Memory management apparatus and method for compartmentalization using linear address metadata
An apparatus and method for memory management using compartmentalization. For example, one embodiment of a processor comprises: execution circuitry to execute instructions and process data, at least one instruction to generate a system memory access request using a first linear address; and address translation circuitry to perform a first walk operation through a set of one or more address translation tables to translate the first linear address to a first physical address, the address translation circuitry to concurrently perform a second walk operation through a set of one or more linear address metadata tables to identify metadata associated with the linear address, and to use one or more portions of the metadata to validate access by the at least one instruction to the first physical address.
1. A processor comprising:
execution circuitry to execute instructions and process data, at least one instruction to generate a system memory access request having a first linear address; and
address translation circuitry to perform a first walk operation through a set of one or more address translation tables to translate the first linear address to a first physical address,
the address translation circuitry to concurrently perform a second walk operation through a corresponding set of one or more linear address metadata tables to identify metadata associated with the first linear address, and to use one or more portions of the metadata to validate access by the at least one instruction to the first physical address, wherein both of an address translation table of the set of one or more address translation tables and a corresponding linear address metadata table of the corresponding set of one or more linear address metadata tables use a same portion of the first linear address for the walk operations.
2. The processor of claim 1 wherein the metadata comprises one or more linear address tags, wherein validating access comprises comparing the one or more linear address tags to a first security identifier.
3. The processor of claim 2 further comprising:
a second control register to store a first base address associated with a base translation table of the set of one or more address translation tables, the address translation circuitry to begin the first walk operation by reading the first base address to access the base translation table.
4. The processor of claim 3 further comprising:
a third control register to store a second base address associated with a base metadata table of the set of one or more linear address metadata tables, the address translation circuitry to begin the second walk operation by reading the second base address to access the base metadata table.
5. The processor of claim 4 wherein the execution circuitry comprises program code compartmentalization circuitry to isolate program code sequences into execution compartments, the first security identifier comprising a first compartment identifier associated with a first compartment in which the at least one instruction is to be executed.
6. The processor of claim 5 wherein the program code compartmentalization circuitry comprises circuitry to execute a plurality of instructions related to compartmentalization including:
a first compartmentalization instruction to store a second compartment identifier in the first control register to provide entry of a new program code sequence into a second compartment; and
a second compartmentalization instruction to cause an exit from the second compartment.
7. The processor of claim 6 wherein the program code compartmentalization circuitry is to implement a native compartment identified by a third compartment identifier, the native compartment to execute user mode program code to implement the first and second compartments.
8. The processor of claim 6 wherein each of the first and second compartments are to be associated with a different base address in the third control register.
9. A method comprising:
executing an instruction and responsively generating a system memory access request with a first linear address; and
performing a first walk operation through a set of one or more address translation tables to translate the first linear address to a first physical address;
concurrently performing a second walk operation through a set of one or more linear address metadata tables to identify metadata associated with the first linear address, wherein both of an address translation table of the set of one or more address translation tables and a corresponding linear address metadata table of the corresponding set of one or more linear address metadata tables use a same portion of the first linear address for the walk operations; and
validating access by the instruction to the first physical address using one or more portions of the metadata.
10. The method of claim 9 wherein the metadata comprises one or more linear address tags, wherein validating access comprises comparing the one or more linear address tags to a first security identifier.
11. The method of claim 10 further comprising:
storing a first base address associated with a base translation table of the set of one or more address translation tables in a second control register, wherein the first walk operation is to begin by reading the first base address to access the base translation table.
12. The method of claim 11 further comprising:
storing a second base address associated with a base metadata table of the set of one or more linear address metadata tables in a third control register, wherein the second walk operation is to begin by reading the second base address to access the base metadata table.
13. The method of claim 12 further comprising:
isolating program code sequences into execution compartments, the first security identifier comprising a first compartment identifier associated with a first compartment in which the instruction is to be executed.
14. The method of claim 13 further comprising:
executing a plurality of instructions related to compartmentalization including a first compartmentalization instruction to store a second compartment identifier in the first control register to provide entry of a new program code sequence into a second compartment; and a second compartmentalization instruction to cause an exit from the second compartment.
15. The method of claim 14 further comprising:
implementing a native compartment identified by a third compartment identifier, the native compartment to execute user mode program code to implement the first and second compartments.
16. The method of claim 14 wherein each of the first and second compartments are to be associated with a different base address in the third control register.
17. A non-transitory machine-readable medium having program code stored thereon which, when executed by a machine, causes the machine to perform:
executing an instruction and responsively generating a system memory access request with a first linear address; and
performing a first walk operation through a set of one or more address translation tables to translate the first linear address to a first physical address;
concurrently performing a second walk operation through a set of one or more linear address metadata tables to identify metadata associated with the first linear address, wherein both of an address translation table of the set of one or more address translation tables and a corresponding linear address metadata table of the corresponding set of one or more linear address metadata tables use a same portion of the first linear address for the walk operations; and
validating access by the instruction to the first physical address using one or more portions of the metadata.
18. The non-transitory machine-readable medium of claim 17 wherein the metadata comprises one or more linear address tags, wherein validating access comprises comparing the one or more linear address tags to a first security identifier.
19. The non-transitory machine-readable medium of claim 18 further comprising:
storing a first base address associated with a base translation table of the set of one or more address translation tables in a second control register, wherein the first walk operation is to begin by reading the first base address to access the base translation table.
20. The non-transitory machine-readable medium of claim 19 further comprising:
storing a second base address associated with a base metadata table of the set of one or more linear address metadata tables in a third control register, wherein the second walk operation is to begin by reading the second base address to access the base metadata table.
21. The non-transitory machine-readable medium of claim 20 further comprising:
isolating program code sequences into execution compartments, the first security identifier comprising a first compartment identifier associated with a first compartment in which the instruction is to be executed.
22. The non-transitory machine-readable medium of claim 21 further comprising:
executing a plurality of instructions related to compartmentalization including a first compartmentalization instruction to store a second compartment identifier in the first control register to provide entry of a new program code sequence into a second compartment; and a second compartmentalization instruction to cause an exit from the second compartment.
23. The non-transitory machine-readable medium of claim 22 further comprising:
implementing a native compartment identified by a third compartment identifier, the native compartment to execute user mode program code to implement the first and second compartments.
24. The non-transitory machine-readable medium of claim 22 wherein each of the first and second compartments are to be associated with a different base address in the third control register.