PCIe Passthrough to TEE Virtual Machines Under Host Kernel Compromise

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In current PCIe device passthrough to virtual machines, the virtual machine is managed by a virtual machine monitor in the host operating system kernel, making it vulnerable to attacks that can compromise the security of the PCIe device and passthrough data.

Innovation Solution

The hardware resources of the computing device are partitioned into a rich execution environment (REE) side and a trusted execution environment (TEE) side, with the PCIe device configured for passthrough to the TEE side, ensuring the virtual machine's security by preventing access from the REE side, even if the host operating system kernel is compromised.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If the virtual machine is managed by a virtual machine monitor in the host operating system kernel, then the virtual machine can be controlled and managed conveniently, but the security of the PCIe device and passthrough data is compromised when the host operating system kernel is cracked

Engineering Contradiction:

Improvevirtual machine managementVSAvoidsecurity of PCIe device and passthrough data

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The system is segmented into a host operating system environment and a trusted execution environment (TEE) with separate virtual machine monitors. The TEE contains a secure virtual machine monitor that isolates the virtual machine from the host OS kernel, allowing convenient management through the host while maintaining security through the isolated TEE boundary. This segmentation resolves the contradiction by enabling easy management at the host level while protecting security at the TEE level.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The TEE acts as an intermediary layer between the host operating system and the virtual machine. The secure virtual machine monitor within the TEE mediates all access to the virtual machine and PCIe device, preventing direct access from the host OS kernel even when compromised. This intermediary structure maintains both manageability (through host interface) and security (through TEE protection).

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If the host operating system kernel is cracked by an attacker, then the attacker can control the virtual machine monitor to access passthrough data, but this creates a security vulnerability that needs to be prevented

Engineering Contradiction:

Improveaccess control flexibilityVSAvoidsecurity threat to PCIe device and data

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The system implements preliminary anti-action by pre-establishing security boundaries through the TEE before any potential attacks occur. The hardware-enforced isolation and secure virtual machine monitor are configured in advance to prevent unauthorized access, countering potential security threats before they can exploit vulnerabilities in the host OS kernel. This proactive security measure resolves the contradiction by maintaining access flexibility while preemptively blocking security threats.

Inventive Principle:

Principle #9Preliminary anti-action

Solution Approach 2:

The TEE provides beforehand cushioning by creating a protected security buffer between the host OS and the virtual machine. Even when the host OS kernel is compromised, this pre-established protective layer absorbs and blocks the attack, preventing it from reaching the virtual machine and PCIe device. This cushioning mechanism maintains system security while preserving legitimate access control flexibility.

Inventive Principle:

Principle #11Beforehand cushioning (Prior cushioning)

3Reliability

If the virtual machine is isolated in a TEE to prevent host OS access, then security is improved, but the complexity of the system architecture increases

Engineering Contradiction:

Improvesecurity protection of virtual machineVSAvoidsystem architecture complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The TEE with its secure virtual machine monitor is nested within the host operating system environment, creating a layered architecture where the TEE functions as a protected subset within the larger system. This nesting approach improves security by isolating critical components while managing complexity through hierarchical organization, where each layer handles specific functions and the host OS maintains overall system control.

Inventive Principle:

Principle #7Nested doll (Nesting)

Data Source

PatentEP4715654A1Method and apparatus for PCIE device to pass through to virtual machine, and related device

Publication Date: 2026.03.25 HUAWEI TECH CO LTD

Figure 1
Figure 2
Figure 3

AI summary

A method and an apparatus for passthrough of a PCIe device to a virtual machine, and a related device are disclosed and may be applied to a computing device whose hardware resources are partitioned into an REE side and a TEE side. The computing device (300) includes a first PCIe device, and the TEE side includes the virtual machine. The method includes the following steps: A processor of the computing device (300) obtains a first instruction on the REE side, where the first instruction instructs to configure passthrough of the first PCIe device to the virtual machine on the TEE side. Then, the processor configures, on the TEE side, passthrough of the first PCIe device to the virtual machine according to the first instruction. The method can protect security of passthrough data between the virtual machine and the PCIe device in a scenario of passthrough of the PCIe device to the virtual machine and protect security of the PCIe device, thereby meeting requirements of a user on security of the passthrough data and the PCIe device.