Access control for memory protection key architecture
A processing system includes a processing core to execute a task and a memory management unit, coupled to the core. The memory management unit includes a protection key register comprising a plurality of fields. Each field comprising a set of bits reflecting a memory access permission for each of a plurality of memory domains. The memory management unit also includes a plurality of protection key mask registers. Each of the protection key mask registers comprising a mask having a plurality of bits, each bit reflecting an access permission to a corresponding field of the protection key register by a code page residing in a memory domain of the plurality of memory domains identified by an index of the protection key mask register. The memory management unit is, responsive to receiving a request to modify the protection key register by the code page residing in the memory domain, to select a protection key mask register among the plurality of protection key mask registers and to apply a mask comprised by selected protection key mask register indexed by an identifier of the memory domain.
1. A processing system comprising:
a processing core to execute an instruction in a task; and
a memory management unit, comprising:
a protection key register comprising a plurality of fields, each field comprising a set of bits reflecting a memory access permission for each of a plurality of memory domains; and
a plurality of protection key mask registers, each protection key mask register comprising a mask having a plurality of bits, each bit reflecting an access permission to a corresponding field of the protection key register by a code page residing in a memory domain of the plurality of memory domains identified by an index of the protection key mask register; wherein the memory management unit is, responsive to receiving a request to modify the protection key register by the code page residing in the memory domain, to select a protection key mask register among the plurality of protection key mask registers and to apply a mask comprised by the selected protection key mask register indexed by an identifier of the memory domain.
2. The processing system of claim 1 , wherein the protection key mask register is selected based on a value of the identifier.
3. The processing system of claim 1 wherein a value is assigned to each of the plurality of bits in the mask.
4. The processing system of claim 3 wherein the value is assigned based on a policy set by one of an operating system or an application.
5. The processing system of claim 3 wherein the memory management unit to modify the corresponding bit in the protection key register in view of the value.
6. The processing system of claim 1 wherein the memory access permissions comprises one of a read permission to read content in the memory domain, a write permission to write content into the memory domain or an execute permission to execute content in the memory domain.
7. The processing system of claim 1 , wherein the protection key register is modifiable by a process having a user privilege level.
8. The processing system of claim 1 wherein the protection key mask register is modifiable by a process having a privilege level higher than a user privilege level.
9. A system-on-a chip (SoC) comprising:
a memory; and
a processor, communicatively coupled to the memory, comprising:
a processing core to execute a task; and
a memory management unit, coupled to the processing core, comprising:
a protection key register comprising a plurality of fields, each field comprising a set of bits reflecting a memory access permission for each of a plurality of memory domains; and
a plurality of protection key mask registers, each protection key mask register comprising a mask having a plurality of bits, each bit reflecting an access permission to a corresponding field of the protection key register by a code page residing in a memory domain among the plurality of memory domains identified by an index of the protection key mask register, wherein the memory management unit is, responsive to receiving a request to modify the protection key register by the code page residing in the memory domain, to select a protection key mask register among the plurality of protection key mask registers and to apply a mask comprised by the selected protection key mask register indexed by an identifier of the memory domain.
10. The SoC of claim 9 , wherein the protection key mask register is selected based on a value of the identifier.
11. The SoC of claim 10 wherein a value is assigned to each of the plurality of bits in the mask.
12. The SoC of claim 11 wherein the value is assigned based on a policy set by one of an operating system or an application.
13. The SoC of claim 11 wherein the memory management unit to modify the corresponding bit in the protection key register in view of the value.
14. The SoC of claim 9 wherein the memory access permissions comprises one of a read permission to read content in the memory domain, a write permission to write content into the memory domain or an execute permission to execute content in the memory domain.
15. A method comprising:
receiving a request to modify a protection key register by a code page residing in a memory domain wherein the protection key register comprising a plurality of fields, each field comprising a set of bits reflecting a memory access permission for each of a plurality of memory domains, wherein a plurality of protection key mask registers, each protection key mask register comprising a plurality of bits, each bit reflecting an access permission to a corresponding field of the protection key register by a code page residing in the memory domain among the plurality of memory domains identified by an index of the protection key mask register;
selecting a protection key mask register among the plurality of protection key mask registers; and
applying a mask comprised by the selected protection key mask register indexed by an identifier of the memory domain.
16. The method of claim 15 wherein the protection key mask register is selected based on a value of the identifier.
17. The method of claim 16 , further comprising modifying the corresponding bit in the protection key register in in view of a value assigned to each of the plurality of bits in the mask, wherein the value is assigned based on a policy set by one of an operating system or an application.
18. A non-transitory machine-readable storage medium including instructions that, when accessed by a processing device, cause the processing device to perform operations comprising:
receiving a request to modify a protection key register by a code page residing in a memory domain wherein the protection key register comprising a plurality of fields, each field comprising a set of bits reflecting a memory access permission for each of a plurality of memory domains, wherein a plurality of protection key mask registers, each protection key mask register comprising a plurality of bits, each bit reflecting an access permission to a corresponding field of the protection key register by a code page residing in the memory domain among the plurality of memory domains identified by an index of the protection key mask register;
selecting a protection key mask register among the plurality of protection key mask registers; and
applying a mask comprised by the selected protection key mask register indexed by an identifier of the memory domain.
19. The non-transitory machine-readable storage medium of claim 18 , wherein the protection key mask register is selected based on a value of the identifier.
20. The non-transitory machine-readable storage medium of claim 19 , wherein the operations further comprising modifying the corresponding bit in the protection key register in view of a value assigned to each of the plurality of bits in the mask, wherein the value is assigned based on a policy set by one of an operating system or an application.