Hypervisor Control Register Configuration for Secure Fast Reboot
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current CPU protection mechanisms, such as SMAP and SMEP, can be disabled by malicious attackers, allowing unauthorized access to user space memory and execution of user space code, which compromises system security, and existing methods like kexec for booting new operating systems lack the ability to change CPU control register configurations without a reset, posing security risks.
Innovation Solution
A hypervisor is configured to detect faults when a guest attempts to execute code from a non-executable memory page, changes the control register configuration from locked to unlocked, allows the guest to execute the kexec routine, and then locks the configuration after a new operating system is booted, ensuring security and enabling fast reboots without CPU resets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CPU control register configuration is locked to prevent unauthorized changes, then system security is improved, but the ability to change configuration for fast reboot is worsened
Solution Approach 1:
The control register configuration state is made dynamic by introducing two distinct states (locked and unlocked) that can be transitioned between based on system needs. The hypervisor unlocks the configuration temporarily to allow guest OS to modify control registers for fast reboot, then relocks it afterward to restore security. This dynamic state change resolves the contradiction between maintaining security and enabling configuration changes.
2Ease of operation
If CPU reset is performed to change control register configuration, then configuration change is enabled, but reboot time increases
Solution Approach 1:
The hypervisor performs preliminary action by unlocking the control register configuration before the guest OS needs to modify it, rather than requiring a full CPU reset. This preliminary unlocking allows the guest OS to change control register settings without going through the lengthy reset process, significantly reducing reboot time while still enabling the necessary configuration changes.
3Productivity
If control register is unlocked to allow guest modification, then fast reboot is enabled, but system security is compromised
Solution Approach 1:
The control register configuration undergoes periodic state changes: locked during normal operation for security, unlocked temporarily when fast reboot is needed to allow guest OS modifications, then relocked afterward. This periodic transition between locked and unlocked states enables fast reboot functionality while maintaining system security during the majority of operational time when the registers remain locked.
Data Source
AI summary
A system includes a memory, a processor, a control register, and a hypervisor. The hypervisor is configured to determine a fault resulting from a guest attempting to execute code on a memory page designated as non-executable. The hypervisor changes a configuration of the control register to an unlocked configuration based at least in part on the fault and designates the memory page as executable. A hypercall is received from the guest after booting a new operating system from the currently-executing operating system. The hypervisor is further configured to change the configuration of the control register to a locked configuration and designate the memory page as non-executable.