Processor Access Permission Control via Register Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current memory access permission mechanisms in computing systems lack control over kernel read access, are inefficient in reducing kernel access restrictions, and require inefficient updates to page tables, leading to limited control and high latency.
Innovation Solution
The implementation of a permission management register (PMR) and a privileged code protection register (PCPR) to manage access permissions, allowing for additional restrictions on read, write, and execute permissions, and enforcing hardware-based protection of kernel code by locking the PCPR after programming, preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access permissions are updated by writing to page tables, then permission control is achieved, but throughput decreases and latency increases
Solution Approach 1:
The permission control mechanism is segmented into two independent parts: page table structures for baseline permissions and a new permission management register (PMR) for additional restrictions. This segmentation allows permission updates to occur in the PMR without requiring page table writes, thereby improving throughput and reducing latency while maintaining reliable permission control.
Solution Approach 2:
The permission management register (PMR) acts as an intermediary between the page table structures and the actual memory access control. The PMR receives permission information from page tables and applies additional restrictions through a separate register structure, eliminating the need to write to page tables for every permission update and thus improving system performance.
2Reliability
If kernel read access is restricted through page tables, then security is improved, but control flexibility is reduced
Solution Approach 1:
Kernel read access control is segmented between page table entries (which provide baseline permissions) and the permission management register (PMR) (which provides additional kernel-specific restrictions). This segmentation enables fine-grained control over kernel read access while maintaining the flexibility to apply different permission sets for different kernel components through register configuration.
Solution Approach 2:
The permission management register allows different permission attributes (read, write, execute) to be independently configured for kernel access. This enables local quality control where specific kernel regions can have tailored permission settings rather than uniform restrictions, improving both security and control flexibility.
3Reliability
If permission restrictions are applied to kernel code, then protection is enhanced, but update capability is reduced
Solution Approach 1:
The permission management register serves as an intermediary that simplifies the process of updating permission restrictions for kernel code. Instead of modifying page table entries directly, software can update the PMR which then applies the restrictions, making permission updates easier and more efficient while maintaining enhanced kernel code protection.
Solution Approach 2:
The permission management register enables dynamic updates to kernel code protection restrictions without requiring page table modifications. The PMR can be programmed and reconfigured during system operation, allowing flexible adjustment of protection levels while maintaining the integrity and security of kernel code.
4Adaptability or versatility
If page table writes are used to modify permissions, then permission changes are achieved, but system efficiency decreases
Solution Approach 1:
The permission modification capability is segmented between page tables (for structural permissions) and the permission management register (for operational permissions). This allows permission changes to be made through the PMR without triggering page table writes, thereby maintaining adaptability while significantly improving system efficiency.
Solution Approach 2:
The permission management register acts as an intermediary that handles permission modifications independently of the page table structure. Software updates permissions by writing to the PMR rather than page tables, achieving the same permission modification capability with improved system efficiency due to the simpler update mechanism.
Data Source
AI summary
Systems, apparatuses, and methods for modifying access permissions in a processor. A processor may include one or more permissions registers for managing access permissions. A first permissions register may be utilized to override access permissions embedded in the page table data. A plurality of bits from the page table data may be utilized as an index into the first permissions register for the current privilege level. An attribute field may be retrieved from the first permissions register to determine the access permissions for a given memory request. A second permissions register may also be utilized to set the upper and lower boundary of a region in physical memory where the kernel is allowed to execute. A lock register may prevent any changes from being made to the second permissions register after the second permissions register has been initially programmed.