Technologies for object-oriented memory management with extended segmentation

Patent metadata

Field	Value
Publication number	US-12585757-B2
Application number	US-202318526346-A
Country	US
Kind code	B2
Filing date	Dec 1, 2023
Priority date	Oct 1, 2016
Publication date	Mar 24, 2026
Grant date	Mar 24, 2026

Abstract

Technologies for memory management with memory protection extension include a computing device having a processor with one or more protection extensions. The processor may load a logical address including a segment base, effective limit, and effective address and generate a linear address as a function of the logical address with the effective limit as a mask. The processor may switch to a new task described by a task state segment extension. The task state extension may specify a low-latency segmentation mode. The processor may prohibit access to a descriptor in a local descriptor table with a descriptor privilege level lower than the current privilege level of the processor. The computing device may load a secure enclave using secure enclave support of the processor. The secure enclave may load an unsandbox and a sandboxed application in a user privilege level of the processor. Other embodiments are described and claimed.

First claim

The invention claimed is:

1 . An apparatus comprising:
processing circuitry coupled to a memory, the processing circuitry to: load an unsandbox associated with a user privilege level of the processor circuitry; load, via the unsandbox, a sandboxed application in the user privilege level; associate, via the unsandbox, descriptor logic to a register associated with the processor circuitry wherein the descriptor logic references a descriptor table and comprises one or more of a protection domain identifier, an extended descriptor bit, or an extended descriptor offset; execute the sandboxed application in response to enablement of an application sandbox mode of the processor circuitry; load a logical address in response to execution of the sandboxed application; and enable, within a single process, the application sandbox mode in response to storing an extended descriptor selector in a code segment register such that isolation of multiple components is achieved using the application sandbox mode within the single process.

2 . The apparatus of claim 1 , wherein the processor circuitry is further to enable the application sandbox mode in response to storage of the descriptor in the register.

3 . The apparatus of claim 2 , wherein the descriptor table comprises a hierarchical table having a first level and a second level, wherein the first level is indexed by the protection domain identifier associated with the descriptor logic and wherein the second level is indexed by the extended descriptor offset associated with the descriptor logic.

4 . The apparatus of claim 1 , wherein the processor circuitry is further to prohibit loading of the register with legacy descriptor logic in response to the enablement of the application sandbox mode, wherein the legacy descriptor logic references a local descriptor table or a global descriptor table.

5 . The apparatus of claim 1 , wherein the processing circuitry comprises one or more of application processing circuitry or graphics processing circuitry.

6 . A method comprising:
loading, by a processing circuitry of a computing device, an unsandbox associated with a user privilege level of the processor; loading, via the unsandbox, a sandboxed application in the user privilege level; associating, via the unsandbox, descriptor logic to a register associated with the processor wherein the descriptor logic references a descriptor table and comprises one or more of a protection domain identifier, an extended descriptor bit, or an extended descriptor offset; executing the sandboxed application in response to enablement of an application sandbox mode of the processor; loading a logical address in response to execution of the sandboxed application; and enabling, within a single process, the application sandbox mode in response to storing an extended descriptor selector in a code segment register such that isolation of multiple components is achieved using the application sandbox mode within the single process.

7 . The method of claim 6 , further comprising enabling the application sandbox mode in response to storage of the descriptor in the register.

8 . The method of claim 6 , wherein the descriptor table comprises a hierarchical table having a first level and a second level, wherein the first level is indexed by the protection domain identifier associated with the descriptor logic and wherein the second level is indexed by the extended descriptor offset associated with the descriptor logic.

9 . The method of claim 6 , further comprising prohibiting loading of the register with legacy descriptor logic in response to the enablement of the application sandbox mode, wherein the legacy descriptor logic references a local descriptor table or a global descriptor table.

10 . The method of claim 6 , wherein the processing circuitry is coupled to a memory, the processing circuitry comprises one or more of application processing circuitry or graphics processing circuitry.

11 . At least one non-transitory computer-readable medium having stored thereon instructions which, when executed, cause a computing device to perform operations comprising:
loading an unsandbox associated with a user privilege level of a processor of the computing device; loading, via the unsandbox, a sandboxed application in the user privilege level; associating, via the unsandbox, descriptor logic a register associated with a processor of the computing device wherein the descriptor logic references a descriptor table and comprises one or more of a protection domain identifier, an extended descriptor bit, or an extended descriptor offset; executing the sandboxed application in response to enablement of an application sandbox mode of the processor; loading a logical address in response to execution of the sandboxed application, and enabling, within a single process, the application sandbox mode in response to storing an extended descriptor selector in a code segment register such that isolation of multiple components is achieved using the application sandbox mode within the single process.

12 . The non-transitory computer-readable medium of claim 11 , wherein the operations further comprise enabling the application sandbox mode in response to storage of the descriptor in the register.

13 . The non-transitory computer-readable medium of claim 11 , wherein the descriptor table comprises a hierarchical table having a first level and a second level, wherein the first level is indexed by the protection domain identifier associated with the descriptor logic and wherein the second level is indexed by the extended descriptor offset associated with the descriptor logic.

14 . The non-transitory computer-readable medium of claim 11 , wherein the operations further comprise prohibiting loading of the register with legacy descriptor logic in response to the enablement of the application sandbox mode, wherein the legacy descriptor logic references a local descriptor table or a global descriptor table.

15 . The non-transitory computer-readable medium of claim 11 , wherein the computing device comprises processing circuitry coupled to a memory, the processing circuitry having one or more of application processing circuitry or graphics processing circuitry.

Assignees

• Intel Corp

Inventors

• Lemay Michael
• Huntley Barry E
• Sahita Ravi

Classifications

• G06F2221/033

  Test or assess software · CPC title

• G06F12/00

  Accessing, addressing or allocating within memory systems or architectures (digital input from, or digital output to record carriers, e.g. to disk storage units, G06F3/06) · CPC title

• G06F21/1015

  to users · CPC title

• G06F2221/2113

  Multi-level security, e.g. mandatory access control · CPC title

• G06F21/74

  operating in dual or compartmented mode, i.e. at least one secure mode · CPC title