Information about Memory Protection

Memory protection is a way for controlling memory usage on a computer, and is core to virtually every OS. The main purpose of memory protection is to prevent processes on an operating system from accessing the memory of other processes. This prevents

1. bug in one process affecting another process.
2. malicious software gaining unwanted access to the system.

Methods

There are different ways to achieve memory protection. These include: [1]

Segmentation

Segmentation refers to dividing a computer's memory into segments.

The x86 architecture has multiple segmentation features, which are useful for those who wish to use protected memory on this architecture. [2] On the x86 architecture, the Global Descriptor Table and Local Descriptor Tables can be used to reference segments in the computer's memory. Pointers to memory segments on x86 processors can also be stored in the processor's segment registers. Initially x86 processors had 4 segment registers, CS, SS, DS and ES; later another two segment registers were added – FS and GS. [3]

Paging

In paging, the memory address space is divided into equal, small pieces, called pages. Using a virtual memory mechanism, each page can be made to reside in any location of the physical memory, or be flagged as being protected. Paging makes it possible to have a linear virtual memory address space access pieces out of a fragmented physical memory space. It also can used to implement a system whereby memory not currently in used can be stored on disk stoage. On x86 based architectures, paging can also be used for memory protection.

A page table is used for mapping virtual memory to physical memory. The page table is usually invisible to the process. Page tables make it easier to allocate new memory, as each new page can be allocated from anywhere in physical memory.

When paging is used to store memory than is not currently in use onto disk, the OS copies pages onto disk, and sets a bit in the pages entry in the page table to signify that a given page is not currently available in the physical memory. Then when an application attempts to access memory that is not present, a page fault (#PF) is triggered. The OS will then catch the page fault (#PF), copy the page back to physical memory, possibly putting another page back onto disk in the process. The os can then mark the page as present, and return control to the application requesting the page.

Protection keys

A protection key mechanism divides physical memory up into blocks of a particular size (e.g. 2KB), each of which has an associated numerical value called a protection key. Each process also has a protection key value associated with it. On a memory access the hardware checks that the current process's protection key matches the value associated with the memory block being accessed; if not, an exception occurs. This mechanism was used in the System/360 architecture.

Simulated segmentation

Simulation is use of a monitoring program to interpret the machine code instructions of some computer. Such a simulator can provide memory protection by using a segmentation-like scheme and validating the target address and length of each instruction in real time before actually executing them. The simulator must calculate the target address and length and compare this against a list of valid address ranges that it holds concerning the thread's environment, such as any dynamic memory blocks acquired since the thread's inception plus any ("valid") shared static memory slots. The meaning of valid may change throughout the thread's life depending upon context. In other words, it may sometimes be allowed to alter a static block of storage, and sometimes not, depending upon the current mode of execution which may or may not depend on a storage key or supervisor state.

It is generally not advisable to use this method of memory protection where adequate facilities exist on a CPU, as this takes valuable processing power from the computer and could be compared to "reinventing the wheel".

Measures

A useful estimation of the protection level of a particular implementation, is to measure how closely it adheres to the principle of minimum privilege.^[1]

Memory protection in different operating systems

There are very few operating systems that do not use some form of memory protection. CP/M and all variants of MS-DOS lacked it. Even then, early versions of Microsoft Windows implemented memory protection on top of DOS.

Some operating systems that do implement memory protection include

• Microsoft(R) Windows family
• Linux
• BSD
• Mac OS X (Pre-OS X Mac OS had limited memory protection. Modern versions of Mac OS are based on the XNU Kernel)
• Other versions of UNIX

IA-32 & IA 64 Memory protection

On IA (Intel Architecture) 32 and 64 bit, memory is split into rings, from level 0 to level 3. Code in each ring can only access memory in the same ring and in rings of a higher number. An OS kernel always runs in ring 0, and in a standard design applications run in ring 3.

See also

• OLIVER (CICS interactive test/debug) a commercial software protection product for CICS utilizing simulation methodology.

Refs

External links

• http://www.intel.com/products/processor/manuals/index.htm - Intel Developer Manuals. These contain a lot more in depth information on memory protection, on the Intel based architectures.