Shadow Page Tables for Virtual Machine Memory Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtualization systems lack effective memory protection mechanisms, particularly against vulnerabilities like the 'meltdown' attack, which allows unauthorized access to kernel memory, and often require invasive changes to operating systems and hardware.
Innovation Solution
The use of multiple sets of host page tables managed by a hypervisor to differentiate between privileged and unprivileged memory pages, generating distinct page tables based on the guest machine's mode (kernel or user mode) to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional single set of page tables is used in virtualized systems, then device complexity is reduced, but memory protection reliability is insufficient against attacks like meltdown
Solution Approach 1:
The patent divides the traditional single page table into multiple separate page tables (first page table for user mode, second page table for kernel mode). Each page table independently manages memory access permissions for its specific mode, preventing unauthorized cross-mode access and eliminating vulnerabilities like meltdown while maintaining clear separation of duties
Solution Approach 2:
The patent introduces a mode indicator as an intermediary mechanism that mediates between the CPU and page tables. The mode indicator dynamically selects which page table to use based on the current execution mode (user or kernel), ensuring that unprivileged code can only access user mode page tables while privileged code can access kernel mode page tables, thus providing reliable memory protection
2Reliability
If multiple sets of host page tables are generated to differentiate privileged and unprivileged memory pages, then memory protection is enhanced, but device complexity increases
Solution Approach 1:
The patent segments memory protection by creating distinct page tables for different privilege levels. The first page table contains only unprivileged memory page mappings, while the second page table contains privileged memory page mappings. This segmentation ensures that unprivileged code cannot access privileged memory even if it obtains page table pointers, as the privilege flags in each page table entry enforce strict access control
Solution Approach 2:
The patent performs preliminary configuration of page tables during system initialization and mode transitions. The hypervisor pre-configures the first and second page tables with appropriate privilege flags before code execution begins. When mode transitions occur, the hypervisor proactively switches between page tables and updates the mode indicator, ensuring protection is in place before any potential security threats can arise
3Reliability
If existing operating systems are modified to fix memory protection vulnerabilities, then security is improved, but ease of manufacture and adaptability are reduced
Solution Approach 1:
The patent introduces the mode indicator and dual page table mechanism as intermediaries between the existing operating system and the hardware memory management unit. This intermediary layer provides memory protection without requiring modifications to the guest operating system code. The hypervisor manages the page tables and mode indicators, allowing unmodified operating systems to benefit from enhanced security through the virtualization layer
Solution Approach 2:
The patent creates a virtualized copy of the memory management structure (page tables) that mirrors the operating system's expected interface. The first and second page tables are hypervisor-managed copies that present the same interface to the guest operating system while enforcing additional security constraints. This copying approach allows existing operating systems to continue functioning unchanged while gaining protection from the hypervisor's page table management
Data Source
AI summary
Aspects of the disclosure provide for mechanisms for memory protection of virtual machines in a computer system. A first host page table and a second host page table is generated by a processing device running a hypervisor in view of a guest page table associated with a virtual machine. The first host page table includes a first mapping corresponding to a privileged page of a guest memory and a second mapping corresponding to an unprivileged page of the guest memory. The second host page table includes a third mapping corresponding to the unprivileged page of the guest memory. The first host page table is associated with the virtual machine. In response to detecting a transition from a first guest mode to a second guest mode by the virtual machine, the virtual machine is associated with the second page table.