Two-Stage Address Translation Protecting Stage-1 Table Writes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing two-stage address translation methods in memory management systems are vulnerable to attacks that corrupt stage-1 translation table entries, leading to security breaches and performance degradation due to unnecessary translation table walks and restricted write permissions.
Innovation Solution
Implementing partially-read-only stage-2 access permissions and protected-entry-checking type of read-check-write (RCW) instructions to control write access to stage-1 translation table entries, combined with anti-aliasing checks and stage-1 top-level base address protection, to enhance security and performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If stage-1 translation table entries are made writable by the operating system, then the operating system can maintain and update address mappings, but the system becomes vulnerable to attacks that corrupt translation table entries
Solution Approach 1:
The patent segments write permissions for stage-1 translation table entries by distinguishing between metadata-updating write requests (which are permitted) and other write requests (which are prohibited). This segmentation allows the operating system to maintain necessary address mappings while protecting against malicious writes that could corrupt critical translation table data.
Solution Approach 2:
The patent introduces an intermediary permission checking mechanism that mediates between the operating system's need to write to translation tables and the security requirement to prevent corruption. The memory management circuitry acts as an intermediary that evaluates write requests against the restricted subset permission and either permits or prohibits them, thus resolving the contradiction between accessibility and security.
2Object-affected harmful factors
If write permissions are restricted to protect translation table entries, then security is improved, but performance degrades due to unnecessary translation table walks
Solution Approach 1:
The patent applies partial action by permitting a restricted subset of write requests (metadata-updating writes) while prohibiting other write requests. This partial permission approach maintains security by blocking potentially harmful writes while preserving performance by allowing necessary metadata updates without triggering translation table walks or security violations.
3Adaptability or versatility
If intermediate addresses are remapped to different physical addresses, then virtualisation support is improved, but the attack surface increases due to more translation table entries
Solution Approach 1:
The patent segments the protection mechanism by applying the restricted subset permission specifically to stage-2 translation table entries that map intermediate addresses to physical addresses. This segmentation allows virtualisation functionality to proceed while selectively protecting the translation entries that are most vulnerable to attacks, thus reducing the effective attack surface without compromising virtualisation support.
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
Memory management circuitry (28) supports two-stage address translation based on a stage-1 and stage-2 translation table structures. Stage-2 access permission information specified by a stage-2 translation table entry has an encoding specifying whether a corresponding memory region has a partially-read-only permission indicating that write requests to the memory region corresponding to the target intermediate address, issued when processing circuitry (4) is in a predetermined execution state, are permitted for a restricted subset of write request types (including metadata-updating write requests for updating access tracking metadata in translation table entries) but prohibited for other write request types. The memory management circuitry (28) rejects a memory access request when the stage-2 access permission information of a corresponding stage-2 translation table entry specifies the partially-read-only permission and the memory access request is a write request, other than the restricted subset of write request types, issued in the predetermined execution state.