Tracking and managing translation lookaside buffers

A method comprising:

• executing, via a VM comprising a plurality of virtual processors, a plurality of conversion instructions on the plurality of virtual processors to convert a plurality of non-secure pages to a plurality of secure pages, wherein the VM is managed by a virtual machine monitor (VMM) executing on a processing core, wherein a first value of a guest epoch is stored in a field of a secure area of memory for each of the plurality of non-secure pages prior to an initial execution of a first conversion instruction of the plurality of conversion instructions, wherein the first value of the guest epoch indicates a first period of time during which mappings to the plurality of non-secure pages are allowed, and wherein a beginning of a second period of time associated with a second value of the guest epoch is marked by the initial execution of the first conversion instruction;
• responsive to converting the plurality of non-secure pages to the plurality of secure pages, store the second value of the guest epoch in the field of the secure area of the memory for each of the plurality of secure pages, wherein the second value of the guest epoch indicates the second period of time during which new mappings to the plurality of secure pages are blocked until clearing of a translation lookaside buffer (TLB);
• and
• executing, via the VM, one or more allocation instructions on at least one of the plurality of virtual processors to allocate at least one secure page of the plurality of secure pages, execution of the one or more allocation instructions to include determining the second value of the guest epoch is stored in the field for the at least one secure page and determining the TLB is cleared of any mappings to the at least one secure page prior to allocating the at least one secure page, wherein an end of the second period of time associated with the second value of the guest epoch is marked by an initial attempt by any of the plurality of virtual processors to execute a first allocation instruction of the one or more allocation instructions on the at least one secure page converted during the second period of time.

A system comprising:

• a memory device to store instructions;
• and
• a processing device operably coupled to the memory device, the processing device comprising a translation lookaside buffer (TLB) and the processing device to execute the instructions to:
• allocate, via a virtual machine monitor (VMM), a data structure for a virtual machine (VM), wherein:
• the VM is to execute a plurality of conversion instructions on a plurality of virtual processors of the VM to convert a plurality of non-secure pages to a plurality of secure pages;
• the data structure comprises a guest epoch for the VM and a tracking in progress (TIP) bite;
• a first value of the guest epoch is indicative of a first time period during which mappings are made by the VM to a non-secure page in the TLB and the first value of the guest epoch is stored in a secure area of memory for the non-secure page by a guest operating system (OS) of the VM prior to an initial execution of a first conversion instruction of the plurality of conversion instructions;
• a beginning of a second period of time associated with a second value of the guest epoch is marked by the initial execution of the first conversion instruction;
• the second value of the guest epoch is indicative of a second time period during which new mappings to an unallocated secure page in the TLB by the VM are blocked until clearing of the TLB and the second value is stored in the secure area of the memory for the unallocated secure page by the guest OS of the VM responsive to conversion of the unallocated secure page from non-secure to secure;
• and
• an end of the second period of time associated with the second value of the guest epoch is marked by an initial attempt by any of the plurality of virtual processors to execute a first allocation instruction on at least one secure page converted during the second period of time;
• receive execution control of the VM via a VM exit;
• responsive to a determination that a value of the guest epoch stored for the unallocated secure page matches a current value of the guest epoch in the data structure and the TIP bit is clear:
• increment the current value of the guest epoch in the data structure;
• set the TIP bit;
• and
• clear the TLB of any mappings to the unallocated secure page.