Hardware-based memory protection

1. A computer-implemented method for hardware-based memory protection of a container-based virtualization environment, the method comprising:

establishing, for hardware-based memory protection of the container-based virtualization environment, a set of access identifiers for a container of a kernel process related to a memory component associated with the container-based virtualization environment;

receiving, by a processor hardware memory management engine, an access request from a first user process to a first portion of the memory component associated with the container-based virtualization environment;

detecting, by the processor hardware memory management engine with respect to the access request, a first candidate access identifier for the first portion of the memory component associated with the container-based virtualization environment;

identifying, by the processor hardware memory management engine, a first access identifier of the set of access identifiers that corresponds to the first portion of the memory component associated with the container-based virtualization environment;

determining, by the processor hardware memory management engine based on the first candidate access identifier and the first access identifier, a hardware-based memory protection response operation which pertains to the first portion of the memory component associated with the container-based virtualization environment;

carrying-out, by the processor hardware memory management engine, the hardware-based memory protection response operation which pertains to the first portion of the memory component associated with the container-based virtualization environment:

configuring, using the kernel process to manage access authority of the first user process to the memory component associated with the container-based virtualization environment, a group of hardware registers which have the set of access identifiers;

determining, by the processor hardware memory management engine based on the first candidate access identifier and the first access identifier of a first hardware register of the group of hardware registers, the hardware-based memory protection response operation which pertains to the first portion of the memory component associated with the container-based virtualization environment;

determining the hardware-based memory protection response operation which pertains to the first portion of the memory component associated with the container-based virtualization environment by the processor hardware memory management engine based on:

the first candidate access identifier,

the first access identifier of the first hardware register of the group of hardware registers, and

a second access identifier of a second hardware register of the group of hardware registers; and

configuring, using a hypervisor process to manage access authority of one or more processes to the memory component associated with the container-based virtualization environment, the second hardware register which has the second access identifier.

2. The method of claim 1 , further comprising:

comparing, to determine the hardware-based memory protection response operation which pertains to the first portion of the memory component associated with the container-based virtualization environment, the first candidate access identifier and the first access identifier.

3. The method of claim 1 , further comprising:

determining, by the processor hardware memory management engine based on the first candidate access identifier and the first access identifier, a hardware-based memory protection allowance operation which pertains to the first portion of the memory component associated with the container-based virtualization environment; and

carrying-out, by the processor hardware memory management engine, the hardware-based memory protection allowance operation which pertains to the first portion of the memory component associated with the container-based virtualization environment.

4. The method of claim 1 , further comprising:

determining, by the processor hardware memory management engine based on the first candidate access identifier and the first access identifier, a hardware-based memory protection disallowance operation which pertains to the first portion of the memory component associated with the container-based virtualization environment; and

carrying-out, by the processor hardware memory management engine, the hardware-based memory protection disallowance operation which pertains to the first portion of the memory component associated with the container-based virtualization environment.

5. The method of claim 1 , further comprising:

managing, by the processor hardware memory management engine, access from the kernel and first user processes to the memory component associated with the container-based virtualization environment.

6. The method of claim 1 , further comprising:

assigning, using a page table entry, individual access identifiers of the set of access identifiers to individual portions of the memory component associated with the container-based virtualization environment; and

identifying, by the processor hardware memory management engine using the page table entry, the first access identifier of the set of access identifiers that corresponds to the first portion of the memory component associated with the container-based virtualization environment.

7. The method of claim 1 , further comprising:

detecting, by the processor hardware memory management engine, a context switch with respect to the container; and

switching, by the processor hardware memory management engine in response to detecting the context switch with respect to the container, the first hardware register of the group of hardware registers.

8. The method of claim 1 , further comprising:

configuring, using a second user process to manage access authority of the first user process to the memory component associated with the container-based virtualization environment, the second hardware register which has the second access identifier.

9. The method of claim 1 , further comprising:

configuring, using the kernel process to manage access authority of one or more user processes to the memory component associated with the container-based virtualization environment, the second hardware register which has the second access identifier;

determining, by the processor hardware memory management engine based on the second access identifier of the second hardware register of the group of hardware registers, a hardware-based memory protection disallowance operation which pertains to the first portion of the memory component associated with the container-based virtualization environment; and

carrying-out, by the processor hardware memory management engine, the hardware-based memory protection disallowance operation which pertains to the first portion of the memory component associated with the container-based virtualization environment.

10. The method of claim 1 , further comprising:

performing, without a multithreading lock mechanism, the hardware-based memory protection of the container-based virtualization environment.

11. The method of claim 1 , further comprising:

managing, using the processor hardware memory management engine for hardware-based memory protection of the container-based virtualization environment, a plurality of containers of the kernel process related to the memory component associated with the container-based virtualization environment.

12. The method of claim 1 , further comprising:

introducing hardware-based memory protection of the container-based virtualization environment at a hardware-level using one or more labels to indicate one or more relationships with one or more portions of the memory component.

13. The method of claim 1 , further comprising:

executing, in a dynamic fashion to streamline hardware-based memory protection of the container-based virtualization environment, each operational step.

14. The method of claim 1 , further comprising:

executing, in an automated fashion without user intervention, each operational step.

15. The method of claim 1 , further comprising:

managing, by the processor hardware memory management engine, access from the kernel and first user processes to the memory component associated with the container-based virtualization environment;

configuring, using the kernel process to manage access authority of the first user process to the memory component associated with the container-based virtualization environment, a group of hardware registers which have the set of access identifiers;

determining, by the processor hardware memory management engine based on the first candidate access identifier and the first access identifier of a first hardware register of the group of hardware registers, the hardware-based memory protection response operation which pertains to the first portion of the memory component associated with the container-based virtualization environment;

assigning, using a page table entry, individual access identifiers of the set of access identifiers to individual portions of the memory component associated with the container-based virtualization environment;

identifying, by the processor hardware memory management engine using the page table entry, the first access identifier of the set of access identifiers that corresponds to the first portion of the memory component associated with the container-based virtualization environment;

detecting, by the processor hardware memory management engine, a context switch with respect to the container;

switching, by the processor hardware memory management engine in response to detecting the context switch with respect to the container, one or more hardware registers of the group of hardware registers;

determining the hardware-based memory protection response operation which pertains to the first portion of the memory component associated with the container-based virtualization environment by the processor hardware memory management engine based on:

the first candidate access identifier,

the first access identifier of the first hardware register of the group of hardware registers,

a second access identifier of a second hardware register of the group of hardware registers, and

a third access identifier of a third hardware register of the group of hardware registers;

configuring, using a second user process to manage access authority of the first user process to the memory component associated with the container-based virtualization environment, the second hardware register which has the second access identifier; and

configuring, using the kernel process to manage access authority of one or more user processes to the memory component associated with the container-based virtualization environment, the third hardware register which has the third access identifier.

16. A system for hardware-based memory protection of a container-based virtualization environment, the system comprising:

a memory having a set of computer readable computer instructions, and

a processor for executing the set of computer readable instructions, the set of computer readable instructions including:

establishing, for hardware-based memory protection of the container-based virtualization environment, a set of access identifiers for a container of a kernel process related to a memory component associated with the container-based virtualization environment;

receiving, by a processor hardware memory management engine, an access request from a first user process to a first portion of the memory component associated with the container-based virtualization environment;

detecting, by the processor hardware memory management engine with respect to the access request, a first candidate access identifier for the first portion of the memory component associated with the container-based virtualization environment;

identifying, by the processor hardware memory management engine, a first access identifier of the set of access identifiers that corresponds to the first portion of the memory component associated with the container-based virtualization environment;

determining, by the processor hardware memory management engine based on the first candidate access identifier and the first access identifier, a hardware-based memory protection response operation which pertains to the first portion of the memory component associated with the container-based virtualization environment;

carrying-out, by the processor hardware memory management engine, the hardware-based memory protection response operation which pertains to the first portion of the memory component associated with the container-based virtualization environment;

configuring, using the kernel process to manage access authority of the first user process to the memory component associated with the container-based virtualization environment, a group of hardware registers which have the set of access identifiers;

determining, by the processor hardware memory management engine based on the first candidate access identifier and the first access identifier of a first hardware register of the group of hardware registers, the hardware-based memory protection response operation which pertains to the first portion of the memory component associated with the container-based virtualization environment;

determining the hardware-based memory protection response operation which pertains to the first portion of the memory component associated with the container-based virtualization environment by the processor hardware memory management engine based on:

the first candidate access identifier,

the first access identifier of the first hardware register of the group of hardware registers, and

a second access identifier of a second hardware register of the group of hardware registers; and

configuring, using a hypervisor process to manage access authority of one or more processes to the memory component associated with the container-based virtualization environment, the second hardware register which has the second access identifier.

17. A computer program product for hardware-based memory protection of a container-based virtualization environment, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, the program instructions executable by a processor to cause the processor to perform a method comprising:

establishing, for hardware-based memory protection of the container-based virtualization environment, a set of access identifiers for a container of a kernel process related to a memory component associated with the container-based virtualization environment;

receiving, by a processor hardware memory management engine, an access request from a first user process to a first portion of the memory component associated with the container-based virtualization environment;

detecting, by the processor hardware memory management engine with respect to the access request, a first candidate access identifier for the first portion of the memory component associated with the container-based virtualization environment;

identifying, by the processor hardware memory management engine, a first access identifier of the set of access identifiers that corresponds to the first portion of the memory component associated with the container-based virtualization environment;

determining, by the processor hardware memory management engine based on the first candidate access identifier and the first access identifier, a hardware-based memory protection response operation which pertains to the first portion of the memory component associated with the container-based virtualization environment;

carrying-out, by the processor hardware memory management engine, the hardware-based memory protection response operation which pertains to the first portion of the memory component associated with the container-based virtualization environment;

configuring, using the kernel process to manage access authority of the first user process to the memory component associated with the container-based virtualization environment, a group of hardware registers which have the set of access identifiers;

determining, by the processor hardware memory management engine based on the first candidate access identifier and the first access identifier of a first hardware register of the group of hardware registers, the hardware-based memory protection response operation which pertains to the first portion of the memory component associated with the container-based virtualization environment;

determining the hardware-based memory protection response operation which pertains to the first portion of the memory component associated with the container-based virtualization environment by the processor hardware memory management engine based on:

the first candidate access identifier,

the first access identifier of the first hardware register of the group of hardware registers, and

a second access identifier of a second hardware register of the group of hardware registers; and

configuring, using a hypervisor process to manage access authority of one or more processes to the memory component associated with the container-based virtualization environment, the second hardware register which has the second access identifier.