METHOD AND SYSTEM FOR ESTABLISHING A ROBUST VIRTUALIZED ENVIRONMENT

• US 20090172661A1
• Filed: 12/28/2007
• Published: 07/02/2009
• Est. Priority Date: 12/28/2007
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Zimmer, Vincent J., Rothman, Michael A.
• Granted Patent: US 8,522,236 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45566 Nested virtual machines
• CPC Class Codes: G06F 2009/45583 Memory management, e.g. access or allocation
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

A method and system for establishing a virtualized environment includes booting a first virtual machine monitor to establish a first virtual machine and booting a second virtual machine monitor in the first virtual machine. The first and second virtual machine monitors may be hypervisors. The method may also include directing management interrupts, such as system management interrupts and/or platform management interrupts, to the first virtual machine monitor.

Claims

1. A method comprising:

executing firmware instructions to boot a first virtual machine monitor;

establishing a first virtual machine using the first virtual machine monitor;

booting a second virtual machine monitor in the first virtual machine;

establishing a second virtual machine using the second virtual machine monitor; and

establishing a software trap to direct management interrupts to the first virtual machine monitor.

2. The method of claim 1, wherein the first virtual machine monitor is a hypervisor.

3. The method of claim 2, wherein the second virtual machine monitor is a hypervisor.

4. The method of claim 1, wherein the management interrupts include at least one of a system management interrupt and a platform management interrupt.

5. The method of claim 1, wherein the first virtual machine monitor is a platform-specific virtual machine monitor.

6. The method of claim 1, wherein executing firmware instructions to boot the first virtual machine monitor comprises booting the first virtual machine monitor using an authenticated code module.

7. The method of claim 1, further comprising providing the management interrupt to the second virtual machine monitor.

8. The method of claim 1, further comprising translating a guest-physical memory address associated with the second virtual machine monitor to a host-physical memory address associated with the first virtual machine monitor using Extended Page Tables (EPT).

9. The method of claim 1, further comprising performing a page migration by the first virtual machine monitor to a reserved memory region that has been sequestered from the second virtual machine monitor.

10. A method comprising:

executing firmware instructions of a platform to boot a platform-specific virtual machine monitor;

establishing a first virtual machine using the platform-specific virtual machine monitor;

booting a non-platform-specific virtual machine monitor in the first virtual machine;

establishing a second virtual machine using the non-platform-specific virtual machine monitor; and

directing all management interrupts to the platform-specific virtual machine monitor.

11. The method of claim 10, wherein each of the platform-specific virtual machine monitor and the non-platform-specific virtual machine monitor is a hypervisor.

12. The method of claim 10, wherein the management interrupts include at least one of a system management interrupt and a platform management interrupt.

13. The method of claim 10, wherein executing firmware instructions of a platform to boot a platform-specific virtual machine monitor comprises booting the platform-specific virtual machine monitor using an authenticated code module.

14. The method of claim 10, wherein the platform-specific virtual machine monitor delivers the management interrupt to the non-platform-specific virtual machine monitor.

15. The method of claim 10, further comprising translating a guest-physical memory address associated with the non-platform-specific virtual machine monitor to a host-physical memory address associated with the platform-specific virtual machine monitor using Extended Page Tables (EPT).

16. The method of claim 10, further comprising performing a page migration by the platform-specific virtual machine monitor to a reserved memory region that has been sequestered from the non-platform-specific virtual machine monitor.

17. A computing device comprising:

a processor; and

a memory device having stored therein a plurality of instructions, which when executed by the processor, cause the processor to;

boot a first hypervisor;

virtualize a second hypervisor using the first hypervisor; and

establish a software trap to direct management interrupts to the first hypervisor.

18. The computing device of claim 17, wherein the first hypervisor is a platform-specific hypervisor and the second hypervisor is a non-platform specific hypervisor.

19. The computing device of claim 17, wherein to boot the first hypervisor comprises to boot the first hypervisor using an authenticated code module.

20. The computing device of claim 17, wherein the plurality of instructions further cause the processor to perform a page migration to a reserved memory region that has been sequestered from the second hypervisor prior to the booting of the second hypervisor.