Intra-address space protection using segmentation hardware

The technological evolution towards extensible software systems and component-based software development requires efficient, flexible and easy-to-use protection mechanisms to isolate software modules residing in the same address space. While a number of software-based approaches have been proposed in the last several years, no clear winner emerges that satisfactorily addresses all the design issues involved in establishing multiple protection domains within an address space. This paper describes a novel intra-address space protection mechanism based on the segmentation and paging hardware in Intel's x86 architecture. Measurements from the prototype implementation indicate that a null protected procedure call and return costs about 147 CPU cycles on a Pentium 200 MHz machine.