TLB Tracking for Secure Page Allocation in Virtual Machines
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computer systems, the conversion of non-secure pages to secure pages in memory can lead to undesirable behavior due to stale entries in the translation lookaside buffer (TLB), particularly in virtualized environments where guest operating systems may access and modify secure pages unintentionally, causing security breaches and performance issues.
Innovation Solution
A virtual machine monitor (VMM) implements a TLB tracking mechanism that invalidates guest TLB entries before allocating secure pages, using a guest epoch to manage conversions and ensure secure page access, thereby preventing unauthorized access and reducing unnecessary VM exits and TLB shoot-downs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If non-secure pages are converted to secure pages in memory, then security protection is improved, but stale TLB entries cause unauthorized access and security breaches
Solution Approach 1:
The patent applies preliminary action by invalidating guest TLB entries before secure pages are allocated. The VMM tracks guest TLB entries and proactively invalidates them when a non-secure page is converted to a secure page, preventing stale entries from causing unauthorized access. This is implemented through the tlbs_invalidating logic that monitors page conversions and flushes relevant TLB entries before the secure page becomes accessible to guests.
Solution Approach 2:
The patent implements feedback through the TLB tracking mechanism that monitors guest TLB entries and provides information to the VMM. When a page conversion occurs, the tracking system feedbacks the status of relevant TLB entries, enabling the VMM to make informed decisions about invalidation. This feedback loop ensures that security measures are triggered appropriately based on the actual state of TLB entries.
2Reliability
If guest TLB entries are invalidated before allocating secure pages, then security is improved, but system complexity and overhead increase
Solution Approach 1:
The patent introduces an intermediary tracking mechanism between the guest OS and the physical TLB. This intermediary layer tracks which guest TLB entries correspond to which physical pages, enabling selective invalidation without requiring complex modifications to the guest OS or hardware TLB structure. The tracking data structure acts as a mediator that simplifies the invalidation process by providing a mapping that can be queried and updated efficiently.
Solution Approach 2:
The patent segments the TLB management into distinct components: guest TLB entries, physical page mappings, and conversion tracking. By dividing the management into these segments, the system can selectively invalidate only the relevant guest TLB entries associated with converted pages rather than flushing the entire TLB. This segmentation reduces overhead and complexity by targeting only the necessary entries for invalidation.
3Reliability
If TLB shoot-downs are performed frequently to maintain security, then security is improved, but performance deteriorates due to increased VM exits
Solution Approach 1:
The patent applies partial action by invalidating only the specific guest TLB entries that correspond to converted pages rather than performing full TLB shoot-downs. The tracking mechanism identifies and invalidates only the relevant entries, avoiding the performance penalty of flushing the entire TLB. This selective approach maintains security while minimizing the impact on system performance by performing the minimum necessary invalidation actions.
Solution Approach 2:
By invalidating guest TLB entries before secure page allocation, the patent performs the security-critical action in advance, preventing the need for subsequent TLB shoot-downs. This preliminary invalidation ensures that when secure pages are allocated, the guest TLB already contains the correct mappings, eliminating the performance penalty of later shoot-down operations and reducing the number of VM exits required.
Data Source
AI summary
Translation lookaside buffer (TLB) tracking and managing technologies are described. A processing device comprises a translation lookaside buffer (TLB) and a processing core to execute a virtual machine monitor (VMM), the VMM to manage a virtual machine (VM) including virtual processors. The processing core to execute, via the VM, a plurality of conversion instructions on at least one of the virtual processors to convert a plurality of non-secure pages to a plurality of secure pages. The processing core also to execute, via the VM, one or more allocation instructions on the at least one of the virtual processors to allocate at least one secure page of the plurality of secure pages, execution of the one or more allocation instructions to include determining whether the TLB is cleared of mappings to the at least one secure page prior to allocating the at least one secure page.