Root Hypervisor Callbacks for Multi-Level Virtualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing systems with thin hypervisors face challenges in executing additional hypervisors or virtual machine monitors (VMMs) while maintaining security, as hosted VMMs can potentially compromise the host operating system's security, and nested virtualization leads to a high number of virtual machine exits, affecting performance.
Innovation Solution
A computing device that supports root and non-root virtualization modes, where the root hypervisor handles virtual machine exits and evaluates trigger conditions to execute callback handlers, reducing the need for nested virtualization and minimizing virtual machine exits, thereby improving performance and security by maintaining a smaller trusted code base.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a thin hypervisor is used to monitor host operating system integrity, then security is improved, but the ability to execute additional hypervisors or VMMs is reduced
Solution Approach 1:
The patent implements nested virtualization where a hosted VMM runs within the host operating system under the supervision of the thin hypervisor. This allows multiple virtualization layers to coexist, with the thin hypervisor maintaining security while the hosted VMM provides additional virtualization capabilities. The nested structure enables the thin hypervisor to virtualize hardware features for the hosted VMM, resolving the contradiction between security and adaptability.
2Adaptability or versatility
If hosted VMMs are executed with privileged components, then functionality is improved, but security of the host operating system is compromised
Solution Approach 1:
The patent applies different privilege levels to different components. The hosted VMM receives virtualized hardware features with appropriate privilege levels through the thin hypervisor, allowing it to function properly while the thin hypervisor maintains elevated privileges for security. This local differentiation of privilege levels enables the hosted VMM to have sufficient functionality without compromising overall system security.
3Adaptability or versatility
If nested virtualization is implemented, then the ability to run hosted VMMs is improved, but the number of virtual machine exits increases
Solution Approach 1:
The thin hypervisor acts as an intermediary between the hardware and the hosted VMM, virtualizing hardware features and managing VM exits. By intercepting and handling VM exits at the thin hypervisor level, the system can optimize exit handling and reduce the overall number of exits propagating through the nested virtualization stack, thereby improving performance while maintaining the ability to run hosted VMMs.
Data Source
AI summary
Technologies for multi-level virtualization include a computing device having a processor that supports a root virtualization mode and a non-root virtualization mode. A non-root hypervisor determines whether it is executed under control of a root hypervisor, and if so, registers a callback handler and trigger conditions with the root hypervisor. The non-root hypervisor hosts one or more virtual machines. In response to a virtual machine exit, the root hypervisor determines whether a callback handler has been registered for the virtual machine exit reason and, if so, evaluates the trigger conditions associated with the callback handler. If the trigger conditions are satisfied, the root hypervisor invokes the callback handler. The callback handler may update a virtual virtualization support object based on changes made by the root hypervisor to a virtualization support object. The root hypervisor may invoke the callback handler in the non-root virtualization mode. Other embodiments are described and claimed.