Processor feature ID response for virtualization

Abstract

The disclosed techniques generally relate to virtualization techniques. The disclosed techniques include providing, by a processor, processor feature ID information requested by or from a virtual machine (VM), a virtualized application, a virtualization-based secure (VBS) user mode process, a VBS kernel mode process, or other guest partition. Such information may be provided based on information (e.g., by a supervisory partition such as a hypervisor) priori provided to the processor. The disclosed techniques also include, for example, a supervisory partition that provides such information to a processor and a guest partition that receives such information.

Description

BACKGROUND

[0001] Virtualization technology is employed in many contexts. For example, virtualization technology can be employed to abstract physical computing resources from guest partitions, to improve utilization of physical computing resources, to support portability of guest partitions across physical devices, to protect physical computing resources from malicious and / or erroneous code running in guest partitions, to protect confidentiality, to enforce security requirements or policies, etc. In previous virtualization technology, a guest exit (e.g., transfer of control of a processor from a guest partition to a supervisory partition such as a hypervisor) can occur in response to certain operations. For example, a guest exit can occur in response to a request for processor feature ID information. SUMMARY

[0002] This "SUMMARY" is provided to introduce a selection of concepts that are further described in the "DETAILED DESCRIPTION" below. This "SUMMARY" is not intended to identify key or essential features of the claimed subject matter, nor is it intended to be used in limiting the scope of the claimed subject matter.

[0003] Briefly, the disclosed technology generally relates to virtualization technology. The disclosed technology includes providing, by a processor, processor feature ID information requested by or from a virtual machine (VM), a virtualization application, a virtualization-based security (VBS) user-mode process, a VBS kernel-mode process, or other guest partition. Such information can be provided based on information provided a priori (e.g., by a supervisory partition such as a hypervisor) to the processor. The disclosed technology also includes a supervisory partition, e.g., providing such information to a processor, and a guest partition receiving such information.

[0004] Other aspects and applications of the disclosed technology will become apparent upon reading and understanding the attached figures and description. BRIEF DESCRIPTION OF DRAWINGS

[0005] Non-limiting and non-exhaustive examples of the present disclosure are described with reference to the following figures. The components in the figures are not necessarily to scale, emphasis instead being placed upon illustrating the principles of the disclosure. In the drawings, like reference numerals designate corresponding parts throughout the various figures.

[0006] For a better understanding of the present disclosure, reference will be made to the following "DETAILED DESCRIPTION" which will be read in connection with the accompanying drawings, wherein:

[0007] Figure 1 is a block diagram illustrating a physical view of one example of a suitable computing device in accordance with aspects of the disclosed technology;

[0008] Figure 2is a block diagram illustrating a logical view of an example computing device in accordance with aspects of the disclosed technology;

[0009] Figure 3 illustrates an example process in accordance with aspects of the disclosed technology;

[0010] Figure 4 illustrates another example process in accordance with additional aspects of the disclosed technology; and

[0011] Figure 5 illustrates yet another example process in accordance with other aspects of the disclosed technology. DETAILED DESCRIPTION

[0012] The following description provides specific details for a thorough understanding of, and enabling disclosure of, various examples of the technology. One skilled in the art will understand that the technology can be practiced without many of the details described in this description. In some instances, well-known structures and functions have not been described in detail or have been shown in a simplified schematic in order not to obscure the description of examples of the technology. Descriptions of the same or similar elements are not necessarily repeated in the description of every example of the technology. Although the terms used in this disclosure are believed to be common usage, they are to be interpreted to be in the broadest reasonable manner. Even though certain terms can be emphasized, no single term is used that is intended to be a limitation on the meaning of the description. Throughout the description, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this technology belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and the present disclosure and will not be interpreted in an overly literal sense unless expressly so defined herein. The meaning of "in" includes "in" and "on." The use of the phrase "in an embodiment" or "in an example" does not necessarily refer to the same embodiment or example; although, it can. The use of a specific number of a particular textual reference does not mean that there is a smaller number of that reference. For example, a recitation of "a widget selected from the group consisting of a third 'foo' and a fourth 'bar'" does not mean that there are at least three 'foo' elements or at least four 'bar' elements. Singular references are used for readability and include plural references unless specifically excluded. The term "or" is an inclusive "or" operator, unless specifically indicated otherwise. For example, the phrase "A or B" means "A, B, or both A and B." As used herein, the term "component" or "system" is intended to encompass a hardware, software, or various combinations thereof. Thus, a component or system can be a process, a process executing on a computing device, a computing device, or a portion thereof.

[0013] In brief overview, the disclosed technology generally relates to virtualization technology. The disclosed technology includes providing, by a processor, processor feature ID information requested by or from a virtual machine (VM), a virtualization application, a virtualization-based security (VBS) user-mode process, a VBS kernel-mode process, or other guest partition. For example, such requests can be generated by code executing on a guest virtual processor within a guest partition. Such information can be provided based on information provided a priori to the processor (e.g., by a supervisory partition such as a hypervisor). The disclosed technology also includes, for example, a supervisory partition providing such information to a processor and a guest partition receiving such information.

[0014] In some examples, the disclosed technology can be employed in a virtualization / virtualized system. For example, the technology can be employed in connection with a hypervisor, a virtual machine, a virtualization application, a virtualization-based security (VBS) user-mode process, a VBS kernel-mode process, etc. For example, the technology can include pre-computing or otherwise determining processor feature ID information by a hypervisor or other supervisory partition, and providing the determined processor feature ID information to a processor of a computing device for subsequent use in response to a request for the processor feature ID information, such as from a guest partition. For example, a request for such information from a guest partition can subsequently be processed by the processor without intervention of the supervisory partition.

[0015] Use of the disclosed technology can be to reduce and / or eliminate the frequency of VM exits or other guest exits in which the system exits from execution of guest code to execute supervisory partition code. As one example of a guest exit, in response to a query for processor feature ID information by a guest, a supervisory partition process can take control of the processor from the guest partition, build the processor feature ID registers of the processor, and then return control of the processor to the guest partition.

[0016] In certain existing virtualization systems, a guest exit occurs in response to certain operations being performed from a guest partition. For example, a guest exit can occur in response to an operation being performed from a guest partition in which CPUID or other processor feature ID information is requested. Such exits are typically "expensive" in terms of time, power, and computing performance. For example, a guest exit can be associated with use of processing bandwidth for supervisory partition code (e.g., overhead) rather than guest partition code (e.g., intended work). A guest exit can also be associated with additional context switch overhead due to rewriting of processor data and / or instruction cache locations with supervisory partition code, etc.

[0017] Illustrative physical computing device

[0018] Figure 1 This is a block diagram illustrating an example physical view of computing device 100, in which aspects of the present technology can be practiced. Computing device 100 can be virtually any type of general-purpose or special-purpose computing device. For example, computing device 100 can be a user device, such as a desktop computer, laptop computer, tablet computer, display device, camera, printer, or smartphone. Similarly, computing device 100 can also be a server device, such as an application server computer, virtual machine computer, or file server computer. Computing device 100 can also be an IoT device connected to a network to receive IoT services. Similarly, computing device 100 can be, as discussed in more detail below, in... Figures 2-5 Examples of any devices shown or referred to in the text. For example... Figure 1 As shown, computing device 100 includes processing circuitry 110, operating memory 120, memory controller 130, data storage memory 150, input interface 160, output interface 170, and network adapter 180. Each of these components listed above in computing device 100 includes at least one hardware element.

[0019] Computing device 100 includes at least one processing circuit 110 configured to execute instructions, such as instructions for implementing the workloads, processes, or techniques described herein. Processing circuit 110 may include a microprocessor, microcontroller, graphics processor, coprocessor, field-programmable gate array, programmable logic device, signal processor, or any other circuitry suitable for processing data. Processing circuit 110 is a core example. During operation of computing device 100, the aforementioned instructions and other data (e.g., datasets, metadata, operating system instructions, etc.) may be stored in operational memory 120. Operational memory 120 may also include any data storage device / component from a variety of data storage devices / components, such as volatile memory, semi-volatile memory, random access memory, static memory, cache, buffer, or other media for storing runtime information. In one example, operational memory 120 does not retain information when computing device 100 is powered off. Instead, computing device 100 may be configured to pass instructions from a non-volatile data storage component (e.g., data storage component 150) to operational memory 120 as part of a booting or other loading process.

[0020] The operational memory 120 can include fourth generation double data rate (DDR4) memory, third generation double data rate (DDR3) memory, other dynamic random access memory (DRAM), high bandwidth memory (HBM), hybrid memory cube memory, 3D-stacked memory, static random access memory (SRAM), or other memory, and such memory can include one or more memory circuits integrated onto a DIMM, SIMM, SODIMM, or other package. Such operational memory modules or devices can be organized according to channels, ranks, and banks. For example, the operational memory devices can be coupled to the processing circuitry 110 in channels via the memory controller 130. One example of the computing device 100 can include one or two DIMMs per channel, each channel having one or two ranks. Operational memory within a rank can operate using a shared clock and shared address and command buses. Also, the operational memory devices can be organized into several banks, where a bank can be considered an array addressed by rows and columns. Based on this organization of the operational memory, a physical address within the operational memory can be referenced by a tuple of channel, rank, bank, row, and column.

[0021] Despite the above discussion, the operational memory 120 specifically does not include or encompass communication media, any communication media, or any signal per se.

[0022] The memory controller 130 is configured to interface the processing circuitry 110 to the operational memory 120. For example, the memory controller 130 can be configured to interface commands, addresses, and data between the operational memory 120 and the processing circuitry 110. The memory controller 130 can also be configured to extract or otherwise manage certain aspects of memory management from or for the processing circuitry 110. Although the memory controller 130 is illustrated as a single memory controller separate from the processing circuitry 110, in other examples multiple memory controllers can be employed, the memory controller(s) can be integrated with the operational memory 120, and so on. Further, the memory controller can be integrated into the processing circuitry 110. These and other variations are possible.

[0023] In the computing device 100, the data storage memory 150, the input interface 160, the output interface 170, and the network adapter 180 are interfaced to the processing circuitry 110 by the bus 140. Although Figure 1Bus 140 is illustrated as a single bus, but other configurations (such as a combination of buses, a combination of point-to-point links, input / output controllers, bridges, other interface circuits, or any combination thereof) can also be suitable for adoption to join data storage memory 150, input interface 160, output interface 170, or network adapter 180 to processing circuitry 110.

[0024] In computing device 100, data storage memory 150 is used for long-term non-volatile data storage. Data storage memory 150 can include any of a variety of non-volatile data storage devices / components, such as non-volatile memory, magnetic disks, disk drives, hard drives, solid state drives, or any other medium that can be used for non-volatile storage of information. However, data storage memory 150 specifically excludes or does not include communication media, any communication medium, or any signal per se. In contrast to operating memory 120, data storage memory 150 is employed by computing device 100 for non-volatile long-term data storage, rather than for runtime data storage.

[0025] Furthermore, computing device 100 can include or be coupled to any type of processor-readable media, such as processor-readable storage media (e.g., operating memory 120 and data storage memory 150) and communication media (e.g., communication signals and radio waves). Although the term processor-readable storage media includes operating memory 120 and data storage memory 150, the term “processor-readable storage media” is defined herein, throughout the specification and claims, whether used in singular or plural, to not specifically exclude and not include communication media, any communication media, or any signals per se. However, the term “processor-readable storage media” does encompass processor cache, random access memory (RAM), register memory, and the like.

[0026] The computing device 100 also includes an input interface 160 that can be configured to support receipt of input from a user or from other devices by the computing device 100. Additionally, the computing device 100 includes an output interface 170 that can be configured to provide output from the computing device 100. In one example, the output interface 170 includes a frame buffer, graphics processor, graphics processor or accelerator, and is configured to render a display for presentation on a separate visual display device, such as a monitor, projector, virtual computing client computer, or the like. In another example, the output interface 170 includes a virtual reality device and is configured to render and present a display for viewing. In yet another example, the input interface 160 and / or the output interface 170 can include a universal asynchronous receiver / transmitter (“UART”), a serial peripheral interface (“SPI”), an internal integrated circuit (“I1C”), a general purpose input / output (GPIO), or the like. Moreover, the input interface 160 and / or the output interface 170 can include or be interfaced to any number or type of peripheral devices.

[0027] In the illustrated example, the computing device 100 is configured to communicate with other computing devices or entities via a network adapter 180. The network adapter 180 can include a wired network adapter, such as an Ethernet adapter, a token ring adapter, or a digital subscriber line (DSL) adapter. The network adapter 180 can also include a wireless network adapter, such as a Wi-Fi adapter, a Bluetooth adapter, a ZigBee adapter, a long term evolution (LTE) adapter, or a 5G adapter.

[0028] Although the computing device 100 is illustrated as having certain components configured in a particular arrangement, these components and arrangement are merely one example of a computing device in which the technology can be employed. In other examples, the data storage memory 150, the input interface 160, the output interface 170, or the network adapter 180 can be directly coupled to the processing circuit 110, or coupled to the processing circuit 110 via an input / output controller, bridge, or other interface circuit. Other variations of the technology are possible.

[0029] Some examples of the computing device 100 include at least one memory (e.g., operating memory 120) adapted to store runtime data and at least one processor (e.g., processing unit 110) adapted to execute processor-executable code that, in response to executing the processor-executable code, enables the computing device 100 to perform an action.

[0030] Illustrative logical computing device

[0031] Figure 2is a block diagram illustrating one example of a logical view of a computing device 200 in which aspects of the technology can be practiced. The computing device 200 can be an example of the computing device 100 Figure 1 In the illustration of FIG. 2, logical components of the computing device 200 include guest partitions 211-213, a supervisor partition 230, physical resources 241-243, and processor feature IDs 250. Figure 2 In the illustration of FIG. 2, logical components of the computing device 200 include guest partitions 211-213, a supervisor partition 230, physical resources 241-243, and processor feature IDs 250.

[0032] The physical resources 241-243 can include any of a variety of physical components, such as processor components, input / output (I / O) components, and / or other components or devices. For example, the physical resources 241-243 can include any suitable combination of physical components, such as those discussed in connection with the physical resources 141-143. Figure 1 Although the physical resources 241-243 are illustrated as part of the computing device 200, one or more of the physical resources 241-243 (e.g., one or more data storage memories) can be implemented external to the computing device 200. Various components or modules running on the computing device 200, including the supervisor partition 230, can access the function(s) provided via the physical resources 241-243 directly and / or indirectly via other components or modules.

[0033] The supervisor partition 230 can generate any number of guest partitions, e.g., the guest partitions 211-213. Each of the guest partitions 211-213 can be a VM, a virtualized application, a VBS execution environment, a user mode process, etc. For example, the guest partition 211 is illustrated as a VM with an operating system (OS) 221 and an application 222, the guest partition 212 is illustrated as a virtualized application 223, and the guest partition 224 is illustrated as having a process 224 executing therefrom.

[0034] Each of the guest partitions 211-213 is an isolated logical unit from which an operating system and / or other software is executed. Each of the guest partitions 211-213 can also include a guest virtual processor. Software executing within each of the guest partitions 211-213 is isolated from software executing in each of the other guest partitions. For example, software executing in each of the guest partitions 211-213 cannot access and need not be aware of software executing in each of the other guest partitions. The physical resources 241-243 are virtualized to the guest partitions 211-213, and access to the physical resources 241-243 is managed by the supervisor partition 230.

[0035] As illustrated, the computing device 100 includes a supervisor partition 230. The supervisor partition 230 can include a hypervisor, such as a virtual machine monitor, that manages access to functionality provided by the physical resources 241-243. In another example, the supervisor partition 230 is a kernel mode process of a kernel or OS, such as an OS that employs VBS.

[0036] The computing device 200 also includes one or more processor feature IDs 250. For example, the processor feature IDs 250 can represent a physical hardware ID register (or set of registers) of a physical processor, such as a register (or set of registers) containing x86 CPU ID leaf information, an ID register for an Advanced RISC Machines (ARM) processor, and the like. The processor feature IDs 250 can also represent features supported by a processor, a set of features supported by a processor, physical characteristics of a processor, and the like. For example, the processor feature IDs 250 can represent a processor frequency, a supported physical address width, a clock multiplier, a power setting, availability of instructions, a stepping number, a serial number, and the like.

[0037] Illustrative process

[0038] For clarity, the processes described herein are described with reference to the operations performed by particular devices or components of a system in a particular order. However, it should be noted that other processes are not limited to the order, devices, or components described. For example, certain actions can be performed in a different order, in parallel, omitted, or supplemented with additional actions or features, whether described herein or not. Likewise, any of the techniques described in this disclosure can be incorporated into the processes described or other processes, whether the technique is specifically described in relation to the process or not. The disclosed processes can also be performed on or by other devices, components, or systems, whether described herein or not. These processes can also be implemented in a variety of ways. For example, they can be implemented on an article of manufacture (e.g., as processor-readable instructions stored on a processor-readable storage medium) or as computer-implemented processes. As an alternative example, they can be encoded as processor-executable instructions and transmitted via a communication medium.

[0039] Figure 3 An example process 300 is illustrated that is performed by a processor (e.g., the processing circuit 110 of the computing device 100 or the processing circuit 210 of the computing device 200) of a computing device, such as the computing device 100 or the computing device 200. Figure 1 An example process 300 is illustrated that is performed by a processor (e.g., the processing circuit 110 of the computing device 100 or the processing circuit 210 of the computing device 200) of a computing device, such as the computing device 100 or the computing device 200. Figure 2The process is shown from the perspective of physical resources 241, 242, or 243. Process 300 begins at 381, where a request for a processor characteristic ID is received. For example, this request may be received by a physical processor, and this request may have originated from a guest partition. For example, this request may be generated by code executed on a guest virtual processor within the guest partition.

[0040] The process proceeds from 381 to 382. At 382, ​​for example, the processor looks up the processor feature ID. In one example, the processor looks up the processor feature ID from the processor feature ID register, from the processor-accessible memory structure, from the processor feature ID lookup table, etc. This lookup can also be based on information provided to the processor a priori by the hypervisor or other supervisory partitions, such as, in combination with... Figure 4 The process will be discussed further in section 400.

[0041] Then, the process proceeds to step 383, where a processor feature ID is provided, for example, without a guest logout. This could include the processor providing the requested processor feature ID to the guest partition, such as through a request process from the guest partition. The provided processor feature ID could be based on information previously provided to the processor. After step 383, the process returns to other operations.

[0042] Figure 4 Example process 400 is illustrated from the perspective of a supervisory partition (e.g., a management program). For example, process 400 is illustrated from... Figure 2 The angle of the supervised partition 230 is illustrated.

[0043] Process 400 begins at 481, where a value for the processor feature ID is obtained. This value may be obtained by the supervisory partition in conjunction with or in response to a setup operation for at least one of a guest partition, a guest virtual processor, or a guest virtual processor virtual trust level. For example, such a setup operation may include at least one of creating, instantiating, or launching a guest partition, a guest virtual processor, or a guest virtual processor virtual trust level. For example, the value may be obtained by reading the value of the corresponding hardware register of the physical processor of the computing device. As an example, the obtained processor feature ID value may be a value assigned by the manufacturer of the physical processor (e.g., an on-chip value) and / or a value representing and / or indicating a feature / feature set supported by that processor.

[0044] The process optionally proceeds to 482, where the processor feature ID to be stored is computed or otherwise determined. For example, 482 can include determining whether the obtained processor feature ID value is to be stored without change, or whether a different value is to be stored. For example, if the supervisor partition is to "offer" to the guest partition a different set of processor features than are supported by the processor itself, e.g., for enhanced guest partition portability, performance, and / or other reasons, a different value can be stored. At 482, multiple values for the obtained processor feature ID value can also be determined, e.g., each value associated with a different guest partition and / or guest virtual processor and / or trust level context, and / or each value designated for a different guest partition and / or guest virtual processor and / or trust level context. In some examples, different processor feature ID values can be employed on each virtual processor context or virtual trust level context of a virtual processor. Examples of each virtual processor context or virtual trust level context of a virtual processor are a virtual machine control structure (VMCS), a virtual machine control block (VMCB), a set of system registers containing a guest context, or other virtualization instruction set architecture specific collection of a guest context.

[0045] The process proceeds to 483, where the processor feature ID of 482 is provided to the processor. For example, the supervisor partition can provide the processor feature ID determined at 482 to the processor for subsequent use by the processor in response to requests from guest partition software for processor feature ID information. At 483, the processor can also receive this processor feature ID information from the supervisor partition.

[0046] The process then proceeds to 484. At 484, the provided processor feature ID is stored. For example, 484 can include the supervisor process's action of causing the processor to store the provided processor feature ID, and / or the processor's action of performing the storing. For example, the storing can include storing the processor feature ID in a processor feature ID register, in a processor feature ID lookup table in memory, etc. In yet another example, the supervisor partition code can store the processor feature ID through a processor interface instruction such as an ID_REGISTER_WRITE instruction.

[0047] In yet another example, the processor feature ID can be written into a processor-accessible memory structure, and the location of that memory structure can be programmed into a processor register. In this and other examples, multiple memory structures can be employed, e.g., to support use of different processor feature ID values for different guest partitions, for different VMCSes, virtual processor contexts, trust level contexts, etc. In use, e.g., in response to a control of the processor switching from one guest partition, guest virtual processor, or guest virtual processor virtual trust level to another, a context switch between different memory structures can be performed by the processor or by supervisory partition code 230.

[0048] Optionally, 484 can also include storing a conditional expression to the processor that directs the processor to the appropriate value / memory structure of the plurality of values / memory structures for a given request from the guest partition. For example, the expression can be stored via an instruction such as ID_REGISTER_WRITE(VP_CONTEXT, REGISTER_NAME, CONDITIONAL, VALUE).

[0049] As noted above, this storage can also support the processor subsequently using the processor feature ID to respond to requests from the guest partition without causing the guest to exit. Process 400 can be repeated for additional processor feature IDs, or multiple processor feature IDs can be obtained, determined, provided, and stored in a single iteration of process 400. After 484, process returns to other operations.

[0050] Figure 5 An example process 500 is illustrated from the perspective of a guest partition (e.g., a guest partition 211, 212, or 213 of FIG. 2). Figure 2 Process 500 begins at 581, where it is determined that a processor feature ID is to be obtained. For example, this determination can be made by or at a guest partition in response to a request for a processor feature ID from an application or other process executing from the guest partition. As another example, this determination can represent a request by a virtual machine that a processor feature ID is to be obtained for use by the virtual machine.

[0051] Then, the process proceeds to 582, where a request for a processor feature ID is sent from the guest partition. This request can be sent to the processor. In response to the request of 582, at 583, a processor feature ID can be received from the processor. As discussed above, the received processor feature ID can be according to information provided a priori to the processor by the supervisor partition. From 583, the process can proceed to 584, where the received processor feature ID is provided to the requester (e.g., an application or other process on the guest partition). After 584, the process returns to other operations.

[0052] Conclusion

[0053] While the above DETAILED DESCRIPTION describes certain examples of the technology, and describes the best mode of practicing the technology, it is to be understood that the technology can be practiced in many ways, as encompassed by the following claims. Details can vary substantially in implementation, while still being encompassed by the technology described herein. As described above, particular terminology used when describing certain features or aspects of the technology should not be taken to imply that the terminology is being redefined herein to be restricted to any specific characteristics, features, or aspects with which that terminology is associated. In general, the terms used in the following claims should not be construed to limit the technology to the particular examples disclosed herein. Accordingly, the actual scope of the technology encompasses not only the disclosed examples, but also all equivalent ways of practicing or implementing the technology.

Claims

1. A method for supporting virtualization, comprising: The physical processor receives processor feature ID information from the supervisory partition for a processor feature ID, which is different from the value assigned by the manufacturer of the physical processor; After receiving the processor feature ID information from the supervisory partition, the physical processor receives a request for the processor feature ID initiated from the guest partition; as well as In response to the request, without intervention from the supervisory partition, the physical processor provides the processor feature ID to the guest partition based on the processor feature ID information previously received by the physical processor for the processor feature ID.

2. The method of claim 1, wherein the processor feature ID information for the processor feature ID is received from the supervisory partition in conjunction with a setting operation for at least one of the following: the guest partition, the guest virtual processor, or the guest virtual processor virtual trust level.

3. The method according to claim 2, wherein the setting operation of the guest partition, the guest virtual processor, or the guest virtual processor virtual trust level includes at least one of the following: generating, instantiating, or starting the guest partition, the guest virtual processor, or the guest virtual processor virtual trust level.

4. The method according to claim 1, wherein the processor feature ID indicates support for a first feature or indicates a lack of support for a second feature, wherein the first feature is not supported by the physical processor itself, and the second feature is supported by the physical processor itself.

5. The method according to claim 1, wherein, The processor feature ID is assigned to either the Virtual Machine Control Structure (VMCS) or the Virtual Machine Control Module (VMCB), and Different processor feature IDs are assigned for different VMCS or VMCB.

6. The method according to claim 1, wherein, The processor feature ID is specified for a virtual processor or a virtual trust level context of a virtual processor, and Different processor feature IDs are assigned for different virtual processors or different virtual trust level contexts of virtual processors.

7. A computing device, comprising: A memory and a physical processor, the memory and the physical processor being configured to store and execute instructions, the instructions including instructions for causing the computing device to perform operations, the operations including: The processor feature ID information is determined by the supervised partition. In response to a request for the processor feature ID information from software executing in the guest partition, the processor feature ID information is returned by the physical processor, and the processor feature ID information is different from the value assigned by the manufacturer of the physical processor. The supervisory partition provides the processor feature ID information to the physical processor so that the physical processor can subsequently use the processor feature ID information in response to a request from the software, without the intervention of the supervisory partition. After receiving the processor feature ID information from the supervisory partition, the physical processor receives a request for the processor feature ID information from the software executing in the guest partition; and In response to the request, without intervention from the supervisory partition, the processor feature ID information is provided by the physical processor based on the processor feature ID information provided by the supervisory partition.

8. The computing device according to claim 7, wherein, The processor feature ID information, combined with a setting operation for the guest partition or at least one of the software executed in the guest partition, is provided to the physical processor; as well as The setup operation includes at least one of the following: the generation, instantiation, or startup of the guest partition or the software executed in the guest partition.

9. The computing device according to claim 7, wherein the processor feature ID information includes a processor feature ID value.

10. The computing device of claim 7, wherein the processor feature ID information includes a CPUID value.

11. The computing device according to claim 7, wherein the processor feature ID information includes: Instructions regarding support for at least one feature not supported by the physical processor itself, or instructions regarding the lack of support for at least one other feature supported by the physical processor itself.

12. A method for operating a virtual machine on a computing device, comprising: The processor feature ID to be obtained is determined by the virtual machine executing on the computing device for use by the virtual machine; The virtual machine sends a request for the processor's characteristic ID to the physical processor of the computing device; as well as In response to the request, the processor feature ID is received from the physical processor, wherein the processor feature ID is provided by the physical processor based on processor feature ID information previously received by the physical processor from the supervisory partition without intervention from the supervisory partition, and the processor feature ID is different from the value assigned by the manufacturer of the physical processor.

13. The method of claim 12, wherein the processor feature ID is received from the physical processor without requiring the virtual machine to exit.

14. The method of claim 12, wherein the processor feature ID indicates support for a first processor feature or indicates a lack of support for a second processor feature, the first processor feature not being supported by the physical processor itself, and the second processor feature being supported by the physical processor itself.

15. The method according to claim 12, wherein, The processor feature ID is specific to at least one of the following: the virtual machine, the virtual processor, or the trust level of the virtual processor, and Different processor feature IDs are specific to another virtual machine, virtual processor, or trust level of the virtual processor on the computing device.

16. The method of claim 12, wherein the processor feature ID includes a CPUID value.

17. The method according to claim 12, wherein, The processor characteristic ID is received in conjunction with a setting operation for at least one of the following: the virtual machine, the virtual processor, or the trust level of the virtual processor, and The setting operation for at least one of the virtual machine, virtual processor, or trust level of the virtual processor includes at least one of the following: generating, instantiating, or starting the virtual machine, virtual processor, or trust level of the virtual processor.

Images