PSI Blacklist Enforcement Logic for VM Exit Reduction

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Inefficient monitoring of page directory base register (PDBR) modifications in processors leads to significant performance degradation, as existing methods lack effective mechanisms to securely manage paging structure identification values.

Innovation Solution

Implementing a PSI blacklist enforcement logic that compares attempted modifications to a set of blacklist values, allowing or blocking modifications based on matches, thereby reducing the need for VM exits and improving performance by focusing monitoring on trusted processes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If monitoring of PDBR modifications is implemented for security purposes, then security is improved, but performance deteriorates due to significant performance degradation

Engineering Contradiction:

ImprovesecurityVSAvoidperformance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent segments the monitoring process by dividing PDBR modification attempts into two categories: those matching blacklist values and those not matching. Only blacklist matches trigger VM exits, while non-matches are handled locally by the processor. This segmentation reduces the number of performance-critical VM exits while maintaining security monitoring for suspicious modifications.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary action by pre-populating a blacklist of suspicious or malicious PDBR values before the monitoring process begins. This allows the processor to quickly compare attempted modifications against known bad values using efficient comparison logic, rather than performing complex security checks for every modification attempt.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If inefficient monitoring of PDBR modifications is performed, then security monitoring is maintained, but performance degrades significantly

Engineering Contradiction:

Improvesecurity monitoringVSAvoidperformance degradation

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies local quality by implementing different monitoring behaviors for different types of PDBR modifications. Local processor logic handles routine non-blacklist modifications efficiently without VM exits, while only suspicious blacklist-matching modifications trigger the more expensive VM exit path. This creates quality differentiation in the monitoring approach based on the nature of each modification attempt.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent uses copying by maintaining a copy of the PDBR value in the processor for quick comparison against the blacklist, rather than repeatedly accessing the actual PDBR register or performing full security validation for every modification. This copying approach enables fast local comparison while preserving security through selective VM exits.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS10360055B2Processors, methods, and systems to enforce blacklisted paging structure indication values

Publication Date: 2019.07.23 INTEL CORP

AI summary

A method of an aspect includes receiving an indication of an attempt by a virtual machine to modify a paging structure identification storage location to have a given value. It is determined that the given value matches at least one of a set of one or more blacklist values. The attempt by the virtual machine to modify the paging structure identification storage location to have the given value is trapped to a virtual machine monitor. Other methods, apparatus, and systems are also disclosed.