Secure mapping of process address space identifiers for computing environment implementing input / output virtualization

Abstract

A processor includes a virtual machine manager (VMM) configured to map a guest process address space identifier (PASID) associated with a virtual machine (VM) to a host PASID associated with a host machine of the VM. The processor further includes a processor core configured to, in response to the guest PASID being mapped to the host PASID, maintain an entry in a PASID reverse mapping table (PMP), the entry including one or more security attributes associated with the host PASID.

Description

Background Technology

[0001] Processing systems (e.g., servers) typically employ virtualized execution environments to combine and scale the physical and logical resources of the processing system. For example, a processing system executes virtual machines (guests), which are software entities that emulate the hardware of the processing system or otherwise interface with the hardware to support the execution of software programs. Virtual machines can use hardware elements in the processing system (e.g., processors, memory, network interfaces, etc.) to provide support for one or more instances of an operating system (referred to as guest operating systems). The guest operating system then provides support for executing other software programs such as applications and databases. A virtual machine manager or monitor (e.g., a hypervisor) controls the scheduling of the different virtual machines used for execution and provides an interface between the virtual machines and the server hardware, enabling each VM to operate as if it were executing on its own dedicated hardware. In another example, a processing system virtualizes one or more of its input / output devices, such as controllers (e.g., bus, interconnect and / or infrastructure controllers, network interface controllers, etc.), processors / accelerators (e.g., graphics processors, cryptographic accelerators, compression accelerators), and any other resources that can be addressed within the processing system. Virtualization of input / output devices allows physical devices to appear as multiple physical devices to the host machine or virtual machines. Attached Figure Description

[0002] This disclosure can be better understood by referring to the accompanying drawings, and many of its features and advantages will be apparent to those skilled in the art. The same reference numerals are used in different drawings to denote similar or identical items.

[0003] Figure 1 It is a block diagram of a processing system that employs secure mapping of process address space identifiers (PASIDs) for virtualized computing / execution environments, based on some specific implementations.

[0004] Figure 2 The illustration shows an example of a PASID mapping table configuration based on some specific implementations.

[0005] Figure 3 The illustration shows an example of a PASID reverse mapping table (PMP) based on some specific implementations.

[0006] Figure 4 The illustration is based on some specific implementations. Figure 1 A block diagram of an example Virtual Machine Manager (VMM) of a processing system, which performs a PMP update process to add the host PASID security attribute to... Figure 3 PMP.

[0007] Figure 5 The illustration is based on some specific implementations. Figure 1 A block diagram of an example virtual machine (VM) of a processing system, which performs a PMP authentication process to authenticate the host PASID associated with the guest PASID of the VM. Figure 3 The contents of the entries in PMP.

[0008] Figure 6 The illustration is based on some specific implementations. Figure 1 A block diagram of an example of the processing core of the processing system, which performs a PMP check process in response to receiving an enqueue command from a VM to ensure that the PMP includes the VM’s guest PASID and guest identifier.

[0009] Figure 7 The illustration is based on some specific implementations. Figure 6 A block diagram showing a detailed view of the PMP inspection process.

[0010] Figure 8 and Figure 9 This is a diagram illustrating an exemplary method for the secure management of PASID mapping in a computing environment that implements virtualized input / output devices, based on some specific implementations. Detailed Implementation

[0011] Various technologies can be implemented by processing systems used for virtualizing input / output (I / O) devices. An example of I / O virtualization technology is Single Root I / O Virtualization (SR-IOV), which allows multiple virtual machines (also referred to herein as guests or VMs) to share Peripheral Component Interconnect High Speed ​​(PCIe) hardware resources within a single-node system (e.g., a single-rooted complex). For example, an SR-IOV device allows a physical device such as a Network Interface Controller (NIC) to appear as multiple NICs to a VM or host machine. Thus, multiple VMs at the host machine can share a single PCIe device. In an SR-IOV environment, a hypervisor (also called a virtual machine manager or monitor (VMM)) maps one or more logical interfaces (i.e., virtual functions) to VMs, where each logical interface appears as a single input / output device for the host operating system (OS). However, the number of virtualization instances (e.g., virtual functions) for a given hardware type (such as a NIC or bus) is limited. For example, a NIC is limited by hardware constraints regarding the number of virtual functions it can support. Therefore, SR-IOV limits the number of virtual functions for input / output devices, which in turn limits the number of VMs that can utilize virtual functions.

[0012] Scalable I / O Virtualization (SIOV) attempts to overcome the scalability and other issues associated with SR-IOV. SIOV is a PCIe-based virtualization technology that provides scalable sharing of virtualized execution environments across I / O devices. Unlike SR-IOV's coarse-grained device partitioning approach, which creates multiple virtual functions on a device, SIOV allows software to flexibly compose virtual devices with hardware assistance for finer-grained device sharing. Performance-critical operations on the composed virtual devices are directly mapped to the underlying device hardware, while non-critical operations are simulated by device-specific composition software on the host.

[0013] SIOV scales device interaction by implementing a shared work queue (SWQ) and a type of memory access via PCIe called deferred memory writes. For example, a SIOV-enabled device is configured to group its resources into multiple isolated assignable device interfaces (ADIs), which form the assignment and isolation units of the device to create a virtual device. An ADI is associated with an SWQ used for work submission, which is an interface that can be used simultaneously by different VMs. In other words, an SWQ allows multiple VMs to submit work requests to the same ADI. A VM's process submits a work request to the SWQ using a deferred memory write (DMWr). A DMWr is a write that may temporarily fail due to the unavailability of the underlying resource. Such a failure indicates that the process should retry accessing the SWQ. When a process within a VM writes to the SWQ's register to submit a work request / descriptor to the ADI, the process uses instructions to create the DMWr in that register. That is, the instructions used by the process atomically submit the work descriptor to the SWQ. More generally, an instruction is an "enqueue command" used to write a command to an "enqueue register," which is a special device register accessed using memory-mapped I / O (MMIO). Examples of this instruction include the enqueue command (ENQCMD) and the enqueue command supervisor (ENQCMDS).

[0014] In SIOV, a Process Address Space Identifier (PASID) is used to identify ADI visitors. This PASID is a unique identifier that isolates the process address space used by the visitor (VM) OS and links visitor access to its views and access permissions to memory. The PASID is used to differentiate upstream memory transactions performed against different ADIs and to communicate the address space targeted by these transactions. This contrasts with SR-IOV, where visitors (e.g., VM processes) interact with the SR-IOV interface using interface-specific MMIO addresses. In non-virtualized environments, the OS uses, for example, a Model-Specific Register (MSR) to manage the assignment of PASIDs to processes. This MSR allows application address spaces to be associated with PASIDs. When the scheduler context switches to a process, the OS sets the MSR to the appropriate PASID. Instructions such as ENQCMD then use the MSR to append the PASID to the DMWr request in the work queue of the I / O device. However, in virtualized systems, the visitor OS assigns multiple PASIDs to its processes. Therefore, the VMM virtualizes the PASID associated with the VM. In other words, the VMM transparently maps the PASID assigned by the guest OS to the real PASID, giving the guest OS a view of the entire PASID space. As part of this PASID mapping process, the VMM uses memory data structures to point to a mapping table that maps guest PASIDs to host PASIDs. Therefore, when the guest process invokes an enqueue command, the PASID written by the VM process is automatically translated into a host PASID by the processor and written to the SWQ via DMWr.

[0015] While SIOV allows many different VMs to access a single I / O device resource without the constraints imposed by SR-IOV, SIOV is not typically designed with security or confidential computing as a priority, which can make implementing SIOV in confidential computing environments challenging. For example, the mapping from guest PASID to host PASID and from host PASID to guest context within I / O devices is trusted for the VMM in SIOV. However, the VMM is generally not considered a trusted device in a confidential computing environment because it could act maliciously or introduce security risks into the environment. For instance, a VMM could maliciously execute a DMWr with a VM's PASID and gain access to an isolated domain within the SIOV environment.

[0016] Accordingly, this disclosure describes specific implementations of systems and methods for securely managing PASID mappings in confidential computing environments that implement input / output virtualization (such as SIOV or equivalents). As described in more detail below, one or more techniques are implemented that allow the VMM to indirectly assign PASIDs to VMs without allowing the VMM to arbitrarily change the mappings. For example, in at least some implementations, the VMM is configured to allocate a system-global table, such as a PASID reverse mapping table (PMP), indexed by the host PASID. When a VM process invokes an enqueue command to submit a work request to a device interface (e.g., ADI) via SWQ, the processor uses one or more translation techniques to convert the guest PASID into a host PASID. The processor then indexes the PMP table using the obtained host PASID. If the PMP entry associated with the host PASID includes a guest PASID and an identifier of the accessing VM process, the processor determines that the access is valid and the enqueue command proceeds. Otherwise, the processor determines that the VMM has changed the PASID mapping and the enqueue command fails. For example, the processor issues an error message to one or both of the VMM or VM, preventing the enqueue command from being processed. Thus, the technique described in this paper provides secure management of PASID mapping by the VMM and protects the VM from malicious PASID modification.

[0017] Figure 1 The illustration depicts a processing system 100 for secure mapping of PASIDs for virtualized computing / execution environments, according to an implementation of some inventions. It should be understood that while one or more techniques presented herein are described with respect to scalable input / output virtualization, these techniques are applicable to any virtualization architecture, framework, or specification for implementing PASID mapping for virtualized resources.

[0018] Processing system 100 is typically configured to execute a set of instructions (e.g., a computer program) to perform tasks on behalf of an electronic device. Therefore, processing system 100 is part of a variety of electronic devices in different specific implementations. For purposes of description, it is assumed that processing system 100 is part of an electronic device (such as a server) implementing a confidential computing environment. However, in other specific implementations, processing system 100 is part of a desktop computer, laptop computer, tablet computer, game console, etc.

[0019] To enable a confidential computing environment and to execute instruction sets and corresponding operations, processing system 100 includes a processor 102, memory 104, and one or more input / output (I / O) devices (such as I / O device 106). In some implementations, processor 102 is a general-purpose processor, such as a central processing unit (CPU) including hardware structures configured to retrieve and execute instruction sets. Memory 104 includes one or more memory devices configured to store and retrieve data based on commands received from processor 102 (e.g., store and load commands). Therefore, in various implementations, memory 104 is random access memory (RAM), non-volatile memory (NVM), hard disk storage, or any combination thereof.

[0020] I / O device 106 is any device that can process input information, output information, or combinations thereof on behalf of processing system 100 independently of processor 102. For example, in some embodiments, I / O device 106 is a network interface device that processes input and output information to a network (not shown) connected to processing system 100. In other embodiments, I / O device 106 is a storage controller (e.g., a disk controller or non-volatile memory (NVM) storage controller), a controller associated with a user interface (e.g., a keyboard), etc.

[0021] To execute instruction sets and corresponding operations, processor 102 includes processor core 108, security module 110, and input / output memory management unit (IOMMU) 112. It should be understood that in some embodiments, processor 102 includes additional hardware for executing instructions and performing operations based on those instructions, such as additional processor cores, additional processing units (e.g., one or more graphics processing units), one or more controllers (e.g., memory controllers and input / output controllers), etc.

[0022] Processor core 108 includes one or more instruction pipelines, which include multiple stages for pipelined execution of instructions. Thus, for example, in some implementations, the instruction pipeline of processor core 108 includes a fetch stage, a decode stage, a dispatch stage, one or more execution stages (with one or more corresponding execution units), a decommissioning stage, etc. Processor core 108 also includes or has access to memory structures and other hardware supporting instruction execution. Figure 1 (Not explicitly illustrated). For example, in some implementations, processor core 108 includes or has access to one or more cache structures to store data for instruction execution.

[0023] Security module 110 is a set of hardware structures typically configured to create, monitor, and maintain a secure environment for processor 102. For example, in at least some embodiments, security module 110 is configured to manage the startup process of processor 102, initialize security-related mechanisms of processor 102, and monitor suspicious activity or events in processing system 100 and implement appropriate responses. In some embodiments, security module 110 includes a microcontroller, a cryptographic coprocessor (CCP) for encrypting and decrypting data, local memory and local registers for storing, for example, cryptographic keys, and includes interfaces for interacting with memory 104, the I / O controller of processor 102, and the configuration registers of processor 102. In some embodiments, security module 110 includes environment management control hardware that performs environment and security checks to ensure that processor 102 operates according to specified security parameters.

[0024] In some implementations, security module 110 manages the device binding process, where I / O device 106 is bound to VM (guest) 114 by undergoing a specified security registration process. For example, in some implementations, VM 114 seeks to bind I / O device 106 by sending a binding request to security module 110. In response, security module 110 initiates a specified security registration process, such as by requesting authentication information (e.g., a device certificate) from I / O device 106 and verifying that authentication information (e.g., by comparing the authentication information or key information generated based on the authentication information with one or more security keys). If the authentication information received from I / O device 106 is verified, security module 110 instructs VM 114 and other components of processor 102, as further described herein, that I / O device 106 is bound to VM 114.

[0025] As described above, the processing system 100 is typically configured to implement a confidential computing environment and specifically executes multiple VMs 114 (also referred to as guests) and a VMM (hypervisor 116, also referred to as the host) to manage the execution of the multiple VMs 114. Since the different VMs 114 and, in at least some cases, the VMM 116 are owned by different entities, the processing system 100 implements security features to protect the data of a given VM 114 from access by other software (such as another VM 114 or VMM 116). For example, the processing system 100 achieves data security for the VMs 114 by implementing a secure region 118 in a memory 104 that stores encrypted data. Specifically, the processor 102 is configured to encrypt designated data for each VM 114 according to a corresponding private cryptographic key and store the encrypted data in the secure region 118. Because the data is encrypted, the data of one VM 114 is protected from unauthorized access by other VMs 114 and VMM 116. In at least some implementations, the cryptographic key for VM 114 is managed by security module 110, and data encryption and decryption for VM 114 are performed by a dedicated hardware encryption / decryption module (not shown) at the memory controller (not shown) of processor 102.

[0026] In at least some embodiments, the confidential computing environment of processing system 100 provides integrity guarantees by implementing a reverse mapping table (RMP) 120. RMP 120 is a single data structure shared across system 100 and includes one entry for each given memory page (e.g., 4k pages) that can be used by VM 114. RMP 120 tracks the owner of each page of memory. A memory page can be owned by VMM 116, a specific VM 114, or security module 110. Access to memory is controlled so that only the owner of the page can write to it. In at least some embodiments, RMP 120 is used in conjunction with a standard page table to implement memory restrictions and page access permissions. In at least some embodiments, processing system 100 also implements a secure device table (SDT) 122 that encodes device interface VM bindings and security attributes. In at least some embodiments, SDT 122 is a repository of security attributes for I / O devices 106. When traffic enters or leaves I / O device 106, IOMMU 112 checks SDT 122 to make a security policy decision on whether to allow access.

[0027] In at least some implementations, I / O device 106 accesses memory 104 assigned to VM 114 by generating direct memory access (DMA) requests to read data from memory 104, write data to memory 104, or combinations thereof. IOMMU 112 is configured to process DMA requests issued by I / O device 106. For example, to improve processing efficiency, IOMMU 112 is typically configured to perform specified memory access operations on behalf of processor 102—that is, to perform memory access operations using dedicated hardware of IOMMU 112, without requiring processor 102 to manage the memory access operations. Specifically, IOMMU 112 includes dedicated hardware for performing DMA operations. In some implementations, each DMA request issued by I / O device 106 includes a descriptor indicating the virtual address of the data to be accessed (i.e., the virtual address of the data to be read, the virtual address of the data to be written, or both). These virtual addresses indicate a region of memory 104 targeted by the DMA request. The IOMMU112 is typically configured to translate a virtual address indicated by a DMA request into a physical address of the memory 104, and to interact with the memory 104 to perform one or more operations (read operations, write operations, or combinations thereof) indicated by the DMA request.

[0028] In at least some implementations, processor core 108 accesses I / O device 106 by issuing MMIO requests associated with a specific execution VM 114. Each MMIO request identifies a memory address from which data is to be read, a memory address to which data is to be written, or a combination thereof. For example, in some cases, processor core 108 programs a specific register of I / O device 106 by issuing an MMIO request to write data to a memory address associated with a register. By using memory addresses to provide information to or retrieve information from I / O device 106, processor core 108 can improve the overall efficiency of the processor core by using a relatively simple set of access commands and by utilizing at least some of the hardware for accessing system memory. To further improve processing efficiency, IOMMU 112 assists in executing MMIO requests, such as by performing virtual-to-physical address translation on the MMIO requests.

[0029] The confidential computing environment further implements I / O virtualization, enabling I / O devices 106 to be virtualized and shared among multiple VMs 114. An example of I / O virtualization implemented by the confidential computing environment is SIOV. In some implementations, one or more I / O devices 106 are devices that implement one or more device interfaces 134 (illustrated as device interface 134-1 and device interface 134-2) supporting physical I / O virtualization. Each device interface 134 allows I / O devices 106 to be virtualized as different virtual I / O devices for each VM 114. In at least some implementations, device interfaces 134 are assignable device interfaces (ADIs) that form assignment and isolation units to create virtual devices.

[0030] After VMM 116 has assigned VM 114 to device interface 134, the VM's software process / thread submits a work request to device interface 134 using one or more techniques. In one example, the process submits the work request through the shared work queue (SWQ) of device interface 134, which is an interface that allows multiple VMs 114 to submit work requests to the same device interface 134. In at least some implementations, the VM 114 process submits the work request to device interface 134 by sending an enqueue command 124 (such as ENQCMD or ENQCMDS) to processor core 108. In at least some implementations, the enqueue command 124 is an instruction that atomically submits a work descriptor to device interface 134. The enqueue command 124 includes, for example, the virtual address of all parameters, the virtual address of the completion record, and the PASID of the VM process submitting the work descriptor.

[0031] PASID is a unique identifier that isolates the process address space used by VM 114 and links process access to its view and access rights to memory. PASID is used to distinguish upstream memory transactions performed on different devices and to communicate the address space targeted by these transactions. VM 114 operates using guest PASIDs, while VMM 116 (including the underlying hardware) operates using host PASIDs. In at least some implementations, VMM 116 assigns PASIDs to VM 114 from a global pool of available PASIDs, and VM 114 assigns multiple PASIDs to its processes. VMM 116 virtualizes PASIDs by maintaining a mapping between guest PASIDs and host PASIDs in one or more data structures, such as PASID mapping table 126. That is, VMM 116 transparently maps PASIDs assigned by VM 114 to real PASIDs to give VM 114 a view that it owns the entire PASID space.

[0032] Figure 2 An example of a PASID mapping table configuration 200 applicable to the techniques described herein is shown. It should be understood that other mapping table configurations are also applicable. In mapping table configuration 200, the first part 204 of the guest PASID 202 includes a PASID directory indicator. The PASID directory indicator identifies a PASID directory indicator 210 (illustrated as PASID directory indicator 1 210-1 and PASID directory indicator N 210-2) in the memory data structure 212 associated with the corresponding VM 114. The PASID directory indicator 210 points to a PASID directory 214 (illustrated as PASID directory 1 214-1 and PASID directory N 214-2). The second part 206 of the guest PASID 202 identifies a designated entry 216 (illustrated as entry 216-1 and entry 216-2) in the PASID directory 214. Entry 216 points to a specified PASID table 218 (illustrated as PASID table 1 218-1 and PASID table M 218-2). The third part 208 of visitor PASID 202 identifies a specified entry in PASID table 218 that includes the corresponding host PASID 220 (illustrated as host PASID 220-1 and host PASID 220-2) for visitor PASID 202.

[0033] Refer again Figure 1 Each task submitted to device interface 134 by a process in VM 114 is associated with a guest PASID that is translated into the corresponding host PASID. This translation task is performed by CPU core 108 for enqueue command 124. For example, when a VM process calls enqueue command 124 to submit a work request descriptor to device interface 134 by writing to the registers of the SWQ, processor core 108 uses PASID mapping table 126 to automatically translate the guest PASID associated with the work request into a host PASID. The core processor 108 then uses a type of memory access via PCIe (referred to as Deferred Memory Write (DMWr) 128) to place the work request into the SWQ of device interface 134. DMWr 128 is a write that may temporarily fail due to the unavailability of underlying resources. DMWr 128 includes information such as the host PASID based on the translation process identifier and the work request sent by the VM process. In at least some specific implementations, CPU core 108 sends DMWr 128 to device interface 134 via PCIe controller 130.

[0034] As described above, VMM 116 is responsible for mapping guest PASIDs to host PASIDs and mapping host PASIDs to guest contexts within I / O device 106. Therefore, a malicious or corrupted VMM potentially has the opportunity to maliciously set / change PASIDs and gain access to isolated domains within the virtualized computing environment. Thus, processing system 100 implements one or more security mechanisms that allow VMM 116 to indirectly assign PASIDs to VM 114 while disallowing VMM 116 to arbitrarily change the mappings. For example, processor core 108 maintains and protects one or more data structures, referred to herein as a PASID reverse mapping table (PMP) 132, which is global to the system indexed by host PASIDs. In at least some specific implementations, PMP 132 includes an entry for each guest PASID assigned by VM 114. PMP 132 includes a per-host PASID security attribute, which is checked by processor core 108 upon receiving enqueue command 124 from the VM process to ensure that VMM 116 has not accidentally altered the PASID mapping. In at least some implementations, security module 110 initializes PMP 132.

[0035] Figure 3An example of a PMP 132 according to some specific implementation is shown. In the depicted example, PMP 132 includes multiple entries 301, each of which is assigned to a different host PASID. Each entry of PMP 132 includes multiple fields, including an assigned field 302, a guest ID field 304, a guest PASID field 306, a locked field 308, an authenticated field 310, etc. The assigned field 302 stores bits (or other information) indicating whether the host PASID associated with PMP entry 301 has been assigned (or not yet assigned) to VM 114. For example, if this bit is set in the assigned field 302, this indicates that the host PASID has been assigned to VM 114. The guest ID field 304 stores an identifier of VM 114, such as an address space identifier (ASID), that has been assigned to the host PASID associated with PMP entry 301. The Guest PASID field 306 stores the Guest PASID that should be translated to the Host PASID associated with PMP entry 301. The Lock field 308 stores bits (or other information) used to coordinate multiple hardware threads of processor core 108 during concurrent access to PMP 132. If multiple hardware threads exist, and one thread is updating entry 301 of PMP 132 while other threads are attempting to access the same entry 301, the Lock field 308 instructs the thread that owns entry 301. For example, when writing to entry 301, the thread will attempt to atomically set the bit in the Lock field 308. If the thread successfully sets the bit, the thread knows it owns the entry and can continue accessing it. The thread will clear the bit after it has completed its operation. The Verified field 310 stores bits (or other information) indicating that VM 114 has previously verified that the Host PASID associated with entry 301 has been assigned to VM 114, as described in more detail below.

[0036] Figures 4 to 6 The illustration shows an example of a processing system 100 according to some specific implementation, which uses a PMP 132 to perform security management of PASID mappings to protect VM 114 from accidental changes to the PASID mappings. In the illustrated example, VMM 116 initially assigns the host PASID to VM 114, and VM 114 assigns guest PASIDs to one or more processes within its processes. VMM 116 uses one or more techniques (e.g., memory writes) to set entries in PASID mapping table 126 to map guest PASIDs to host PASIDs. Figure 4As shown, VMM 116 then invokes PMP update process 401 to update entry 301 in PMP 132 for a specific host PASID. In at least some specific implementations, VMM 116 executes PMP update process 401 by sending instruction 402, such as a PMPUPDATE instruction, to processor core 108. Processor core 108 then executes instruction 402 to update entry 301 in PMP 132. Instruction 402 includes information / parameters for updating one or more fields of entry 301. For example, the assigned field 302 is updated to indicate that the associated host PASID has been assigned to VM 114, the guest ID field 304 is updated to include the guest ID of VM 114 that has the associated host PASID, and the guest PASID field 306 is updated using the guest PASID that should be converted to the associated host PASID. The PMP update process also clears / resets bits stored in verified field 310 that indicate that VMM 114 has changed the information maintained by entry 301. For example, Figure 4 The verified field 310 of PMP entry 301 has a value of "0", which indicates that the content of entry 301 has been changed and has not yet been verified by VM 114.

[0037] In at least some specific implementations, when VM 114 intends to access device interface 134 using a specified guest PASID, VM 114 executes PMP authentication process 501 to verify the mapping of that guest PASID, such as... Figure 5 As illustrated. For example, VM 114 sends an instruction or request 502, such as the PMPVALIDATE instruction, to processor core 108. Processor core 108 then executes instruction 502. Instruction 502 includes one or more parameters, such as the guest PASID. Instruction 502 uses PASID mapping table 126 to translate the guest PASID into its host PASID. For example, see reference... Figure 2In the mapping table configuration 200, instruction 502 uses the PASID directory indicator in the first part 204 of the guest PASID to identify the PASID directory indicator 210 from the memory data structure 212 associated with VM 114. Then, instruction 502 uses the second part 206 of the guest PASID to identify a specific entry 216 in the associated PASID directory 214 for locating the corresponding PASID table 218. Instruction 502 uses the third part 208 of the guest PASID to locate the entry in PASID table 218 that includes the guest PASID and the corresponding host PASID. The host PASID is used by instruction 502 as an index in PMP 132 to identify the entry 301 associated with the host PASID. After entry 301 in PMP 132 has been identified, instruction 502 examines one or more fields of entry 301. For example, instruction 502 checks the assigned field 302 to determine if the host PASID has been assigned, and also checks the guest ID field 304 to determine if the VM 114 performing the PMP verification process 501 has been assigned to the host PASID. If the host PASID has been assigned and is assigned to the VM 114 performing the PMP verification process 501, instruction 502 sets a bit in the verified field 310 of entry 301 to indicate that the contents of entry 301 have been explicitly verified by VM 114. For example, Figure 5 The verified field 310 of PMP entry 301 has a value of "1", indicating that the content of entry 301 has been verified by VM 114.

[0038] When a process in VM 114 wants to access device interface 134 assigned to VM 114, the process issues an enqueue command 124 to processor core 108, such as... Figure 6 As shown in the diagram. The enqueue command is generated by the process to place the work request in the SWQ of device interface 134, as described above. Figure 1 As described, the enqueue command 124 includes, for example, the virtual address of all parameters, the virtual address of the completion record, and the guest PASID of the VM process submitting work to the device interface 134. In other embodiments, the enqueue command 124 obtains the guest PASID by reading the MSR programmed using the guest PASID. The processor core 108 receives the enqueue command 124 and, using the guest PASID included in the enqueue command 124, uses the PASID mapping table 126 to translate the guest PASID into its host PASID, similar to the translation process described above with respect to the PMP verification process 501.

[0039] As part of executing the enqueue command 124, processor core 108 performs a PMP check 601 on the PASID translation, such as Figure 7As illustrated in the diagram. For example... Figure 7 The diagram illustrates processor core 108 executing a translation process 703 to translate guest PASID 702 included in enqueue command 124 into its host PASID 720. Processor core 108 uses host PASID 720 as an index into PMP 132 to identify PMP entry 701 corresponding to host PASID 720. Processor core 108 then performs a PMP check 601 to determine if entry 701 meets one or more conditions. For example, processor core 108 determines whether the guest PASID field 306 of entry 701 includes a guest PASID that matches the translated guest PASID 702, and whether the guest ID field 304 of entry 701 includes an identifier for accessing VM 114 (i.e., the VM 114 that issued enqueue command 124). This reverse mapping check ensures that VMM 116 does not modify PASID mapping table 126. In at least some specific implementations, processor core 108 also checks whether the assigned field 302 indicates that host PASID 720 has been assigned to VM 114, whether the verified field 310 indicates that the current content of entry 301 has previously been verified by VM 114 associated with enqueue command 124, or a combination thereof. If any of these conditions are not met, the PMP check fails, and processor core 108 determines that VMM 116 has inadvertently changed the PASID mapping after VM 114 previously verified the content of entry 301. Enqueue command 124 then exits VM 114, and expects VMM 116 to recover by updating PMP 132 using the aforementioned PMP update instruction 402. However, if the PMP check conditions are true, enqueue command 124 proceeds, and processor core 108 issues DMWr 128 to place the work request submitted by the process of VM 114 into the SWQ of device interface 134. In this way, the PMP Validation 501 and PMP Check 601 processes ensure that the processes of VM 114 do not work on unexpected or malicious PASID mappings.

[0040] Figure 8 and Figure 9 A flowchart illustrating a method 800 for securely managing PASID mappings in a confidential computing environment implementing input / output virtualization, according to some specific implementations, is provided. For illustrative purposes, reference is made to... Figure 1The method 800 is described using an exemplary implementation at processing system 100, but it should be understood that in other implementations, method 800 is implemented at processing systems with different configurations. At box 802, VMM 116 initially assigns a host PASID to VM 114. For example, VMM 116 assigns a host PASID to VM 114 from a global pool of available PASIDs. At box 804, VM ​​114 assigns a guest PASID to one or more processes within its processes. At box 806, VMM 116 stores guest PASID and host PASID mapping information. For example, VMM 116 as described above regarding... Figure 1 The entries in the PASID mapping table 126 are set up as described. Maintaining the PASID mapping allows VMM 116 to virtualize the PASIDs. That is, VMM 116 transparently maps the PASIDs assigned by VM 114 to real PASIDs, giving VM 114 a view of its ownership of the entire PASID space.

[0041] At box 808, VMM 116 performs the above-mentioned... based on the mapping executed at box 506. Figure 4 The described PMP update process 401. For example, VMM 116 executes PMP update instruction 402, which updates the assigned field 302, the guest ID field 304, and the guest PASID field 306. PMP verification instruction 402 also clears the verified bit in the verified field 310. At box 810, the process of VM 114 is intended to access device interface 134 using the assigned guest PASID and executes PMP verification instruction (or request) 502. PMP verification instruction 502 uses PASID mapping table 126 to translate the guest PASID into its host PASID, as described above. Figure 5 As described, PMP verification instruction 502 uses the host PASID as an index into PMP 132 to identify entry 301 associated with the host PASID. After entry 301 has been identified in PMP 132, instruction 502 checks one or more fields of entry 301. For example, PMP verification instruction 502 confirms that the entry indicates the host PASID associated with entry 101 has been assigned to the guest ID of VM 114.

[0042] At box 812, the process issues enqueue command 124 to access device interface 134. For example, enqueue command 124 attempts to place a work request in the SWQ of device interface 134, as described above. Figure 1As described above. At box 814, processor core 108 receives enqueue command 124. At box 816, processor core 108 converts the guest PASID included in enqueue command 124 into its host PASID, as described above. Figure 6 and Figure 7As described. In boxes 818-826, processor core 108 uses the host PASID as an index into PMP 132 for performing PMP check 601. For example, in box 818, processor core 108 uses the host PASID as an index into PMP 132 to identify entry 301 corresponding to the host PASID. In box 820, processor core 108 determines whether the assigned field 302 of entry 301 indicates that the host PASID has been assigned to VM 114. If the host PASID has not yet been assigned to VM 114, the process flows to box 828, and processor core 108 sends an error notification to VMM 116. In other words, processor core 108 prevents VM 114 from accessing device interface 134. VMM 116 is then expected to perform PMP update process 401 to correct the error. Otherwise, the process flows to box 822, and processor core 108 determines whether the guest ID of VM 114 matches the guest ID included in guest ID field 304 of entry 301. If the guest ID of VM 114 does not match the guest ID included in guest ID field 304, the process flows to box 828, and processor core 108 sends an error notification to VMM 116. Otherwise, the process flows to box 824, and processor core 108 determines whether the converted guest PASID matches the guest PASID included in guest PASID field 306 of entry 301. If the converted guest PASID does not match the guest PASID included in guest PASID field 306, the process flows to box 828, and processor core 108 sends an error notification to VMM 116. Otherwise, the process flows to box 826, and processor core 108 determines whether the current content of entry 301 has previously been verified by VM 114. If the content of entry 301 has not been previously verified, processor core 108 determines that VMM 116 has changed the content of entry 301 after VM 114 performed PMP verification process 501 at box 510. The process then flows to box 828, and processor core 108 sends an error notification to VMM 116. However, if the current content of entry 301 has been previously verified by VM 114, the processor issues DMWr 128 at box 530 to place a work request submitted by the process of VM 114 into the SWQ of device interface 134. DMWr 128 includes information such as the translated host ID and the work request submitted by the process. It should be understood that in other implementations, processor core 108 uses different arrangements of boxes 820 through 826 to perform PMP check 601.

[0043] In some specific implementations, certain aspects of the above-described techniques may be implemented by one or more processors of a processing system executing the software. The software includes one or more sets of executable instructions stored or otherwise tangibly embodied on a non-transitory computer-readable storage medium. The software may include instructions and certain data that, when executed by one or more processors, manipulate one or more processors to perform one or more aspects of the above-described techniques. The non-transitory computer-readable storage medium may include, for example, disk or optical disc storage devices, solid-state storage devices such as flash memory, cache, random access memory (RAM), or one or more other non-volatile memory devices. The executable instructions stored on the non-transitory computer-readable storage medium may be source code, assembly language code, object code, or other instruction formats that are interpreted or otherwise executed by one or more processors.

[0044] It should be noted that not all activities or elements described above in the general description are essential. A particular activity or part of the apparatus may not be essential, and one or more additional activities may be performed, or elements may be included in addition to those described. Furthermore, the order in which the activities are listed is not necessarily the order in which they are performed. Moreover, the concepts have been described with reference to specific embodiments. However, those skilled in the art will understand that various modifications and changes can be made without departing from the scope of this disclosure as set forth in the appended claims. Therefore, the specification and drawings should be viewed in an illustrative rather than restrictive sense, and all such modifications are intended to be included within the scope of this disclosure.

[0045] The benefits, other advantages, and solutions to problems have been described above with respect to specific embodiments. However, the benefits, advantages, solutions to problems, and any features that may lead to or make any benefit, advantage, or solution appear or become more significant should not be construed as key, essential, or fundamental features of any or all claims. Furthermore, the specific embodiments disclosed above are merely illustrative, as the disclosed subject matter can be modified and practiced in different but equivalent ways that will be apparent to those skilled in the art who benefit from the teachings herein. No limitation is intended on the details of the constructions or designs shown herein, except as described in the following claims. Therefore, it will be apparent that the specific embodiments disclosed above can be altered or modified, and all such changes are considered to be within the scope of the disclosed subject matter. Therefore, the protection sought herein is set forth in the following claims.

Claims

1. A method, the method comprising: The virtual machine manager maps the guest process address space identifier (PASID) associated with the virtual machine (VM) to the host PASID associated with the host machine of the VM; and In response to the mapping, the processor's security module maintains entries in a PASID reverse mapping table (PMP), the entries including one or more security attributes associated with the host PASID.

2. The method according to claim 1, wherein, Maintaining the entries in the PMP includes: Store the visitor PASID as a security attribute in a field of the entry; and The visitor identifier associated with the VM is stored as a second security attribute among the one or more security attributes in the second field of the entry.

3. The method according to claim 2, wherein, Maintaining the entries in the PMP includes: Set the indicator in the third field of the entry to the third security attribute of the one or more security attributes, the indicator indicating that the VM has not yet verified the guest PASID and the guest identifier stored in the entry.

4. The method according to any one of claims 1 to 3, wherein the method further comprises: Receive a PMP verification command including the guest PASID from the VM; Convert the visitor PASID included in the PMP verification command into the host PASID; Determine that the entry in the PMP corresponds to the host PASID associated with the translated visitor PASID; and In response to the indication in the entry that one or more security attributes match the converted guest PASID stored in the entry and that the guest identifier stored in the entry corresponds to the guest identifier of the VM, an indicator is set in the entry indicating that the VM has verified the guest PASID and the guest identifier stored in the entry.

5. The method according to any one of claims 1 to 4, the method further comprising: In response to receiving a request to access a virtual device from the VM, the guest PASID included in the request is converted to the host PASID; The entry in the PMP is identified based on the host PASID associated with the translated visitor PASID; and In response to one or more security attributes satisfying at least one specified condition, the VM is allowed to access the virtual device.

6. The method according to claim 5, wherein, The at least one specified condition includes: a visitor PASID stored in the entry that matches the converted visitor PASID, and a visitor identifier stored in the entry that matches the visitor identifier of the VM.

7. The method according to claim 6, wherein, The at least one specified condition further includes an indication that the VM has previously verified the visitor PASID and the visitor identifier stored in the entry.

8. The method according to any one of claims 1 to 7, the method further comprising: In response to receiving a request to access a virtual device from the VM, the guest PASID included in the request is converted to the host PASID; The entry in the PMP is identified based on the host PASID associated with the converted visitor PASID; and Access to the virtual device is blocked in response to at least one of the following: The guest PASID stored in the entry for the identifier and the guest identifier stored in the entry for the identifier fail to match the translated guest identifier and the guest identifier of the VM, or The entry for the identifier includes an indication that the VM has not previously verified the guest PASID and the guest identifier stored in the entry for the identifier.

9. A method, the method comprising: In response to receiving a request to access a virtual machine (VM) device, the guest process address space identifier (PASID) of the VM is converted to a host PASID associated with the host machine; and In response to the identification that an entry in the PASID Reverse Mapping Table (PMP) for the host PASID fails to meet one or more conditions, access to the virtual device is blocked.

10. The method according to claim 9, wherein, Preventing the access includes at least one of the following: It was determined that the visitor PASID stored in the entry failed to match the converted visitor PASID; or It was determined that the guest identifier stored in the entry failed to match the guest identifier of the VM.

11. The method according to claim 9, wherein, Preventing the access includes: determining that the entry includes an indication that the VM has not yet verified at least one of the guest PASID stored in the entry and the guest identifier stored in the entry.

12. The method according to any one of claims 9 to 11, the method further comprising allowing access to the virtual device in response to any of the following: Determine that the visitor PASID stored in the entry matches the transformed visitor PASID; and Determine if the visitor identifier stored in the entry matches the visitor identifier of the VM.

13. The method according to any one of claims 9 to 11, the method further comprising: In response to determining that the entry includes an indication that the VM has verified at least one of the guest PASID stored in the entry and the guest identifier stored in the entry, the access to the virtual device is permitted.

14. A processor, the processor comprising: An executable virtual machine manager (VMM) is configured to map a guest process address space identifier (PASID) associated with a virtual machine (VM) to a host PASID associated with the host machine of the VM. as well as A processor core configured to maintain entries in a PASID reverse mapping table (PMP) in response to the guest PASID being mapped to the host PASID, the entries including one or more security attributes associated with the host PASID.

15. The processor of claim 14, wherein, The processor core is configured to maintain the entries in the PMP by: Store the visitor PASID as a security attribute in a field of the entry; as well as The visitor identifier associated with the VM is stored as a second security attribute among the one or more security attributes in the second field of the entry.

16. The processor of claim 15, wherein, The processor core is configured to maintain the entries in the PMP by: Set the indicator in the third field of the entry to the third security attribute of the one or more security attributes, the indicator indicating that the VM has not yet verified the guest PASID and the guest identifier stored in the entry.

17. The processor according to any one of claims 14 to 16, wherein, The processor core is further configured as follows: Receive a PMP verification command including the guest PASID from the VM; Convert the visitor PASID included in the PMP verification command into the host PASID; Determine that the entry in the PMP corresponds to the host PASID associated with the translated visitor PASID; and In response to the indication in the entry that one or more security attributes match the converted guest PASID stored in the entry and that the guest identifier stored in the entry corresponds to the guest identifier of the VM, an indicator is set in the entry indicating that the VM has verified the guest PASID and the guest identifier stored in the entry.

18. The processor according to any one of claims 14 to 18, wherein, The processor core is further configured as follows: In response to receiving a request to access a virtual device from the VM, the guest PASID included in the request is converted to the host PASID; The entry in the PMP is identified based on the host PASID associated with the translated visitor PASID; and In response to one or more security attributes satisfying at least one specified condition, the VM is allowed to access the virtual device.

19. The processor of claim 18, wherein, The at least one specified condition includes at least one of the following: The guest PASID stored in the entry that matches the converted guest PASID, and the guest identifier stored in the entry that matches the guest identifier of the VM; or The VM has previously verified the guest PASID and the guest identifier stored in the entry.

20. The processor according to any one of claims 14 to 19, wherein, The processor is further configured to: In response to receiving a request to access a virtual device from the VM, the guest PASID included in the request is converted to the host PASID; The entry in the PMP is identified based on the host PASID associated with the converted visitor PASID; and Access to the virtual device is blocked in response to at least one of the following: The guest PASID stored in the entry for the identifier and the guest identifier stored in the entry for the identifier fail to match the translated guest identifier and the guest identifier of the VM, or The entry for the identifier includes an indication that the VM has not previously verified the guest PASID and the guest identifier stored in the entry for the identifier.

Images