Fine Granularity Memory Protection via Range-Based Allocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory systems face inefficiencies in providing guard-page protection, especially in non-volatile memory systems, as they need to allocate additional ranges for legacy software support, leading to wastefulness and inefficiency.
Innovation Solution
Implementing a range-based allocation scheme using the mprotect function to change access protections for memory pages, allowing for finer granularity in protecting memory ranges without allocating additional physical memory, and utilizing mechanisms like DAX, tag arrays, and double faulting to generate faults efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional guard-page protection is used in non-volatile memory systems, then memory allocation boundaries are protected, but additional physical memory must be allocated which is wasteful and inefficient
Solution Approach 1:
The patent segments the memory protection mechanism into fine-grained units (e.g., 4KB pages or smaller) that can be independently managed. Instead of allocating entire guard pages, the system divides memory into smaller allocatable units and applies protection selectively to each unit, allowing precise control over memory boundaries without wasting space on full-page guard allocations.
Solution Approach 2:
The patent implements local quality by applying different protection characteristics to different regions of memory. Rather than uniformly protecting entire pages, the system applies protection only to specific boundaries where needed (e.g., between allocated blocks), allowing the majority of memory to remain unprotected and available for use while maintaining security at critical boundaries.
2Productivity
If range-based allocation is implemented, then memory efficiency is improved, but legacy software compatibility is compromised
Solution Approach 1:
The patent introduces an intermediary layer (memory management software or hardware abstraction layer) that sits between legacy software and the range-based allocation mechanism. This intermediary translates legacy software's traditional memory access patterns into range-based operations, allowing legacy applications to function as if using traditional allocation while actually benefiting from efficient range-based management underneath.
Solution Approach 2:
The patent creates a universal memory management system that can handle both traditional page-based allocation and modern range-based allocation through a single interface. The system provides multi-functionality by supporting multiple allocation paradigms simultaneously, allowing legacy software to use traditional interfaces while new software can utilize optimized range-based operations.
3Manufacturing precision
If fine granularity protection is applied, then memory precision is improved, but system complexity increases
Solution Approach 1:
The patent applies partial action by implementing fine-grained protection only where necessary (at memory allocation boundaries) rather than throughout the entire address space. The system uses coarse-grained protection for regions where precision is not critical and reserves fine-grained mechanisms for boundary regions, reducing overall system complexity while maintaining necessary precision.
Solution Approach 2:
The patent adds another dimension to memory management by introducing a hierarchical protection structure with multiple levels of granularity. Instead of a single flat protection mechanism, the system organizes protection in layers (coarse-grained regions containing fine-grained sub-regions), allowing the system to manage complexity through dimensional organization rather than uniform fine-grained control.
Data Source
AI summary
A system, apparatus and method for accessing an electronic storage medium, such as a memory location storing a page table, or range table. A virtual address of the electronic storage medium is identified that corresponds to designated portions, such as a range of addresses of the electronic storage medium. The virtual address is translated to a corresponding physical address and one or more commands are identified as being excluded from execution in the designated portions of the electronic storage medium. This may be accomplished by using a routine such as mprotect( ). A fault indication, or decoration, is provided to meta-data associated with the physical address, which is associated with the designated portions of the electronic storage medium when excluded commands are provided to the physical address. A mechanism, such as hardware, is actuated when the fault is generated.