Abstract:As virtualization becomes a key technique for supporting cloud computing, much effort has been made to reduce virtualization overhead, so a virtualized system can match its native performance. One major overhead is due to memory or page table virtualization. Conventional virtual machines rely on a shadow mechanism to manage page tables, where a shadow page table maintained by the VMM (Virtual Machine Monitor) maps virtual addresses to machine addresses while a guest maintains its own virtual to physical page table. This shadow mechanism will result in expensive VM exits whenever there is a page fault that requires synchronization between the two page tables. To avoid this cost, both Intel and AMD provide hardware assists, EPT (extended page table) and NPT (nested page table), to facilitate address translation. With the hardware assists, the MMU (Memory Management Unit) maintains an ordinary guest page table that translates virtual addresses to guest physical addresses. In addition, the extended page table as provided by EPT translates from guest physical addresses to host physical or machine addresses. NPT works in a similar style. With EPT or NPT, a guest page fault can be handled by the guest itself without triggering VM exits. However, the hardware assists do have their disadvantage compared to the conventional shadow mechanism -- the page walk yields more memory accesses and thus longer latency. Our experimental results show that neither hardware-assisted paging (HAP) nor shadow paging (SP) can be a definite winner. Despite the fact that in over half of the cases, there is no noticeable gap between the two mechanisms, an up to 34% performance gap exists for a few benchmarks. We propose a dynamic switching mechanism that monitors TLB misses and guest page faults on the fly, and dynam-ically switches between the two paging modes. Our experiments show that this new mechanism can match and, sometimes, even beat the better performance of HAP and SP.

EPTI: Efficient Defence Against Meltdown Attack for Unpatched VMs.

Undertow: an Intra-Kernel Isolation Mechanism for Hardware-Assisted Virtual Machines.

Effectively Mitigating I/O Inactivity In Vcpu Scheduling

Design and Implementation of SecPod, A Framework for Virtualization-Based Security Systems.

MIPE: a Practical Memory Integrity Protection Method in a Trusted Execution Environment.

Store-to-Leak Forwarding: Leaking Data on Meltdown-resistant CPUs (Updated and Extended Version)

AMD Prefetch Attacks through Power and Time

Overtake: Achieving Meltdown-type Attacks with One Instruction

SecPT: Providing Efficient Page Table Protection based on SMAP Feature in an Untrusted Commodity Kernel

Indirect Meltdown: Building Novel Side-Channel Attacks from Transient-Execution Attacks

EPK: Scalable and Efficient Memory Protection Keys

Selective Hardware/software Memory Virtualization

Architecture support for guest-transparent VM protection from untrusted hypervisor and physical attacks

Transient Execution of Non-Canonical Accesses

Reviving Meltdown 3a

MPTEE: Bringing Flexible and Efficient Memory Protection to Intel SGX

(Mostly) Exitless VM Protection from Untrusted Hypervisor Through Disaggregated Nested Virtualization.

Measuring the Impact of Spectre and Meltdown

Attack detection based on machine learning algorithms for different variants of Spectre attacks and different Meltdown attack implementations

Secure and Efficient In-Hypervisor Memory Introspection Using Nested Virtualization.

Domain Page-Table Isolation