Virtual Machine Function Access via Supervisor Mode Transition
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtual machine systems face challenges in securely executing virtual machine functions by guest applications without compromising security and performance, as they often require intermediary involvement from the hypervisor, which can lead to overhead.
Innovation Solution
The method involves allocating and initializing guest virtual addresses, toggling user and valid bits in page table entries, and requesting supervisor mode to validate and execute virtual machine functions, allowing guest applications to execute trusted code while maintaining security and reducing hypervisor overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the hypervisor is involved in executing virtual machine functions, then security is maintained, but performance deteriorates due to overhead
Solution Approach 1:
The patent segments execution into two modes: user mode for normal application execution and supervisor mode for trusted virtual machine function execution. By segmenting the execution environment and using mode transitions, the system maintains security through hypervisor involvement only when necessary while improving performance by allowing direct execution in supervisor mode for trusted functions.
Solution Approach 2:
The patent dynamically transitions between user mode and supervisor mode based on the trust level of the code being executed. This dynamic mode switching allows the system to adapt its security posture - maintaining strict security checks in user mode while enabling high-performance direct execution in supervisor mode for verified virtual machine functions, thus resolving the contradiction between security and performance.
2Productivity
If guest applications execute virtual machine functions directly, then performance improves, but security risks increase
Solution Approach 1:
The patent introduces supervisor mode as an intermediary between user mode and direct hardware execution. This intermediary layer validates that the code being executed is indeed a trusted virtual machine function before allowing supervisor mode execution. The intermediary prevents untrusted code from executing directly while still enabling performance optimization for verified functions, thus managing security risks while maintaining performance benefits.
3Productivity
If hypervisor overhead is reduced, then performance improves, but security validation may be compromised
Solution Approach 1:
The patent performs security validation in advance by establishing trust relationships and validating virtual machine functions before they are executed in supervisor mode. The hypervisor pre-validates that a function is indeed a trusted virtual machine function and sets up the appropriate execution context. This preliminary action reduces the need for continuous hypervisor intervention during execution, improving performance while maintaining security validation integrity.
Data Source
AI summary
Methods, systems, and computer program products for accessing a protected function are provided. A computer-implemented method includes allocating and initializing a guest virtual address for a virtual machine function. A user bit and a valid bit are configured to protect a page associated with the guest virtual address. Once the user bit and the valid bit are configured, the virtual machine function is mapped to the guest virtual address. Supervisor mode is requested in order to access the virtual machine function. In supervisor mode, the virtual machine function is validated and executed.