Memory Protection Unit for Shared Memory Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In coherent data processing networks, shared memory contents are vulnerable to unauthorized access, which can lead to memory corruption, and existing permission-based filtering is insufficient to address these issues in coherent systems.
Innovation Solution
The implementation of a memory protection unit (MPU) that provides read/write permissions per master per memory region, integrated into the data processing network, intercepts and filters access requests based on predefined permissions, ensuring that only authorized actions are performed on shared memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If permission-based filtering is implemented in coherent data processing networks, then memory integrity is improved, but device complexity increases due to the need for additional filtering units and permission management mechanisms
Solution Approach 1:
A filtering unit is introduced as an intermediary component between master devices and the shared memory system. This filtering unit intercepts access requests, checks permission bits associated with each master device for the target memory address, and selectively permits or blocks access. By placing this intermediary layer, the patent protects memory integrity without requiring modification of the core memory architecture or master devices, thus limiting the increase in overall system complexity.
Solution Approach 2:
The permission management system is segmented into discrete permission bits associated with each master device for specific memory addresses. Each master device has its own permission configuration that can be independently managed. This segmentation allows fine-grained control over access permissions while keeping the filtering logic modular and manageable, reducing the complexity burden of implementing comprehensive permission checking.
2Reliability
If access requests are intercepted and filtered based on permission bits, then unauthorized access is prevented, but access speed decreases due to the additional filtering step
Solution Approach 1:
Permission bits for each master device are pre-configured and stored in association with memory addresses before access requests occur. The filtering unit performs preliminary setup of access control policies, so that during actual memory access operations, the system only needs to perform a simple permission bit check rather than complex authorization evaluation. This preliminary configuration reduces the time penalty of permission checking during runtime.
Solution Approach 2:
The permission checking mechanism uses simplified permission bit representations rather than full access control lists or complex authorization data structures. By copying and storing only the essential permission information (permission bits) at the filtering unit, the system achieves fast permission verification without the overhead of managing detailed access control policies during each memory access operation.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
A system,apparatus and method for protecting coherent memory contents in a coherent data processing network by filtering data access requests and snoop response based on the Read/Write (R/W) access permissions. Requests are augmented with access permissions in memory protection units and the access permissions are used to control memory access by home nodes of the network.