Memory domains protection method and apparatus with composite protection key numbers
In embodiments, an apparatus for computing includes a protection key register (PKR) having 2 N bits, where N is an integer, to store a plurality of permission entries corresponding to protected memory domains, and a protected memory domain controller, coupled to the PKR. In embodiments, the memory domain controller is to: obtain protection key (PK) bits from a page table entry for a target page address; obtain one or more additional PK bits from a target linear memory address; and combine the PK bits and the additional PK bits to form a PK domain number to index into the plurality of permission entries in the PKR to obtain a permission entry for a protected memory domain.
1. An apparatus for computing, comprising:
a protection key register (PKR) to store a plurality of permission entries corresponding to a plurality of protected memory domains; and
a protected memory domain controller, coupled to the PKR, to:
obtain protection key (PK) bits from a page table entry of a page table for a target page address in a target linear memory address having the target page address and an offset;
obtain one or more additional bits directly from the target linear memory address; and
combine the PK bits and the additional bits to form a PK domain number to index into the plurality of permission entries in the PKR to obtain one of the plurality of permission entries for a corresponding one of the protected memory domains.
2. The apparatus of claim 1 , wherein each permission entry in the PKR has M bits, M being a multiple of 2, and wherein the PKR includes permission entries for 2 N /M protected memory domains, where N is an integer.
3. The apparatus of claim 2 , wherein 2 N /M=64.
4. The apparatus of claim 1 , wherein the PKR has 128 bits, each permission entry in the PKR has 2 bits, and wherein the PK domain number includes four PK bits from the page table entry, and two additional PK bits.
5. The apparatus of claim 1 , wherein the PK bits are least significant bits (LSBs) of the PK domain number.
6. The apparatus of claim 1 , wherein each PKR entry has two bits, a first bit indicating whether the protected memory domain may be accessed, and a second bit indicating whether the protected memory domain may be written into.
7. The apparatus of claim 1 , wherein the protected memory domain controller is further arranged to read the permission entry of the PKR at a location indexed by the PK domain number.
8. The apparatus of claim 7 , wherein the protected memory domain controller is further arranged to output permission data for a memory access to the protected memory domain, based on reading the permission entry at the indexed PKR location.
9. The apparatus of claim 1 , further comprising a translation lookaside buffer (TLB) to store the page table.
10. The apparatus of claim 1 , wherein the one or more additional bits are bits of the target linear memory address not otherwise needed for memory addressing.
11. The apparatus of claim 10 , wherein a number of the one or more additional bits is from 1 to 16.
12. The apparatus of claim 1 , wherein the apparatus is a central processing unit (CPU) having the PKR and the protected memory domain controller.
13. One or more non-transitory computer-readable storage media comprising a set of instructions, which, when executed on memory control logic (MCL) coupled to a protection domain permission register (PDPR) that stores a plurality of permission entries corresponding to a plurality of protected memory domains, cause the MCL to:
read PK bits from a page table entry of a page table for a target page address in a target linear memory address having the target page address and an offset;
read one or more additional bits directly from the target linear memory address; and
combine the PK bits and the additional bits to form a protected memory domain number (PMDN) to index into the plurality of entries in the PDPR, to obtain one of the plurality of permission entries corresponding to one of the plurality of protected memory domains (PMD).
14. The one or more non-transitory computer-readable storage media of claim 13 , wherein the PDPR has 2 N total bits, where N is an integer.
15. The one or more non-transitory computer-readable storage media of claim 14 , wherein each PDPR entry has M bits, M being a multiple of 2, and wherein the PDPR includes permission entries for 2 N /M PMDs.
16. The one or more non-transitory computer-readable storage media of claim 13 , wherein each PDPR entry has 2 bits, a first bit indicating whether the PMD may be accessed, and a second bit indicating whether the PMD may be written into.
17. The one or more non-transitory computer-readable storage media of claim 13 , further comprising instructions that, when executed, further cause the MCL to read the entry of the PDPR at a location indexed by the PMDN.
18. The one or more non-transitory computer-readable storage media of claim 17 , further comprising instructions that, when executed, further cause the MCL to output permission data for a memory access to the PMD, based on reading the permission entry at the indexed PDPR location.
19. The one or more non-transitory computer-readable storage media of claim 18 , wherein if the permission data denies access to the PMD, that access denial overrides any memory access permission otherwise determined for the target page address based on the page table entry.
20. A method of obtaining memory domain permissions by a memory controller (MC) of a CPU, the MC coupled to a protection key register (PKR) that stores a plurality of permission entries corresponding to a plurality of protected memory domains, comprising:
obtaining protection key (PK) bits from a page table entry of a page table for a target page address in a target linear memory address having the target page address and an offset;
obtaining additional bits directly from the target linear memory address;
combining the PK bits and the additional bits to form a PK domain number, the PK domain number an index into the plurality of permission entries in the PKR; and
using the PK domain number, obtaining one of the plurality of permission entries corresponding to one of the protected memory domains (PMD).
21. The method of claim 20 , further comprising using the PK bits as LSBs of the PK domain number, and the additional bits as most significant bits (MSBs) of the PK domain number.
22. The method of claim 21 , wherein the PKR holds 2 N bits total, where N is an integer, wherein each PKR entry has M bits, M being a multiple of 2, and wherein the PKR includes entries for 2 N /M PMDs.
23. The method of claim 22 , wherein the number of PK bits and the number of additional bits sum to log 2 {2 N /M}.
24. The method of claim 21 , wherein each PKR entry has 2 bits, a first bit indicating whether the PMD may be accessed, a second bit indicating whether the PMD may be written into, and further comprising reading the entry of the PKR at a location indexed by the PK domain number.
25. The method of claim 24 , further comprising outputting to the CPU permission data for a memory access to the PMD, based the contents of the entry at the indexed PKR location.