Flexible memory protection for multicore processors

A system’s memory access control mechanisms profoundly impact the performance, reliability, security, and composability of the software it runs. Desirable features of an access control mechanism include: the ability to grant arbitrary permissions on any region of memory to any thread in the system; zero-copy sharing between threads with no restrictions on the set of sharers, region granularity, or sharing of pointer-based data structures; time and space overheads dependent only on the fundamental complexity of the access control being requested; and well-defined, hierarchical memory region ownership and permission semantics. The virtual-memory-based access control used in most modern systems, as well as recently proposed enhancements, fall short along one or more of these dimensions. We introduce Lumen, an access control scheme providing security, fault isolation, and efficient shared memory to any number of threads within a single address space. Lumen uses a new concurrent interval skip list (ISL) to scalably maintain and query a set of memory region descriptors containing permissions information. We describe a permissions and ownership system for memory regions that allows safe delegation of privileges between protection domains for sandboxing and software reusability purposes. We describe the LumenCache, which caches region permissions to avoid most ISL lookups. We discuss applications of Lumen in debugging, security, and reliability, and extensions to use Lumen for prefetching, profiling, and user-facing memory management features. Lumen offers scalable, flexible memory access control and the ability to trade off security, system reliability, and performance in a way not possible with existing solutions.

Name thesis:degree_name

M.S.

Level thesis:degree_level

Thesis

Discipline thesis:degree_discipline

Electrical & Computer Engr

Grantor

University of Illinois at Urbana-Champaign

Year dc:date

2013

Author dc:creator

• Johnson, Matthew

Contributors dc:contributor

• Patel, Sanjay J.

• Memory
• Multicore
• Processor Architecture
• Memory Systems
• Memory Protection
• Data Structures
• Concurrency
• Virtual Memory

Statement dc:rights

• Copyright 2013 Matthew R. Johnson

Language dc:language

en

Handle dc:identifier

http://hdl.handle.net/2142/44416

OAI identifier oai:identifier

oai:www.ideals.illinois.edu:2142/44416