US 7,890,727 B2Granted

Key-controlled object-based memory protection

AssigneeInternational Business Machines Corporation

InventorsThomas S. Mathews, Bruce Mealey, Pratap Chandra Pattnaik, Ravi A. Shankar

Life of this patent

Estimating the term…

Loading patent…

Abstract

A processing unit includes an authority check for controlling access by the processing unit to pages of memory according to whether a hardware protection key set currently loaded in an authority mask register allows access to the pages. In particular, each page of memory is assigned a page key number that indexes into the hardware protection key set. The currently loaded hardware protection key set specifies those page key numbers that are currently accessible to the processing unit for the execution context. Each hardware key within the hardware protection key set is associated with a particular data object or group of data objects. Thus, effectively, the currently loaded hardware protection key set identifies which data objects or groups of data objects are currently accessible. Software keys are assigned to data objects and dynamically mapped to hardware protection key sets, such that when a module is called, the software keys assigned to that module are mapped to the hardware protection key set to be loaded for controlling current access to memory.

Claims12

Dependent claims

A system for memory protection based on data objects, comprising:

an authority controller coupled to a processing unit for controlling access by said processing unit to a plurality of pages of memory, wherein each of a plurality of pages of memory is assigned a particular key number from among a plurality of key numbers distinguishable from a page number within a separate entry for each page within a page table of said memory, wherein each selection of pages of memory assigned a same key number from among said plurality key numbers are associated with a same region of said memory associated with a particular key number, wherein each of said plurality of key numbers is associated with at least one from among a plurality of data objects;
said authority controller further programmed to:
control assignment of a separate software key from among a plurality of software keys to each separate data object of said plurality of data objects;
and
map, in selections of at least one, each of said plurality of software keys to at least one key number from among a plurality of key numbers, wherein each of said plurality of key numbers is associated with a separate region of memory from among a memory unit;
assign to each of said plurality of pages of memory within said separate entry for each page within said page table of said memory said separate key number from among a plurality of key numbers associated with said separate region of memory to which each page of said memory is associated;
map a separate hardware protection key set for each module from among a plurality of modules from a separate selection of said key numbers assigned to a selection of software keys from among said plurality of software keys assigned to each said separate module;
and
responsive to loading a particular module in said processing unit from among a plurality of modules, load a particular hardware protection key set mapped for said particular module into said memory management unit for controlling access to said memory;
and
an authority register accessible to said authority controller, wherein said particular hardware protection key set currently loaded in said authority register specifies a particular selection of allowed key numbers from among said plurality of key numbers, wherein said authority controller only allows said processing unit access to those selections of pages assigned to one from among said selection of allowed key numbers.

8 more elements

A computer program product comprising a computer-readable program, residing on a volatile or non-volatile computer readable medium, for memory protection based on data objects, wherein the computer-readable program when executed on a computer causes the computer to:

assign to each of a plurality of pages of memory within a separate entry for each page within a page table of said memory a separate key number from among a plurality of key numbers distinguishable from a page number for each of said plurality of pages, wherein each selection of pages of memory assigned a same key number from among said plurality key numbers are associated with a same region of said memory associated with a particular key number, wherein each of said plurality of key numbers is associated with at least one from among a plurality of data objects, by:
controlling assignment of a separate software key from among a plurality of software keys to each separate data object of said plurality of data objects;
and
mapping, in selections of at least one, each of said plurality of software keys to at least one key number from among a plurality of key numbers, wherein each of said plurality of key numbers is associated with a separate region of memory from among a memory unit;
assigning to each of said plurality of pages of memory within said separate entry for each page within said page table of said memory said separate key number from among a plurality of key numbers associated with said separate region of memory to which each page of said memory is associated;
mapping a separate hardware protection key set for each module from among a plurality of modules from a separate selection of said key numbers assigned to a selection of software keys from among said plurality of software keys assigned to each said separate module;
and
responsive to loading a particular module in said processing unit from among a plurality of modules, loading a particular hardware protection key set mapped for said particular module into said memory management unit for controlling access to said memory;
and
only allow a processing unit to access a particular selection of pages from among said plurality of pages according to said particular hardware protection key set currently loaded in said memory management unit controlling accesses to said memory, wherein said currently loaded hardware protection key set identifies a selection of key numbers from among said plurality of key numbers that are currently accessible to said processing unit.

7 more elements

Dependencies are inferred from the claim text.