A Method for Isolating Virtual Memory Domains with Multiple Address Spaces across Architectures

Abstract

The present invention discloses a method for virtual memory domain isolation across architectures. Based on the memory domain primitives provided by hardware, by modifying the operating system kernel code, with a process architecture design of multiple address spaces, a finite number of physical memory domains are virtualized into an infinite number of virtual memory domains, providing sufficient memory domains for upper-layer application programs to support the establishment of a software security isolation architecture with scalable quantity. Through expanding the quantity of address spaces, the virtualization of finite physical memory isolation domains is achieved, and an infinite number of virtual memory isolation domains can be efficiently provided for applications. The design of this method is universal and can be applied to different processor architectures without relying on special processor features other than memory domain primitives. This method can provide an infinite number of memory isolation domains for target application programs to support the establishment of a software security isolation architecture with scalable quantity.

Description

Technical Field

[0001] The present invention relates to the field of software and hardware collaborative security, and specifically, to a method for isolating virtual memory domains across architectures with multiple address spaces. Background Art

[0002] In recent years, mainstream processor manufacturers have provided a hardware feature called memory domain primitives in their products, such as Intel Memory Protection Keys, ARM Memory Domains, IBM Power Protection Keys, etc. This feature extends the control of memory page permissions by processes. Memory domain primitives provide a certain number of memory isolation domains for upper-layer applications, dividing the memory of an address space into different memory domains. Each thread of a process can separately control the access permissions of each memory domain. In the page table entries and TLB entries of each level of page tables, a domain ID field is added to identify which memory domain a memory page belongs to. The access permissions for each memory domain are stored in a privilege register owned by each hardware thread, so the control of permissions is at the thread granularity. When a thread accesses memory, the processor first obtains the domain ID corresponding to the virtual address, and then checks the privilege register to see if the thread has the correct access permission. If not, an exception is triggered. Based on memory domain primitives, software can construct software partitions or data vaults, or be used in scenarios such as high-speed privilege switching for JIT code caches.

[0003] The number of memory domains provided by memory domain primitives for applications is limited. There are only 16 memory domains on Intel and ARM. However, in some protection scenarios, software has a large demand for the number of memory isolation domains, which is mainly reflected in the following three aspects: Many applications rely on a large number of third-party libraries, and many of these third-party libraries have CVEs or sensitive data, making the relationship between these dependent components untrusted. A large number of isolation domains need to be established for different components to achieve secure isolation between components; Server applications often have a large number of threads (more than 16), and each thread may have private sensitive data. For example, each thread in Apache httpd has the keys required for SSL connections, which requires a unique memory domain to be established for each thread to protect secure data; Persistent memory allows a large number of files to be accessed like memory, which requires a large number of isolation domains to avoid the persistent impact caused by memory damage.

[0004] Therefore, when using memory domain primitives to divide memory isolation domains for software, there is still a problem of insufficient number of memory domains, that is, although memory domain primitives can provide a certain number of memory isolation domains, their number is not sufficient to meet the security requirements of establishing a large number of isolation domains in real applications.

[0005] Currently, for the purpose of virtualizing the number of physical memory domains, there are three design solutions in the prior art:

[0006] (1) Hardware-based solution: This solution requires modifying the hardware design of the processor, but the invasive hardware modification hinders the wider use of this method.

[0007] (2) Hypervisor-based solution: This solution combines the Intel MPK memory domain primitive on Intel processors with the Intel VMFUNC feature, and uses the Extended pagetable feature to virtualize the physical memory domain. However, this method is only applicable to the Intel X86 architecture and requires the protected application to run in a virtual machine, which will bring additional virtualization overhead.

[0008] (3) Page table entry-based solution: This solution realizes the virtualization of memory domains on a single address space by operating on page table entries. However, its design requires frequent TLB flushing operations, and only a limited number of memory domain accesses are supported at the same time, introducing the overhead of busy waiting. This solution will introduce high performance overhead and lose the original efficient features of the memory domain primitive.

[0009] It can be seen that there are still many deficiencies in the prior art. Summary of the Invention

[0010] The object of the present invention is to propose a cross-architecture multi-address space virtualized memory domain isolation method for the problem of insufficient physical memory domains provided by hardware in the memory domain primitive.

[0011] The present invention is realized by the following technical solutions:

[0012] The present invention discloses a cross-architecture multi-address space virtualized memory domain isolation method. A process has an address space. Under the condition that the hardware has the memory domain primitive feature, each address space contains a certain number of physical memory isolation domains. By creating a process with multiple address spaces, the process is supported to establish an infinite number of virtual memory isolation domains, which specifically includes the following steps:

[0013] 1) Add a kernel abstract structure module to the operating system kernel; the kernel abstract structure module includes a virtual domain metadata structure and an address space structure; the virtual domain metadata structure is used to record the memory page information protected by each virtual domain in the process, and the address space structure is used to represent an address space in the process and record the mapping from the private physical memory domain to the virtual memory domain of this address space; all address spaces owned by the process share the memory mapping relationship from the virtual address space to the physical address space of the process;

[0014] 2) Add a virtual domain access processing module to the operating system kernel; the virtual domain access processing module is used to process the access of threads in a process to the virtual domains created by the process; the virtual domain access processing module makes a conditional determination based on the virtual domain metadata and address space established by the kernel abstraction structure module in step 1) for the process, and performs one of the operations of virtual domain mapping, thread migration, old virtual domain eviction, and address space switching according to the conditions; the operations make corresponding modifications to the virtual domain metadata and address space of the process, and create a new address space for the process when the number of virtual domains is insufficient to support the access of threads in the process to the virtual memory domains created by the process.

[0015] 3) Add a user-mode library module to the user space of the operating system; the user-mode library module provides a secure virtual memory domain usage interface for application programs based on the functions provided by the kernel abstraction structure module in step 1) and the virtual domain access processing module in step 2); the application program calls the function interface provided by the user-mode library module to establish an infinite number of virtual memory isolation domains.

[0016] As a further improvement, the memory isolation domain in the present invention is provided by hardware memory domain primitives. The hardware memory domain primitives divide the memory of a process into a certain number of memory regions. The process can have different access permissions to different memory regions, and each memory region is a memory isolation domain.

[0017] As a further improvement, the virtual memory isolation domain in the present invention is virtualized based on memory domain primitives and supports an infinite number of memory isolation domains.

[0018] As a further improvement, for the mapping from the private physical memory domain to the virtual memory domain in step 1) of the present invention, the physical memory domain is provided by hardware memory domain primitives. There is a certain number of physical memory domains in each address space. The memory domain primitives provide 16 physical memory domains for each address space. The physical memory domain to which a memory page belongs is identified by the domain ID field in the page table entry of the memory page. The domain ID of the physical memory domain is 0 - 15. The number of virtual domains owned by a process can be infinitely many, which is greater than the number 16 that can be identified by the domain ID. Each address space provides 16 physical memory domains, which can accommodate 16 virtual memory domains among all virtual memory domains. The address space structure maintains the private mapping from the physical memory domain to the virtual memory domain, and the mapping identifies the virtual memory domain corresponding to each physical memory domain in the current address space.

[0019] As a further improvement, the condition determination in step 2) of the present invention is that the virtual domain access processing module makes a condition determination based on the current virtual domain metadata of the process and the situation of the address space to decide what operation should be performed. After the process calls the user-mode library function interface in step 3) to create a new virtual domain, the operating system kernel does not immediately operate on the address space structure of the process;

[0020] When a thread in the process accesses the newly created virtual domain, the virtual domain access processing module of the operating system kernel starts to make a condition determination:

[0021] If there is an idle physical memory domain in the address space where the thread is located, perform a virtual domain mapping operation;

[0022] If there is no idle physical memory domain in the address space where the thread is located and the address space accommodates multiple threads, perform a thread migration operation;

[0023] If there is no idle physical memory domain in the address space where the thread is located, there are no other threads in this address space, and the application program limits that the thread only has one address space, perform an old virtual domain eviction operation;

[0024] If there is no idle physical memory domain in the address space where the thread is located, there are no other threads in this address space, and the application program limits that the thread can have multiple address spaces, perform an address space switching operation.

[0025] As a further improvement, the virtual domain mapping operation in step 2) of the present invention is specifically as follows: If there is an idle physical memory domain in the address space where the accessing thread is located, there is no need to create a new address space. The virtual domain access processing module maps the idle physical memory domain in the address space where the thread is located to the virtual memory domain to be accessed, and at the same time updates the page table entry corresponding to the memory page protected by the virtual domain, modifies the domain ID field in the page table entry, and binds the memory page to the idle physical domain.

[0026] As a further improvement, the thread migration operation in step 2) of the present invention is specifically as follows: If there is no idle physical memory domain in the address space where the accessing thread is located and the address space accommodates multiple threads, migrate the thread to another address space that can accommodate the thread. The virtual domain access processing module scans all the address spaces owned by the process where the thread is located. If there is another address space that can accommodate the thread, transfer the thread to the address space that can accommodate the thread; if there is no other address space that can accommodate the thread, create a new address space and transfer the thread to the newly created address space; the so-called accommodation means that there are enough physical domains in the address space to be mapped to the virtual domain to be accessed by the thread.

[0027] As a further improvement, in the old virtual domain eviction operation in step 2) of the present invention, if the address space where the thread is located has no free physical memory domains, there are no other threads in the address space, and the application limits the thread to only one address space, the virtual domain access processing module performs the old virtual domain eviction operation. In the address space owned by the thread, only 16 physical memory domains can be mapped to 16 virtual memory domains. The thread needs to access a newly created virtual memory domain, which is temporarily not mapped to a physical memory domain in the address space. The virtual domain access processing module selects an old virtual memory domain that has been mapped to a physical memory domain, evicts the mapping of the old virtual memory domain, and uses the resulting free physical domain for mapping the newly accessed virtual memory domain. Each address space of a process is bound to an independent address space identifier (ASID). When evicting an old virtual memory domain, only a local TLB flush operation of the CPU core is required.

[0028] As a further improvement, in the address space switching operation in step 2) of the present invention, if the address space where the thread is located has no free physical memory domain, and there are no other threads in the address space, and the application limits the thread to have multiple address spaces, then the virtual domain access processing module performs the address space switching operation; the newly created virtual memory domain is temporarily not mapped to the physical memory domain in the address space, and the new virtual domain created by the process needs to establish a mapping in other address spaces owned by the thread; the virtual domain access processing module switches the thread to the address space where the newly created virtual domain is located by switching the page table base address; each address space of the process is bound to an independent address space identifier (ASID), and no TLB flush operation is introduced when switching the address space.

[0029] As a further improvement, the user state library module in step 3) of the present invention is a dynamic link library in user state. The application establishes an unlimited number of virtual memory isolation domains for the application by calling the function interface provided by the user state library module.

[0030] The beneficial effects of the present invention are as follows:

[0031] To address the issue of insufficient physical memory domains provided by hardware in memory domain primitives, this paper proposes a method for cross-architecture multi-address space virtualized memory domain isolation. Based on the memory domain primitives provided by the hardware, this method modifies the operating system kernel code and uses a multi-address space process architecture design to virtualize a limited number of physical memory domains into an unlimited number of virtual memory domains. This provides sufficient memory domains for upper-level applications, enabling software to establish a scalable software security isolation architecture.

[0032] To achieve the virtualization of memory domains, this method designs and implements a process architecture based on multiple address spaces. By expanding the number of address spaces, it realizes the virtualization of limited physical memory isolation domains and can efficiently provide an infinite number of virtual memory isolation domains for applications. The design of this method is general and can be applied to different processor architectures without relying on special processor features other than memory domain primitives. This method can provide an infinite number of memory isolation domains for target applications to support the establishment of a scalable software security isolation architecture.

[0033] Compared with existing related solutions, this method does not require hardware modification, does not rely on other hardware features such as Intel VMFUNC, can be applied to multiple architectures, and brings little performance overhead to target applications.

[0034] Experiments prove that this method can efficiently achieve the virtualization of memory domains, provide infinite virtual memory domains for software, and only bring little performance overhead. Experiments on a Linux-based prototype system on a real platform show that when this method is applied to the multi-memory domain protection scenario of real server applications, the performance overhead brought by this method is at most only 2.65% under two processor architectures (X86 and ARM), and the overhead is less than other existing solutions. Specifically, using the present invention to protect the key structure in OpenSSL, allocating a separate virtual memory domain for each key, and testing with Apache httpd, the performance overhead on X86 and ARM is less than 2.18% and 2.65% respectively; using the present invention to protect the stack and memory data of threads in MySQL, allocating a separate virtual memory domain for the stack of each thread and a virtual memory for the database data in memory, the performance overhead on X86 and ARM is 0.47% and 2.59% respectively. In addition, the present invention has compatibility, is compatible with other Linux subsystems, and can be adapted to the existing Intel MPK software sandbox architecture on the X86 architecture. Description of the Drawings

[0035] Figure 1 It is a design diagram of a process architecture using a cross-architecture multi-address space virtualized memory domain isolation method;

[0036] Figure 2 It is a flowchart of the virtual domain access processing module;

[0037] Figure 3 It is a case flowchart of thread migration in the virtual domain access processing module. Detailed Implementation Manner

[0038] The following further describes the specific technical solutions of the present invention in conjunction with the drawings of the specification:

[0039] Figure 1 It is a process architecture design diagram using a method for cross-architecture multi-address space virtual memory domain isolation: a user-state library module for applications is newly added to the user space, and a kernel abstraction structure module and a virtual domain access processing module are newly added to the operating system kernel. A method for cross-architecture multi-address space virtual memory domain isolation includes the following steps:

[0040] 1) Add a kernel abstraction structure module to the operating system kernel; the kernel abstraction structure module includes a virtual domain metadata structure and an address space structure; the virtual domain metadata structure is used to record the memory page information protected by each virtual domain in the process, and the address space structure is used to represent an address space in the process and records the mapping from the private physical memory domain to the virtual memory domain of the address space; all address spaces owned by the process share the memory mapping relationship from the virtual address space to the physical address space of the process;

[0041] 2) Add a virtual domain access processing module to the operating system kernel; the virtual domain access processing module is used to process the access of threads in the process to the virtual domains created by the process; the virtual domain access processing module makes a conditional determination according to the virtual domain metadata and address space established by the kernel abstraction structure module in step 1) of the process, and performs one of the operations of virtual domain mapping, thread migration, old virtual domain eviction, and address space switching according to the conditions; the operation makes corresponding modifications to the virtual domain metadata and address space of the process, and creates a new address space for the process when the number of virtual domains is insufficient to support the access of threads in the process to the virtual memory domains created by the process;

[0042] 3) Add a user-state library module to the operating system user space; the user-state library module provides a secure virtual memory domain usage interface for applications based on the functions provided by the kernel abstraction structure module in step 1) and the virtual domain access processing module in step 2); the application calls the function interface provided by the user-state library module to establish an infinite number of virtual memory isolation domains.

[0043] Specifically, the transformed operating system kernel in the embodiment provides a virtual memory domain for upper-layer applications that is consistent with the semantics of the original memory domain primitives. The application can call the user-state library module of the present invention to construct an infinite number of virtual memory domains. The user-state library interacts with the kernel abstraction structure module and the virtual domain access processing module. The operating system kernel can automatically manage the threads and address spaces in the process according to the access order of the process to the virtual domains, and create multiple address spaces for the application process to support the creation of an infinite number of virtual memory domains by the process.

[0044] Specifically, based on the kernel abstract structure module, the operating system kernel allocates multiple address space structures for a process, and each address space maintains its own private mapping from the physical memory domain to the virtual memory domain. All the address spaces owned by the process share the memory mapping relationship of the process from the virtual address space to the physical address space. Figure 1 shows the abstract structure of a process in the kernel at a certain moment, including the virtual domain metadata structure and the address space structure of the process in the kernel. For the sake of concise description here, Figure 1 assuming that the processor provides 4 physical memory domains, in the actual hardware, the memory domain primitive provides 16 physical memory domains. The protected multi-threaded application process has 3 threads, where thread 1 and thread 2 are in address space 0, and thread 3 has two address spaces, address space 1 and address space 2. Thread 1 and thread 2 together only access 4 virtual memory domains, and one address space (address space 0) can accommodate the 4 virtual memory domains. Thread 3 accesses 7 virtual memory domains in total. Here, two address spaces are allocated for thread 3 to provide an additional number of memory domains for thread 3. Each address space has an independent mapping from the virtual memory domain to the physical memory domain, as shown in the mapping table in Figure 1 . In address spaces 0 and 1, physical memory domains 0, 1, 2, 3 all correspond to virtual memory domains 0, 1, 2, 3. In address space 2, physical memory domains 0, 1, 2, 3 correspond to virtual memory domains 0, 4, 5, 6. Multiple address spaces enable the process to establish an infinite number of virtual memory domains.

[0045] Figure 2It is a flowchart of the virtual domain access processing module, showing a series of steps that the operating system kernel needs to execute after a thread accesses a certain virtual memory domain. Specifically, when a thread in a process accesses a certain virtual memory domain, the virtual domain access processing module in step 2) needs to operate on the threads and address spaces owned by the process accordingly. When an application program executes, the threads it owns will access different virtual memory domains, and the access order determines the binding relationship between the generated threads and address spaces, as well as the mapping relationship from virtual domains to physical domains in different address spaces. When a thread in a process accesses a virtual domain, the virtual domain access processing module checks whether there is a mapping of this virtual domain in the address space where the thread is located (①). If there is a mapping of this virtual domain in the address space where the thread is located, that is, it has been mapped to a physical memory domain, then directly access it. If there is no mapping, then check whether there is an idle (i.e., not mapped to a virtual domain) physical domain in the current address space (②). If there is an idle physical domain, update the abstract structure of the process in the kernel. The update means mapping the virtual domain to be accessed to this idle physical domain (③). In addition, it is necessary to update the page table entries corresponding to the memory pages protected by this virtual domain, modify the domain ID field in the page table entries, and bind these memory pages to the idle physical domain. If there is no idle physical domain, then check whether there are other threads in the current address space (④). If there are no other threads in the current address space, perform an old virtual domain eviction or address space switching operation (⑤). Among them, if the application program limits that this thread only has one address space, perform an old virtual domain eviction operation; if the application program limits that this thread can have multiple address spaces, perform an address space switching operation. If there are other threads in the current address space, scan all the address spaces owned by the process to check whether there is another address space that can accommodate the current thread (⑥). If there is another address space that can accommodate it, migrate the current thread to the other address space that can accommodate it (⑧). If there is no other address space that can accommodate it, create a new address space (⑦), and migrate the current thread to the other address space that can accommodate it (⑧).

[0046] In step ⑤ of the flowchart of the virtual domain access processing module, if there is no free physical memory domain in the address space where the thread is located and there is no other thread in this address space, then an old virtual domain eviction or address space switching operation is performed. Among them, if the application program specifies that the thread only has one address space, then the old virtual domain eviction operation is performed; if the application program specifies that the thread can have multiple address spaces, then the address space switching operation is performed. For the old virtual domain eviction operation, in this one address space owned by the thread, only 16 physical memory domains can be mapped to 16 virtual memory domains. The thread needs to access a newly created virtual memory domain that is temporarily not mapped to a physical memory domain in the address space. The virtual domain access processing module selects an old virtual memory domain that has been mapped to a physical memory domain, evicts the mapping of this old virtual memory domain, and uses the obtained free physical domain for the mapping of the newly accessed virtual memory domain. This method binds each address space of the process to an independent address space identifier (ASID). When evicting the old virtual memory domain, only the TLB flushing operation local to the CPU core is required. For the address space switching operation, the new virtual domain created by the process needs to be mapped in other address spaces owned by this thread. The virtual domain access processing module switches to the address space where the virtual domain is located by switching the page table base address. This method binds each address space of the process to an independent address space identifier (ASID). When switching the address space, no TLB flushing operation is introduced.

[0047] Figure 3 It is a case flowchart of thread migration in the virtual domain access processing module. Figure 3 Assume that the underlying hardware provides 10 physical memory domains, with physical domain 0 being the default domain and physical domain 1 being used for the inaccessible domain. Figure 3Among them, Px represents the access permission of virtual domain x, and FA represents the read-write permission. Before thread migration, address space 0 accommodated a total of 6 threads. Among them, thread T and the other 5 threads belonged to address space 0. The virtual domains 0, 4, 14, 24, and 30 used by thread T were respectively mapped to physical domains 0, 5, 8, 2, and 4. In the thread context of thread T, the permission register field stored the permissions corresponding to the existing mapped virtual domains. For example, the permission of physical domain 0 and the permission of physical domain 2 were the permissions of virtual domain 24 (P24). Assume that the new virtual domain D has not been mapped in address space 0. At this time, since there is no free physical domain in address space 0 and there are other threads in address space 0. After checking, address space 1 can accommodate thread T. Therefore, the virtual domain access processing module needs to migrate thread T to address space 1. In address space 1, virtual domains 0, 24, and 30 have been mapped to physical domains 0, 4, and 5, and physical domains 6, 7, 8, and 9 are free physical domains. To implement thread migration, the virtual domain access processing module needs to map virtual domains 4, 14, and D in address space 1 to physical domains 6, 7, and 8, and update the virtual domain metadata structure and address space structure of the process. In addition, the permission register field in the thread context of thread T needs to be updated accordingly. For the page table entries, the virtual domain access processing module needs to modify the page table entries corresponding to virtual domains 4, 14, and D in address space 1 so that they are mapped to physical domains 6, 7, and 8, and switch the page table base address in the thread context of thread T to switch thread T to address space 1.

[0048] A method for isolating memory domains in a multi-address space virtualization across architectures is used. In the embodiment, multi-memory domain protection is applied to real servers such as OpenSSL and MySQL. The key structure in OpenSSL is protected using this method, and a separate virtual memory domain is assigned to each key. When tested using Apache httpd, it brings performance overheads of less than 2.18% and 2.65% on X86 and ARM respectively; the stack and memory data of threads in MySQL are protected using the present invention, a separate virtual memory domain is assigned to the stack of each thread, and a virtual memory is assigned to the database data in memory. It brings performance overheads of 0.47% and 2.59% on X86 and ARM respectively. In addition, this method has compatibility, is compatible with other Linux subsystems, and can adapt to the existing Intel MPK software sandbox architecture on the X86 architecture.

[0049] The above are only the preferred embodiments of the present invention. It should be noted that for those of ordinary skill in the art in this technical field, without departing from the core technical features of the present invention, several improvements and refinements can be made, and these improvements and refinements should also be regarded as the protection scope of the present invention.

Claims

1. A method for isolating virtual memory domains across architectures with multiple address spaces, characterized in that A process has an address space. Under the condition that the hardware has the memory domain primitive feature, each address space contains a certain number of physical memory isolation domains. By creating a process with multiple address spaces, the process is supported to establish an infinite number of virtual memory isolation domains. The specific steps are as follows: 1) Add a kernel abstract structure module to the operating system kernel; the kernel abstract structure module includes a virtual domain metadata structure and an address space structure; the virtual domain metadata structure is used to record the memory page information protected by each virtual domain in the process, and the address space structure is used to represent an address space in the process, recording the mapping from the private physical memory domain to the virtual memory domain in this address space; all address spaces owned by the process share the memory mapping relationship from the virtual address space to the physical address space of the process; 2) Add a virtual domain access processing module to the operating system kernel; the virtual domain access processing module is used to process the access of threads in the process to the virtual domains created by the process; the virtual domain access processing module makes a conditional determination according to the virtual domain metadata and address space established by the kernel abstract structure module in step 1) of the process, and performs one of the operations of virtual domain mapping, thread migration, old virtual domain eviction, and address space switching according to the conditions; the operation makes corresponding modifications to the virtual domain metadata and address space of the process, and creates a new address space for the process when the number of virtual domains is insufficient to support the access of threads in the process to the virtual memory domains created by the process; 3) Add a user-state library module to the user space of the operating system; the user-state library module provides a secure virtual memory domain usage interface for application programs based on the functions provided by the kernel abstract structure module in step 1) and the virtual domain access processing module in step 2); the application program calls the function interface provided by the user-state library module to establish an infinite number of virtual memory isolation domains.

2. The method for isolating virtual memory domains with multiple address spaces across architectures according to claim 1, wherein The memory isolation domain is provided by the hardware memory domain primitive, and the hardware memory domain primitive divides the memory of the process into a certain number of memory regions. The process can have different access permissions to different memory regions, and each memory region is a memory isolation domain.

3. The method for cross-architecture multi-address space virtualized memory domain isolation according to claim 1, characterized in that, The virtual memory isolation domain is virtualized based on the memory domain primitive and supports an infinite number of memory isolation domains.

4. The method for cross-architecture multi-address space virtualized memory domain isolation according to claim 1, wherein For the mapping from the private physical memory domain to the virtual memory domain in step 1), the physical memory domain is provided by the hardware memory domain primitive. The memory domain primitive provides 16 such physical memory domains for each address space, and each address space can accommodate 16 virtual memory domains among all virtual memory domains. The address space structure maintains the private mapping from the physical memory domain to the virtual memory domain, and the mapping identifies the virtual memory domain corresponding to each physical memory domain in the current address space.

5. The method for isolating virtual memory domains with multiple address spaces across architectures according to claim 1 or 4, characterized in that The conditional determination in step 2) is that the virtual domain access processing module makes a conditional determination according to the current situation of the virtual domain metadata and address space of the process to decide which operation should be performed. The specific method of making the conditional determination is as follows: When a thread in the process accesses a newly created virtual domain, the virtual domain access processing module of the operating system kernel starts condition judgment: If there is an idle physical memory domain in the address space where the thread is located, perform a virtual domain mapping operation; If there is no idle physical memory domain in the address space where the thread is located and multiple threads are accommodated, perform a thread migration operation; If there is no idle physical memory domain in the address space where the thread is located, there are no other threads in this address space, and the application program limits that the thread only has one address space, perform an old virtual domain eviction operation; If there is no idle physical memory domain in the address space where the thread is located, there are no other threads in this address space, and the application program limits that the thread can have multiple address spaces, perform an address space switching operation.

6. The method for cross-architecture multi-address space virtualized memory domain isolation according to claim 5, wherein The specific virtual domain mapping operation is that the virtual domain access processing module maps the idle physical memory domain in the address space where the thread is located to the virtual memory domain to be accessed, and at the same time updates the page table entry corresponding to the memory page protected by the virtual domain, modifies the domain ID field in the page table entry, and binds the memory page to the idle physical memory domain.

7. The method for cross-architecture multi-address space virtualized memory domain isolation according to claim 5, wherein The specific thread migration operation is that the virtual domain access processing module scans all the address spaces owned by the process where the thread is located. If there is another address space that can accommodate the thread, transfer the thread to the address space that can accommodate the thread; If there is no other address space that can accommodate the thread, create a new address space and transfer the thread to the newly created address space; the accommodation means that there are enough physical domains in the address space to be mapped to the virtual domain to be accessed by the thread.

8. The method for cross-architecture multi-address space virtualized memory domain isolation according to claim 5, wherein For the old virtual domain eviction operation, in the one address space owned by the thread, only 16 physical memory domains can be mapped to 16 virtual memory domains. The thread needs to access a newly created virtual memory domain, and the newly created virtual memory domain is not temporarily mapped to a physical memory domain in the address space; the virtual domain access processing module selects an old virtual memory domain that has been mapped to a physical memory domain, evicts the mapping of the old virtual memory domain, and uses the obtained idle physical domain for the mapping of the newly accessed virtual memory domain; each address space of the process is bound to an independent address space identifier (ASID). When evicting the old virtual memory domain, only the TLB flushing operation of the CPU core local is required.

9. The method for cross-architecture multi-address space virtualized memory domain isolation according to claim 6, wherein For the address space switching operation, the newly created virtual memory domain is not temporarily mapped to a physical memory domain in the address space, and the new virtual domain created by the process needs to establish a mapping in other address spaces owned by the thread; the virtual domain access processing module switches the thread to execute under the address space where the newly created virtual domain is located by switching the page table base address; each address space of the process is bound to an independent address space identifier (ASID). When switching the address space, no TLB flushing operation is introduced.

10. The method for isolating virtual memory domains with multiple address spaces across architectures according to claim 1, wherein The user-mode library module in step 3) is a dynamic link library in the user mode. The application program creates an infinite number of virtual memory isolation domains for the application program by calling the function interfaces provided by the user-mode library module.

Images