Sub-Page Write Protection for Virtual Machine Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current virtual-machine systems lack fine-grained memory write protection mechanisms, limiting their ability to securely manage guest physical memory and enforce permissions at a sub-page level, which is essential for security and device virtualization applications.
Innovation Solution
The implementation of Extended Page Table (EPT)-based Sub-Page Protection allows Virtual Machine Monitors (VMMs) to specify write-protection for guest physical memory at a 128-byte sub-page granularity, using a sub-page protection table to enforce permissions and prevent unauthorized writes, thereby enhancing security and memory management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If EPT-based sub-page protection is implemented, then memory write protection precision is improved, but system complexity increases
Solution Approach 1:
The patent divides a 4K memory page into multiple 128-byte sub-pages and applies write protection independently to each sub-page. This segmentation enables fine-grained control where only specific sub-pages can be protected while others remain accessible, resolving the contradiction by providing high precision protection without requiring protection of entire pages.
Solution Approach 2:
The patent applies different write protection attributes to different sub-pages within the same memory page. Each sub-page can have its own write permission bit, allowing selective protection of critical regions while maintaining write access to non-critical regions. This local differentiation achieves precise protection without unnecessary system-wide complexity.
2Reliability
If fine-grained sub-page protection is enforced, then security is improved, but processing overhead increases
Solution Approach 1:
The patent pre-calculates and pre-sets write protection bits for each sub-page before memory operations occur. The VMM configures the write permission bits in advance based on security requirements, so that during actual memory access, the CPU can quickly check pre-established protection bits without performing complex security checks, thereby reducing processing overhead while maintaining security.
3Measurement precision
If sub-page protection tables are used, then memory access control precision is improved, but memory usage increases
Solution Approach 1:
The patent combines multiple sub-page protection attributes into a single compact data structure. Instead of maintaining separate tables for each protection attribute, the implementation merges write protection bits and other control attributes into a unified sub-page protection table, reducing the overall memory footprint while preserving fine-grained control precision.
Solution Approach 2:
The patent optimizes the representation of protection attributes by changing parameters such as using bit-level encoding instead of byte-level encoding for write permission bits. Each 128-byte sub-page is represented by compact bit fields in the protection table, significantly reducing the memory required to store protection information while maintaining precise control over each sub-page.
Data Source
AI summary
An apparatus and method for sub-page extended page table protection. For example, one embodiment of an apparatus comprises: a page miss handler to perform a page walk using a guest physical address (GPA) and to detect whether a page identified with the GPA is mapped with sub-page permissions; a sub-page control storage to store at least one GPA and other data related to a sub-page; the page miss handler to determine whether the GPA is programmed in the sub-page control storage; and the page miss handler to send a translation to a translation lookaside buffer (TLB) with a sub-page protection indication set to cause a matching of the sub-page control storage when an access matches a TLB entry with sub-page protection indication.