Protection domains for a computer operating system

• US 7,213,247 B1
• Filed: 01/10/2000
• Issued: 05/01/2007
• Est. Priority Date: 01/10/2000
• Status: Expired due to Term

• Current Assignee: Wind River Systems Incorporated (Aptiv PLC)
• Original Assignee: Wind River Systems Incorporated (Aptiv PLC)
• Inventors: Gordon, John, Myers, Cy H., Koning, Maarten A., Wilner, David N., Long, Kent D., Fogelin, John C., Preyssler, Thierry C.
• Primary Examiner(s): BULLOCK JR, LEWIS ALEXANDER
• Application Number:
  US09/480,309
• Time in Patent Office: 2,668 Days
• Field of Search: 709/1, 709/100, 709/102, 709/104, 709/106, 717 1-178, 711 1-221, 718/1, 718100-108, 719310-332, 726 1- 26
• US Class Current: 718/100
• CPC Class Codes: G06F 9/44521 Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]

Abstract

A protection domain system is implemented to provide protection for applications executing in a computing environment. Protection domains are allocated system resources and may contain executing tasks. The protection domain system may allow tasks to access resources in other protection domains to which attachments have been made. Attachment is transparent to the software developer. The protection domain system provides flexibility in implementing operating system services and defining protection hierarchies.

Claims

1. A method, comprising the steps of:

loading a code module into a memory space of a first domain, wherein the first domain owns one of a kernel space and a portion of a user space, the code module including an instruction having a symbol reference;

determining if the symbol reference is to an external location outside of the memory space;

generating a link stub for the symbol reference when the symbol reference is to an external location to access the external location;

redirecting the instruction to the link stub; and

determining if the external location is within a second domain that is within a protection view of the first domain, wherein the second domain owns the other one of the kernel space and a portion of the user space;

requesting attachment of the second domain to the first domain when the second domain is determined not to be within the protection view of the first domain; and

attaching the second domain to the first domain using an attachment mechanism.

2. The method of claim 1, wherein the link stub is part of a linking table entry corresponding to the symbol reference.

3. The method of claim 1, wherein the link stub is a jump instruction to the external location.

4. The method of claim 1, further comprising the steps of:

determining whether the attachment request is permitted based on authorization information provided by the first domain;

wherein attachment to the second domain is not permitted when the attachment request is not permitted.

5. A method, comprising:

creating a task in a first domain, wherein the first domain owns one of a kernel space and a portion of a user space, the task executing a number of instructions;

executing a first jump instruction in the number of instructions that refers to a link stub corresponding to an external location in a second domain, wherein the second domain owns the other one of the kernel space and a portion of the user space;

executing the link stub;

comparing the external location to a task protection view;

generating a processing exception when the external location is outside the task protection view; and

executing an exception handling routine in response to the generation of the processing exception, the exception handling routine including,

saving a pre-exception setting of the task protection view,

altering the task protection view to include a protection view of the second domain, and

jumping to the external location.

6. The method of claim 5, wherein the link stub is part of linking table entry corresponding to the external location.

7. The method of claim 5, wherein the link stub includes a second jump instruction to the external location.

8. The method of claim 5, wherein the task protection view is saved on a task protection switch stack.

9. The method of claim 5, further comprising steps of:

retrieving the pre-exception setting of the task protection view;

restoring the task protection view using the pre-exception setting of the task protection view;

returning to a subsequent instruction to the first jump instruction in the number of instructions.