US 11,144,347 B2 · Protection domains for processes in shared address space

Abstract

Methods, systems and computer program products provide protection domains for processes in shared address space. Multiple processes may share address space, for example, in a software isolated process running on top of a library operating system (OS). A protection domain (PD), such as a Protection Key (PKEY), may be assigned to a process to protect its allocated address spaces from access by other processes. PDs may be acquired from a host OS. A library OS may manage PDs to protect processes and/or data. A PD may be freed and reassigned to a different process or may be concurrently assigned to multiple processes, for example, when the number of processes exceeds the number of protection domains. Threads spawned by a process may inherit protection provided by a PD assigned to the process. Process PDs may be disassociated with address spaces as they are deallocated for a process or its threads.

Claims20

Dependent claims

A method performed by at least one computing device for managing a plurality of protection domains (PDs) for a plurality of processes with shared address space, comprising:

creating a first process association between a first process in the plurality of processes and a first PD in the plurality of PDs;
creating a second process association between a second process in the plurality of processes and a second PD in the plurality of PDs;
allocating a first address range in the shared address space to the first process;
allocating a second address range in the shared address space to the second process;
associating the first PD with the first address range based on the first process association;
associating the second PD with the second address range based on the second process association;
and
creating a third process association between a third process in the plurality of processes and the first PD in the plurality of PDs when a quantity of the plurality of processes exceeds a quantity of the plurality of PDs.

5 more elements

A computing device, comprising:

one or more processors;
and
one or more memory devices that store program code configured to be executed by the one or more processors, the program code comprising:
a process manager configured to:
manage a plurality of process protection domains (PDs) for a plurality of processes in shared address space;
create a first process association between a first process in the plurality of processes and a first PD in the plurality of PDs;
and
create a second process association between a second process in the plurality of processes and a second PD in the plurality of PDs;
and
a memory manager configured to:
allocate a first address range in the shared address space to the first process;
allocate a second address range in the shared address space to the second process;
associate the first PD with the first address range based on the first process association;
and
associate the second PD with the second address range based on the second process association;
wherein the plurality of PDs are specified by a plurality of protective keys (PKEYs) and wherein access and write permissions are specified for each of the PKEYs in a register of the one or more processors.

13 more elements

A computer-readable storage medium having program instructions recorded thereon that, when executed by a processing circuit, perform a method for managing a plurality of protection domains (PDs) for a plurality of processes with a shared address space, comprising:

creating a first process association between a first process in the plurality of processes and a first PD in the plurality of PDs;
creating a first thread association between a first thread spawned by the first process, and the first PD based on the first process association;
creating a second process association between a second process in the plurality of processes and a second PD in the plurality of PDs;
creating a second thread association between a second thread spawned by the second process, and the second PD based on the second process association;
allocating a first address range, a second address range, a third address range, and a fourth address range in the shared address space to the first process, the second process, the first thread, and the second thread, respectively;
and
associating the first PD with the first address range based on the first process association, the second PD with the second address range based on the second process association, the first PD with the third address range based on the first thread association, and the second PD with the fourth address range based on the second thread association.

4 more elements

Dependencies are inferred from the claim text.

Protection domains for processes in shared address space

Life of this patent

Protection domains for processes in shared address space

Life of this patent

Abstract

Claims20