IOMMU Protection Mode for Secure Boot Memory Constraints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern software and hardware systems face challenges in securely initializing trusted boot sequences due to the limited 64K memory region protected by existing secure kernel initialization instructions, which is insufficient for storing I/O translation tables required by IOMMUs, making it difficult to restrict memory access operations from peripheral devices effectively.
Innovation Solution
An IOMMU is configured to operate in a protection mode where it disables memory access by peripheral devices without requiring significant storage, using a protection flag to treat all memory access requests as if they came from a default device, allowing all translation tables to be stored on a single page and reducing the memory footprint, enabling the TBOOT sequence to set up larger IOMMU data structures within the protected limits.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the SKINIT instruction protects a 64K region of memory to ensure secure initialization, then security against malicious software is improved, but the ability to store I/O translation tables required by IOMMUs deteriorates due to insufficient space
Solution Approach 1:
The patent divides the IOMMU data structures into two segments: I/O translation tables that must be protected during trusted boot, and device tables that can be stored outside the protected 64K region. This segmentation allows the critical security data structures to reside in the protected memory while device-specific tables are stored in unprotected memory, resolving the space constraint.
Solution Approach 2:
The patent introduces a new dimensional organization for IOMMU data structures by creating separate storage locations for different types of tables. Instead of storing all IOMMU data structures in a single memory region, the system uses multiple dimensions: protected memory for critical translation tables and unprotected memory for device tables, thereby expanding the effective storage capacity within the security constraints.
2Reliability
If I/O translation tables are stored in the protected 64K memory region, then memory access restriction from peripheral devices is improved, but the device complexity increases due to the need to manage limited space
Solution Approach 1:
The patent extracts device tables from the protected memory region and stores them in unprotected memory. This extraction simplifies the management of protected memory by removing the complexity of fitting all IOMMU data structures into the limited 64K space, while still maintaining security for the critical translation tables that remain in protected memory.
Solution Approach 2:
The patent performs preliminary setup of the IOMMU system during trusted boot by pre-configuring the protected translation tables in the 64K region before the full system initializes. This preliminary action establishes the security foundation early, allowing the rest of the IOMMU data structures to be configured in unprotected memory without compromising security.
3Ease of operation
If all IOMMU data structures are stored in unprotected memory, then device complexity and management ease are improved, but security against malicious peripheral access deteriorates
Solution Approach 1:
The patent applies local quality by providing different security levels to different IOMMU data structures. Critical translation tables that require security are stored in the protected 64K region with high security, while device tables that do not require security are stored in unprotected memory with lower security requirements. This differentiated approach optimizes both security and manageability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A memory management unit is configured to receive requests for memory access from a plurality of I/O devices. The memory management unit implements a protection mode wherein the unit prevents memory accesses by the plurality of I/O devices by mapping memory access requests (from the I/O devices) to the same set of memory address translation data. When the memory management unit is not in the protected mode, the unit maps memory access requests from the plurality of I/O devices to different respective sets of memory address translation data. Thus, the memory management unit may protect memory from access by I/O devices using fewer address translation tables than are typically required (e.g., none).