MMU Address Translation Checks for Thread-Private Memory Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer processor circuits face challenges in isolating and securing thread-private data, as threads may unintentionally or maliciously modify each other's data due to shared virtual address spaces, leading to security vulnerabilities.
Innovation Solution
Implementing thread-private permission indications in conjunction with address range information, using a memory management unit (MMU) to check virtual addresses against a base and limit register-defined range, preventing unauthorized access to thread-private memory regions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If threads share virtual address spaces for efficient memory access, then productivity is improved, but thread-private data security deteriorates as threads may unintentionally or maliciously modify each other's data
Solution Approach 1:
The patent segments the address space by introducing thread-private indicators in translation table entries and maintaining thread-specific base and limit registers. This divides the shared virtual address space into thread-specific accessible ranges, allowing threads to efficiently access their private data while preventing unauthorized access to other threads' data, thus resolving the security issue without sacrificing memory access efficiency
Solution Approach 2:
The patent applies local quality by making translation table entries have different properties based on their thread-private status. Entries with thread-private indicators are treated differently during address translation, with the MMU checking thread-specific base and limit registers to determine accessibility. This localized differentiation ensures that only authorized threads can access specific memory regions while maintaining overall system efficiency
2Reliability
If address translation is enabled for memory protection and virtual address space management, then reliability is improved, but device complexity increases due to the need for translation tables and address translation mechanisms
Solution Approach 1:
The patent merges the thread-private indicator checking with the existing address translation process in the MMU. Rather than adding a separate verification step, the thread-private indicator is checked as part of the normal address translation workflow, utilizing the existing translation table infrastructure and base/limit register mechanisms already present in the system, thus maintaining reliability without significantly increasing complexity
Solution Approach 2:
The patent enhances the universality of the address translation mechanism by making it serve multiple functions: traditional virtual-to-physical address translation, memory protection, and thread-private data isolation. The MMU's address translation process is extended to also verify thread-private indicators and compare addresses against thread-specific base and limit registers, allowing a single mechanism to handle multiple security and management tasks
Data Source
AI summary
Techniques are disclosed relating to access control for threads executed by a computer processor. Processor circuitry may include an execution pipeline, a base register and a limit register. The base register and the limit register may define a range of virtual addresses for a thread executed by the execution pipeline. Control circuitry may access a translation table that stores translation entries that map a virtual address space to a physical address space, wherein a given entry includes a thread-private state indication. for a virtual address provided by the thread at a first permission level, the control circuitry may: determine that the thread-private state indication of a corresponding entry of the translation table is set and in response to the determination, provide a translation of the virtual address only if the virtual address falls within the range of virtual addresses.