Dual Translation Table Selection for Protected Virtual Address Regions

Solution Overview

Problem

Existing address translation systems face inefficiencies and security challenges in managing translation table structures for secure sandboxed components, particularly in multi-processor systems, due to the need for synchronization and cooperation between different parties managing secure and less secure code, leading to increased overhead and security risks.

Innovation Solution

Implementing first and second translation table address storage circuitry, with address translation circuitry selecting between them based on whether the target virtual address is within a protected region, allowing separate translation table structures for secure and less secure regions, reducing the need for synchronization and duplication of translation entries.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Quantity of substance

If a single translation table structure is used for both secure and less secure code, then memory capacity requirements are reduced, but security risks increase and synchronization overhead is required

Engineering Contradiction:

Improvememory capacity requirementsVSAvoidsecurity guarantees

Core Design Contradiction:

Quantity of substanceVSReliability

Solution Approach 1:

The translation table structures are segmented into multiple separate structures: a first translation table structure for secure code and a second translation table structure for less secure code. This segmentation allows each structure to be managed independently, eliminating the need for synchronization between parties while providing stronger security guarantees through isolated computing environments. The patent implements this by maintaining separate translation table structures that can be independently updated and accessed.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Different translation table structures are used for different regions of virtual address space based on security requirements. Protected regions of virtual address space use the first translation table structure with stronger security guarantees, while unprotected regions use the second translation table structure. This local quality approach allows the system to apply appropriate security measures only where needed, balancing security requirements with memory efficiency.

Inventive Principle:

Principle #3Local quality

2Reliability

If separate translation table structures are used for secure and less secure regions, then security guarantees are strengthened, but memory capacity requirements increase

Engineering Contradiction:

Improvesecurity guaranteesVSAvoidmemory capacity requirements

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The translation table structures are segmented into multiple separate structures: a first translation table structure for secure code and a second translation table structure for less secure code. This segmentation allows each structure to be managed independently, eliminating the need for synchronization between parties while providing stronger security guarantees through isolated computing environments. The patent implements this by maintaining separate translation table structures that can be independently updated and accessed.

Inventive Principle:

Principle #1Segmentation

3Quantity of substance

If translation table structures are shared between secure and less secure code, then memory capacity is optimized, but synchronization overhead increases

Engineering Contradiction:

Improvememory capacityVSAvoidsynchronization requirements

Core Design Contradiction:

Quantity of substanceVSDevice complexity

Solution Approach 1:

The translation table structures are segmented into multiple separate structures: a first translation table structure for secure code and a second translation table structure for less secure code. This segmentation allows each structure to be managed independently, eliminating the need for synchronization between parties while providing stronger security guarantees through isolated computing environments. The patent implements this by maintaining separate translation table structures that can be independently updated and accessed.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12566715B2Translation table address storage circuitry

Publication Date: 2026.03.03 ARM LTD

AI summary

An apparatus has address translation circuitry to translate a target virtual address (VA) specified by a memory access request into a target physical address, first/second translation table address storage circuitry to store first/second translation table addresses; and protected region defining data storage circuitry to store region defining data specifying at least one protected region of virtual address space. In response to the memory access request: when the target VA is in the protected region(s), the address translation circuitry translates the target VA based on address translation data from a first translation table structure identified by the first translation table address. When the target VA is outside the protected region(s), the target VA is translated based on address translation data from a second translation table structure identified by the second translation table address.