Enclave Memory Page Oversubscription via Context-Aware Eviction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems face challenges in managing enclave memory pages, particularly in oversubscription scenarios where virtual machine monitors (VMMs) lack information about guest OS usage, leading to system performance issues and overhead when trying to allocate or evict memory pages.
Innovation Solution
The implementation provides processor instructions that allow the VMM to access and manage enclave memory pages by determining context information, such as page attributes and parent/child relationships, without incurring significant overhead, enabling on-demand tracking and allocation of memory pages without disrupting VM execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the VMM tracks guest OS usage of enclave memory pages, then memory management accuracy is improved, but system overhead increases
Solution Approach 1:
The enclave memory page itself provides usage information through processor instructions (ERDINFO, ESDINFO) without requiring external tracking by the VMM. The memory page autonomously reports its state (encrypted/decrypted, in-use/free) enabling the VMM to make allocation decisions without continuous monitoring overhead.
Solution Approach 2:
The patent introduces an intermediary mechanism where the processor hardware (enclave memory management logic) acts as a mediator between the guest OS and VMM. The hardware provides usage information on-demand through specific instructions, eliminating the need for software-based tracking and reducing overhead.
2Productivity
If the VMM allocates enclave memory pages dynamically, then memory utilization is improved, but system complexity increases
Solution Approach 1:
The patent uses copy-on-write semantics where enclave memory pages are allocated from a shared pool and copied to the guest OS only when needed. The VMM maintains a simplified allocation structure rather than tracking detailed usage states, reducing complexity while maintaining dynamic allocation capability.
Solution Approach 2:
The VMM pre-allocates pools of enclave memory pages and prepares them for potential guest OS usage. Pages are staged in an intermediate state where they can be quickly allocated to guests without complex real-time decision-making, simplifying the allocation process while maintaining high utilization.
3Reliability
If the system enforces cryptographic protections on reserved memory, then security is improved, but access flexibility deteriorates
Solution Approach 1:
The enclave memory pages dynamically change their cryptographic protection state based on usage. Pages transition between encrypted (when free or not in use) and decrypted (when allocated to guest OS) states. This dynamic behavior allows the system to maintain strong security defaults while providing flexible access when needed, as the protection level adapts to the current usage state.
Solution Approach 2:
The patent changes the cryptographic parameter (encryption state) of memory pages based on allocation status. When a page is allocated to a guest OS, its encryption parameter changes from encrypted to decrypted, enabling access. When freed, it returns to encrypted state. This parameter change mechanism maintains security while enabling flexible access control.
Data Source
AI summary
Implementations of the disclosure provide for supporting oversubscription of guest enclave memory pages. In one implementation, a processing device comprising a memory controller unit to access a secure enclave and a processor core, operatively coupled to the memory controller unit. The processing device is to identify a target memory page in memory. The target memory page is associated with a secure enclave of a virtual machine (VM). A data structure comprising context information corresponding to the target memory page is received. A state of the target memory page is determined based on the received data structure. The state indicating whether the target memory page is associated with at least one of: a child memory page or a parent memory page of the VM. Thereupon, an instruction to evict the target memory page from the secure enclave is generated based on the determined state.