Importance

Loading Importance Indicators...

Abstract

Described systems and methods enable a host system to efficiently perform computer security activities, when operating in a hardware virtualization configuration. A processor is configured to generate a VM suspend event (e.g., a VM exit or a virtualization exception) when software executing within a guest VM performs a memory access violation. In some embodiments, the processor is further configured to save disassembly data determined for the processor instruction which triggered the VM suspend event to a special location (e.g., a specific processor register) before generating the event. Saved disassembly data may include the contents of individual instruction encoding fields, such as Prefix, Opcode, Mod R/M, SIB, Displacement, and Immediate fields on Intel® platforms.

Loading the Abstract Image...

First Claim