User Space Driver Isolation via Host Page Table Switching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
User space device drivers in computer systems can be vulnerable to malicious or inadvertent access by application code, compromising memory protection and device integrity.
Innovation Solution
Implementing two host page table structures to control access, where one structure renders application code executable and the other non-executable, allowing driver code to access devices while preventing application code from doing so, using a host page table switching instruction to manage access permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If user space device drivers are implemented to enhance performance, then execution speed is improved, but memory protection and security are compromised
Solution Approach 1:
The patent segments user space memory into two distinct regions: a first region for application code and a second region for driver code. This segmentation allows each region to have different access permissions to device memory, enabling driver code to access devices while preventing application code from doing so, thus maintaining memory protection despite user space driver execution
Solution Approach 2:
The patent applies local quality by assigning different memory access properties to different regions of user space memory. The first region (application code) has restricted access to device memory, while the second region (driver code) has full access. This localized differentiation of memory qualities enables performance enhancement for drivers while preserving security for applications
2Ease of operation
If application code can access devices directly, then ease of operation is improved, but system security and stability are worsened
Solution Approach 1:
The patent introduces an intermediary mechanism through the memory management unit that mediates between application code and device memory. The memory management unit translates device memory addresses to different memory regions based on the executing code's region, allowing applications to access devices through the driver code intermediary while blocking direct malicious access
3Productivity
If driver code executes in user space, then productivity is improved, but device integrity is compromised
Solution Approach 1:
The patent segments user space into driver execution region and application execution region, allowing driver code to execute in user space for improved productivity while the segmentation itself ensures device integrity by preventing application code from accessing devices directly
Solution Approach 2:
The patent changes the memory access parameters dynamically based on the executing code's region. When driver code executes, the memory management unit configures specific memory regions as accessible; when application code executes, those same regions are restricted. This parameter change maintains device integrity while enabling efficient user space driver execution
Data Source
AI summary
A driver associated with a host peripheral component interconnect (PCI) device may be initiated, the host PCI device to be accessed by an application executed by a guest operating system (OS) of a guest using user space memory of the guest. A host page table switching instruction may be executed using the driver to cause a switch from a first host page table structure to a second host page table structure. The host PCI device may be accessed using the driver via a PCI alias address that is mapped to a host PCI address in the second host page table structure. Application code associated with the application may be prevented from accessing a host memory address in the second host page table structure.