Security configurations in page table entries for execution domains using a sandbox application operation

1. A computer system, comprising:

a memory configured to at least store instructions of routines of a predefined set of domains;

a processor coupled with the memory;

a memory management unit coupled between the processor and the memory, wherein the memory management unit is configured to manage a page table containing a page table entry that includes a security setting for each of the domains in the predefined set; and

a shadow cache structure having a first call stack and a second call stack;

wherein the memory management unit is configured to map a virtual memory address to a physical memory address using the page table entry during a call of a first routine to a second routine at the virtual memory address;

wherein the memory management unit is further configured to extract a first security setting from the page table entry based on a first domain in which the first routine is; and

wherein the computer system is configured to selectively implement a security operation for the call based at least in part on a value of the first security setting retrieved from the page table entry;

wherein the first routine is configured to use the first call stack and prevented from accessing the second call stack; and

wherein in response to the call, the second routine is configured to use the second call stack based on the value of the first security setting being equal to a predetermined value requiring a sandboxing operation.

2. The computer system of claim 1 , wherein the page table entry includes a base for a page of physical addresses.

3. The computer system of claim 2 , wherein the memory management unit is configured to combine the base and an offset specified in the virtual memory address to generate the physical address.

4. The computer system of claim 3 , wherein the predefined set of domains comprises at least one of a domain for hypervisor, a domain for operating system, or a domain for application, or any combination thereof.

5. The computer system of claim 1 , wherein in response to the call, the second routine is configured to use the first call stack based on the value of the first security setting being not equal to a predetermined value requiring the sandboxing operation.

6. The computer system of claim 1 , further comprising:

a first set of control registers configured to operate the first call stack; and

a second set of control registers configured to operate the second call stack.

7. The computer system of claim 5 , wherein each of the first set and the second set of control registers includes:

a stack pointer;

a frame pointer; and

an argument pointer.

8. The computer system of claim 7 , wherein at least a portion of content in the first call stack is replicated into the second call stack in response to the call for execution of the second routine.

9. The computer system of claim 3 , wherein the virtual memory address includes a plurality of virtual page numbers, including a last virtual page number; and the memory management unit is configured to index into the page table using the last virtual page number to locate the page table entry.

10. The computer system of claim 9 , wherein the page table is a last page table; and the memory management unit is further configured to index into a first page table using a first virtual page number in the plurality of virtual page numbers to retrieve a first page table entry that identifies the last page table.

11. A method, comprising:

receiving a request to call a second routine at a virtual memory address during an execution of a first routine;

determining a page table entry in translating the virtual memory address to a physical memory address;

identifying, among a plurality of predefined domains, an execution domain that contains the execution of the first routine;

retrieving, from the page table entry, a security setting specified for the execution domain;

executing, based at least in part on the security setting, the second routine using a shadow cache structure having a first stack and a second stack, where the second routine uses the second stack based on the security setting requiring a sandboxing operation when the first routine uses the first stack; and

preventing the first routine from accessing the second stack.

12. The method of claim 11 , further comprising:

extracting a base from the page table entry;

extracting an offset from the virtual memory address; and

combining the base and an offset to generate the physical memory address.

13. The method of claim 12 , wherein the plurality of predefined domains includes a domain for hypervisor.

14. The method of claim 12 , wherein the plurality of predefined domains includes a domain for operating system.

15. The method of claim 12 , further comprising:

copying at least a portion of the first stack into the second stack in response to the call and before the executing of the second routine using the second stack.

16. The method of claim 15 , further comprising:

erasing the second stack upon return of the second routine.

17. A computing device, comprising:

at least one register;

at least one execution unit;

a memory management unit having a page table entry containing a plurality of security settings corresponding to a plurality of predefined domains respectively; and

a shadow cache structure having a first stack and a second stack;

wherein, in response to a first routine executed in the computing device calling a second routine using a virtual memory address,

the memory management unit is configured to generate a physical memory address using the page table entry;

the computing device is configured to determine whether to perform a security operation based on a first security setting of the plurality of security settings, the first security setting corresponding to an execution domain of the first routine; and

based on the first security setting requiring a sandboxing operation, the computing device is configured to allocate the second stack for the second routine when the first routine uses the first stack and prevent the first routine from accessing the second stack.

18. The computing device of claim 17 , wherein:

the second stack is configured for execution of the second routine in response to the first routine calling the second routine using the virtual memory address based at least in part on the security operation.

19. The computing device of claim 18 , wherein the predefined domains comprise at least one of a domain of hypervisor, a domain of operating system, or a domain of application, or any combination thereof.