Memory protection at a thread level for a memory protection key architecture

A system-on-a chip (SoC) comprising:

• a memory;
• and
• a processor, communicatively coupled to the memory, comprising a processing core to execute a thread of the process and an input output (IO) memory management unit (IOMMU) comprising a storage unit to store a page table entry comprising an identifier of a memory domain and a protection key associated with the identifier, the protection key indicating whether a memory page in the memory domain is accessible, wherein the page table entry to translate a virtual address to a physical address;
• and
• an input output (IO) device comprising:
• a protection key register comprising a field indexed by the protection key, the field comprising a set of bits reflecting a memory access permission associated with the protection key, wherein the protection key register is, responsive to receiving a request from an IO device to store data associated with a process or the thread of the process, to one of allow or deny permission to access the memory page in the memory domain for storage of the data associated with the process or the thread of the process based on the protection key.

A system comprising:

• a memory;
• and
• a processor, communicatively coupled to the memory, comprising a processing core to execute a thread of a process and a storage unit to store a page table entry comprising an identifier of a memory domain and a protection key associated with the identifier indicating whether a memory page in the memory domain is accessible, wherein the page table entry to translate a virtual address to a physical address;
• and
• an input output (IO) device comprising an IO memory management unit comprising:
• a protection key register comprising a field indexed by the protection key, the field comprising a set of bits reflecting a memory access permission associated with the protection key, wherein the protection key register is, responsive to receiving a request from an IO device to store data associated with a process or a thread of the process, to one of allow or deny permission to access the memory page in the memory domain for storage of the data associated with the process or the thread of the process based on the protection key.

A method comprising:

• receiving a request from an input/output (I/O) device to access a memory page in a memory domain to store data associated with a process or a thread of a process,
• identifying a protection key associated with an identifier of the memory domain, wherein the protection key indicates whether the memory page in the memory domain is accessible, and wherein a page table entry maintains an association between the protection key and the identifier of the memory domain, the page table entry to translate a virtual address to a physical address;
• and
• generating one of allow or deny permission to access the memory page in the memory domain for storage of the data associated with the process or the thread of the process based on the identified protection key.