Memory Page Read-Only Marking for Virtual USB Controller Change Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized computer systems, frequent traversals of the frame list topology to detect changes are inefficient, as they consume time and resources, and often result in false alarms due to shared memory locations.
Innovation Solution
Marking specific memory pages as read-only and using a virtualization layer to catch page fault exceptions, allowing identified instructions to execute and storing their identifiers for future detection, thereby reducing unnecessary traversals and false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If frequent traversals of the frame list topology are performed to detect changes, then detection reliability is improved, but system performance and resource usage deteriorate
Solution Approach 1:
The system performs preliminary action by marking memory pages as read-only before allowing guest instructions to execute. This preventive measure enables the virtualization layer to detect write attempts through page fault exceptions without requiring frequent traversals of the frame list topology, thus maintaining detection reliability while improving system performance.
2Reliability
If frequent traversals of the frame list topology are performed to detect changes, then detection completeness is improved, but time consumption increases
Solution Approach 1:
The system replaces the mechanical traversal mechanism with a page fault-based detection mechanism. Instead of repeatedly traversing the frame list topology to detect changes, the system uses hardware-level page fault exceptions triggered when guest instructions attempt to write to read-only marked pages. This substitution eliminates time-consuming traversals while maintaining complete detection of memory modifications.
3Measurement precision
If memory pages are marked as read-only to detect write attempts, then detection accuracy is improved, but false alarms occur due to shared memory locations
Solution Approach 1:
The virtualization layer acts as an intermediary between the guest OS and the physical memory system. When a page fault exception occurs, the virtualization layer intercepts the exception, examines the instruction that caused it, and determines whether it was a legitimate write attempt to the frame list topology or a false alarm from shared memory locations. This intermediary analysis reduces false alarms while maintaining detection accuracy.
4Reliability
If complete traversal of the frame list topology is performed, then all changes are detected, but processing overhead increases
Solution Approach 1:
The system extracts the essential detection function from the complete traversal process. By marking specific memory pages as read-only and using page fault exceptions, the system extracts only the necessary write detection capability without requiring complete traversal of the frame list topology. This extraction maintains detection completeness for write operations while significantly reducing processing overhead.
Data Source
AI summary
A system and method for detecting changes of memory state. In accordance with one embodiment, memory locations to be observed are determined, and pages of these locations are marked as read-only. Then, guest instructions execute during a trial period. During the trial period, guest instructions attempting to write to the identified memory locations cause page faults which result in identifying the instructions. At the end of the trial period, the pages are returned to a writable status, and attempts to modify the memory locations by the guest code are detected based on the instruction identifier. The system and method can be used for efficient frame list topology monitoring, such as in a virtual USB controller of a virtual machine.