Extended Page Table Access Rights for Virtual Machine Memory Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current memory management systems, particularly in virtual machine monitors, face performance degradation when enhancing memory protection by intercepting every memory access request due to the lack of support for page modes in underlying hardware architectures, which requires applying the most restrictive permissions among different page modes to prevent undesired accesses.
Innovation Solution
The introduction of an expanded set of access right flags in the extended page table entries that allow the virtual machine monitor to specify access rights based on user/supervisor mode attributes, enabling more precise control over memory access rights by using separate flags for user and supervisor modes, such as (RU, WU, XU) and (RS, WS, XS), as determined by the guest operating system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the virtual machine monitor intercepts every memory access request to enhance memory protection, then security is improved, but performance deteriorates
Solution Approach 1:
The patent introduces an intermediary mechanism (extended page table with access right flags) between the guest OS and physical memory that automatically enforces access controls without requiring VMM interception of every memory access, thus maintaining security while improving performance
Solution Approach 2:
The system enables self-service by allowing the guest OS to specify access rights for its own memory pages, which are then automatically enforced by the hardware-supported extended page table mechanism, eliminating the need for continuous VMM intervention
2Reliability
If the system applies the most restrictive permissions among different page modes to prevent undesired accesses, then security is improved, but device complexity increases
Solution Approach 1:
The patent segments access rights into mode-specific flags (user mode and supervisor mode separate flags) in the extended page table, allowing precise control for each mode rather than applying a single restrictive permission set to all accesses
Solution Approach 2:
The system applies local quality by allowing different access rights for different page modes (user vs supervisor) based on the specific requirements of each mode, rather than uniformly applying the most restrictive permissions across all pages and modes
Data Source
AI summary
A processing system includes a processing core to execute a virtual machine (VM) comprising a guest operating system (OS) and a memory management unit, communicatively coupled to the processing core, comprising a storage device to store an extended page table entry (EPTE) comprising a mapping from a guest physical address (GPA) associated with the guest OS to an identifier of a memory frame, a first plurality of access right flags associated with accessing the memory frame in a first page mode referenced by an attribute of a memory page identified by the GPA, and a second plurality of access right flags associated with accessing the memory frame in a second page mode referenced by the attribute of the memory page identified by the GPA.