Encrypted Memory VM–Hypervisor Communication Without Firmware Traps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication mechanisms between guest virtual machines (VMs) and hypervisors in secure encrypted virtualization (SEV) suffer from high latency due to context switches caused by firmware traps, which are unacceptable for low-latency workloads like stock trading platforms, and require core modifications to the guest OS.
Innovation Solution
A setup process establishes translation tables between the hypervisor and guest OS driver to enable direct communication through encrypted memory without firmware involvement, allowing the hypervisor and driver to learn a 1-to-1 correspondence between encrypted and unencrypted data patterns, reducing latency by eliminating context switches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firmware traps are used for communication between guest VM and hypervisor in SEV, then encryption security is maintained, but latency increases due to context switches
Solution Approach 1:
The patent extracts the firmware trap mechanism from the communication path between guest VM and hypervisor. By removing firmware involvement and using direct hypervisor-to-guest memory access with translation tables, the harmful context switch overhead is eliminated while maintaining SEV encryption security through preserved encryption key management and memory encryption.
Solution Approach 2:
The patent introduces translation tables as an intermediary mechanism that enables direct communication between hypervisor and guest VM without firmware traps. These tables map encrypted guest memory addresses to hypervisor-accessible addresses, allowing low-latency communication while maintaining encryption integrity through the intermediary translation layer.
2Reliability
If firmware traps are used for encrypted communication, then security isolation is maintained, but processing overhead increases
Solution Approach 1:
The patent removes firmware from the communication path, extracting the context switch overhead that causes high processing overhead. Direct hypervisor access to guest memory through translation tables eliminates the firmware trap mechanism while maintaining security isolation through preserved SEV encryption and memory protection.
Solution Approach 2:
The patent performs preliminary setup of translation tables during VM initialization, mapping encrypted guest memory addresses to hypervisor-accessible addresses before communication occurs. This preliminary action enables subsequent direct access without firmware involvement, reducing processing overhead while maintaining security isolation.
3Reliability
If all guest memory is encrypted in SEV, then security is enhanced, but communication with hypervisor becomes complex
Solution Approach 1:
The patent introduces translation tables as an intermediary that simplifies communication with fully encrypted guest memory. These tables map encrypted guest memory addresses to hypervisor-accessible addresses, providing a straightforward lookup mechanism that reduces communication complexity while maintaining enhanced security through complete memory encryption.
Solution Approach 2:
The patent changes the address space parameters by creating a mapping between encrypted guest memory addresses and hypervisor-accessible addresses through translation tables. This parameter transformation enables simple direct access patterns while maintaining full memory encryption, reducing communication mechanism complexity.
Data Source
AI summary
Systems and methods for enabling a Virtual Machine (VM) and hypervisor to communicate are disclosed. An example method includes sending data from a hypervisor to a virtual machine (VM) by storing, by the hypervisor, the data to an encrypted memory page of the VM, wherein the data stored by the hypervisor to the encrypted memory page is not encrypted. The method also includes processing, by the VM, the data stored to the encrypted memory page according to a decryption routine to generate scrambled data. The method also includes looking up, by the VM, the scrambled data in a translation table to obtain unscrambled data, wherein the unscrambled data is the data as it was originally stored to the encrypted memory page by the hypervisor.