Transparent secure interception handling

1. A computer system for transparent secure interception handling, the computer system comprising:

one or more computer processors;

one or more computer-readable storage media;

program instructions stored on the computer-readable storage media for execution by at least one of the one or more processors, the program instructions comprising:

a hypervisor running on a hardware, the hypervisor being configured for deploying a virtual machine, VM, in the computer system, the virtual machine being configured to access a corresponding VM memory of the computer system;

upon deploying the virtual machine providing a buffer to a firmware and executing VM instructions of the virtual machine;

the firmware being part of the computer system, the firmware manages the hardware and manages states of the virtual machine, wherein the firmware is configured for intercepting a VM instruction of the VM instructions which requires access to instruction data, the instruction data comprising at least one of VM data that is stored in the VM memory and at least part of a state of the virtual machine (VM state);

copying the VM state into a shadow VM state buffer owned by the firmware;

copying the instruction data to the buffer;

the hypervisor being configured for executing an intercepted VM instruction using the buffer;

the firmware being configured for updating at least part of shadow VM state buffer and the VM data in the VM memory using result data in the buffer in response to the executing of the intercepted VM instruction resulting in the result data;

the firmware being further configured for executing the VM instructions based on a state stored in the updated shadow VM state buffer, and following the intercepted VM instruction.

2. The computer system of claim 1 , further comprising:

the firmware being configured for updating at least part of the shadow VM state buffer and the VM data in the VM memory using result data in the buffer before resuming execution of the VM instructions following the intercepted VM instruction and in response to executing the intercepted VM instruction, by the hypervisor, resulting in the result data; and

the firmware being further configured for resuming execution of the VM instructions following the intercepted VM instruction based on state stored in the shadow VM state buffer.

3. The computer system of claim 1 , further comprising:

interrupting the execution of the VM instructions;

the firmware being configured for updating at least part of the shadow VM state buffer and the VM data in the VM memory using result data in the buffer before resuming execution of the VM instructions following the intercepted VM instruction and in response to executing the intercepted VM instruction, by the hypervisor, resulting in the result data; and

the firmware being further configured for resuming execution of the VM instructions following the intercepted VM instruction based on state stored in the shadow VM state buffer.

4. A computer hardware structure for transparent secure interception handling, the computer hardware structure managing hardware and states of a virtual machine, the computer hardware structure storing code defining a firmware, the code being embodied on a tangible storage medium of the computer hardware structure for execution by a processor of the computer hardware structure, the firmware being configured for:

intercepting a VM instruction of VM instructions of the VM which requires access to instruction data, the instruction data comprising at least one of VM data that is stored in a VM memory and at least part of a state of the virtual machine (VM state);

copying the VM state into a shadow VM state buffer owned by the firmware;

copying the instruction data to buffer;

updating at least part of the shadow VM state buffer and the VM data in the VM memory using result data in the buffer in response to the executing of the intercepted VM instruction resulting in the result data; and

executing the VM instructions based on a state stored in the updated shadow VM state buffer, and following the intercepted VM instruction.

5. The firmware of claim 4 , further comprising:

before resuming the execution of the VM instructions following the intercepted VM instructions performing the updating at least part of the shadow VM state buffer updating the shadow VM state buffer and the VM data in the VM memory using result data in the buffer in response to the executing of the intercepted VM instruction, by the hypervisor, resulting in the result data; and

resuming the execution of the VM instructions following the intercepted VM instruction based on the state stored in the updated shadow VM state buffer.

6. The firmware of claim 4 , further comprising:

interrupting the execution of the VM instructions; and

before resuming the execution of the VM instructions following the intercepted VM instructions performing the updating at least part of the shadow VM state buffer updating the shadow VM state buffer and the VM data in the VM memory using result data in the buffer in response to the executing of the intercepted VM instruction, by the hypervisor, resulting in the result data; and

resuming the execution of the VM instructions following the intercepted VM instruction based on the state stored in the updated shadow VM state buffer.

7. A computer program product for transparent secure interception handling, the computer program product comprising a tangible storage device and programming instructions embodied on the tangible storage device for execution by a processor, the programming instructions defining a hypervisor being configured for:

deploying a virtual machine, VM, in a computer system;

configuring the virtual machine to access a corresponding VM memory of the computer system;

upon deploying the virtual machine providing a buffer to a firmware of the computer system;

executing VM instructions of the virtual machine;

executing an intercepted VM instruction of the VM instructions using the buffer;

causing execution of the VM instructions based on a state stored in an updated shadow VM state buffer, and following the intercepted VM instruction.

8. The hypervisor of claim 7 , further comprising:

causing resumption of execution of the VM instructions following the intercepted VM instruction based on a state stored in a shadow VM state buffer.

9. A computer program product for transparent secure interception handling, the computer program product comprising one or more non-transitory computer readable storage medium and program instructions stored on the one or more computer-readable storage media, the program instructions executable by a processor to:

deploy a virtual machine (VM) in an environment, the environment comprising a hypervisor running on a hardware and a firmware which manages the hardware and which manages states of the virtual machine, the virtual machine being configured to access a corresponding VM memory of the environment;

provide a buffer to the firmware, upon deploying the virtual machine;

execute VM instructions of the virtual machine;

intercept a VM instruction of the VM instructions which requires access to instruction data, the instruction data comprising at least one of VM data that is stored in the VM memory and at least part of a state of the virtual machine (VM state);

copy the VM state into a shadow VM state buffer owned by the firmware, upon intercepting of the VM instruction;

copy the instruction data to the buffer;

execute the intercepted VM instruction using the buffer;

update the shadow VM state buffer and the VM data in the VM memory using result data in the buffer in response to the executing of the intercepted VM instruction resulting in the result data; and

execute the VM instructions based on a state stored in the updated shadow VM state buffer, and following the intercepted VM instruction.

10. The computer program product of claim 9 , further comprising:

update at least one of the shadow VM state buffer and the VM data in the VM memory using result data in the buffer in response to executing of the intercepted VM instruction, by the hypervisor, resulting in the result data, before resuming execution of the VM instructions following the intercepted VM instruction; and

resume execution of the VM instructions following the intercepted VM instruction based on state stored in the shadow VM state buffer.

11. The computer program product of claim 9 , further comprising:

interrupt the execution of the VM instructions;

update at least one of the shadow VM state buffer and the VM data in the VM memory using result data in the buffer in response to executing of the intercepted VM instruction, by the hypervisor, resulting in the result data, before resuming execution of the VM instructions following the intercepted VM instruction; and

resume execution of the VM instructions following the intercepted VM instruction based on state stored in the shadow VM state buffer.