Memory rights management

Abstract

In some examples, a method includes an operating system providing a plurality of address spaces for a process of an application to be executed, each of the plurality of address spaces including a respective different access right.

Description

TECHNICAL FIELD

[0001] The present application relates generally to managing memory permissions in a processor. BACKGROUND

[0002] Modern processors (CPUs) and multi-tasking operating systems (OS) provide memory protection, isolation and dynamic allocation through virtual memory. That is, each process is given a different address space, which is a view of virtual memory. Within a given address space, the operating system manages different physical memory granules that the corresponding process can access, with permissions including: read, write and / or execute; and attributes including: cacheable, shared, etc.

[0003] Computing systems typically use a memory management unit (MMU) to translate virtual addresses to physical addresses. In addition to performing the translation, the MMU can also control memory access permissions. However, managing memory access permissions is associated with many performance issues related to efficiency and latency. SUMMARY

[0004] It is an object of the present application to support fast changing of memory mapping sets without flushing fast translation buffers (or more generally, without disturbing hardware optimizations of virtual memory functionality), and with existing general-purpose processors.

[0005] The above and other objects are achieved by the features of the independent claims.

[0006] Further implementation forms are evident from the dependent claims, the description and the figures.

[0007] A first aspect of the present application provides a method, comprising: an operating system providing a plurality of address spaces for a process of an application to be executed, each of the plurality of address spaces comprising a respective different access permission.

[0008] Thus, full context switch overhead can be eliminated. Furthermore, there is no restriction on the architecture, design and implementation of the compiler to isolate the compiler functionality from the generated code.

[0009] In an implementation form of the first aspect, the operating system can maintain a description of the different access permissions for the process.

[0010] Each of the plurality of address spaces can correspond to a mode of the process, the process comprising a plurality of modes.

[0011] The process can indicate to the operating system when to switch from one of the plurality of address spaces to another of the plurality of address spaces based on the pattern.

[0012] A compiler associated with the process can provide different access permissions for memory mapping for the operating system.

[0013] Each of the plurality of address spaces can be associated with a single memory location in physical memory.

[0014] The method can further comprise the operating system assigning an address space identifier (ASID) to each of the plurality of address spaces.

[0015] The method can further comprise a virtual machine manager providing a plurality of address spaces for a virtual machine, each of the plurality of address spaces comprising a respective different access permission.

[0016] The method can comprise maintaining a description of the different access permissions for the virtual machine.

[0017] The method can comprise a virtual machine manager assigning a virtual machine identification (VMID) to each of the plurality of address spaces.

[0018] A second aspect of the application provides an apparatus for performing the method described herein.

[0019] The compiler can comprise a just-in-time (JIT) compiler.

[0020] The apparatus can be for allocating the access permissions using flags.

[0021] The processor-implemented instruction set architecture of the apparatus comprises x86-64, Armv7-VHE, Armv8-A, and RISC-V.

[0022] A third aspect of the application provides a computer-readable storage medium comprising computer program code, which computer program code is accessible from the apparatus comprising a processor to provide instructions and / or data to the apparatus, the computer program code for causing the apparatus, by means of the processor, to perform an operating system providing a process for an application to be executed with a plurality of address spaces, each of the plurality of address spaces comprising a respective different access permission.

[0023] These and other aspects of the application will become apparent from the following detailed description of one or more embodiments of the application. BRIEF DESCRIPTION OF DRAWINGS

[0024] For the purposes of the present application, the term "about" in relation to a measurement means ±10% of the stated measurement.

[0025] Figure 1 Flow chart of the method provided for one example;

[0026] Figure 2 Schematic diagram of the apparatus provided for one example. DETAILED DESCRIPTION

[0027] The exemplary embodiments will be described in sufficient detail that those skilled in the art can make and use the systems and processes described herein. It is to be understood that the examples are merely illustrative of specific embodiments that can be implemented to create the systems and processes described herein. Important aspects of the application can be embodied in many different forms, not just the specific examples disclosed herein; therefore general principles are used to illustrate generic and specific aspects of the application.

[0028] Thus, although the embodiments can be modified and various forms can be taken, specific embodiments are shown by way of example in the drawings and will herein be described in detail. It should be understood that the drawings to which reference is made in this patent are in schematic form. We do not intend to be bound by any specific form described herein, but on the contrary, we intend to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the appended claims. Elements of the example embodiments are, where appropriate, identically labeled with the same reference numerals throughout the several figures.

[0029] The terminology used herein to describe embodiments is not intended to be limiting in scope. Singular terminology is not intended as limiting of the number of elements and / or components described by the terminology to one unless the content clearly dictates otherwise. The terms "comprise," "comprising," "include," "including," and / or "contains" as used herein are specifically intended to be construed as including one or more elements or steps, whether or not related to those elements or steps are recited elsewhere herein. The description herein of any embodiments, including preferred embodiments, is specifically intended to be illustrative only and not limiting of alternative embodiments.

[0030] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein.

[0031] In modern instruction set architectures (x86, Arm, RISC-V, etc.), the address space is described by the operating system to the hardware memory management unit through "page tables." In practice, these form multi-level nested hash tables, using virtual memory addresses as input keys. The process of looking up an entry is called a "page table walk."

[0032] The page table itself is also stored in computer memory. Therefore, when a running process accesses memory, the MMU must first perform several serialized memory accesses to "go through the page table". Finally, it can verify permissions and attributes, determine the physical address of the memory the process wants to access, and then perform the expected memory access.

[0033] To avoid significant performance bottlenecks, modern processor MMU designs employ a hardware cache structure known as the "Translation Look-aside Buffer" (TLB). Page table walks can be avoided if a memory access matches an existing entry in the TLB (the exact heuristic for adding entries and evicting them from the cache is a trade secret of the processor design company).

[0034] On the other hand, whenever a page table entry is modified, the operating system must notify the MMU to invalidate any potentially outdated cached entries in the TLB. At some point, page table moves will occur again to generate updated cached entries as needed. Essentially, the TLB is optimized for scenarios where the memory permissions and mappings of a given process remain constant over time. If memory permissions change frequently, the TLB will not improve performance and may even degrade it.

[0035] When the OS scheduler switches running processes on a given CPU, the address space changes completely. To avoid having to completely flush TLB entries every time, the ISA typically defines a cache keying mechanism that isolates TLB entries by process (this key is called ASID on Arm and PCID on Intel / x86).

[0036] However, the problem persists when memory permissions (and / or physical mappings or attributes) are changed without altering the running process.

[0037] Specifically, these situations often arise with "just-in-time" (JIT) compilers that typically use some form of intermediate code representation (such as Java, .NET, JavaScript, or WebAssembler) to run applications. In these cases, the compiler needs to write to the machine a memory range containing the generated code, while the runtime needs to execute the same memory range. Furthermore, the generated code is often not trusted and should not be able to write to those memory ranges (or the compiler's memory range).

[0038] This not only requires flushing the TLB, but also updating potentially a large number of page table entries in the page table. For this, the JIT needs to influence a large number of system calls.

[0039] Current available solutions attempt to solve these problems by defining a new system control register that provides an indirect layer for memory mapping permissions, e.g. by designing a custom extension for the processor. The page table contains an index value instead of the permission flags. The system register of the processor defines a runtime mapping of the index value to the actual permission flags. However, this usually only works in privileged mode of the operating system and is not suitable for user mode processes. Another disadvantage of this approach is that it requires a new processor design to implement the functionality in hardware, thus incurring additional costs and increased complexity.

[0040] According to one example, a mechanism is provided that facilitates an application process to switch all of its memory mapping permissions in a single operation in a uniform manner without flushing fast translation buffers or otherwise disturbing hardware optimizations within a given implementation of virtual memory consisting of a given memory management unit. Furthermore, the mechanism is applicable to existing general-purpose / application processor designs.

[0041] Examples in this disclosure can be provided as methods, systems, or machine-readable instructions, such as any combination of software, hardware, firmware, etc. Such machine-readable instructions can be included in or on a computer-readable storage medium (including, but not limited to, disk memory, CD-ROM, optical memory, etc.) having computer-readable program code.

[0042] The methods, devices, and systems provided in connection with the examples of the disclosure can be described in connection with flow diagrams and / or block diagrams that illustrate the methods, devices, and systems. Although the flow diagrams show a particular order of execution, the order of execution can differ from that which is described. Blocks can be combined together or separated into separate blocks in some examples. Some blocks can not be required in some examples and / or additional blocks can be added. It should be understood that each block of the flow diagrams and / or block diagrams and combinations of flows and / or blocks in the flow diagrams and / or block diagrams can be implemented by machine-readable instructions.

[0043] For example, the machine readable instructions can be executed by a processor of a general purpose computer or other machine, a user device such as a smart phone, a special purpose computer, an embedded processor or other programmable data processing apparatus to implement a method, as described in the specification and drawings. In particular, a processor or processing apparatus can execute the machine readable instructions. Thus, a module of a device (e.g. a module implementing a comparator unit, or a firewall structure, etc.) can be implemented by a processor executing machine readable instructions stored in a memory, or a processor operating in accordance with instructions embedded in logic circuitry. The term 'processor' is to be interpreted broadly to include a CPU, processing unit, ASIC, logic unit or programmable gate array, etc. The methods and modules can be performed by a single processor or divided amongst several processors.

[0044] Such machine readable instructions can also be stored in a computer readable storage that can direct a computer or other programmable data processing apparatus to operate in a specific mode. For example, the instructions can be provided in a non-transitory computer readable storage medium encoded with instructions executable by a processor.

[0045] To avoid resetting the TLB, rewriting the page tables and placing many system calls, if the process is a JIT compiled environment, the present invention proposes to reserve multiple "copies" of the address space for a single process. These "copies" describe multiple address spaces (presumably two) with the same virtual-physical address mapping, but at least some of the mappings have different memory permissions. The present invention involves the interface between the software / application / process using the present invention and the software component (presumably an operating system kernel component) responsible for programming the virtual memory, to switch between address spaces without changing the active running process.

[0046] Figure 1 A flowchart of a method provided for one example. In block 101, an operating system (and / or an operating system kernel) provides a process for an application to be executed with multiple address spaces, each of the multiple address spaces comprising respective different access permissions. For example, a first address space of the multiple address spaces can comprise privileged (higher) access permissions compared to access permissions of a second address space of the multiple address spaces, or vice versa.

[0047] Each of the multiple address spaces can be associated with the same memory location in physical memory of the device. In other words, while the address spaces are associated with respective different access permissions, they can map (or correspond to) the same memory location in physical memory.

[0048] In existing operating systems, memory management interfaces provide a way to specify the intended memory permissions for a given memory mapping being created or modified, e.g., as three flags for read, write, and execute permissions.

[0049] To understand the present invention, a reference use case of an application running in a Just In Time (JIT) compiler environment on a processor complex is described. In this scenario, the execution flow of the application can alternate between running the JIT compiler's machine code to dynamically compile (or recompile) the application bytecode into machine code and running the machine code thus generated. In general, the compiler code will be more trusted than the application code, even though both are running in the same process. For example, the compiler code can be provided by a device vendor or an OS vendor, while the application code can be provided by a third party application developer. Thus, the JIT code can have more conceptual permissions and capabilities than the application code.

[0050] JIT compilers have become exceptionally complex, as many optimizations have been added to improve the runtime performance of the application. As a result, many popular JIT compilers have had and are likely to continue to have implementation or design flaws. These software vulnerabilities can be exploited by the application code, intentionally or unintentionally, to gain permissions: either to gain additional capabilities of the compiler, or as a step in a privilege escalation attack to gain higher permissions.

[0051] A JIT process not using the present invention typically has memory mappings using the following different combinations of permissions:

[0052] - read only data constants of the compiler and data constants of the generated code,

[0053] - read and write runtime data / state of the compiler and runtime data of the generated code,

[0054] - read and execute the compiler's own code,

[0055] - read, write, and execute the compiler generated code.

[0056] In one implementation of the method, new memory permissions can be defined. For example, in the scenario of using a JIT compiler, the following permissions can be distinguished between the compiler and the generated code. Specifically, the compiler generated code can have the following permissions:

[0057] - read and execute permissions (not write) at runtime of the generated code,

[0058] - read and write permissions (not execute) at runtime of the JIT compiler code.

[0059] Similar distinctions can also be made for non-code data mappings.

[0060] Although the above examples describe the present application with reference to a JIT compilation environment, the skilled person will readily appreciate that the present application can also be used for other types of application processes if different execution modes of a process at runtime (i.e. a compilation mode in which the compiler's own code is executed and a run mode in which the compiler generated code is executed) exhibit similar distinctions.

[0061] The operating system can maintain a description of different access permissions for a process. As mentioned above, these permissions can relate to write, read and execute. Each of the plurality of address spaces corresponds to a mode of the process, which comprises a plurality of modes. These modes can relate to the origin / type of the code being executed, but are not limited thereto.

[0062] The process can instruct the operating system when to switch from one of the plurality of address spaces to another of the plurality of address spaces based on the mode. For example, based on the mode, the process can instruct the operating system to switch from a privileged access mode (e.g. a mode in which write and execute are allowed) to a less privileged access mode (e.g. a mode in which only read is allowed). This instruction can be done by a thread of the process of the application. The compiler associated with the process can provide the operating system with different access permissions for the memory mapping.

[0063] The operating system can provide an address space identifier (ASID) for each of the plurality of address spaces. By providing a plurality of ASIDs for a single process, the need to flush the TLB cache can be eliminated. Flushing the TLB cache loses the performance advantages of using the TLB cache.

[0064] As mentioned above, the plurality of address spaces can define the same memory mapping but include different access permissions. Therefore, a separate mechanism to manage the memory mapping is not required. Normal memory management functions can be applied to all of the plurality of address spaces.

[0065] The method can include the hypervisor providing a plurality of address spaces for a virtual machine, each of the plurality of address spaces including a respective different access permission. The virtual machine can refer to an execution environment for a single application abstracted from the normal "native" execution environment of the ordinary application (e.g., a Java application running within a JVM, Java Virtual Machine), or to a virtualized computer system (including processor, memory, operating system, applications, and peripherals) running under a hypervisor. As noted above, the operating system can provide an ASID for a given application process's set of permissions for a plurality of address spaces. In the case where the application process includes a JIT compiler, the virtual machine can specify the execution environment for the application (i.e., the first scenario).

[0066] In other words, the invention can also exhibit a plurality of address spaces in the second stage of memory translation, which is used by the hypervisor to resolve and constrain memory accesses of the virtual machine in the form of a full operating system. That is, functionality can be provided to a qualified virtual machine (VM) in place of a process of an application to be executed. The virtual machine hypervisor can assign a virtual machine identification (VMID) for each of the plurality of address spaces. The virtual machine hypervisor can maintain a description of the different access permissions for the virtual machine. In other words, the invention can serve as an interface between the hypervisor, which manages the second stage translation tables, and the qualified VM.

[0067] Figure 2 A schematic diagram of an apparatus provided for one example. The apparatus 200 can be, for example, a computing system or apparatus, user device, network device (physical or virtual), or portions thereof. The apparatus 200 can include a processor 203 and a memory 205 coupled to the processor 203 and used to store instructions or program code 207 executable by the processor 203. The program code 203 can include instructions to cause the apparatus to provide, by an operating system, a plurality of address spaces for a process of an application to be executed, each of the plurality of address spaces including a respective different access permission.

[0068] According to one example, the machine readable instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or on the other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or on the other programmable apparatus provide operations for implementing the functions specified in the flowchart block or blocks and / or in the flowchart diagrams.

[0069] Furthermore, the teachings herein can be implemented in the form of software storable on a computer or non-transitory machine readable storage medium and including a plurality of instructions arranged to implement the methodologies described herein. Implementations of the various embodiments can include distribution of the software over network(s) coupled to one or more computers or one or more instances of cloud computing.

[0070] In some examples, some methods can be performed in a cloud computing or network-based environment. Cloud computing environments can provide various services and applications via the Internet. These cloud-based services (e.g., software as a service, platform as a service, infrastructure as a service, etc.) can be accessible through a web browser or other remote interface of a user device. Various functions described herein can be provided through a remote desktop environment or any other cloud-based computing environment.

[0071] Although various embodiments have been described herein in the context of fully functioning computing systems, one or more of these example embodiments can be distributed over a networked environment and executed by one or more computers or other processors. In some embodiments, individual operations of the example embodiments can be performed by one or more computer systems or processors that are configured through hardware and / or software. In some embodiments, the example embodiments can be executed by software modules being executed by one or more computers or other processors.

[0072] The above description is provided for the purpose of enabling a person skilled in the art to make and use the example embodiments disclosed herein. The example description is not intended to be exhaustive or to limit the application to the precise forms disclosed. Various modifications and changes are possible in the scope of the application. The embodiments disclosed herein are to be considered in all respects as illustrative only and not restrictive in any manner. Where ranges are provided, endpoints are included. Where ranges of variants are provided, individual variants are included. Where methods are provided, individual steps are included. Where numerical ranges are provided, individual numbers within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within the range are included. Where physical properties are provided, individual values within

Claims

1. A method characterized by, comprising: An operating system provides a process of an application to be executed with a plurality of address spaces, each of the plurality of address spaces comprising a respective different access permission.

2. The method of claim 1, wherein, comprising maintaining a description of the different access permissions for the process by the operating system.

3. The method according to claim 1 or 2, characterized in that, Each of the plurality of address spaces corresponds to a mode of the process, the process comprising a plurality of modes.

4. The method of claim 3, wherein, The process instructs the operating system when to switch from one of the plurality of address spaces to another of the plurality of address spaces based on the mode.

5. The method of claim 3, wherein, A compiler associated with the process provides the operating system with different access permissions for memory mapping.

6. The method according to any of the preceding claims, characterized in that, Each of the plurality of address spaces relates to a single memory location in physical memory.

7. The method according to any of the preceding claims, characterized in that, further comprising: The operating system assigns an address space identifier (ASID) for each of the plurality of address spaces.

8. The method according to any of the preceding claims, characterized in that, further comprising: A virtual machine manager provides a virtual machine with a plurality of address spaces, each of the plurality of address spaces comprising a respective different access permission.

9. The method of claim 8, wherein, comprising maintaining a description of the different access permissions for the virtual machine.

10. The method according to claim 8 or 9, characterized in that, The virtual machine manager assigns a virtual machine identification (VMID) for each of the plurality of address spaces.

11. An apparatus, comprising: for performing the method according to claims 1 to 10.

12. The apparatus of claim 11, wherein, The compiler comprises a just-in-time (JIT) compiler.

13. The apparatus of claim 11 or 12, wherein, The apparatus is for allocating the access permissions using flags.

14. The apparatus of claim 11, 12, or 13, wherein, The instruction set architecture implemented by the processor of the apparatus comprises x86-64, Armv7-VHE, Armv8-A, and RISC-V.

15. A computer-readable storage medium, characterized in that, comprising computer program code accessible by an apparatus comprising a processor to provide instructions and / or data to the apparatus, the computer program code for causing the apparatus to perform operations by the processor: An operating system provides a process of an application to be executed with a plurality of address spaces, each of the plurality of address spaces comprising a respective different access permission.

Images