Mondrian memory protection

Abstract

Mondrian memory protection (MMP) is a fine-grained protection scheme that allows multiple protection domains to flexibly share memory and export protected services. In contrast to earlier pagebased systems, MMP allows arbitrary permissions control at the granularity of individual words. We use a compressed permissions table to reduce space overheads and employ two levels of permissions caching to reduce run-time overheads. The protection tables in our implementation add less than 9% overhead to the memory space used by the application. Accessing the protection tables adds less than 8% additional memory references to the accesses made by the application. Although it can be layered on top of demandpaged virtual memory, MMP is also well-suited to embedded systems with a single physical address space. We extend MMP to support segment translation which allows a memory segment to appear at another location in the address space. We use this translation to implement zero-copy networking underneath the standard read system call interface, where packet payload fragments are connected together by the translation system to avoid data copying. This saves 52% of the memory references used by a traditional copying network stack.

DEMIX: Domain-Enforced Memory Isolation for Embedded System

“…For instance, hardware virtualization extensions [ 9 , 10 ], SGX enclaves [ 11 , 12 , 13 ], and tagged memory architectures [ 14 , 15 , 16 ], which are commonly used in security solutions, are unsuitable for low-end embedded devices due to the additional hardware costs and power consumption. To overcome this challenge, researchers have proposed alternative methods to enhance the security of embedded systems, such as the memory isolation technique [ 17 , 18 , 19 , 20 ]. This technology enhances the security of embedded systems by limiting the range of accessible code and data regions.…”

Code-Centric Domain Isolation : a hardware/software co-design for efficient program isolation

“…Mondriaan Memory Protection (MMP) builds on the PLB concepts [124,125], but instead provides memory protection at arbitrary granularity, as shown in Figure 2.1c. MMP also supports unsupervised domain switches, at the cost of an additional in-memory entry point table and a hardware CAM cache (the GLB) that controls the ability to switch domains at call/return boundaries.…”

“…Mondrix [124,125]: Implicitly switches domains using call/return instructions, as implemented by the second MMP design [125]. The benchmark optimistically approximates the cost of a domain switch using an instruction barrier.…”