Enforcing unique page table permissions with shared page tables

    公开(公告)号:US10969980B2

    公开(公告)日:2021-04-06

    申请号:US16367944

    申请日:2019-03-28

    Abstract: A processor includes a processing core; a filter register to store a first permissions filter; and a memory management unit (MMU), coupled to the processing core, the filter register and a first peripheral device associated with the first permissions filter, wherein the MMU comprises a logic circuit to manage a shared page table comprising entries corresponding to the processing core and the first peripheral device, wherein the logic circuit is to; receive a memory access request for a first page of memory from the first peripheral device; determine whether the set of permission bits of the first entry match a first combination of bits of the first permissions filter; grant the memory access request if the set of permission bits match the first combination of bits of the first permissions filter; and cause a page fault if the set of permission bits do not matching the first combination of bits.

    Apparatuses, methods, and systems for instructions to compartmentalize code

    公开(公告)号:US11556341B2

    公开(公告)日:2023-01-17

    申请号:US17341068

    申请日:2021-06-07

    Abstract: Systems, methods, and apparatuses relating to instructions to compartmentalize memory accesses and execution (e.g., non-speculative and speculative) are described. In one embodiment, a compartment manager circuit is to determine, when a compartment control register of a hardware processor core is set to an enable value, that a first subset of code requested for execution on the hardware processor core in user privilege is within a first compartment of memory, load a first compartment descriptor for the first compartment into one or more registers of the hardware processor core from the memory, check if the first compartment is marked in the first compartment descriptor, within the one or more registers of the hardware processor core, as a management compartment, and, when the first compartment is marked in the first compartment descriptor as the management compartment, allowing the first subset of the code within the first compartment to load a second compartment descriptor for a second compartment of the memory into the one or more registers of the hardware processor core from the memory, switching execution from the first subset of code within the first compartment to a second subset of code in user privilege within the second compartment, allowing speculative memory accesses for the second subset of code only within the second compartment, and preventing a memory access outside of the second compartment for the second subset of code as indicated by the second compartment descriptor stored within the one or more registers of the hardware processor core.

    APPARATUSES, METHODS, AND SYSTEMS FOR INSTRUCTIONS TO COMPARTMENTALIZE CODE

    公开(公告)号:US20220012059A1

    公开(公告)日:2022-01-13

    申请号:US17341068

    申请日:2021-06-07

    Abstract: Systems, methods, and apparatuses relating to instructions to compartmentalize memory accesses and execution (e.g., non-speculative and speculative) are described. In one embodiment, a compartment manager circuit is to determine, when a compartment control register of a hardware processor core is set to an enable value, that a first subset of code requested for execution on the hardware processor core in user privilege is within a first compartment of memory, load a first compartment descriptor for the first compartment into one or more registers of the hardware processor core from the memory, check if the first compartment is marked in the first compartment descriptor, within the one or more registers of the hardware processor core, as a management compartment, and, when the first compartment is marked in the first compartment descriptor as the management compartment, allowing the first subset of the code within the first compartment to load a second compartment descriptor for a second compartment of the memory into the one or more registers of the hardware processor core from the memory, switching execution from the first subset of code within the first compartment to a second subset of code in user privilege within the second compartment, allowing speculative memory accesses for the second subset of code only within the second compartment, and preventing a memory access outside of the second compartment for the second subset of code as indicated by the second compartment descriptor stored within the one or more registers of the hardware processor core.

    Apparatuses, methods, and systems for instructions to compartmentalize code

    公开(公告)号:US11029957B1

    公开(公告)日:2021-06-08

    申请号:US16833478

    申请日:2020-03-27

    Abstract: Systems, methods, and apparatuses relating to instructions to compartmentalize memory accesses and execution (e.g., non-speculative and speculative) are described. In one embodiment, a compartment manager circuit is to determine, when a compartment control register of a hardware processor core is set to an enable value, that a first subset of code requested for execution on the hardware processor core in user privilege is within a first compartment of memory, load a first compartment descriptor for the first compartment into one or more registers of the hardware processor core from the memory, check if the first compartment is marked in the first compartment descriptor, within the one or more registers of the hardware processor core, as a management compartment, and, when the first compartment is marked in the first compartment descriptor as the management compartment, allowing the first subset of the code within the first compartment to load a second compartment descriptor for a second compartment of the memory into the one or more registers of the hardware processor core from the memory, switching execution from the first subset of code within the first compartment to a second subset of code in user privilege within the second compartment, allowing speculative memory accesses for the second subset of code only within the second compartment, and preventing a memory access outside of the second compartment for the second subset of code as indicated by the second compartment descriptor stored within the one or more registers of the hardware processor core.

    ENFORCING UNIQUE PAGE TABLE PERMISSIONS WITH SHARED PAGE TABLES

    公开(公告)号:US20200310665A1

    公开(公告)日:2020-10-01

    申请号:US16367944

    申请日:2019-03-28

    Abstract: A processor includes a processing core; a filter register to store a first permissions filter; and a memory management unit (MMU), coupled to the processing core, the filter register and a first peripheral device associated with the first permissions filter, wherein the MMU comprises a logic circuit to manage a shared page table comprising entries corresponding to the processing core and the first peripheral device, wherein the logic circuit is to; receive a memory access request for a first page of memory from the first peripheral device; determine whether the set of permission bits of the first entry match a first combination of bits of the first permissions filter; grant the memory access request if the set of permission bits match the first combination of bits of the first permissions filter; and cause a page fault if the set of permission bits do not matching the first combination of bits.

Patent Agency Ranking