Shadow Page Tables for ARM Virtual Memory Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtualizing memory protection in ARM processor architectures poses challenges due to the lack of hardware assistance, requiring innovative methods to effectively manage memory protection attributes and domain access control in a virtualized environment.
Innovation Solution
The implementation of shadow page tables that map domain access information and access permissions from guest page tables to processor DACR, allowing the memory management unit to combine and reflect effective access permissions, thereby isolating the guest from the virtualization software and ensuring secure memory protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If shadowing techniques are used to virtualize memory management unit (MMU) without hardware assistance, then memory protection can be virtualized, but system complexity and performance overhead increase significantly
Solution Approach 1:
The patent introduces shadow page tables as an intermediary layer between the guest OS page tables and the hardware MMU. The shadow page tables contain both domain identifiers and access permissions, acting as a mediator that translates guest memory protection requirements into hardware-enforceable permissions without requiring hardware assistance for virtualization. This intermediary structure resolves the contradiction by providing reliable memory protection virtualization while managing complexity through a well-defined shadowing mechanism.
Solution Approach 2:
The patent segments the memory protection information into two distinct components: domain identifiers and access permissions. These are stored separately in the shadow page table entries, allowing independent management and validation. This segmentation enables the system to virtualize memory protection by validating domain identifiers against the DACR while simultaneously managing access permissions, thereby achieving reliable protection without excessive complexity.
2Reliability
If shadow page tables are implemented to map domain access information and permissions, then guest isolation and security are improved, but memory management overhead increases
Solution Approach 1:
The patent merges domain identifiers and access permissions into a single shadow page table structure that is validated together during address translation. By combining these two elements in one data structure and validating them simultaneously through the MMU, the system achieves strong guest isolation while reducing the overhead of separate validation processes. This merging allows the hardware MMU to enforce both domain-based and permission-based protection in a single translation step.
Solution Approach 2:
The shadow page table validation process is designed to be self-service in that the MMU automatically validates domain identifiers against the DACR and checks access permissions during normal address translation operations, without requiring additional software intervention. This self-validating mechanism improves guest isolation while minimizing memory management overhead by making the protection checks an inherent part of the translation process rather than a separate overhead operation.
3Reliability
If domain access control is enforced through shadow page tables, then unauthorized access is prevented, but access control complexity increases
Solution Approach 1:
The patent extracts the domain access control logic from the shadow page table structure itself and places it in the hardware DACR (Domain Access Control Register). By taking out the domain validation logic and implementing it in hardware, the patent simplifies the access control mechanism while maintaining strong security. The shadow page tables only need to store domain identifiers, which are automatically validated against the hardware DACR, reducing the complexity of the overall access control system while preventing unauthorized access.
Data Source
AI summary
A computing system includes a guest domain access control register (DACR), and guest first and second level page tables, the page tables containing domain identifiers used to obtain domain access information and access permission information, and the domain access information and the access permission information providing an effective guest access permission. The computing system provides a shadow page table, in which domain identifiers are used to identify domain access information in a processor DACR that are mapped from domain access information in the guest DACR, and in which access permissions are mapped from effective access permission information in the guest page tables and guest DACR. A memory management unit in the processor traverses the shadow page table, accesses the processor DACR, and combines the mapped domain access information in the processor with the mapped access permission in the shadow page table to reflect the guest intended effective access permissions.