# US 12,222,869 B2 · Memory access control through permissions specified in page table entries for execution domains > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,222,869 B2 - Document ID: US12222869B2 - Status: Granted - Kind: B2 - Application number: 17/899,366 - Filed: 2022-08-30 - Published: 2022-12-29 - Granted: 2025-02-11 - Earliest claimed: 2018-08-30 - Assignees: Micron Technology, Inc. - Applicants: Micron Technology, Inc. - Inventors: Steven Jeffrey Wallach - Web page: https://patentgrep.com/patent/US12222869B2 ## CPC - G06F 12/1009: using page tables, e.g. page table structures - G11C 16/22: Safety or protection circuits preventing unauthorised or accidental access to memory cells - G06F 9/45533: {Hypervisors; Virtual machine monitors} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 12/1441: {for a range} - G06F 12/145: {the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism} - G06F 12/1491: {in a hierarchical protection system, e.g. privilege levels, memory rings} - G11C 8/20: Address safety or protection circuits, i.e. arrangements for preventing unauthorized or accidental access - G11C 11/1673: {Reading or sensing circuits or methods} - G11C 11/1675: {Writing or programming circuits or methods} - G11C 11/1695: {Protection circuits or methods} - G11C 16/08: Address circuits; Decoders; Word-line control circuits - G06F 2009/45583: {Memory management, e.g. access or allocation} - G06F 2212/1052: Security improvement - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G11C: STATIC STORES (semiconductor memory devices H10B) ## Abstract Systems, apparatuses, and methods related to a computer system having a page table entry containing permission bits for predefined types of memory accesses made by executions of routines in predefined domains are described. The page table entry can be used to map a virtual memory address to a physical memory address. In response to a routine accessing the virtual memory address, a permission bit corresponding to the execution domain of the routine and a type of the memory access can be extracted from the page table entry to determine whether the memory access is to be rejected. ## Claims ### Claim 1 A device, comprising: a page table having a plurality of page table entries, including a first page table entry configured to specify: a base to map a virtual memory address region to a physical memory address region; and a list of permissions for a plurality of domains of routines respectively; and a logic circuit configured to, in response to an instruction of a routine executed in a processor to access a virtual memory address in a virtual memory address region: determine, based on the list of permissions, a permission to access, by execution of the instruction in a routine having a first domain among the plurality of domains, the physical memory address region; and control, based on the permission, the execution of the instruction in accessing, via the virtual memory address, the physical memory address region. ### Claim 2 (depends on 1) The device of claim 1, further comprising: a memory having the physical memory address region; and the processor coupled with the memory. ### Claim 3 (depends on 2) The device of claim 2, wherein the logic circuit includes a memory management unit. ### Claim 4 (depends on 2) The device of claim 2, wherein a plurality of routines stored in the memory are classified in the plurality of domains. ### Claim 5 (depends on 2) The device of claim 2, wherein the first page table entry includes data representative of the physical memory address region. ### Claim 6 (depends on 5) The device of claim 5, wherein the logic circuit is configured to use an offset specified in the virtual memory address to identify a physical memory address in a physical memory address region. ### Claim 7 (depends on 6) The device of claim 6, wherein the first page table entry is configured to specify, for each respective type of memory access among a plurality of types of memory access and for each of the plurality of domains, a permit. ### Claim 8 (depends on 7) The device of claim 7, wherein the plurality of domains comprises a domain for hypervisor, a domain for operating system, or a domain for application, or any combination thereof. ### Claim 9 (depends on 8) The device of claim 8, wherein the respective type of memory access corresponds to operations of reading the memory. ### Claim 10 (depends on 8) The device of claim 8, wherein the respective type of memory access corresponds to operations of writing to the memory. ### Claim 11 (depends on 8) The device of claim 8, wherein the respective type of memory access corresponds to operations of loading one or more instructions from the memory for execution. ### Claim 12 A method, comprising: specifying, in a first page table entry in a page table having a plurality of page table entries; a base to map a virtual memory address region to a physical memory address region; and a list of permissions for a plurality of domains of routines respectively; and in response to an instruction of a routine executed in a processor to access a virtual memory address in the virtual memory address region: determining, by a logic circuit and based on the list of permissions, a permission to access, by execution of the instruction in a routine having a first domain among the plurality of domains, the physical memory address region; and controlling, by the logic circuit and based on the permission, the execution of the instruction in accessing, via the virtual memory address, the physical memory address region. ### Claim 13 (depends on 12) The method of claim 12, wherein a plurality of routines stored in a memory are classified in the plurality of domains. ### Claim 14 (depends on 13) The method of claim 13, wherein the first page table entry includes data representative of a physical memory address region. ### Claim 15 (depends on 14) The method of claim 14, further comprising: identifying, by the logic circuit using an offset specified in a virtual memory address, a physical memory address in the physical memory address region. ### Claim 16 (depends on 15) The method of claim 15, wherein the first page table entry specifies, for each respective type of memory access among a plurality of types of memory access and for each of the plurality of domains, a permit. ### Claim 17 (depends on 16) The method of claim 16, wherein the plurality of domains comprises a domain for hypervisor, a domain for operating system, or a domain for application, or any combination thereof. ### Claim 18 (depends on 17) The method of claim 17, wherein the plurality of types of memory access include a type of memory access corresponding to operations of reading the memory, a type of memory access corresponding to operations of writing to the memory, or a type of memory access corresponding to operations of loading one or more instructions from the memory for execution, or any combination thereof. ### Claim 19 An apparatus, comprising: a memory configured to store a plurality of routines classified in a plurality of domains; a processor coupled with the memory; and a memory management unit, comprising: a page table having a plurality of page table entries, including a first page table entry configured to specify: a base to map a virtual memory address region to a physical memory address region in the memory; and a list of permissions for the plurality of domains respectively; and a logic circuit configured to, in response to an instruction of a routine executed in a processor to access a virtual memory address in the virtual memory address region: determine, based on the list of permissions, a permission to access, by execution of the instruction in a routine having a first domain among the plurality of domains, the physical memory address region; and control, based on the permission, the execution of the instruction in accessing, via the virtual memory address, the physical memory address region. ### Claim 20 (depends on 19) The apparatus of claim 19, wherein the plurality of domains comprises a domain for hypervisor, a domain for operating system, or a domain for application, or any combination thereof; wherein the first page table entry specifies, for each respective type of memory access among a plurality of types of memory access and for each of the plurality of domains, a permit; and wherein the plurality of types of memory access include a type of memory access corresponding to operations of reading the memory, a type of memory access corresponding to operations of writing to the memory, or a type of memory access corresponding to operations of loading one or more instructions from the memory for execution, or any combination thereof.