Hardware VM Memory Isolation With MMU-MPU Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory management units (MMUs) in virtual machine systems are complex, costly, and compromise security in shared memory environments, leading to performance degradation and increased complexity.
Innovation Solution
A system utilizing second-stage memory management units (MMUs) and memory protection units (MPUs) to control access to physical address space, with configurable settings for virtual machines, providing low-complexity and low-overhead memory protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional MMU is used for memory management in virtual machine systems, then address translation and memory protection are provided, but device complexity and cost increase significantly
Solution Approach 1:
The patent divides the memory management function into two separate stages: first-stage translation tables configured by the guest operating system and second-stage translation tables configured by the hypervisor. This segmentation allows each stage to handle specific aspects of address translation independently, reducing the complexity burden on a single MMU unit while maintaining comprehensive memory protection capabilities.
Solution Approach 2:
The patent introduces an intermediate physical address as a mediator between the virtual address space and the final physical address space. This intermediate address serves as a bridge that enables the hypervisor to control guest access to physical memory without requiring the guest OS to directly manage physical addresses, thereby simplifying the overall system architecture while maintaining security.
2Reliability
If traditional MMU with two-stage translation is used, then hypervisor control over guest memory view is enabled, but management complexity and software overhead increase
Solution Approach 1:
The patent segments the address translation process into two distinct stages with separate translation tables, allowing the hypervisor to manage only the second stage while the guest OS manages the first stage. This division reduces the software overhead on the hypervisor compared to managing a complete MMU, while still providing the necessary memory access control.
Solution Approach 2:
The patent implements partial address translation in the guest OS (first stage to intermediate address) and completes the translation in the hypervisor (second stage to physical address). This partial action approach reduces the burden on the hypervisor compared to full translation management, while maintaining security and control.
3Productivity
If shared memory environment is used for multiple devices, then resource utilization improves, but security is compromised due to increased complexity
Solution Approach 1:
The patent segments the physical address space into multiple distinct regions, each accessible only to specific virtual machines through configured translation tables. This segmentation enables multiple devices to share memory resources efficiently while maintaining security boundaries, as each device can access only its allocated memory regions through the controlled translation process.
Solution Approach 2:
The patent applies different access permissions and translation rules to different regions of the physical address space. Each memory region has its own security characteristics and access controls tailored to the specific requirements of the virtual machines that need to access them, enabling secure shared memory environments with customized access policies for different locations in the address space.
Data Source
AI summary
A system controls access to a physical address (PA) space. The system includes multiple system resources addressable within the PA space, and multiple processing circuits executing multiple virtual machines (VMs). A given region of the PA space is dedicated to addressing the VMs. The system also includes multiple memory management units (MMUs) coupled to corresponding processing circuits. A given MMU is operative to translate a virtual address indicated in an access request from a processing circuit into a requested PA that is accessible by the processing circuit according to a configurable setting of the given MMU. The system further includes multiple memory protection units (MPUs). A given MPU, which is coupled to a target system resource allocated with the requested PA, is operative to grant or deny the request based on information indicating whether the requested PA is accessible to a requesting VM executed on the processing circuit.