Capability-Based Memory Access Checks for Dynamic Range Bounds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing capability-based memory access mechanisms do not account for dynamic changes in memory allocation, leading to potential erroneous accesses when memory regions vary due to processing activities.
Innovation Solution
Implement capability checking circuitry that performs range checks based on both static range constraining information and dynamically varying state information of the processing apparatus, using a determined condition to dynamically adjust memory access constraints.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If capability-based memory access control is implemented with statically defined bounds, then security control and memory access limitation are improved, but adaptability to dynamic memory regions deteriorates
Solution Approach 1:
The patent applies dynamics by making the capability bounds dynamic rather than static. The capability checking circuitry now considers both the originally defined bounds and current values of state variables (such as stack pointers) to determine whether memory accesses are permitted. This allows the system to adapt to changing memory regions while maintaining security control, resolving the contradiction between static security and dynamic adaptability.
2Ease of manufacture
If capability bounds are statically defined, then implementation simplicity is improved, but ability to handle dynamic memory allocation deteriorates
Solution Approach 1:
The patent introduces dynamic checking that combines static capability bounds with dynamic state variables. The capability checking circuitry performs range checks using both the originally defined bounds and current state variable values, enabling the system to handle dynamic memory allocation while building upon the existing static capability structure. This maintains implementation simplicity while adding dynamic adaptability.
3Speed
If only range constraining information is used for capability checks, then check operation speed is improved, but accuracy in dynamic environments deteriorates
Solution Approach 1:
The patent enhances the capability checking operation by incorporating dynamic state variables into the range check process. The capability checking circuitry now uses both the static range constraining information and current state variable values to determine access permission. This dynamic approach maintains checking speed while significantly improving accuracy in dynamic environments where memory regions change during execution.
Data Source
AI summary
There is provided an apparatus, method and computer program for constraining memory accesses. The apparatus comprises processing circuitry to perform operations during which access requests to memory are generated. The processing circuitry is arranged to generate memory addresses for the access requests using capabilities that identify constraining information. The apparatus further comprises capability checking circuitry to perform a capability check operation to determine whether a given access request whose memory address is generated using a given capability is permitted based on given constraining information identified by the given capability. The capability check operation includes performing a range check based on range constraining information provided by the given constraining information, and when a determined condition is met, to perform the range check in dependence on both the range constraining information and an item of state information of the apparatus which varies dynamically during performance of the operations of the processing circuitry.


