Abstract: Technologies for fast launch of trusted containers include a computing device having a trusted platform module (TPM). The computing device measures a container runtime with the TPM and executes the container runtime in response to the measurement. The computing device establishes a trust relationship between the TPM and a virtual platform credential, provisions the virtual platform credential to a virtual TPM, and executes a guest environment in response to provisioning the virtual platform credential. The computing device measures a containerized application with the virtual TPM and executes the containerized application in response to the measurement. The computing device may perform a trusted computing operation in the guest environment with the virtual TPM. The virtual TPM and the containerized application may be protected with multi-key total memory encryption (MKTME) support of the computing device. State of the virtual TPM may be encrypted and persisted. Other embodiments are described and claimed.

Abstract: Technologies for fast launch of trusted containers include a computing device having a trusted platform module (TPM). The computing device measures a container runtime with the TPM and executes the container runtime in response to the measurement. The computing device establishes a trust relationship between the TPM and a virtual platform credential, provisions the virtual platform credential to a virtual TPM, and executes a guest environment in response to provisioning the virtual platform credential. The computing device measures a containerized application with the virtual TPM and executes the containerized application in response to the measurement. The computing device may perform a trusted computing operation in the guest environment with the virtual TPM. The virtual TPM and the containerized application may be protected with multi-key total memory encryption (MKTME) support of the computing device. State of the virtual TPM may be encrypted and persisted. Other embodiments are described and claimed.

Abstract: Technologies for fast launch of trusted containers include a computing device having a trusted platform module (TPM). The computing device measures a container runtime with the TPM and executes the container runtime in response to the measurement. The computing device establishes a trust relationship between the TPM and a virtual platform credential, provisions the virtual platform credential to a virtual TPM, and executes a guest environment in response to provisioning the virtual platform credential. The computing device measures a containerized application with the virtual TPM and executes the containerized application in response to the measurement. The computing device may perform a trusted computing operation in the guest environment with the virtual TPM. The virtual TPM and the containerized application may be protected with multi-key total memory encryption (MKTME) support of the computing device. State of the virtual TPM may be encrypted and persisted. Other embodiments are described and claimed.

Abstract: Memory security technologies are described. An example processing device includes a processor core and a memory controller coupled to the processor core and a memory. The processor core can determine that an exit condition to transfer control of a resource for a processor core from a first virtual machine monitor (VMM) to a second VMM has occurred. The processor core can also determine whether a control virtual machine control structure (VMCS) link pointer is valid. The processor core can also determine whether a reason value corresponding to the control VMCS link pointer is set. The processor core can also determine whether the reason value is set to zero. The processor core can also determining whether an exception bit corresponding to a specific exception type of a reason value is set. The processor core can also transfer a control of the resource from the first VMM to the second VMM.

Abstract: Embodiments of an invention for virtualization exceptions are disclosed. In one embodiment, a processor includes instruction hardware, control logic, and execution hardware. The instruction hardware is to receive a plurality of instructions, including an instruction to enter a virtual machine. The control logic is to determine, in response to a privileged event occurring within the virtual machine, whether to generate a virtualization exception. The execution hardware is to generate a virtualization exception in response to the control logic determining to generate a virtualization exception.

Abstract: Embodiments of an invention for virtualization exceptions are disclosed. In one embodiment, a processor includes instruction hardware, control logic, and execution hardware. The instruction hardware is to receive a plurality of instructions, including an instruction to enter a virtual machine. The control logic is to determine, in response to a privileged event occurring within the virtual machine, whether to generate a virtualization exception. The execution hardware is to generate a virtualization exception in response to the control logic determining to generate a virtualization exception.

Abstract: Embodiments of an invention for virtualization exceptions are disclosed. In one embodiment, a processor includes instruction hardware, control logic, and execution hardware. The instruction hardware is to receive a plurality of instructions, including an instruction to enter a virtual machine. The control logic is to determine, in response to a privileged event occurring within the virtual machine, whether to generate a virtualization exception. The execution hardware is to generate a virtualization exception in response to the control logic determining to generate a virtualization exception.

Abstract: Memory security technologies are described. An example processing device includes a processor core and a memory controller coupled to the processor core and a memory. The processor core can determine that an exit condition to transfer control of a resource for a processor core from a first virtual machine monitor (VMM) to a second VMM has occurred. The processor core can also determine whether a control virtual machine control structure (VMCS) link pointer is valid. The processor core can also determine whether a reason value corresponding to the control VMCS link pointer is set. The processor core can also determine whether the reason value is set to zero. The processor core can also determining whether an exception bit corresponding to a specific exception type of a reason value is set. The processor core can also transfer a control of the resource from the first VMM to the second VMM.

Abstract: Technologies for fast launch of trusted containers include a computing device having a trusted platform module (TPM). The computing device measures a container runtime with the TPM and executes the container runtime in response to the measurement. The computing device establishes a trust relationship between the TPM and a virtual platform credential, provisions the virtual platform credential to a virtual TPM, and executes a guest environment in response to provisioning the virtual platform credential. The computing device measures a containerized application with the virtual TPM and executes the containerized application in response to the measurement. The computing device may perform a trusted computing operation in the guest environment with the virtual TPM. The virtual TPM and the containerized application may be protected with multi-key total memory encryption (MKTME) support of the computing device. State of the virtual TPM may be encrypted and persisted. Other embodiments are described and claimed.

Abstract: Memory security technologies are described. An example processing device includes a processor core and a memory controller coupled to the processor core and a memory. The processor core can determine that an exit condition to transfer control of a resource for a processor core from a first virtual machine monitor (VMM) to a second VMM has occurred. The processor core can also determine whether a control virtual machine control structure (VMCS) link pointer is valid. The processor core can also determine whether a reason value corresponding to the control VMCS link pointer is set. The processor core can also determine whether the reason value is set to zero. The processor core can also determining whether an exception bit corresponding to a specific exception type of a reason value is set. The processor core can also transfer a control of the resource from the first VMM to the second VMM.

Abstract: Memory security technologies are described. An example processing device includes a processor core and a memory controller coupled to the processor core and a memory. The processor core can determine that an exit condition to transfer control of a resource for a processor core from a first virtual machine monitor (VMM) to a second VMM has occurred. The processor core can also determine whether a control virtual machine control structure (VMCS) link pointer is valid. The processor core can also determine whether a reason value corresponding to the control VMCS link pointer is set. The processor core can also determine whether the reason value is set to zero. The processor core can also determining whether an exception bit corresponding to a specific exception type of a reason value is set. The processor core can also transfer a control of the resource from the first VMM to the second VMM.

Abstract: Embodiments of an invention for virtualization exceptions are disclosed. In one embodiment, a processor includes instruction hardware, control logic, and execution hardware. The instruction hardware is to receive a plurality of instructions, including an instruction to enter a virtual machine. The control logic is to determine, in response to a privileged event occurring within the virtual machine, whether to generate a virtualization exception. The execution hardware is to generate a virtualization exception in response to the control logic determining to generate a virtualization exception.

Abstract: Embodiments of an invention for virtualization exceptions are disclosed. In one embodiment, a processor includes instruction hardware, control logic, and execution hardware. The instruction hardware is to receive a plurality of instructions, including an instruction to enter a virtual machine. The control logic is to determine, in response to a privileged event occurring within the virtual machine, whether to generate a virtualization exception. The execution hardware is to generate a virtualization exception in response to the control logic determining to generate a virtualization exception.

Abstract: Embodiments of an invention for virtualization exceptions are disclosed. In one embodiment, a processor includes instruction hardware, control logic, and execution hardware. The instruction hardware is to receive a plurality of instructions, including an instruction to enter a virtual machine. The control logic is to determine, in response to a privileged event occurring within the virtual machine, whether to generate a virtualization exception. The execution hardware is to generate a virtualization exception in response to the control logic determining to generate a virtualization exception.