VMX-Nonroot Access Control Caches for Co-Processors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems face challenges in managing access control transitions between VMX-nonroot and VMX-root modes efficiently, particularly in co-processor operations, which are expensive and hinder high memory access speeds, leaving systems vulnerable to malicious accesses.
Innovation Solution
Implementing a permissions-map per context that can be switched without transitioning to VMX-root mode, using a switch_context instruction to manage access tables and maintain security without explicit mode switches, thereby reducing computational overhead and ensuring rapid context switching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control transitions between VMX-nonroot and VMX-root modes are implemented traditionally, then security protection is ensured, but memory access speed and system performance deteriorate due to expensive mode switching
Solution Approach 1:
The patent pre-establishes multiple access control permission-maps in the VMX-nonroot mode before actual memory access operations occur. These permission-maps are prepared in advance with different access policies, allowing the system to switch between them without transitioning to VMX-root mode, thus maintaining security while avoiding the performance penalty of mode switching during runtime
Solution Approach 2:
The patent introduces an intermediate permission-map structure that acts as a mediator between the VMX-nonroot and VMX-root modes. This permission-map contains pre-configured access control policies that can be activated directly in VMX-nonroot mode, serving as an intermediary layer that provides security enforcement without requiring full mode transitions
2Reliability
If explicit transitions to VMX-root mode are performed for access control changes, then access control policies are enforced correctly, but computational overhead and latency increase
Solution Approach 1:
Access control permission-maps are configured and validated in advance during system initialization or policy update phases, allowing the VMX-nonroot mode to directly apply these pre-validated policies without time-consuming mode transitions. The permission-maps are prepared with all necessary access control rules before runtime operations
Solution Approach 2:
The patent segments the access control functionality into separate permission-map structures that can be independently managed and switched. Each permission-map contains a specific set of access control policies for different contexts or memory regions, allowing selective activation without involving the entire VMX-root mode infrastructure
3Reliability
If VMX-root mode is used for all access control operations, then system security is maintained, but context switching performance and memory access efficiency deteriorate
Solution Approach 1:
The patent applies different access control mechanisms to different contexts or memory regions. For contexts requiring frequent switching, pre-configured permission-maps are used in VMX-nonroot mode with local switching capability. For contexts requiring higher security, traditional VMX-root mode transitions are maintained. This localized approach optimizes performance for time-sensitive operations while maintaining security where needed
Data Source
AI summary
Enabling access control caches for co-processors to be charged using a VMX-nonroot instruction. As a result a transition to VMX-root is not needed, saving the cycles involved in such a transition.