Access permissions modification

Patent metadata

Field	Value
Publication number	US-9852084-B1
Application number	US-201615017427-A
Country	US
Kind code	B1
Filing date	Feb 5, 2016
Priority date	Feb 5, 2016
Publication date	Dec 26, 2017
Grant date	Dec 26, 2017

Abstract

Systems, apparatuses, and methods for modifying access permissions in a processor. A processor may include one or more permissions registers for managing access permissions. A first permissions register may be utilized to override access permissions embedded in the page table data. A plurality of bits from the page table data may be utilized as an index into the first permissions register for the current privilege level. An attribute field may be retrieved from the first permissions register to determine the access permissions for a given memory request. A second permissions register may also be utilized to set the upper and lower boundary of a region in physical memory where the kernel is allowed to execute. A lock register may prevent any changes from being made to the second permissions register after the second permissions register has been initially programmed.

First claim

What is claimed is:

1. A processor comprising:
two or more permissions registers; and
one or more page tables;
wherein the processor is configured to:
retrieve a plurality of bits from page table data associated with a first address;
utilize the plurality of bits as an index into a first permissions register of the two or more permissions registers;
retrieve a first attribute field from the first permissions register at a location indexed by the plurality of bits;
utilize the first attribute field to determine access permissions to the first address; and
override the access permissions with different access permissions based on an access to a second permissions register of the two or more permissions registers, wherein the second permissions register defines an address range within which a kernel is allowed to execute.

2. The processor as recited in claim 1 , wherein the override is in response to determining the first address corresponds to a restricted address region.

3. The processor as recited in claim 2 , wherein the second permissions register includes an upper range boundary and a lower range boundary for the region where the kernel is allowed to execute, and wherein the processor is further configured to prevent the kernel from reading from or writing to the region defined by the upper range boundary and the lower range boundary.

4. The processor as recited in claim 3 , wherein the processor is further configured to prevent the kernel from executing outside of the region defined by the upper range boundary and the lower range boundary.

5. The processor as recited in claim 4 , wherein the processor is further configured to prevent the second permissions register from being written to responsive to a lock bit being set.

6. The processor as recited in claim 1 , wherein the access permissions comprise read, write, and execute permissions.

7. The processor as recited in claim 1 , wherein the plurality of bits include two access permission bits, an execute never bit, and a privileged access never bit.

8. A method comprising:
retrieving a plurality of bits from page table data associated with a first address;
utilizing the plurality of bits as an index into a first permissions register;
retrieving a first attribute field from the first permissions register at a location indexed by the plurality of bits;
utilizing the first attribute field to determine access permissions to the first address; and
overriding the access permissions with different access permissions based on an access to a second permissions register, wherein the second permissions register defines an address range within which a kernel is allowed to execute.

9. The method as recited in claim 8 , wherein the overriding is in response to determining the first address corresponds to a restricted address region.

10. The method as recited in claim 9 , wherein the second permissions register includes an upper range boundary and a lower range boundary for the region where the kernel is allowed to execute, the method further comprising preventing the kernel from reading from or writing to the region defined by the upper range boundary and the lower range boundary.

11. The method as recited in claim 10 , further comprising preventing the kernel from executing outside of the region defined by the upper range boundary and the lower range boundary.

12. The method as recited in claim 11 , further comprising preventing the second permissions register from being written to responsive to a lock bit being set.

13. The method as recited in claim 8 , wherein the access permissions comprise read, write, and execute permissions.

14. The method as recited in claim 8 , wherein the plurality of bits include two access permission bits, an execute never bit, and a privileged access never bit.

15. A computing system comprising:
a memory; and
a processor comprising:
two or more permissions registers; and
one or more page tables;
wherein the processor is configured to:
retrieve a plurality of bits from page table data associated with a first address;
utilize the plurality of bits as an index into a first permissions register of the two or more permissions registers;
retrieve a first attribute field from the first permissions register at a location indexed by the plurality of bits;
utilize the first attribute field to determine access permissions to the first address; and
override the access permissions with different access permissions based on an access to a second permissions register of the two or more permissions registers, wherein the second permissions register defines an address range within which a kernel is allowed to execute.

16. The computing system as recited in claim 15 , wherein the override is in response to determining the first address corresponds to a restricted address region.

17. The computing system as recited in claim 16 , wherein the second permissions register includes an upper range boundary and a lower range boundary for the region where the kernel is allowed to execute, and wherein the processor is further configured to prevent the kernel from reading from or writing to the region defined by the upper range boundary and the lower range boundary.

18. The computing system as recited in claim 17 , wherein the processor is further configured to prevent the kernel from executing outside of the region defined by the upper range boundary and the lower range boundary.

19. The computing system as recited in claim 18 , wherein the processor is further configured to prevent the second permissions register from being written to responsive to a lock bit being set.

20. The computing system as recited in claim 15 , wherein the access permissions comprise read, write, and execute permissions.

Assignees

• Apple Inc

Inventors

• Soderquist Peter G
• Kanapathipillai Pradeep
• Semeria Bernard J
• De Cesare Joshua P
• Williamson David J
• Williams Iii Gerard R

Classifications

• G06F2212/1052

  Security improvement · CPC title

• G06F12/1483 Primary

  using an access-table, e.g. matrix or list · CPC title

• G06F12/1009

  using page tables, e.g. page table structures · CPC title