Two-Stage Address Translation with Selective Metadata Writes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory management systems face challenges in protecting stage-1 translation table entries from corruption by operating systems, which can compromise security and performance, especially when using two-stage address translation.
Innovation Solution
Implementing a partially-read-only permission at the stage-2 level for memory regions storing stage-1 translation table entries, combined with a protected-entry-checking mechanism for stage-1 entries, to allow updates only through specific metadata-updating instructions, reducing the attack surface and maintaining performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If stage-1 translation table entries are made writable by the operating system, then the operating system can update address mappings and access tracking metadata, but the entries become vulnerable to corruption and security attacks
Solution Approach 1:
The patent applies different permission characteristics to different parts of the translation table structure. Stage-1 translation table entries are marked with a first permission characteristic that allows OS-controlled updates, while stage-2 translation table entries are marked with a second permission characteristic that prevents unauthorized modification. This local differentiation of permissions resolves the contradiction by allowing necessary updates in stage-1 while protecting stage-2 entries from corruption.
Solution Approach 2:
The patent segments the address translation process into two distinct stages with separate translation tables. Stage-1 translation tables handle virtual-to-intermediate address mapping with OS-controllable permissions, while stage-2 translation tables handle intermediate-to-physical address mapping with protected permissions. This segmentation allows the OS to update stage-1 entries for normal operation while stage-2 entries remain protected, resolving the security vulnerability without compromising operational capability.
2Reliability
If stage-2 translation table entries are protected from OS updates, then security against corruption is improved, but the ability to update access tracking metadata is reduced
Solution Approach 1:
The patent introduces dynamic permission checking that considers both the permission characteristics of translation table entries and the type of access being requested. The memory management circuitry is configured to permit access when the requested operation is consistent with the permission characteristic and when accessed from an appropriate execution state. This dynamic approach allows access tracking metadata to be updated through controlled mechanisms while preventing unauthorized corruption, resolving the contradiction between protection and adaptability.
Solution Approach 2:
The patent implements a feedback mechanism where the memory management circuitry monitors access requests against the permission characteristics of translation table entries. When an access request is made, the circuitry checks whether the request type and execution state are consistent with the entry's permission characteristic. This feedback loop enables legitimate metadata updates while blocking unauthorized modifications, resolving the contradiction by providing selective access control.
3Reliability
If permission checking is performed for all memory access requests, then security is improved, but processing overhead and performance are worsened
Solution Approach 1:
The patent applies permission checking selectively rather than universally. The memory management circuitry is configured to perform permission checking based on the permission characteristics of translation table entries and the type of access requested. For example, read accesses may be permitted without full permission verification in certain contexts, while write accesses trigger comprehensive permission checks. This partial application of permission checking maintains security for critical operations while reducing overhead for routine accesses, resolving the contradiction between security and performance.
Data Source
AI summary
Memory management circuitry (28) supports two-stage address translation based on a stage-1 and stage-2 translation table structures. Stage-2 access permission information specified by a stage-2 translation table entry has an encoding specifying whether a corresponding memory region has a partially-read-only permission indicating that write requests to the memory region corresponding to the target intermediate address, issued when processing circuitry (4) is in a predetermined execution state, are permitted for a restricted subset of write request types (including metadata-updating write requests for updating access tracking metadata in translation table entries) but prohibited for other write request types. The memory management circuitry (28) rejects a memory access request when the stage-2 access permission information of a corresponding stage-2 translation table entry specifies the partially-read-only permission and the memory access request is a write request, other than the restricted subset of write request types, issued in the predetermined execution state.