Nested Page Table Execute Control for Virtualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Nested hypervisors and virtual machines in virtualization systems experience decreased performance due to the lack of effective mode-based execute control for memory pages, which is not adequately supported by existing technologies.
Innovation Solution
The implementation of nested page table (NPT) mode-based execute control in virtualized computing systems involves providing NPT mode-based execute control from a hypervisor to a virtual machine, generating shadow NPT hierarchies based on an NPT mode-based execute policy, and configuring the processor to exit from the virtual machine to the hypervisor upon privilege level escalation, exposing appropriate shadow NPT hierarchies to ensure secure and efficient execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If nested hypervisors and virtual machines are implemented in virtualization systems, then system functionality and resource utilization are improved, but performance deteriorates due to lack of effective mode-based execute control
Solution Approach 1:
The patent segments the execute control mechanism by creating separate shadow NPT hierarchies for different privilege modes (supervisor-mode and user-mode). This segmentation allows independent control of execute permissions for each mode, enabling nested virtualization to function properly without performance penalty by avoiding unnecessary VM exits while maintaining security boundaries.
Solution Approach 2:
The patent introduces shadow NPT hierarchies as an intermediary layer between the guest NPT and the hardware page tables. This intermediary structure translates guest virtual addresses to host physical addresses while enforcing mode-based execute control, allowing nested hypervisors to operate without direct hardware access and thus avoiding performance-detrimental VM exits.
2Reliability
If mode-based execute control is implemented for memory pages, then system security and integrity are improved, but device complexity increases
Solution Approach 1:
The shadow NPT hierarchies serve multiple functions simultaneously: they perform address translation, enforce mode-based execute control, and provide security boundaries. This multi-functionality reduces the need for separate control structures, managing complexity while achieving reliable execute control for both supervisor and user modes through a unified mechanism.
Solution Approach 2:
The patent creates shadow copies of the NPT hierarchies that mirror the structure and permissions of the guest NPT. These shadow structures copy the essential control information needed for execute permissions without requiring direct modification of the guest NPT, simplifying the control mechanism while maintaining system integrity through enforced permission boundaries.
Data Source
AI summary
A method of emulating nested page table (NPT) mode-based execute control in a virtualized computing system includes: providing NPT mode-based execute control from a hypervisor to a virtual machine (VM) executing in the virtualized computing system; generating a plurality of shadow NPT hierarchies at the hypervisor based on an NPT mode-based execute policy obtained from the VM; configuring a processor of the virtualized computing system to exit from the VM to the hypervisor in response to an escalation from a user privilege level to a supervisor privilege level caused by guest code of the VM; and exposing a first shadow NPT hierarchy of the plurality of shadow NPT hierarchies to the processor in response to an exit from the VM to the hypervisor due to the escalation from the user privilege level to the supervisor privilege level.