Fast stub and frame technology for virtual machine optimization
View Patent ↗A method and system for handling of potential unsafe instructions and/or for handling transfers of control in a Virtual Machine, that includes generating a frame composed of pages of analyzed code based on original guest code; identifying instructions within the frame that transfer control (or are otherwise unsafe); replacing instructions that transfer the control with an interrupt that transfers control to a stub in non-privileged code; wherein the stub checks whether the control transfer (or instruction) is safe or unsafe, and (i) for unsafe control transfers/unsafe instructions, switches the context to Virtual Machine Monitor; and (ii) for safe control transfers, executes the control transfer in non-privileged mode. The instructions that transfer control can include any of JMP, CALL, RET and RET(n). The instructions that transfer control can also include interrupts.
1. A method for handling potentially unsafe instructions in a Virtual Machine, comprising:
(a) generating a set of pages of analyzed code, the set being based on original guest code and being a contiguous combination of sequential pages, such that when executing the analyzed code, a value of guest offset address is the same as a value of a real offset address; and
(b) replacing at least some potentially unsafe instructions with a transfer to a stub in non-privileged code, wherein
(i) for a potentially unsafe instruction identified as unsafe, the stub switches a Virtual Machine Monitor context to full emulation; and
(ii) for a potentially unsafe instruction identified as safe, the stub bypasses the instruction in the Virtual Machine context.
2. The method of claim 1 , wherein the potentially unsafe instructions include transfer control instructions.
3. The method of claim 2 , wherein the transfer control instructions include any of JMP, CALL, RET and RET(n).
4. The method of claim 2 , wherein the stub checks the address to which control transfers and make decision about instruction is safe or unsafe based on the address.
5. The method of claim 1 , wherein control is transferred to the stub using an INT(n).
6. The method of claim 1 , wherein control is transferred to the stub using a jump.
7. The method of claim 1 , wherein the stub is located in a separate memory area from the analyzed code.
8. A method for handling potentially unsafe instructions in a Virtual Machine, comprising:
(a) generating a set of pages of analyzed code based on original guest code and being a contiguous combination of sequential pages, such that when executing the analyzed code, a value of guest offset address is the same as a value of a real offset address;
(b) generating shadow frames corresponding to the set of pages;
(c) identifying the potentially unsafe instructions within the set of pages;
(d) replacing the potentially unsafe instructions with transfer instructions to corresponding shadow frames;
(e) placing code overwritten by the control transfer instruction in the shadow frames;
(f) adding, to the shadow frame, instructions that transfers control to a stub in non-privileged code;
(g) wherein
(i) for the instruction identified as unsafe, the stub switches Virtual Machine Monitor context to full emulation; and
(ii) for the instruction identified as safe, the stub executes the control transfer in a non-privileged mode.
9. The method of claim 7 , further comprising grouping multiple sets of pages of analyzed code into a superframe having a contiguous address space.
10. The method of claim 7 , further comprising grouping multiple sets of pages of analyzed code and multiple shadow frames into a superframe having a contiguous address space.
11. A computer useable storage medium having computer program logic stored thereon for executing on a processor for handling potentially unsafe instructions, the computer program logic comprising executable code for performing the steps of claim 8 .
12. A method for handling transfers of control in a Virtual Machine, comprising:
(a) analyzing original guest code to identify potentially unsafe instructions in the original guest code;
(b) generating analyzed code with the potentially unsafe instructions replaced by breakpoints;
(c) placing the analyzed code into a set of pages of analyzed, wherein the set comprises a plurality of sequential consecutive pages in memory, and each page of the set corresponds to a page of original guest code;
(d) wherein a page sequence in the set corresponds to a page sequence of the original guest code, and when executing the analyzed code, a value of guest offset address is the same as a value of a real offset address;
(e) associating the set with a memory segment, such that a processor can address the analyzed code in the frame using segment-based addressing.
13. The method of claim 12 , further comprising:
(a) generating a shadow frame such that code in the shadow frame is executed instead of the analyzed code when the analyzed contains an unsafe transfer of control instruction;
(b) replacing the unsafe transfer of control instruction in the set of analyzed pages with control transfer instructions to code in the shadow frames;
(c) replacing code overwritten by the control transfer instruction in the shadow frame; and
(d) adding, to the shadow frame, instructions that transfer control to a stub in non-privileged code.
14. The method of claim 12 , wherein the stub is located in a separate memory area from the analyzed code.
15. The method of claim 12 , further comprising grouping multiple sets of pages of analyzed code into a superframe having a contiguous linear address space.