Back to results
US 10,884,953 B2Granted
Capability enforcement processors
AssigneeHewlett Packard Enterprise Development LP
InventorsDejan S Milojicic, Chris I Dalton, Paolo Faraboschi, Kirk M Bresniker
Life of this patent
Estimating the term…
Abstract
Example implementations relate to a capability enforcement processor. In an example, a capability enforcement processor may be interposed between a memory that stores data accessible via capabilities and a system processor that executes processes. The capability enforcement processor intercepts a memory request from the system processor and enforces the memory request based on capability enforcement processor capabilities maintained in per-process capability spaces of the capability enforcement processor.
Claims15
A system comprising:
- a global, non-volatile memory to store data accessible via capabilities;
- a system processor to execute processes, the system processor comprising a central processing unit (CPU) associated with a first instruction set architecture (first ISA), the first ISA lacking instructions for capability-specific functionality;
- a capability enforcement processor interposed between the global, non-volatile memory and the system processor;
- and
- an associated memory coupled to the capability enforcement processor,
- wherein the global, non-volatile memory is shared across the processes, across the system processor and the capability enforcement processor remotely, and the associated memory is remote from the system processor, and
- wherein the capability enforcement processor is configured to:
- intercept a memory request from the system processor, wherein the memory request comprises an identifier corresponding with a virtual address space and the system processor, and
- enforce the memory request based on capability enforcement processor capabilities (CEP capabilities) maintained in a per-process capability space of the capability enforcement processor, wherein enforcing the memory request comprises identifying the per-process capability space based on a related context identifier associated with the memory request,
- wherein the capability enforcement processor exclusively enforces memory requests against a specific range of the associated memory and against a specific range of the global, non-volatile memory, and
- wherein the capability enforcement processor is a separate processor from the system processor, the capability enforcement processor associated with a second instruction set architecture (second ISA) comprising capability-specific instructions enabling capability-specific functionality independent of the first ISA of the system processor, such that the capability enforcement processor employs capabilities independent of the first ISA.
8 more elements
A method comprising:
- maintaining, by a capability enforcement processor interposed between a system processor and a global, non-volatile memory, the capability enforcement processor maintaining capability enforcement processor capabilities (CEP capabilities) in a per-process capability space, wherein the global, non-volatile memory is shared across the processes, across the system processor and the capability enforcement processor remotely, and an associated memory that is coupled to the capability enforcement processor, wherein the associated memory is remote from the system processor;
- intercepting, by the capability enforcement processor, memory requests from the system processor, wherein the system processor comprises a central processing unit (CPU) associated with a first instruction set architecture (first ISA), wherein the first ISA lacks instructions for capability-specific functionality, and wherein each memory request of the memory requests comprises an identifier corresponding with a virtual address space and the system processor;
- and
- enforcing, by the capability enforcement processor, the memory request based on the CEP capabilities maintained in the per-process capability space, wherein enforcing the memory request comprises identifying the per-process capability space based on a related context identifier associated with the memory request,
- wherein the capability enforcement processor exclusively enforces memory requests against a specific range of the associated memory and against a specific range of the global, non-volatile memory, and
- wherein the capability enforcement processor is a separate processor from the system processor, the capability enforcement processor associated with a second instruction set architecture (second ISA) comprising capability-specific instructions enabling capability-specific functionality independent of the first ISA of the system processor, such that the capability enforcement processor employs capabilities independent of the first ISA.
3 more elements
A non-transitory machine readable medium storing instructions executable by processing resource of a capability enforcement processor,
- wherein a global, non-volatile memory is shared across processes, across a system processor and the capability enforcement processor remotely, and an associated memory is remote from the system processor, wherein the global, non-volatile memory stores data accessible via capabilities, and the non-transitory machine readable medium comprising:
- instructions to intercept memory requests from a system processor, wherein the system processor comprises a central processing unit (CPU) associated with a first instruction set architecture (first ISA), wherein the first ISA lacks instructions for capability-specific functionality, and wherein each memory request of the memory requests comprises an identifier corresponding with a virtual address space and the system processor;
- instructions to identify a per-process capability space of the capability enforcement processor based on a context identifier associated with the memory request, the per-process capability space maintaining capability enforcement processor capabilities (CEP capabilities);
- instructions to compare the memory request against the CEP capabilities in the identified per-process capability space of the capability enforcement processor to determine if the memory request matches a valid CEP capability among the CEP capabilities and if the memory request complies with permissions of the valid CEP capability;
- and
- instructions to permit the memory request in response to a determination that the memory request matches a valid CEP capability and that the memory request complies with permissions of the valid CEP capability,
- wherein the capability enforcement processor exclusively enforces memory requests against a specific range of the associated memory and against a specific range of the global, non-volatile memory, and
- wherein the capability enforcement processor is a separate processor from the system processor, the capability enforcement processor associated with a second instruction set architecture (second ISA) comprising capability-specific instructions enabling capability-specific functionality independent of the first ISA of the system processor, such that the capability enforcement processor employs capabilities independent of the first ISA.
5 more elements
Dependencies are inferred from the claim text.