Figure 4: User-level DMA based on extended shadow addressing
Although the previous solution achieves user-level DMA without
operating system kernel modifications,
it can theoretically be broken by a lucky user
who manages to guess another user's key. To avoid this problem,
we have developed a user-level DMA solution that makes the
identification of the process part of the shadow address.
That is, some bits (e.g. the highest ones) of the physical address
that will be passed as an argument to the DMA engine
correspond to the process identification. 
These bits are set by the operating system when it creates the mappings from
shadow virtual addresses to shadow physical addresses. Part of the
shadow physical address is now the CONTEXT_ID.
We envision the CONTEXT_ID to be 1-2 bits long. Thus, 2-4 processes
will be able to start user-level DMA operations from the same processor.
If more processes would like to start DMA operations, the rest will have
to go through the kernel. We believe that allowing 1-2 bits
of the physical address for the CONTEXT_ID is enough for most
practical cases.
A typical shadow address looks like:
A user-level DMA operation will be initiated exactly as the in the second SHRIMP solution - only the shadow addresses will be different - see figure 4
By checking the CONTEXT_ID, the DMA engine knows which process the shadow address belongs to. Effectively, this user-level DMA solution is similar, in principle, to the FLASH solution: in both cases the DMA engine knows which process issues which shadow access. The difference is that this information in our solution is embedded in the shadow address, while in the FLASH solution the operating system kernel is modified to pass the information to the DMA engine. If the DMA engine has several register contexts, it may save these addresses it receives in the appropriate contexts and start the DMA operations when all arguments are available. If the DMA engine has no register contexts, then when it receives pairs of STORE, and LOAD instructions, it checks for the CONTEXT_ID values of the two physical addresses. If they are different, the DMA operation is not started and an error code is returned by the last LOAD instruction.
