Monitoring Execution of Guest Code in a Virtual Machine

• US 20090055693A1
• Filed: 08/08/2008
• Published: 02/26/2009
• Est. Priority Date: 08/08/2007
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Chen, Xiaoxin, Waldspurger, Carl, Subrahmanyam, Pratap, Horovitz, Oded, Budko, Dmitriy
• Granted Patent: US 8,402,441 B2
• Time in Patent Office: Days
• US Class Current: 714/57
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

One embodiment of the present invention is a method of operating a virtualization system, the method including: (a) instantiating a guest in a virtual machine of the virtualization system; and (b) monitoring execution of code registered for monitored execution in an execution context of the guest, wherein the monitoring is performed by the virtualization system and is hidden from computations of the guest.

Claims

1. A method of operating a virtualization system, the method comprising:

executing a guest in a virtual machine of the virtualization system; and

monitoring for execution of code registered for monitored execution in connection with a guest computation, wherein the monitoring is performed by the virtualization system and is hidden from the guest computation.

2. The method of claim 1,

wherein the monitoring includes checking to ensure that the registered code executes on a recurring basis.

3. The method of claim 2,

wherein the recurring basis is generally periodic.

4. The method of claim 1,

wherein the monitoring includes checking to ensure that the registered code executes in response to a triggering event.

5. The method of claim 1,

wherein the monitoring is specific to at least one execution context of the guest computation in which execution of the registered code is expected.

6. The method of claim 1, further comprising:

updating memory mapping information maintained by the virtualization system for a portion of memory that contains at least a portion of the registered code; and

triggering, based on the updated memory mapping information, execution of code that indicates an execution of the registered code.

7. The method of claim 6,

wherein the updated mapping information includes a page table mapping that maps from a guest virtual page (GVPN) exposed to the virtual machine to a physical page (PPN) in memory addressable by the virtualization system.

8. The method of claim 6,

wherein the updating includes marking a memory page as not executable or not present;

and

wherein the triggered code includes a fault handler.

9. The method of claim 1, further comprising:

augmenting binary code instruction sequences executed by the virtualization system in connection with the registered code to indicate an execution of registered code.

10. The method of claim 9,

wherein the augmenting is performed using binary translation functionality of the virtualization system.

11. The method of claim 1, further comprising:

registering the code and an associated trigger.

12. The method of claim 11, wherein the registered code is identified using one or more of:

an address at which at least a portion of the code is stored in virtual or physical memory space;

a process, thread or task identifier under which the code is scheduled for execution by the guest;

an associated execution context of the guest; and

content of a least a portion of the code.

13. The method of claim 11,

wherein registration of the code is performed in response to a request from within the virtual machine.

14. The method of claim 11,

wherein the registered code is identified in connection with static or dynamic configuration information for the virtual machine.

15. The method of claim 1, further comprising:

triggering a notice, alert, or policy-based responsive action in response to a failure to execute the registered code as expected.

16. The method of claim 1, further comprising:

forcing, from the virtualization system, execution of the registered code.

17. The method of claim 16,

wherein the forcing is in response to a failure to execute the registered code as expected.

18. The method of claim 1,

wherein the guest includes a guest operating system;

and

wherein execution of the registered code and of other unregistered code are coordinated by the guest operating system.

19. The method of claim 1,

wherein the guest includes a software appliance;

and

wherein the registered code constitutes a portion of the software appliance.

20. The method of claim 1, wherein the registered code includes code associated with operation of one or more of:

an antivirus system;

a firewall or gateway;

an intrusion detection system;

a performance or uptime monitoring system;

a license monitoring, metering or enforcement system;

a copyright or digital rights management system; and

critical operating system functionality.

21. A computational system that monitors for execution of registered code within a virtual machine, wherein the monitoring is performed from behind a virtualization barrier and without reliance on functionality of guest software executing within the virtual machine.

22. The computational system of claim 21, further comprising:

a guest operating system instantiated in the virtual machine as the guest software,

wherein execution of the registered code and of other unregistered code are coordinated by the guest operating system.

23. The computational system of claim 21, further comprising:

a virtualization system that coordinates execution, on an underlying hardware machine, of instruction sequences that correspond to respective execution contexts of the guest software,

wherein the monitoring includes augmenting at least a particular one of the instruction sequences executed by the virtualization system in connection with the registered code to record execution of registered code.

24. The computational system of claim 21, further comprising:

a virtualization system that maintains mapping information for memory pages exposed to the guest software, the mapping being from a guest memory space to a physical memory space addressable by the virtualization system,

wherein the monitoring includes updating memory mapping information for a portion of memory that contains at least a portion of the registered code and triggering, based on the updated memory mapping information, execution of code that indicates an execution of the registered code.

25. An apparatus comprising:

a hardware machine;

virtualization software encoded in one or more media accessible to the hardware machine and executable to expose at least one virtual machine using resources of the hardware machine; and

guest software encoded in one or more media accessible to the virtual machine, the guest software executable on an exposed virtual machine,

wherein the virtualization software includes code executable on the hardware machine to monitor for execution of registered code within the exposed virtual machine, and wherein the monitoring is performed from behind a virtualization barrier and without reliance on functionality of the guest software.

26. A computer program product comprising:

one or more functional sequences executable as, or in conjunction with, a virtualization system to monitor for execution of registered code within a virtual machine, wherein the monitoring is performed from behind a virtualization barrier and without reliance on functionality of guest software executing within the virtual machine.

27. The computer program product of claim 26, further comprising:

a binary translator operable within the virtualization system to alter an instruction sequence of the registered code and thereby monitor its execution.

28. The computer program product of claim 26, further comprising:

memory management code executable to selectively modify page table entries that correspond to the registered code and which are maintained by the virtualization system, and to thereby trigger, upon attempted access to the registered code, an indication of registered code execution.

29. The computer program product of claim 26, encoded in at least one computer readable medium selected from the set of a disk, tape or other magnetic, optical or electronic storage medium.

30. The computer program product of claim 26, at least transiently encoded in connection with transmission via a network, wire line, wireless or other communications medium.