Figure 12 — Unified Address Space
Memory, attached devices, and machine registers are all segments of one flat address space, all protected by the same Golden Token gate via mLoad. Without the right GT, any address range is unreachable. There is no separate I/O bus, no memory-mapped device backdoor, and no unprotected register file access.
32-bit Unified Address Space
MSB selects segment; remaining bits select offset within segment
MSB
Memory (MSB 0x00 – 0xFD)
0x00
Namespace C-Lists (capability storage)
Golden Tokens, entry metadata, seals, version counters
DATA Objects (structured data)
Accessed via DREAD (R perm) / DWRITE (W perm) with bounds
Code Segments (abstraction bodies)
Entered via CALL (E perm) or LAMBDA (X perm) only
Call Stack Frames
Self-describing tag=0 (CALL) / tag=1 (LAMBDA) frames
Thread Control Blocks
CR8 thread identity GT required for access
General-purpose memory (heap, constants, ...)
All require valid GT with appropriate R/W permissions
0xFD
Attached Devices (MSB 0xFE)
0xFE
UART, GPIO, timers, network — all gated by mLoad/mSave
Machine Register Bank (MSB 0xFF)
0xFF
CRs, DRs, flags, machine status — M-elevation for internal access
mLoad (Read Gate)
Every read-side instruction
passes through mLoad
1
Permission Gate (R/W/X/L/S/E)
2
Bounds Check
3
Version Match
4
MAC / Seal Verify
G
G-bit Reset (G←0)
6
CR Write
7
Thread Shadow
Any failure → FAULT
Permission Gate Table
R → DREAD
W → DWRITE
X → LAMBDA
L → LOAD
S → SAVE
E → CALL
memory
devices
regs
One Address Space, One Gate, One Rule
Every address — whether memory, device, or register — is unreachable without the right Golden Token.
There is no "other bus," no backdoor, no bypass. mLoad is the single read gate for all three segments.
Conventional vs. Unified
Conventional: Fragmented
Virtual memory (MMU/TLB, page tables)
Separate I/O bus (PCI, DMA, MMIO)
Privileged register access (ring-0 only)
3+ separate protection mechanisms
Each with its own bypass vulnerabilities
CTMM: Unified
One flat address space (MSB selects segment)
Devices at 0xFE (same GT gate as memory)
Registers at 0xFF (M-elevation, no ring change)
1 protection mechanism: mLoad + GT
Zero bypass paths (nothing else exists)
MSB Segment Decode
MSB Range
Segment
Gate / Access
0x00 – 0xFD
Memory
mLoad: R/W/X/L/S/E permission on GT
0xFE
Attached Devices
mLoad: same GT gate, device-specific perms
0xFF
Machine Register Bank
M-elevation bypasses perm (internal HW access)
Why Unified Matters
A single protection mechanism is auditable, verifiable, and has no seams to exploit.
Three separate mechanisms (VM, I/O bus, privileged regs) create three attack surfaces. One gate creates zero.
Attached Devices (MSB 0xFE)
Machine Registers (MSB 0xFF)
mLoad gate (single trust point)