Virtual Function Memory Remapping for Passive Integrity Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtual machines leveraging graphics processor resources via hardware virtualization are vulnerable to passive integrity attacks, which cause silent data corruption by ignoring memory integrity errors in virtual function (VF) regions, allowing malicious hypervisors to induce errors in confidential VMs.
Innovation Solution
Implement a device security manager (DSM) within a trusted execution environment (TEE) to receive uncorrectable error notifications for pages mapped to confidential VMs, providing error counter telemetry to trigger life cycle events like migration if error thresholds are exceeded, ensuring the hypervisor is unaware of VF memory errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If fabric level protections are used to protect VF memory regions, then memory isolation and protection against active integrity attacks is enabled, but the system remains vulnerable to passive integrity attacks
Solution Approach 1:
The patent introduces an intermediary mechanism between the fabric level protections and the VF memory regions. Specifically, it uses a per-VF framebuffer carveout with dedicated memory protection units that act as intermediaries to detect and report passive integrity attacks. This intermediary layer enables the system to detect silent data corruption while maintaining the existing fabric level isolation protections.
Solution Approach 2:
The patent implements feedback mechanisms by having the memory protection units continuously monitor the integrity of VF memory regions and provide feedback signals when passive integrity attacks are detected. This feedback enables the system to respond to silent data corruption events, transforming the previously blind system into one that can detect and report integrity violations.
2Productivity
If per-VF framebuffer carveout is implemented for large data transfers, then hardware virtualization performance is improved, but passive integrity attack vulnerability increases
Solution Approach 1:
The patent applies local quality by implementing integrity protection mechanisms specifically within the per-VF framebuffer carveout regions rather than applying uniform protection across the entire memory space. Each VF region has dedicated memory protection units tailored to its specific integrity needs, enabling high-performance data transfers while maintaining localized integrity monitoring.
Solution Approach 2:
The patent segments the memory protection function by creating separate memory protection units for each VF region. This segmentation allows independent integrity monitoring of each VF's framebuffer carveout, enabling performance optimization for each virtual function while maintaining comprehensive integrity protection across all segments.
3Productivity
If hypervisor ignores memory integrity errors in VF regions, then system performance is maintained, but silent data corruption occurs
Solution Approach 1:
The patent introduces feedback mechanisms that enable the hypervisor to receive notifications about memory integrity errors in VF regions without immediately ignoring them. The memory protection units provide feedback signals that allow the hypervisor to be informed of integrity violations while maintaining the ability to continue processing, thus balancing performance with integrity monitoring.
Solution Approach 2:
The patent uses memory protection units as intermediaries between the hypervisor and the VF memory regions. These intermediaries handle the complexity of integrity monitoring and error notification, allowing the hypervisor to maintain performance by delegating integrity checks to the intermediary units rather than directly managing each VF region's memory integrity.
Data Source
AI summary
One embodiment provides a graphics processor comprising a host interface, a plurality of processing resources coupled with the host interface, a memory controller coupled with the plurality of processing resources and memory including error correction circuitry, and circuitry coupled with the memory controller and configured to facilitate integration of the graphics processor into a trusted execution environment. The circuitry is additionally configured to remap a region of the memory associated with the trusted execution environment in response to detection of an uncorrectable error by the error correction circuitry.