BR112021023258A2 - Execução de chamadas do sistema no espaço de endereço isolado no kernel do sistema operacional - Google Patents

Execução de chamadas do sistema no espaço de endereço isolado no kernel do sistema operacional

Info

Publication number
BR112021023258A2
BR112021023258A2 BR112021023258A BR112021023258A BR112021023258A2 BR 112021023258 A2 BR112021023258 A2 BR 112021023258A2 BR 112021023258 A BR112021023258 A BR 112021023258A BR 112021023258 A BR112021023258 A BR 112021023258A BR 112021023258 A2 BR112021023258 A2 BR 112021023258A2
Authority
BR
Brazil
Prior art keywords
kernel
address space
memory
processor
operating system
Prior art date
Application number
BR112021023258A
Other languages
English (en)
Portuguese (pt)
Inventor
James Bottomley
Kelly Nider Joel
Michael Rapoport
Original Assignee
Ibm
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Ibm filed Critical Ibm
Publication of BR112021023258A2 publication Critical patent/BR112021023258A2/pt

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • G06F9/545—Interprogram communication where tasks reside in different layers, e.g. user- and kernel-space
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/4401—Bootstrapping
    • G06F9/4406—Loading of operating system
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/02—Addressing or allocation; Relocation
    • G06F12/08—Addressing or allocation; Relocation in hierarchically structured memory systems, e.g. virtual memory systems
    • G06F12/10—Address translation
    • G06F12/1009—Address translation using page tables, e.g. page table structures
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14—Protection against unauthorised use of memory or access to memory
    • G06F12/1416—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights
    • G06F12/145—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14—Protection against unauthorised use of memory or access to memory
    • G06F12/1458—Protection against unauthorised use of memory or access to memory by checking the subject access rights
    • G06F12/1491—Protection against unauthorised use of memory or access to memory by checking the subject access rights in a hierarchical protection system, e.g. privilege levels, memory rings
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/30003—Arrangements for executing specific machine instructions
    • G06F9/3004—Arrangements for executing specific machine instructions to perform operations on memory
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/468—Specific access rights for resources, e.g. using capability register
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/10—Providing a specific technical effect
    • G06F2212/1052—Security improvement

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Databases & Information Systems (AREA)
  • Storage Device Security (AREA)
  • Hardware Redundancy (AREA)
  • Bus Control (AREA)
BR112021023258A 2019-05-19 2020-05-15 Execução de chamadas do sistema no espaço de endereço isolado no kernel do sistema operacional BR112021023258A2 (pt)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US16/416,229 US11194639B2 (en) 2019-05-19 2019-05-19 Executing system calls in isolated address space in operating system kernel
PCT/EP2020/063618 WO2020234155A1 (en) 2019-05-19 2020-05-15 Executing system calls in isolated address space in operating system kernel

Publications (1)

Publication Number Publication Date
BR112021023258A2 true BR112021023258A2 (pt) 2022-01-04

Family

ID=70779711

Family Applications (1)

Application Number Title Priority Date Filing Date
BR112021023258A BR112021023258A2 (pt) 2019-05-19 2020-05-15 Execução de chamadas do sistema no espaço de endereço isolado no kernel do sistema operacional

Country Status (12)

Country Link
US (1) US11194639B2 (https=)
EP (1) EP3973393B1 (https=)
JP (1) JP7546602B2 (https=)
KR (1) KR102612503B1 (https=)
CN (1) CN113711182B (https=)
AU (1) AU2020277632B2 (https=)
BR (1) BR112021023258A2 (https=)
CA (1) CA3137259A1 (https=)
IL (1) IL288057B2 (https=)
MX (1) MX2021013230A (https=)
SG (1) SG11202110222XA (https=)
WO (1) WO2020234155A1 (https=)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11799741B2 (en) * 2019-10-29 2023-10-24 Fannie Mae Systems and methods for enterprise information technology (IT) monitoring
US11586727B2 (en) * 2021-03-29 2023-02-21 Red Hat, Inc. Systems and methods for preventing kernel stalling attacks
CN114048502B (zh) * 2021-10-15 2023-08-15 中国科学院信息工程研究所 一种轻量级可信通道及其通信控制方法
CN116204884A (zh) * 2021-11-30 2023-06-02 华为技术有限公司 内核保护方法、装置及系统
US12254079B2 (en) * 2022-05-10 2025-03-18 International Business Machines Corporation Providing system services
CN117573419B (zh) * 2024-01-16 2024-04-26 上海芯联芯智能科技有限公司 一种页面异常处理方法及装置
CN119004420B (zh) * 2024-10-23 2025-08-15 浙江大华技术股份有限公司 一种权限控制方法、权限控制装置以及计算机存储介质

Family Cites Families (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7496576B2 (en) 2006-03-30 2009-02-24 Microsoft Corporation Isolated access to named resources
KR20080104591A (ko) * 2007-05-28 2008-12-03 삼성전자주식회사 메모리 보호 방법 및 장치
US10019327B1 (en) 2008-12-15 2018-07-10 Open Invention Network Llc System and method for hybrid kernel- and user-space incremental and full checkpointing
US9354977B1 (en) 2008-12-15 2016-05-31 Open Invention Network Llc System and method for hybrid kernel- and user-space incremental and full checkpointing
US8627451B2 (en) 2009-08-21 2014-01-07 Red Hat, Inc. Systems and methods for providing an isolated execution environment for accessing untrusted content
US8533418B2 (en) * 2010-06-30 2013-09-10 International Business Machines Corporation Memory allocation with identification of requesting loadable kernel module
US8677354B2 (en) 2010-07-12 2014-03-18 International Business Machines Corporation Controlling kernel symbol visibility and accessibility across operating system linkage spaces
US9323921B2 (en) 2010-07-13 2016-04-26 Microsoft Technology Licensing, Llc Ultra-low cost sandboxing for application appliances
US8954697B2 (en) * 2010-08-05 2015-02-10 Red Hat, Inc. Access to shared memory segments by multiple application processes
CN102308282A (zh) * 2011-07-20 2012-01-04 华为技术有限公司 多处理器体系结构远端内存访问的模拟方法及模拟器
US9152548B2 (en) * 2012-01-17 2015-10-06 Vmware, Inc. Controlling access to a privileged resource in user-mode system level mobile virtualization using a ptrace () system call
US9529614B2 (en) * 2012-03-05 2016-12-27 Board Of Regents The University Of Texas Systems Automatically bridging the semantic gap in machine introspection
CN102681940B (zh) * 2012-05-15 2015-06-10 北京航空航天大学 一种针对Linux操作系统内存管理子系统进行性能测试的方法
US10585801B2 (en) * 2012-11-26 2020-03-10 Advanced Micro Devices, Inc. Prefetch kernels on a graphics processing unit
US9910689B2 (en) * 2013-11-26 2018-03-06 Dynavisor, Inc. Dynamic single root I/O virtualization (SR-IOV) processes system calls request to devices attached to host
US9628279B2 (en) * 2014-09-30 2017-04-18 Microsoft Technology Licensing, Llc Protecting application secrets from operating system attacks
US10192067B2 (en) 2016-05-26 2019-01-29 Microsoft Technology Licensing, Llc Self-described security model for resource access
US11188365B2 (en) * 2016-11-29 2021-11-30 Red Hat, Inc. Memory overcommit by speculative fault
US10324838B2 (en) * 2017-10-12 2019-06-18 International Business Machines Corporation Virtually addressable hardware global kernel segment table
US10599835B2 (en) * 2018-02-06 2020-03-24 Vmware, Inc. 32-bit address space containment to secure processes from speculative rogue cache loads
US10698637B2 (en) * 2018-07-03 2020-06-30 Oracle International Corporation Stale block resynchronization in NVM based systems

Also Published As

Publication number Publication date
AU2020277632A1 (en) 2021-10-14
SG11202110222XA (en) 2021-10-28
JP2022534685A (ja) 2022-08-03
KR20210141682A (ko) 2021-11-23
EP3973393A1 (en) 2022-03-30
US20200364101A1 (en) 2020-11-19
CN113711182B (zh) 2025-02-11
JP7546602B2 (ja) 2024-09-06
WO2020234155A1 (en) 2020-11-26
IL288057B1 (en) 2024-02-01
IL288057B2 (en) 2024-06-01
CA3137259A1 (en) 2020-11-26
IL288057A (en) 2022-01-01
EP3973393B1 (en) 2024-08-07
AU2020277632B2 (en) 2023-07-06
CN113711182A (zh) 2021-11-26
US11194639B2 (en) 2021-12-07
KR102612503B1 (ko) 2023-12-08
MX2021013230A (es) 2022-01-06

Similar Documents

Publication Publication Date Title
BR112021023258A2 (pt) Execução de chamadas do sistema no espaço de endereço isolado no kernel do sistema operacional
US9589132B2 (en) Method and apparatus for hypervisor based monitoring of system interactions
TWI499979B (zh) 以交換式記憶體為手段來加速虛擬化或仿真化之方法、系統、及電腦可讀取媒體
US9176763B2 (en) Apparatus and method thereof for efficient execution of a guest in a virtualized environment
CN112236752A (zh) 用于改进软件容器性能和隔离的方法和系统
KR20190096959A (ko) 가상 머신 보안 어플리케이션을 위한 이벤트 필터링
EP3241149B1 (en) Method to isolate real-time or safety-critical software and operating system from non-critical software and operating system
US20160210069A1 (en) Systems and Methods For Overriding Memory Access Permissions In A Virtual Machine
US9952890B2 (en) Kernel state data collection in a protected kernel environment
US20130061012A1 (en) Virtual machine code injection
RU2015107219A (ru) Способы, системы и машиночитаемый носитель для активного контроля, защиты памяти и проверки целостности целевых устройств
DE102014003540A1 (de) Erzeugen einer isolierten ausführungsumgebung in einem co-designten prozessor
US9189620B2 (en) Protecting a software component using a transition point wrapper
EP2996043B1 (en) Debugging in a data processing apparatus
WO2009002756A2 (en) Leveraging transactional memory hardware to accelerate virtualization and emulation
EP2605136A1 (en) Leveraging transactional memory hardware to accelerate virtualization and emulation
US9536084B1 (en) Systems and methods for delivering event-filtered introspection notifications
US9596261B1 (en) Systems and methods for delivering context-specific introspection notifications
BR112021023211A2 (pt) Ambiente de execução limitada para kernel monolítico
US10198280B2 (en) Method and apparatus for hypervisor based monitoring of system interactions
US9531735B1 (en) Systems and methods for delivering introspection notifications from a virtual machine
US20140222410A1 (en) Hybrid emulation and kernel function processing systems and methods
US11461104B2 (en) Deferred system error exception handling in a data processing apparatus
Chen et al. Hyperhammer: Breaking free from kvm-enforced isolation
US10083125B2 (en) Method to efficiently implement synchronization using software managed address translation

Legal Events

Date Code Title Description
B06W Patent application suspended after preliminary examination (for patents with searches from other patent authorities) chapter 6.23 patent gazette]