Memory Protection for Virtual Machines via Remap Circuit
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current memory management units (MMUs) in hypervisor systems are complex and costly, leading to performance overhead and a need for a low-complexity and low-overhead memory protection scheme for virtual machines.
Innovation Solution
A system with a memory interface controller and a remap circuit that maps addresses in extended physical address regions to a remapped address within the physical address space, using a memory protection unit to grant or deny access based on stored access rights information, reducing the complexity of MMU management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a traditional MMU is used for memory management in virtual machines, then memory protection and address translation are provided, but device complexity and performance overhead increase
Solution Approach 1:
The patent extracts the memory protection function from the complex MMU and implements it separately using a memory protection unit (MPU) with permission filters. The MMU handles only address translation while the MPU handles memory protection, separating these functions to reduce overall system complexity while maintaining protection capabilities.
Solution Approach 2:
The patent segments the memory protection mechanism into permission filters that are stored in a dedicated filter memory and applied by the MPU. This segmentation allows the protection logic to be independent from the address translation logic, reducing the complexity burden on the MMU while providing effective memory protection.
2Reliability
If a traditional MMU is used for memory management in virtual machines, then memory protection and address translation are provided, but performance overhead increases
Solution Approach 1:
The patent implements permission filters that are pre-configured and stored in filter memory before memory access operations. The MPU quickly checks these pre-prepared filters during memory access, avoiding the need for complex runtime protection decisions that would increase performance overhead.
3Quantity of substance
If extended physical address regions are allocated to VMs, then memory capacity is increased, but address mapping complexity increases
Solution Approach 1:
The patent introduces an intermediary remap circuit that sits between the extended physical address space and the actual memory. This remap circuit handles the complex mapping of extended addresses to physical addresses, allowing VMs to access extended memory capacity while the complexity of address mapping is isolated to this dedicated intermediary component.
Data Source
AI summary
A system includes a memory addressable by addresses within a physical address (PA) space, and one or more processors that perform operations of virtual machines (VMs). The VMs are allocated with extended PA regions outside the PA space. The system further includes a memory interface controller coupled to the memory and the one or more processors. The memory interface controller receives a request for accessing an address in the extended PA regions from a requesting VM, and uses a remap circuit to map the address in the extended PA regions to a remapped address in the PA space. A memory protection unit (MPU) in the memory interface controller grants or denies the request based on stored information indicating whether the remapped address is accessible to the requesting VM.