after step 42—the following sensitive instruction is emulated by the virtual machine in step 43.
If the following instruction is found to be non-sensitive in step 42 this instruction is executed directly in step 44.
From both steps 43 and 44 the process runs to the checking step 50 whether or not the virtual CPU is still in a critical state. If yes—branch Y after step 50—the process goes back to step 42 checking the following instruction to be sensitive or not.
If the critical state of the virtual CPU is terminated—branch N after step 50—the single-stepping mode is disabled in step 51 and normal virtual machine operation is continued in step 60.
The time diagram of
All further instructions until the end of the critical state are again non-sensitive and thus directly executed illustrated by shorter double-headed arrows 44 in
Another preferred embodiment of the method for detecting and processing sensitive non-privileged processor instructions in a virtual machine is depicted in
As a bypass of the steps 47 through 49 in case that step 46 returns the result that the analyzed instruction is no branch or sensitive instruction—branch N after step 46—another analyzing step 55 follows which checks whether or not the analyzed instruction is a store instruction. If yes—branch Y after step 55—, a breakpoint is set after that instruction in step 56 and the instruction sequence is executed directly by running the process to this breakpoint (step 57). Afterwards the process returns to normal virtual machine operation and step 20.
The chronological representation of
As an advantage of all three processes according to the invention presented above the invention provides for a total specification conforming emulation of sensitive, non-privileged instructions like the cover instruction. Inasmuch there is no dependence on the guest operating system so the virtual machine is capable of running all current operating system versions the same as future versions. Furtheron there is no static/dynamic modification of the guest operating system kernel necessary. Inasmuch the necessity to dynamically re-write portions of the guest operating system is avoided by the invention. Furtheron no special drivers are required for the guest operating systems as the hardware is reproduced as already supported standard hardware components Finally the performance loss by the routines for checking the state of the virtual CPU and analyzing the code is estimated to range from 3% up to 15% which is considerably better than a degradation of up to 30 to 50% of the prior art which deals with non-fully virtualizable processors like the Intel® x 86 (IA-32) and Intel® Itanium® family.
