Physical memory isolation
Physical memory isolation in a virtualized system is described. A notification is received from a guest in the virtualized system that an address space isolation component has been created in the guest. At the host of the virtualized system, a memory isolation domain that is bound with the address space isolation component is created. The memory isolation domain includes a set of second level address translation tables dedicated for that memory isolation domain. Guest-physical address (GPA) range(s) are received from the guest that are mapped into memory of the guest, and memory access permissions for the GPA range(s) are received and are being mapped for a process into the created memory isolation domain. The host determines whether the mapping for the process into the created memory isolation domain is permitted. If not permitted, the mapping is blocked thereby preventing access. If permitted, the mapping is granted thereby allowing access.
1 . A method for physical memory isolation in a virtualized system, comprising:
receiving a notification from a guest in the virtualized system that an address space isolation component has been created in the guest;
creating, at a host of the virtualized system, a memory isolation domain that is bound with the address space isolation component, wherein the memory isolation domain includes a set of second level address translation (SLAT) tables dedicated for that memory isolation domain;
receiving, from the guest, a set of one or more guest-physical address (GPA) ranges that are mapped into memory of the guest and receiving memory access permissions to use for the GPA range that is being mapped for a process into the created memory isolation domain, wherein the host maintains multiple memory isolation domains and GPA mappings for each of the memory isolation domains;
determining, at the host, whether the mapping for the process into the created memory isolation domain is permitted;
responsive to determining that the mapping for the process is not permitted, blocking the mapping thereby preventing access; and
responsive to determining that the mapping for the process is permitted, granting the mapping and thereby allowing access.
2 . The method of claim 1 , wherein determining that the mapping for the process is permitted includes determining that the set of GPA ranges is not currently mapped to any of the memory isolation domains of the virtualized system.
3 . The method of claim 1 , wherein determining that the mapping for the process is permitted includes determining that the set of GPA ranges is already mapped with different memory access permissions inside of the memory isolation bound that is bound with the address space isolation component.
4 . The method of claim 1 , wherein determining that the mapping for the process is permitted includes determining that the set of GPA ranges is mapped with a same memory access permissions inside a different memory isolation domain from the memory isolation domain that is bound with the address space isolation component.
5 . The method of claim 1 , wherein determining that the mapping for the process is not permitted includes determining that none of the following conditions exist:
the set of GPA ranges is not currently mapped to any of the memory isolation domains of the virtualized system;
the set of GPA ranges is already mapped with different memory access permissions inside of the memory isolation bound that is bound with the address space isolation component; and
the set of GPA ranges is mapped with a same memory access permissions inside a different memory isolation domain from the memory isolation domain that is bound with the address space isolation component.
6 . The method of claim 1 , wherein the host does not track virtual memory area (VMA) region of the guest.
7 . A computing device that implements a virtualized system, comprising:
a processor; and
a non-transitory machine-readable storage medium that provides instructions that, if executed by the processor cause the computing device to perform operations including:
receiving a notification from a guest in the virtualized system that an address space isolation component has been created in the guest;
creating, at a host of the virtualized system, a memory isolation domain that is bound with the address space isolation component, wherein the memory isolation domain includes a set of second level address translation (SLAT) tables dedicated for that memory isolation domain;
receiving, from the guest, a set of one or more guest-physical address (GPA) ranges that are mapped into memory of the guest and receiving memory access permissions to use for the GPA range that is being mapped for a process into the created memory isolation domain, wherein the host maintains multiple memory isolation domains and GPA mappings for each of the memory isolation domains;
determining, at the host, whether the mapping for the process into the created memory isolation domain is permitted;
responsive to determining that the mapping for the process is not permitted, blocking the mapping thereby preventing access; and
responsive to determining that the mapping for the process is permitted, granting the mapping and thereby allowing access.
8 . The computing device of claim 7 , wherein determining that the mapping for the process is permitted includes determining that the set of GPA ranges is not currently mapped to any of the memory isolation domains of the virtualized system.
9 . The computing device of claim 7 , wherein determining that the mapping for the process is permitted includes determining that the set of GPA ranges is already mapped with different memory access permissions inside of the memory isolation bound that is bound with the address space isolation component.
10 . The computing device of claim 7 , wherein determining that the mapping for the process is permitted includes determining that the set of GPA ranges is mapped with a same memory access permissions inside a different memory isolation domain from the memory isolation domain that is bound with the address space isolation component.
11 . The computing device of claim 7 , wherein determining that the mapping for the process is not permitted includes determining that none of the following conditions exist:
the set of GPA ranges is not currently mapped to any of the memory isolation domains of the virtualized system;
the set of GPA ranges is already mapped with different memory access permissions inside of the memory isolation bound that is bound with the address space isolation component; and
the set of GPA ranges is mapped with a same memory access permissions inside a different memory isolation domain from the memory isolation domain that is bound with the address space isolation component.
12 . The computing device of claim 7 , wherein the host does not track virtual memory area (VMA) region of the guest.
13 . A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor of a computing device that implements a virtualized system, will cause the computing device to perform operations including:
receiving a notification from a guest in the virtualized system that an address space isolation component has been created in the guest;
creating, at a host of the virtualized system, a memory isolation domain that is bound with the address space isolation component, wherein the memory isolation domain includes a set of second level address translation (SLAT) tables dedicated for that memory isolation domain;
receiving, from the guest, a set of one or more guest-physical address (GPA) ranges that are mapped into memory of the guest and receiving memory access permissions to use for the GPA range that is being mapped for a process into the created memory isolation domain, wherein the host maintains multiple memory isolation domains and GPA mappings for each of the memory isolation domains;
determining, at the host, whether the mapping for the process into the created memory isolation domain is permitted;
responsive to determining that the mapping for the process is not permitted, blocking the mapping thereby preventing access; and
responsive to determining that the mapping for the process is permitted, granting the mapping and thereby allowing access.
14 . The non-transitory machine-readable storage medium of claim 13 , wherein determining that the mapping for the process is permitted includes determining that the set of GPA ranges is not currently mapped to any of the memory isolation domains of the virtualized system.
15 . The non-transitory machine-readable storage medium of claim 13 , wherein determining that the mapping for the process is permitted includes determining that the set of GPA ranges is already mapped with different memory access permissions inside of the memory isolation bound that is bound with the address space isolation component.
16 . The non-transitory machine-readable storage medium of claim 13 , wherein determining that the mapping for the process is permitted includes determining that the set of GPA ranges is mapped with a same memory access permissions inside a different memory isolation domain from the memory isolation domain that is bound with the address space isolation component.
17 . The non-transitory machine-readable storage medium of claim 13 , wherein determining that the mapping for the process is not permitted includes determining that none of the following conditions exist:
the set of GPA ranges is not currently mapped to any of the memory isolation domains of the virtualized system;
the set of GPA ranges is already mapped with different memory access permissions inside of the memory isolation bound that is bound with the address space isolation component; and
the set of GPA ranges is mapped with a same memory access permissions inside a different memory isolation domain from the memory isolation domain that is bound with the address space isolation component.
18 . The non-transitory machine-readable storage medium of claim 13 , wherein the host does not track virtual memory area (VMA) region of the guest.