VM Physical Device Access Security via Supervisor Memory Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques for direct device access in Network Function Virtualization (NFV) improve system performance but introduce security risks, as virtual machines can inadvertently or maliciously damage physical devices by accessing supervisor memory, leading to potential device breakage.
Innovation Solution
A system and method that uses a supervisor to map guest and supervisor memory addresses to reserved device memory addresses, intercepting requests to validate that they do not overlap with reserved ranges, thereby preventing access to protected memory and ensuring secure device operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If direct device access is allowed from virtual machines to improve system performance, then productivity is improved, but reliability deteriorates due to security risks of device damage
Solution Approach 1:
The patent segments the device memory address space into multiple distinct regions: a first region accessible by virtual machines through mapped guest memory addresses, and a second region (reserved range) protected from virtual machine access. The supervisor maintains separate mappings for supervisor memory addresses to the protected region, creating isolated access paths that enable performance improvement while preventing unauthorized access to critical device memory.
2Reliability
If supervisor validation is implemented to prevent unauthorized memory access, then reliability is improved, but device complexity increases due to additional validation layers
Solution Approach 1:
The supervisor performs preliminary actions by pre-establishing distinct memory address mappings before virtual machine execution begins. Guest memory addresses are mapped to specific device memory regions, and supervisor memory addresses are mapped to protected regions in advance. This preliminary configuration eliminates the need for complex runtime validation logic, as the memory management hardware automatically enforces access boundaries based on the pre-configured mappings.
Data Source
AI summary
A system includes a host with a memory, a processor, a supervisor, and a device with access to DMAs. The system also includes a guest with access to GMAs and configured to initialize a first driver for the device. The supervisor is configured to map GMAs to a first subset of DMAs, map SMAs to a second subset of DMAs, which are located in a reserved range of addresses, and to initialize a second driver for the device with access to the SMAs. The device is configured to communicate with the guest and the supervisor via the first subset of DMAs and the SMAs respectively. The supervisor is configured to intercept a request from the first driver and validate that memory addresses associated with the request are outside of the reserved range. The supervisor is also configured to send the request to the device via the second driver.