# US 11,030,113 B1 · Apparatus and method for efficient process-based compartmentalization > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,030,113 B1 - Document ID: US11030113B1 - Status: Granted - Kind: B1 - Application number: 16/728,928 - Filed: 2019-12-27 - Published: 2021-07-01 - Granted: 2021-06-08 - Earliest claimed: 2019-12-27 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: David M. Durham; Jacob Doweck; Michael Lemay; Deepak Gupta - Web page: https://patentgrep.com/patent/US11030113B1 ## CPC - G06F 12/1027: using associative or pseudo-associative address translation means, e.g. translation look-aside buffer [TLB] - G06F 12/1441: {for a range} - G06F 12/1009: using page tables, e.g. page table structures - G06F 12/1036: for multiple virtual address spaces, e.g. segmentation (G06F12/1045 takes precedence) - G06F 2212/151: Emulated environment, e.g. virtual machine - G06F 2212/651: Multi-level translation tables - G06F 2212/657: Virtual address space management - G06F 2212/681: Multi-level TLB, e.g. microTLB and main TLB - G06F 2212/684: TLB miss handling - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An apparatus and method for efficient process-based compartmentalization. For example, one embodiment of a processor comprises: execution circuitry to execute instructions and process data; memory management circuitry coupled to the execution circuitry, the memory management circuitry to manage access to a system memory by a plurality of related processes using one or more process-specific translation structures and one or more shared translation structures to be shared by the related processes; and one or more control registers to store a process-specific base address pointer associated with a first process of the plurality of related processes and to store a shared base address pointer to identify the shared translation structures; wherein the memory management circuitry is to use the process-specific base address pointer in combination with a first linear address provided by the first process to walk the process-specific translation structures to identify any permissions and/or physical address associated with the first linear address, wherein if permissions are identified, the memory management circuitry is to use the permissions in place of any permissions specified in the shared translation structures. ## Claims ### Claim 1 A processor comprising: execution circuitry to execute instructions and process data; memory management circuitry coupled to the execution circuitry, the memory management circuitry to manage access to a system memory by a plurality of related processes using one or more process-specific translation structures and one or more shared translation structures to be shared by the related processes; and one or more control registers to store a process-specific base address pointer associated with a first process of the plurality of related processes and to store a shared base address pointer to identify the shared translation structures; wherein the memory management circuitry is to use the process-specific base address pointer in combination with a first linear address provided by the first process to walk the process-specific translation structures to identify any permissions and/or physical address associated with the first linear address, wherein when permissions are identified, the memory management circuitry is to use the permissions in place of any permissions specified in the shared translation structures. ### Claim 2 (depends on 1) The processor of claim 1 wherein the one or more control registers comprise: a first control register to store the process-specific base address pointer associated with a first process of the plurality of related processes; and a second control register to store the shared base address pointer to identify the shared translation structures. ### Claim 3 (depends on 1) The processor of claim 1 further comprising: a translation lookaside buffer (TLB) to store a plurality of address translation entries comprising mappings of linear addresses to physical addresses, one or more of the address translation entries to be associated with the first process based on a process identification field included in the one or more address translation entries. ### Claim 4 (depends on 3) The processor of claim 3 wherein the memory management circuitry is to initially query the TLB to determine when any entry exists for the first linear address and is to walk the process-specific translation structures only when no TLB entry for the first linear address is found. ### Claim 5 (depends on 4) The processor of claim 4 wherein the memory management circuitry is to update the TLB with an entry including the physical address and/or permissions resulting from the walk of the process-specific translation structures. ### Claim 6 (depends on 1) The processor of claim 1 wherein when permissions are not found in the process-specific translation structures, the memory management circuitry is to use the shared base address pointer and the first linear address to walk the shared translation structures to identify shared permissions associated with the first linear address and to use the shared permissions to manage access to the physical address associated with the first linear address. ### Claim 7 (depends on 6) The processor of claim 6 wherein when permissions are identified in the process-specific translation structure but the physical address is not identified, the memory management circuitry is to walk the shared translation structures to determine the physical address associated with the first linear address and is to use the permissions to manage access to the physical address. ### Claim 8 (depends on 7) The processor of claim 7 wherein the process-specific translation structure is to specify the permissions at a higher level of granularity than the shared translation structures such that the memory management circuitry is to apply the permissions to region of the shared translation structures indicated by the granularity. ### Claim 9 (depends on 8) The processor of claim 8 wherein the shared translation structures comprise a hierarchical arrangement of translation tables and wherein the permissions are applied to a first table and all other tables and/or entries under the first table in the hierarchical arrangement. ### Claim 10 (depends on 1) The processor of claim 1 wherein the plurality of related processes are related as a super-process by an operating system or management component. ### Claim 11 A method comprising: executing a plurality of related processes using one or more process-specific translation structures and one or more shared translation structures to be shared by the related processes; and storing a process-specific base address pointer associated with a first process of the plurality of related processes in one or more control registers; storing a shared base address pointer to identify the shared translation structures in the one or more control registers; walking the process-specific translation structures using the process-specific base address pointer in combination with a first linear address provided by the first process to identify any permissions and/or physical address associated with the first linear address; and using the permissions, when identified, in place of any permissions specified in the shared translation structures. ### Claim 12 (depends on 11) The method of claim 11 wherein the one or more control registers comprise: a first control register to store the process-specific base address pointer associated with a first process of the plurality of related processes; and a second control register to store the shared base address pointer to identify the shared translation structures. ### Claim 13 (depends on 11) The method of claim 11 further comprising: a translation lookaside buffer (TLB) to store a plurality of address translation entries comprising mappings of linear addresses to physical addresses, one or more of the address translation entries to be associated with the first process based on a process identification field included in the one or more address translation entries. ### Claim 14 (depends on 13) The method of claim 13 wherein the memory management circuitry is to initially query the TLB to determine when any entry exists for the first linear address and is to walk the process-specific translation structures only of no TLB entry for the first linear address is found. ### Claim 15 (depends on 14) The method of claim 14 wherein the memory management circuitry is to update the TLB with an entry including the physical address and/or permissions resulting from the walk of the process-specific translation structures. ### Claim 16 (depends on 11) The method of claim 11 wherein when permissions are not found in the process-specific translation structures, the memory management circuitry is to use the shared base address pointer and the first linear address to walk the shared translation structures to identify shared permissions associated with the first linear address and to use the shared permissions to manage access to the physical address associated with the first linear address. ### Claim 17 (depends on 16) The method of claim 16 wherein if permissions are identified in the process-specific translation structure but the physical address is not identified, the memory management circuitry is to walk the shared translation structures to determine the physical address associated with the first linear address and is to use the permissions to manage access to the physical address. ### Claim 18 (depends on 17) The method of claim 17 wherein the process-specific translation structure is to specify the permissions at a higher level of granularity than the shared translation structures such that the memory management circuitry is to apply the permissions to region of the shared translation structures indicated by the granularity. ### Claim 19 (depends on 18) The method of claim 18 wherein the shared translation structures comprise a hierarchical arrangement of translation tables and wherein the permissions are applied to a first table and all other tables and/or entries under the first table in the hierarchical arrangement. ### Claim 20 (depends on 11) The processor of claim 11 wherein the plurality of related processes are related as a super-process by an operating system or management component.