US 2003/0200402 A1 · Memory isolation through address translation data edit control

Abstract

Isolated memory is implemented by controlling changes to address translation maps. Control over the maps can be exercised in such a way that no virtual address referring to an isolated page is exposed to any untrusted process. Requests to edit an entry in a map are evaluated to ensure that the edit will not cause the map to point to isolated memory. Requests to change which map is active are evaluated to ensure that the map to be activated does not point to isolated memory. Preferably, these evaluations are performed by a trusted component in a trusted environment, since isolation of the memory depends on the evaluation component not being compromised. In systems that require all memory access requests to identify their target by virtual address, preventing the address translation maps from pointing to a portion of memory effectively prevents access to that portion of memory, thereby creating an isolated memory.

Claims86

Dependent claims

A method of controlling memory usage in a system that comprises a plurality of memory locations, some of the memory locations being designated to be accessible only by a trusted source, each of the memory locations having a physical address, the system supporting the use of virtual addresses to address the memory locations, the memory location that corresponds at a given point in time to a given virtual address being at least partly determined by a selectable group of address translation data that is storable in the memory locations, the system further comprising a writeable storage location that contains, at any given point in time, a pointer to the particular group of address translation data that has been selected to partly determine which of the memory locations corresponds to a given virtual address, the method comprising:

receiving a request to write a new pointer into the storage location;
determining that loading the new pointer into the storage location will not cause any of the memory locations that are designated to be accessible only by the trusted source to correspond to any virtual address;
and
allowing the request to proceed.

1 more element

In a system that comprises:

a random access memory comprising a plurality of memory locations, each of the memory locations having a physical address;
a storage location that stores an identifier of one of a plurality of groups of address translation data;
an address translation component that uses the group of address translation data whose identifier is stored in the storage location to translate a virtual address into the physical address of one of the memory locations;
and
a processor that processes an instruction to load a datum into the storage location;
the improvement comprising:
an evaluation component that makes a determination as to whether the datum may be loaded into the storage location and that causes the instruction either to be carried our or not carried out according to the determination, the determination being based on criteria comprising:
whether the datum is an identifier of a group of address translation data that will cause the address translation component to translate any virtual address to the physical address of a predetermined set of the memory locations.

5 more elements

A method of managing memory in a system that comprises:

a memory comprising a plurality of locations, each of the locations having a physical address associated therewith;
one or more sources, each of the sources having a group of address translation data associated therewith;
a virtual addressing facility that permits each of the sources to address a location in the memory using a virtual address, the particular location that corresponds to the virtual address being determined at least in part by the group of address translation data associated with the source, there being at least some locations in the memory that do not correspond to a virtual address for a given source;
and
a secure environment that is associatable with a set of locations in the memory to which none of the sources has access, the method comprising:
identifying a portion of the memory;
creating a state for the system in which none of the sources can address the portion of memory using a virtual address;
and
adding to an exclusion set data indicative of said portion of memory.

6 more elements

A computer-readable medium encoded with computer-executable instructions to implement a method of controlling memory usage in a system that comprises a plurality of memory locations, some of the memory locations being designated to be accessible only by a trusted source, each of the memory locations having a physical address, the system supporting the use of virtual addresses to address the memory locations, the memory location that corresponds at a given point in time to a given virtual address being at least partly determined by a selectable group of address translation data that is storable in the memory locations, the system further comprising a writeable storage location that contains, at any given point in time, a pointer to the particular group of address translation data that has been selected to partly determine which of the memory locations corresponds to a given virtual address, the method comprising:

receiving a request to write a new pointer into the storage location;
determining that loading the new pointer into the storage location will not cause any of the memory locations that are designated to be accessible only by the trusted source to correspond to any virtual address;
and
allowing the request to proceed.

1 more element

A computer-readable medium encoded with computer-executable instructions to perform a method of controlling memory usage in a system that comprises a plurality of memory locations, each of the memory locations having a physical address, the system supporting the use of virtual addresses to address the memory locations, the memory location that corresponds at a given point in time to a given virtual address being at least partly determined by modifiable address translation data that are storable in the plurality of memory locations, some of the memory locations being designated to be accessible only by a trusted source, the method comprising:

receiving from a first source a request to write a datum to a first of the memory locations, the first source being different from the trusted source;
determining that carrying out the request will not cause the address translation data to be modified in a manner that causes any of the memory locations that are designated to be accessible only by the trusted source to correspond to any virtual address;
and
allowing the request to proceed.

1 more element

A computer-readable medium encoded with computer-executable instructions for performing a method of managing memory in a system that comprises:

a memory comprising a plurality of locations, each of the locations having a physical address associated therewith;
one or more sources, each of the sources having a group of address translation data associated therewith;
a virtual addressing facility that permits each of the sources to address a location in the memory using a virtual address, the particular location that corresponds to the virtual address being determined at least in part by the group of address translation data associated with the source, there being at least some locations in the memory that do not correspond to a virtual address for a given source;
and
a secure environment that is associatable with a set of locations in the memory to which none of the sources has access, the method comprising:
identifying a portion of the memory;
creating a state for the system in which none of the sources can address the portion of memory using a virtual address;
and
adding to an exclusion set data indicative of said portion of memory.

6 more elements

Dependencies are inferred from the claim text.

Memory isolation through address translation data edit control

Life of this patent

Memory isolation through address translation data edit control

Life of this patent

Abstract

Claims86