Method and system for preventing current-privilege-level-information leaks to non-privileged code
View Patent ↗Various embodiments of the present invention introduce privilege-level mapping into a computer architecture not initially designed for supporting virtualization. Privilege-level mapping can, with relatively minor changes to processor logic, fully prevent privileged-level-information leaks by which non-privilege code can determine the current machine-level privilege level at which they are executing. In one embodiment of the present invention, a new privilege-level mapping register is introduced, and privilege-level mapping is enabled for all but code invoked by privileged-level-0-forcing hardware events.
1. A method for preventing non-privileged code from determining the machine-level, internal privilege level at which the non-privileged code is executing, the method comprising:
introducing a privilege-level-mapping mechanism accessible only to code executing at a highest machine-level, internal privilege that maps virtual-privilege-level values to specified machine-level, internal privilege-level values;
disabling the privilege-level mapping mechanism upon occurrence of a highest-machine-level-internal-privilege-forcing hardware event; and
enabling the privilege-level mapping mechanism at completion of a highest-machine-level-internal-privilege-forcing hardware event.
2. The method of claim 1 wherein the privilege-level-mapping mechanism is a system register that includes a field indicating whether or not privilege-level mapping is enabled, and a field for each virtual privilege level indicating a machine-level, internal privilege level corresponding to each virtual privilege level.
3. The method of claim 2 further including altering a computer processor to, during instruction execution, map virtual-privilege-level values stored in registers to machine-level, internal privilege-level values, when the field indicating whether or not privilege-level mapping is enabled indicates that privilege-level mapping is enabled.
4. A computer processor comprising:
registers;
instruction execution logic;
memory bus interfaces; and
a privilege-level-mapping mechanism accessible only to code executing at a highest machine-level, internal privilege that maps virtual-privilege-level values to specified machine-level, internal privilege-level values.
5. The computer processor of claim 4 further including:
logic that disables the privilege-level mapping mechanism upon occurrence of a highest-machine-level-internal-privilege-forcing hardware event; and
logic that enables the privilege-level mapping mechanism at completion of a highest-machine-level-internal-privilege-forcing hardware event.
6. The computer processor of claim 4 wherein the privilege-level-mapping mechanism is a system register that includes a field indicating whether or not privilege-level mapping is enabled, and a field for each virtual privilege level indicating a machine-level, internal privilege level corresponding to each virtual privilege level.
7. The computer processor of claim 6 further including:
logic that, during instruction execution, maps virtual-privilege-level values stored in registers to machine-level, internal privilege-level values, when the field indicating whether or not privilege-level mapping is enabled indicates that privilege-level mapping is enabled.
8. A method for providing a virtual machine environment by a virtual monitor running on a computer processor the method comprising:
providing the computer processor including registers, instruction execution logic, memory bus interfaces; and a privilege-level-mapping mechanism accessible only to code executing at a highest machine-level, internal privilege that maps virtual-privilege-level values to specified machine-level, internal privilege-level values;
using virtual-privilege-level mapping to map a highest virtual privilege level to a machine-level, internal privilege level less than a highest-machine-level-internal-privilege level;
executing virtual monitor routines at highest-machine-level-internal-privilege level to trap all attempts by non-virtual-monitor code to execute privileged instructions or access privileged resources and emulate highest-machine-level-internal-privilege-level execution of privileged instructions and access to privileged resources.
9. A computer readable medium encoded with computer instructions that, when accessed and executed by a processor within a computer system, implement the method of claim 8 .