Inter-Processor Interrupt Virtualization via APIC Pass-Through
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern computing systems face security risks due to the potential for virtual machines (VMs) to issue interrupt storms, akin to denial-of-service attacks, when provided with direct access to local Advanced Programmable Interrupt Controllers (APICs) for inter-processor interrupts (IPIs), as existing virtualization methods lack effective mechanisms to manage and secure IPIs between VMs and host operating systems.
Innovation Solution
Implementing a system where a Virtual Machine Monitor (VMM) groups processor cores into clusters and creates a data structure to manage IPIs, allowing VMs direct access while ensuring security by verifying that IPIs are directed to authorized cores within the cluster, using a data structure stored in memory that maps APIC IDs to cluster identifiers and bitmaps, thereby preventing unauthorized IPIs from being sent.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If local APIC pass-through is provided to VMs for direct IPI access, then performance is improved, but security deteriorates due to potential interrupt storms
Solution Approach 1:
The VMM acts as an intermediary between VMs and the physical APIC. Instead of providing direct pass-through, the VMM intercepts IPI requests from VMs, validates them against security policies, and forwards authorized requests to the physical APIC. This mediator approach maintains security while enabling controlled direct access performance.
Solution Approach 2:
The interrupt handling functionality is segmented into virtual APIC instances managed by the VMM and the physical APIC hardware. The VMM creates virtualized interrupt controllers that appear to VMs as direct access points but are actually controlled by the VMM, which segments the security enforcement layer from the performance-critical IPI path.
2Reliability
If full virtualization emulation of local APIC is implemented, then security is improved, but performance deteriorates due to trapping and emulating VM access
Solution Approach 1:
The system dynamically switches between full emulation mode and direct access mode based on security requirements and VM trust levels. For trusted VMs requiring high performance, the VMM configures direct APIC access with minimal intervention. For untrusted VMs, full emulation with trapping is maintained. This dynamic adaptation resolves the performance-security tradeoff.
Solution Approach 2:
The VMM changes the operational parameters of the APIC interface based on security context. When a VM is granted direct access, parameters such as interrupt masking, destination validation, and storm detection thresholds are adjusted to maintain security while enabling high-performance direct IPI access.
3Device complexity
If direct local APIC access is provided to VMs, then device complexity is reduced, but harmful factors increase due to interrupt storm attacks
Solution Approach 1:
The VMM implements preliminary anti-actions by pre-configuring security policies that prevent interrupt storms before they occur. These policies include limiting the rate of IPIs a VM can send, validating destination cores against authorized lists, and setting up storm detection thresholds. By establishing these protective measures in advance, the system enables direct access while neutralizing potential harmful effects.
Solution Approach 2:
The potential harm of interrupt storms is converted into a benefit by using storm detection capabilities to trigger security responses. When abnormal IPI patterns are detected, the system can dynamically downgrade the VM's access privileges, isolate the VM, or trigger alerts. The same direct access mechanism that could cause harm is also what enables rapid detection and response to security threats.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
A processor includes cores and instructions executable by at least one of the plurality of cores as a virtual machine monitor (VMM). To configure resources for a virtual machine (VM), the VMM is to: group the cores into cluster(s), where a subset of the cores is to execute the VM; create, within a buffer in memory, a data structure to store, for the subset, one or more entries, each entry including a cluster identifier and a bitmap. The bitmap identifies cores of the subset within a cluster corresponding to the cluster identifier. The VMM is further to write, to a virtual machine control structure (VMCS): a pointer to the data structure, wherein the pointer includes a physical address of the memory; and a number of the one or more entries in the data structure; and set, within the VMCS, a local interrupt controller pass-through field.