Security configuration in page table entries of an execution domain

Abstract

Systems, apparatuses, and methods related to computer systems having page table entries with security settings for calls from a predefined domain are described. The page table entries can be used to map virtual memory addresses to physical memory addresses. In response to an execution of a call to a routine identified using the virtual memory addresses, a security setting corresponding to an execution domain from which the call originated can be extracted from the page table entry to determine whether security measures are to be used. For example, a shadow stack structure can be used to protect private stack contents of the routine from being accessed by a caller and / or to protect private stack contents of the caller from being accessed by a callee.

Description

[0001] Related applications

[0002] This application claims the benefit of the following filing dates: U.S. Patent Application 16 / 520,296, filed July 23, 2019, entitled "Security Configurations in Page Table Entries for Execution Domains"; and Provisional U.S. Patent Application 62 / 724,913, filed August 30, 2018, entitled "Security Configurations in Page Table Entries for Execution Domains," the entire disclosure of which is hereby incorporated by reference. Technical Field

[0003] At least some of the embodiments disclosed herein relate generally to computer architecture, and more precisely, but not limited to, security controls implemented by configurations specified in page table entries of an execution domain. Background Technology

[0004] Instructions programmed for a computer can be structured in a layered manner. One layer can provide resources and services to another. For example, a super manager can create or provide virtual machines implemented on computer hardware components. An operating system can provide resources and services using resources available in a computer with a predefined architecture. The computer resources or computer operated by the operating system can be actual computer hardware components or virtual machine components provided by a super manager. Applications can use the services and resources provided by the operating system to provide application-specific functionality. Attached Figure Description

[0005] The embodiments are shown in the accompanying drawings by way of example and not limitation, and similar reference numerals indicate similar elements in the drawings.

[0006] Figure 1 A system for controlling sandboxing is shown according to some embodiments.

[0007] Figure 2 Show Figure 1 The shadow stack structure used for sandboxing in the system.

[0008] Figure 3 Shows page table entries with sandboxed configuration for the execution domain.

[0009] Figure 4 A computer system with page tables configured for secure operation is shown.

[0010] Figure 5 This demonstrates a method for controlling shadow stack operations by specifying settings in page table entries of the execution domain. Detailed Implementation

[0011] This disclosure includes techniques for selectively applying security measures to protect the contents of the called routine and the calling routine from mutual interference, based on non-hierarchical execution domains of calls from the calling routine to the called routine and on settings specified in page table entries. For example, when routine A calls routine B, security measures can be selectively deployed to protect the data and code of routine A from routine B, and / or to protect the data and code of routine B from routine A. For example, routine B may be a stock routine performing numerical calculations. When routine B is part of the address space of routine A, it may potentially access the data of routine A. To prevent routine B from acting as a Trojan routine, sandboxing can be performed to restrict the data that routine B can access in the address space of routine A, even if routine A and routine B use the same logical-to-physical translation table.

[0012] In traditional systems, different levels of privilege and / or trust can be granted to different layers of instruction (e.g., user applications versus the operating system). Typically, protection rings are built and implemented in a computer to protect data and functionality from ring-hierarchical failures and malicious activity. Rings are statically arranged in a hierarchy from highest privilege (and therefore most trusted) to lowest privilege (and therefore least trusted). For example, a hierarchy might contain an operating system kernel ring with the highest privilege, a device driver ring, and an application ring with the lowest privilege. Programs or routines in lower-privileged rings can be restricted to accessing resources and services of higher-privileged rings in the hierarchy by appropriate dedicated hardware gates. Gated access between rings can improve security.

[0013] In the techniques disclosed herein, instructions or routines programmed for a computer system can be categorized into a set of predefined, non-hierarchical domains, such as the domain of the super administrator, the domain of the operating system, the domain of applications, etc. A routine can call another routine stored in memory identified by a virtual memory address. The virtual memory address is translated into a physical memory address using one or more page tables. The physical memory region storing the called routine can be explicitly configured via page table entries to conditionally activate security measures (e.g., shadow stack) to protect its contents (e.g., private data pushed onto the call stack) from access by the called routine and / or to protect the contents of the calling routine from access by the called routine. Security measures can be selectively deployed based on the execution domain of the calling routine and the corresponding settings in the page table entries, without relying on a static domain hierarchy. Routines in different domains and / or stored in different memory regions can have different security measures for sandboxed calls from different domains. Therefore, sandboxing is not limited to a specific domain.

[0014] Figure 1 A system for controlling sandboxing is illustrated according to some embodiments. Sandboxing generally includes computer measures that isolate the execution of a set of instructions (e.g., an application) from certain system resources and / or other instructions / sets of programs.

[0015] Figure 1 The system includes physical memory 109 that can be used to store data and instructions programmed for various routines used in the computer system.

[0016] Generally, a routine may contain a pre-programmed instruction set stored in memory 109. The routine may also have input data, output data, and / or temporary data stored in memory 109. A routine may activate or call another routine (e.g., 119) for services and / or resources. The calling routine and the called routine may reside in the same or different domains (e.g., 101, 103, ..., 105). Different memory regions 121, 123, ..., 125 in memory 109 may be configured with different sandboxing configurations (e.g., 107) to control the selective deployment of security measures for sandboxing; and each sandboxing configuration 107 of memory region 123 may contain different settings 111, 113, ..., 115 for the activation of the corresponding domain 101, 103, ..., 105 to call the called routine (e.g., 119) stored in memory region 123. For example, a sandbox configuration (e.g., 107) can be specified in the page table entries used for logical-to-physical address translation of virtual memory addresses, such that the structure of memory regions 121, 123, ..., 125 corresponds to the memory page structure, as described below. Figure 3 Further discussion.

[0017] exist Figure 1In this context, the physical memory 109 is divided into multiple memory regions 121, 123, ..., 125. For example, each memory region (e.g., 123) may be a page of the physical memory 109 used for memory management or a set of pages of the physical memory 109.

[0018] A typical memory region Y (e.g., 123) may have a corresponding sandboxing configuration set 107 specified for the predefined set of domains 101, 103, ..., 105. For example, routines of the super manager 102 may be categorized in domain A 101; routines of the operating system 104 may be categorized in another domain B 103; and routines of the application 106 may be categorized in another domain C 105. A super manager or virtual machine monitor (VMM) creates and manages virtual machines. The super manager controls basic functions such as physical memory and input / output (I / O). The sandboxing configuration 107 explicitly identifies whether a call to execute a routine (e.g., 119) stored in memory region 123 requires sandboxing, for example, when a routine executed in domain 101, 103, ..., 105 calls routine 119 stored in memory region 123. Calls to execute the same routine 119 from routines executed in different domains 101, 103, ..., 105 can have different settings 111, 113, ..., 115; and settings 111, 113, ..., 115 specify whether calls from the corresponding domains 101, 103, ..., 105 need to be sandboxed (e.g., to protect the called routine 119 and the calling routine from affecting each other). Therefore, based on the explicit settings (e.g., 111, 113, ..., 115) configured for calls from the corresponding domains 101, 103, ..., 105, sandboxing can be selectively applied to the execution of the called routine 119 stored in memory area 123, regardless of the predefined hierarchy of domains 101, 103, ..., 105.

[0019] For example, routine 119 in domain 103 can be programmed for operating system 104 and configured to be stored in memory area Y 123. When another routine in domain 101 of supermanager 102 calls routine 119 stored in memory area 123, the sandboxing settings 111 specified for memory area 123 for calls from domain 101 are checked. Whether sandboxing operations for calls to routine 119 stored in memory area 123 are activated can be determined based on the sandboxing settings 111 specified for domain 101 and memory area 123. Therefore, sandboxing operations can be activated independently of the relative hierarchy between the called domain 103 and the calling domain 101 of routine 119.

[0020] Similarly, consider routine 119 programmed for operating system 104 and stored in memory area Y 123 in domain 103. When another routine in domain 105 of application 106 calls routine 119 stored in memory area 123 for execution, the sandboxing settings 115 specified for domain 105 that calls memory area 123 are checked. Whether to deploy a sandboxing operation for executing routine 119 stored in memory area 123 in response to a call from application 106 in domain 103 can be determined based on the sandboxing settings 115 specified for domain 105 and memory area 123. Therefore, sandboxing operations can be activated independently of the relative hierarchy between the calling and called domains (e.g., 105 and 103).

[0021] Generally, different routines of the same domain (e.g., 103) can be stored in different memory areas (e.g., 121, 123, ..., 125) and are therefore configured to have different sandboxing requirements for calls from the same domain (e.g., 101, 103, or 105).

[0022] Generally, a memory area (e.g., 123) can store multiple routines (e.g., 119) that share the same sandboxing configuration 107.

[0023] because Figure 1 The sandbox configuration does not rely on a predefined hierarchy of trusted domains (i.e., it is non-hierarchical), so it can provide better flexibility and finer control than a conventional statically bound hierarchical protection ring.

[0024] Figure 2 Show Figure 1 The shadow stack structure used for sandboxing in the system.

[0025] exist Figure 2 In this context, the calling routine (caller) and the called routine (callee) can be configured to use separate call stacks 131 and 132 for sandboxing.

[0026] For example, the caller is configured to use call stack A 131 and a set of control registers 133, such as stack pointer 231, frame pointer 233, and variable parameter pointer 235. Generally, the caller itself can be called by another routine. Therefore, when the caller returns, frame pointer 233 identifies the location of the caller's return address 257. Variable parameter pointer 235 identifies the location of the variable parameters / arguments used by the other routine to activate the caller.

[0027] Generally, the caller can push its private contents onto stack A 131 during execution and pop them off stack A 131 during execution. For example, caller contents 255 can be pushed onto stack A 131 before the call to execute the callee; and caller contents 255 can be popped off stack A 131 after the callee's execution returns. Stack pointer 231 identifies the top of stack A 131 used by the caller.

[0028] Before the callee is loaded for execution, the caller may push the call parameter 253 of the callee; and the return address 251 may also be pushed onto stack A131.

[0029] When sandboxing is performed to protect the caller's contents from the callee's contents and / or to protect the callee's contents from the caller's contents, a portion of the contents of stack A 131 is copied to a separate stack B 132, containing return address 251 and call parameters 253. The separate stack B 132 can be considered a shadow of stack A 131. The shadow stack B 132 can be used to execute the callee.

[0030] Preferably, a separate set of 134 control registers is used in the operation of stack B 132. For example, a separate stack pointer 241, a separate frame pointer 243, and a separate variable parameter point 245 may be used when executing the callee using stack B 132.

[0031] During the execution of the callee, the callee's instructions may push its private content 261 onto stack B 132 and pop items from stack B 132 as needed. The callee is limited to using stack B 132 and cannot access the caller's separate stack A 131. Therefore, the callee may not have physical access to the caller's private content.

[0032] Similarly, the caller may be limited to using stack A 131 and cannot access the callee's separate stack B 132 (e.g., via an allocation slot on the stack without first pushing data onto the stack). Therefore, the caller cannot physically access the callee's private content.

[0033] Once the callee returns (e.g., using return address 251 identified by a separate frame pointer 243), the caller can continue its operation using stack A 131 and its associated set of 133 control registers.

[0034] Optionally, the contents of stack B132 may be erased after the callee returns and / or when stack B132 is used during the initiation of the call.

[0035] When using Figure 2When a shadow stack structure is used, the data security of the callee is improved; and the caller cannot access the stack data of the callee.

[0036] Optionally, stack B 132 does not contain data about the caller (and its caller). For example, when stack B 132 is configured for the operation of the callee, return address 251 and call parameters 253 can be copied from stack A 131 to stack B 132; and other data under call parameters 253 (including caller content 255) is not copied from stack A 131 to stack B 132. Therefore, the callee cannot physically access the caller's private content and / or other call stack data.

[0037] Whether the callee stored in memory area 123 needs to use a separate stack B132 can be configured using sandboxing configuration 107. Sandboxing configuration 107 can have different settings 111, 113, ..., 115 for callers from different domains 101, 103, ..., 105.

[0038] Sandbox configuration 107 can be stored as a portion of page table entries in memory area 123, such as Figure 3 As shown in the image.

[0039] Figure 3 Page table entries 153 with sandboxed configuration 107 are shown for execution domains (e.g., 101, 103, ..., 105).

[0040] A typical virtual address 141 in virtual address space 127 can be translated into a corresponding physical address 159 in physical address space 129 using page table 151. Generally, multiple page tables (e.g., 151) can be used to map virtual address space 127 to physical address space 129.

[0041] Virtual address 141 may contain table ID 143, entry ID 145, and offset 147. Table ID 143 can be used to identify page table 151 containing page table entry 153 for pages containing memory cells identified by virtual address 141 and physical address 159. Entry ID 145 is used as an index of page table 151 to efficiently locate page table entry 153. Page table entry 153 provides the base address 157 of physical address 159. Physical addresses in the same memory page share the same base address 157. Therefore, base address 157 identifies memory region 123 in memory 109. Offset 147 of virtual address 141 is used as the corresponding offset 147 of page or memory region 123 in memory 109. The combination of base address 157 and offset 147 provides the physical address 159 corresponding to virtual address 141.

[0042] exist Figure 3In the page table entry 153, not only is the base address 157 of the page or region 123 specified, but also the sandboxing configuration 107 of the page or memory region 123 is specified, including... Figure 1 The corresponding fields 101, 103, ..., 105 are set to 111, 113, ..., 115.

[0043] For example, sandbox configuration 107 may include a set of bits 111, 113, ..., 115 for the set of fields 101, 103, ..., 105 respectively. When a sandbox setting bit (e.g., 111, 113, ..., or 115) is set to have a first value (e.g., 1 or 0), a call to a routine stored in memory area 123 from the corresponding field (e.g., 101, 103, ..., 105) is required. Figure 2 The shadow stack structure protects the callee's content from being accessed by the caller and / or protects the caller's content 255 from being accessed by the callee. When the sandbox setting bit (e.g., 111, 113, ..., 115) is set to have a second value (e.g., 0 or 1), calls to routines stored in memory area 123 from the corresponding field (e.g., 101, 103, ..., 105) do not use the sandbox setting bit. Figure 2 The shadow stack structure protects the caller and the callee from affecting each other; and the caller and the callee can share the same set of controller registers 133 and the same stack 131.

[0044] Optionally, page table entry 153 may specify other attributes 155 of the physical memory page, such as whether the data in the page is valid, whether the page is in main memory, or whether the page is invalid (e.g., changes to the data in the physical memory page have not yet been flushed to long-term memory / storage device relative to memory area 123).

[0045] Furthermore, page table entry 153 may optionally include permission settings for accessing memory area 123 for various operations (e.g., read, write, execute, etc.) in domains 101, 103, ..., 105. For example, for each domain 101, 103, ..., or 105, permission bits in page table entry 153 may specify whether a routine running in domain 101, 103, ..., or 105 can access memory area 123 defined by base address 157 for a specific type of operation, such as read, write, or execute. For example, attribute 155 may include a page fault bit indicating whether the page is in the computer's main memory or in the computer's storage device. If the permission settings allow current access to the memory page and the page fault bit indicates that the page is not currently in the computer's main memory, then memory management unit 181 may swap the page from storage device to the computer's main memory to facilitate access to the page identified by page table entry 153. However, if the permission settings deny current access to the page for the currently executing domain, then it is not necessary to evaluate the page fault bit and / or swap in the page corresponding to page table entry 153.

[0046] Generally, table ID 143 can be divided into multiple fields used to locate page table 151. For example, table ID 143 may contain a top table ID that identifies the top-level page table and a top table entry ID that serves as an index for the top-level page table to retrieve page table entries containing the identifier of page table 151 (similar to how entry ID 145 indexes page table 151 to identify page table entry 153 containing base address 157).

[0047] Generally, entry ID 145 can be regarded as a virtual page number in page table 151; and the virtual page number (e.g., 145) can be used in page table 151 to find page table entry 153 containing base address 157.

[0048] For example, table ID 143 may contain a set of virtual page numbers that can be used to identify a series of page tables (e.g., 151). Each virtual page number is used as an index in the page table (or page directory) to identify a page table entry (or page directory entry) containing the identifier or base address of the next level page table (or page directory).

[0049] In some instances, different running processes in a computer may have different virtual address spaces (e.g., 127); and the process ID of a running process can be used to determine the top-level page table (or page directory). In some instances, a hash of a portion of virtual address 141, the process ID, and / or the identifier of a virtual machine hosted on the computer system can be used to locate the top-level page table (or page directory). In some instances, the hash is used as an index or key to look up page table entries. Regardless of how page table entry 153 is located (e.g., via indexing through multiple page tables, via the use of a hash as an index or key), the contents of page table entry 153 can be... Figure 3The manner shown is configured to provide a sandboxed configuration 107 for selectively deploying security measures for different domains 101, 103, ..., 105 to invoke routines stored in the page / memory area 123 corresponding to base address 157.

[0050] exist Figure 3 In this context, the sandboxing configuration 107 of page or memory region Y 123 is specified in the underlying page table 151, where page table entry 153 in the underlying page table 151 provides the base address 157 of physical address 159.

[0051] Alternatively or in combination, higher-level page tables (or page directories) may also have sandboxed configurations for their page table entries (or page directory entries). For example, a page table entry (or page directory entry) identifying page table 151 may have a sandboxed configuration for all pages in page table 151; and thus, domain permission data in the page table entry may be applied to the memory area defined by page table 151. The sandboxed configuration hierarchy specified in a series of page table entries leading to page table 151 and the sandboxed configuration 107 in the lower-level page table entry 153 may be combined via logical AND or logical OR operations.

[0052] For example, if all sandboxing configurations in a series of page table entries leading to base address 157 (including underlying table entry 153) have values ​​that require sandboxing, then a call from a routine running in the domain (e.g., 101, 103, ..., 105) to the called routine 119 may require sandboxing (e.g., using...). Figure 2 (The shadow stack structure). Alternatively, sandboxing may be required if any sandboxed configuration in a series of page table entries (including the underlying table entry 153) leading to base address 157 has a value that requires sandboxing. Alternatively, sandboxing is not performed if any sandboxed configuration in a series of page table entries (including the underlying table entry 153) leading to base address 157 does not have a value that requires sandboxing. Alternatively, sandboxing is not performed if any sandboxed configuration in a series of page table entries (including the underlying table entry 153) leading to base address 157 has a value that does not require sandboxing.

[0053] Optionally, the sandboxing configuration (e.g., 107) is specified in the lower-level page table 151, but not in the higher-level page table (directory).

[0054] Figure 4 A computer system is shown with a page table (e.g., 151) configured for secure operation.

[0055] Figure 4 The computer system has a host system 165 coupled to a memory system 161 via one or more buses 163. The memory system 161 has memory components 171, ..., 173.

[0056] For example, bus 163 may include a memory bus connected to one or more memory modules and / or include a peripheral Internet connected to one or more storage devices. Some of the memory components 171, ..., 173 provide random access; and some of the memory components 171, ..., 173 provide persistent storage capability. Some of the memory components 171, ..., 173 may be volatile because the data stored in the memory component will be corrupted and / or erased when the power supply to the memory component is temporarily disconnected. Some of the memory components 171, ..., 173 may be non-volatile because the memory component is able to retain its stored contents for a long period of time without power.

[0057] Generally, memory system 161 can also be referred to as a memory device. An example of a memory device is a memory module connected to a central processing unit (CPU) via a memory bus. Examples of memory modules include dual in-line memory modules (DIMMs), small outline DIMMs (SO-DIMMs), non-volatile dual in-line memory modules (NVDIMMs), etc. Another example of a memory device is a storage device connected to the central processing unit (CPU) via peripheral interconnects (e.g., input / output buses, memory area networks). Examples of storage devices include solid-state drives (SSDs), flash drives, universal serial bus (USB) flash drives, and hard disk drives (HDDs). In some instances, the memory device is a hybrid memory / storage system that provides both memory and storage functions.

[0058] Memory components 171, ..., 173 may comprise different types of non-volatile memory components and / or any combination of volatile memory components. Examples of non-volatile memory components include NAND flash memory having one or more arrays of memory cells (e.g., single-level cell (SLC) or multi-level cell (MLC) (e.g., three-level cell (TLC) or four-level cell (QLC)). In some instances, a particular memory component may comprise both SLC and MLC portions of memory cells. Each memory cell may store one or more data bits (e.g., data blocks) for use by the host system 165. Alternatively or in combination, memory components 171, ..., or 173 may comprise a class of volatile memory. In some instances, memory components 171, ..., or 173 may include, but are not limited to, random access memory (RAM), read-only memory (ROM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), phase-change memory (PCM), magnetic random access memory (MRAM), spin-transfer torque (STT)-MRAM, ferroelectric random access memory (FeTRAM), ferroelectric RAM (FeRAM), bridged-conducting RAM (CBRAM), resistive random access memory (RRAM), oxide-based RRAM (OxRAM), NOR flash memory, electrically erasable programmable read-only memory (EEPROM), nanowire-based non-volatile memory, memory with memristor technology, and / or cross-point arrays of non-volatile memory cells. The cross-point array of non-volatile memory may be combined with a stackable cross-grid data access array to perform bit storage based on changes in bulk resistance. In addition, compared to many flash-based memories, cross-point non-volatile memories can perform in-situ write operations, where non-volatile memory cells can be programmed without previously erasing non-volatile memory cells.

[0059] Generally, host system 165 may utilize memory system 161 as physical memory 109 containing one or more memory components 171, ..., 173. Host system 165 may load instructions from memory system 161 for execution, provide data to be stored in memory system 161, and request data to be retrieved from memory system 161.

[0060] exist Figure 4 In this system, host system 165 includes a memory management unit (MMU) 181 and a processor 169. Processor 169 has an execution unit (e.g., 185), such as an arithmetic logic unit. Processor 169 has registers 183 to store instructions for execution, data as operands of the instructions, and / or the results of instruction execution. Processor 169 may have an internal cache 187 as a proxy for the memory system 161.

[0061] In some instances, host system 165 may contain multiple processors (e.g., 169) with multiple processing cores integrated as a central processing unit (CPU) on the same silicon die.

[0062] Routines programmed for execution in processor 169 may initially be stored in memory system 161. These routines may contain instructions for super manager 102, operating system 104, and application program 106. Routines initially stored in memory system 161 may be loaded into internal cache 187 and / or register 183 for execution in execution unit 185.

[0063] The execution of the routine forms the execution 167 of the super manager 102, the operating system 104, and the application 106. In some instances, the super manager 102 is not used; and the operating system 104 controls hardware components (e.g., memory system 161, peripheral input / output devices, and / or network interface cards) without the super manager.

[0064] The execution 167 of the super manager 102, operating system 104, and / or application 106 accesses memory region 123 (e.g., in memory components 171, ..., 173) using virtual addresses (e.g., 141) defined in one or more virtual memory spaces (e.g., 127). At least one page table 151 (e.g., such as...) is used. Figure 3 The virtual address (e.g., 141) used in execution will be translated into the physical memory address (e.g., 159) of the memory component (e.g., 171, ..., 173).

[0065] like Figure 1 As shown, the execution of routines in the super manager 102, operating system 104, and application 106 can be organized into multiple domains 101, 103, ..., 105. For each of the execution domains 101, 103, ..., 105 and the memory area 123 identified by page table entry 153, page table entry 153 identifies a sandboxed configuration 107 with sandbox settings (e.g., 131, 133, ..., 135) to invoke routine 119 stored in memory area 123.

[0066] When the sandbox setting (e.g., 111, 113, ..., or 115) in page table entry 153 has a predefined value (e.g., 1) for the caller's corresponding execution domain (e.g., 101, 103, ..., or 105), the host system 165 may have Figure 2 A shadow stack structure is used to protect the callee contents 261 of the called routine 119 loaded from memory area 123.

[0067] Figure 5 This illustrates a method for controlling shadow stack operations by specifying settings (e.g., 111, 113, ..., 115) in page table entries (e.g., 153) of execution domains 101, 103, ..., 105.

[0068] For example, Figure 5 The method can be found in Figure 4 Used in computer systems Figure 3 Page table 151 is executed so that it can be used for... Figure 1 The invocation of routines in the corresponding execution domains 101, 103, ..., 105 shown is provided. Figure 2 The sandbox settings are 111, 113, ..., 115.

[0069] At box 201, the computer system (e.g., in...) Figure 4 (As shown in the diagram) During the execution of the first routine, a request to call the second routine at virtual address 141 is received.

[0070] For example, the first routine could be part of the super manager 102, the operating system 104, or the application 106. Therefore, the execution of the first routine can be categorized as... Figure 1 In one of the set of predetermined fields 101, 103, ..., 105 shown.

[0071] At box 203, the memory management unit (MMU) 181 (or the computer system's processor 169) determines page table entry 153 when the virtual address 141 is translated into a physical memory address 159, such as Figure 3 As shown in the image.

[0072] At box 205, the memory management unit (MMU) 181 (or the processor 169 of the computer system) identifies an execution domain (e.g., 101) containing the execution of the first routine among a plurality of predefined domains 101, 103, ..., 105.

[0073] For example, the memory address of the instructions used to load the routine may include an object identifier that determines the domain (e.g., 101, 103, ..., 105) when the routine is loaded for execution in processor 169. In other instances, the object identifier is a portion of the virtual address space and does not specify a domain. In some embodiments, page table entry 153 contains information identifying the domain of a routine stored in memory region 123 identified by page table entry 153.

[0074] For example, when a routine is being executed in processor 169, processor register 183 may store the identifier of the routine's field.

[0075] At box 207, the memory management unit (MMU) 181 (or the processor 169 of the computer system) retrieves the security settings (e.g., 111, 113, ..., or 115) specified for the execution domain (e.g., 101, 103, ..., or 105) in page table entry 153.

[0076] For example, the settings 111, 113, ..., 115 of the sandbox configuration 107 can be stored in a predetermined location in page table entry 153.

[0077] At box 209, the computer system (e.g., in...) Figure 4 (As shown in the figure) In response to a security setting (e.g., 111, 113, ... or 115) having a predetermined value (e.g., 1), a second routine is run using a stack B 132 that is separated from the first stack 131 used by the first routine (e.g., in domains 101, 103, ... or 105).

[0078] If the security setting (e.g., 111, 113, ... or 115) does not have a predetermined value (e.g., 1), then the computer system (e.g., in...) will not have a default value. Figure 4 (As shown in the diagram) the second routine is run using the same stack 131 used by the first routine.

[0079] At box 211, the computer system (e.g., in...) Figure 4 The hardware (shown in the diagram) prevents the first routine (e.g., in domains 101, 103, ..., or 105) from accessing stack B 132.

[0080] For example, the sandbox setting bits 111, 113, ..., 115 of the corresponding domains 101, 103, ..., 105 can be stored in predetermined locations within page table entry 153. Therefore, based on the execution domain of the instruction, the memory management unit (MMU) 181 (or the processor 169 of the computer system) can extract the sandbox setting bits (e.g., 111, 113, ..., or 115) and determine whether to activate sandboxing operation for a call to the called routine 119 based on the extracted sandbox setting bits.

[0081] The techniques disclosed herein are applicable at least to computer systems in which the processor and memory are separated and the processor communicates with the memory and storage devices via a communication bus and / or computer network. Furthermore, the techniques disclosed herein are applicable to computer systems in which processing power is integrated within the memory / storage device. For example, processing circuitry including execution units and / or registers of a typical processor can be implemented within an integrated circuit and / or integrated circuit package of memory media to perform processing within the memory device. Therefore, the processor (e.g., 169) as discussed above and shown in the figures is not necessarily a central processing unit in a von Neumann architecture. The processor can be a unit integrated within memory to overcome the von Neumann bottleneck, which limits computational performance due to throughput limitations caused by latency in data movement between a central processing unit and memory configured separately according to the von Neumann architecture.

[0082] The description and accompanying drawings in this disclosure are illustrative and should not be construed as limiting. Numerous specific details are described to provide a thorough understanding. However, in some instances, well-known or conventional details are omitted to avoid obscuring the description. References to one or more embodiments of this disclosure are not necessarily references to the same embodiment; and such references imply at least one.

[0083] In the foregoing description, this disclosure has been described with reference to specific exemplary embodiments thereof. It will be apparent that various modifications may be made thereto without departing from the broader spirit and scope set forth in the appended claims. Therefore, the description and drawings should be considered illustrative rather than restrictive.

Claims

1. A computer system comprising: A memory configured to store instructions for routines of at least one set of predefined domains; A processor coupled to the memory; A memory management unit coupled between the processor and the memory, wherein the memory management unit is configured to manage a page table containing page table entries, the page table entries containing security settings for each of the set of predefined domains; as well as A shadow cache structure, which has a first call stack and a second call stack; The memory management unit is configured to map the virtual memory address to a physical memory address using the page table entry during a call from the first routine to the second routine at the virtual memory address. The memory management unit is further configured to extract a first security setting from the page table entry based on the first domain in which the first routine resides; The computer system is configured to selectively perform the security operation of the call based at least in part on the value of the first security setting retrieved from the page table entry; as well as In response to the call, the second routine is configured to use the second call stack based on the value of the first security setting being equal to a predetermined value requiring sandboxing.

2. The computer system of claim 1, wherein the page table entry contains the base address of the physical address page.

3. The computer system of claim 2, wherein the memory management unit is configured to combine the base address and an offset specified in the virtual memory address to generate the physical address.

4. The computer system of claim 3, wherein the set of predefined domains includes at least one of the super manager domain, the operating system domain, or the application domain, or any combination thereof.

5. The computer system of claim 3, wherein the first routine is configured to use the first call stack and has no access to the second call stack.

6. The computer system of claim 5, wherein in response to the call, the second routine is configured to use the first call stack based on the fact that the value of the first security setting is not equal to a predetermined value requiring the sandboxing operation.

7. The computer system according to claim 5, further comprising: The first set of control registers is configured to operate the first call stack; as well as The second set of control registers is configured to operate the second call stack.

8. The computer system of claim 7, wherein each of the first set of control registers and the second set of control registers comprises: Stack pointer; Frame pointer; and Pointer to variable parameters.

9. The computer system of claim 8, wherein in response to the call for executing the second routine, at least a portion of the contents of the first call stack is copied into the second call stack.

10. The computer system of claim 3, wherein the virtual memory address comprises a plurality of virtual page numbers, including a last virtual page number; and the memory management unit is configured to use the last virtual page number to index the page table to locate the page table entries.

11. The computer system of claim 10, wherein the page table is the last page table; and the memory management unit is further configured to index the first page table using a first virtual page number among the plurality of virtual page numbers to retrieve a first page table entry identifying the last page table.

12. A method for implementing security controls, comprising: During the execution of the first routine, a request to call the second routine at the virtual memory address is received; Page table entries are determined when the virtual memory address is translated into a physical memory address; The execution domain containing the first routine is identified among multiple predefined domains; Retrieve the security settings specified for the execution domain from the page table entries; Based at least in part on the security settings, the second routine is executed using a shadow cache structure having a first stack and a second stack, wherein the second stack is separated from the first stack used by the first routine; as well as Prevent the first routine from accessing the second stack.

13. The method of claim 12, further comprising: Extract the base address from the page table entry; Extract the offset from the virtual memory address; as well as The base address and offset are combined to generate the physical memory address.

14. The method of claim 13, wherein the plurality of predefined domains includes domains of the super manager.

15. The method of claim 13, wherein the plurality of predefined domains includes domains of an operating system.

16. The method of claim 13, further comprising: In response to the call and before executing the second routine using the second stack, at least a portion of the first stack is copied into the second stack.

17. The method of claim 16, further comprising: The second stack is erased after the second routine returns.

18. A computing device comprising: At least one register; At least one execution unit; The memory management unit has page table entries containing multiple security settings corresponding to multiple predefined domains; as well as A shadow cache structure, which has a first stack and a second stack; The second routine is invoked in response to a first routine executing in the computing device using a virtual memory address. The memory management unit is configured to generate physical memory addresses using the page table entries; and The computing device is configured to determine whether to perform a security operation based on a first security setting among the plurality of security settings; Wherein, at least in part, based on the first security setting having a predetermined value that requires sandboxing operation, the first stack is configured to execute the first routine and the second stack cannot be accessed by the first routine.

19. The computing device of claim 18, wherein the second stack is configured to execute the second routine in response to the first routine calling the second routine using the virtual memory address, at least in part based on the security operation.

20. The computing device of claim 19, wherein the predefined domain includes at least one or any combination of a super manager domain, an operating system domain, or an application domain.

Images