WO2019085811A1 - 一种实现驱动的系统及方法 - Google Patents

一种实现驱动的系统及方法 Download PDF

Info

Publication number
WO2019085811A1
WO2019085811A1 PCT/CN2018/111815 CN2018111815W WO2019085811A1 WO 2019085811 A1 WO2019085811 A1 WO 2019085811A1 CN 2018111815 W CN2018111815 W CN 2018111815W WO 2019085811 A1 WO2019085811 A1 WO 2019085811A1
Authority
WO
WIPO (PCT)
Prior art keywords
interrupt
driver
user space
space
interrupt processing
Prior art date
Application number
PCT/CN2018/111815
Other languages
English (en)
French (fr)
Inventor
吴彩娣
吕达夫
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2019085811A1 publication Critical patent/WO2019085811A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/48—Program initiating; Program switching, e.g. by interrupt
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management

Definitions

  • the present application relates to, but is not limited to, computer technology, and more particularly to a system and method for implementing a driver.
  • the user space input/output interface (UIO) driver in the Linux kernel (Linux kernel) is taken as an example.
  • the UIO user space (Userspace) implements mmap(), which is used to process device memory. Mapping. If the UIO driver waits for an interrupt in user space, it needs to simply block the read read() operation of /dev/uioX.
  • the kernel space of the UIO driver (Kernelspace) still needs to set the interrupt handler function, so that when the device generates When interrupted, the kernel space response is interrupted, the interrupt calculator is incremented by 1, and the read() operation returns immediately.
  • the UIO driver implements the poll() system call, which can be used to wait for an interrupt to occur.
  • the registered UIO device will appear under /sys/class/uioX, and control of the device can be done by reading and writing each file under /sys/class/uioX.
  • TEE Trusted Execution Environment
  • the present invention provides a system and method for implementing a driver, which can implement a TA driver to manage a user's driver, and can greatly reduce the complexity of program development.
  • the present invention provides a system for implementing a driver, including: a user space and a kernel space, wherein the user space is provided with: a first trusted execution environment internal application programming interface, a security application, and a driver. Program; the kernel space is provided with: a second trusted execution environment internal application programming interface, a trusted execution environment framework, and a secure operating system; wherein
  • An attribute for driving the security application is configured in the driver
  • the first trusted execution environment internal application programming interface and the second trusted execution environment internal application programming interface are used to implement internal calls between the user space, the kernel space, and the user space and the kernel space. ;
  • the trusted execution environment framework based on the security operating system, parses and drives an attribute of the security application when loading the driver to complete allocation of resources, register driving, and map a device physical address to a corresponding virtual address. At least one function in space.
  • the kernel space is further configured with: a user space driving framework;
  • the trusted execution environment framework is further configured to: when a user space-driven interrupt needs to be registered, establish a separate interrupt processing thread for the driver that needs to respond to the interrupt;
  • a user space driving framework configured to save an interrupt processing thread established by the trusted execution environment framework, a correspondence relationship between an interrupt processing function in the user space, and an interrupt number of the interrupt, and is programmed by the second trusted execution environment internal application program
  • the interface calls the interrupt processing function common to the registered user space driving device; when an interrupt occurs, the user space driving framework calls a general interrupt processing function, and wakes up the corresponding interrupt processing thread according to the interrupt number corresponding to the generated interrupt in the corresponding relationship,
  • the entry address of the user space interrupt handler is passed to the wakeup interrupt handler thread.
  • the application also provides a method for implementing a driver, including:
  • the kernel space loads the driver, parsing the attribute of the driving security application to complete at least one function of allocating resources, registering the driver, and mapping the device physical address to the corresponding virtual address space, wherein the attribute of the driving security application is User space configuration.
  • the method further includes:
  • the kernel space When a user space driven interrupt needs to be registered, the kernel space establishes a separate interrupt processing thread for the driver that the interrupt needs to respond to;
  • the kernel space saves a correspondence between the established interrupt processing thread, the interrupt processing function in the user space, and the interrupt number of the registered interrupt, and registers an interrupt processing function common to the user space driving device;
  • the kernel space calls a general interrupt processing function, and wakes up the corresponding interrupt processing thread according to the interrupt number corresponding to the generated interrupt in the corresponding relationship, and transmits the entry address of the driving user space interrupt processing function to the wakeup. Interrupt processing thread.
  • the present application further provides a computer readable storage medium storing computer executable instructions for performing the method of implementing the driving described in any of the above.
  • the present application further provides an apparatus for implementing a driver, including a memory and a processor, wherein the memory stores the following instructions executable by the processor: when the kernel space loads the driver, parsing the attribute of the driving security application to At least one function of allocating resources, registering drivers, mapping device physical addresses to corresponding virtual address spaces is completed, wherein the attributes of the driving security application are configured in a user space.
  • the memory further stores the following instructions executable by the processor:
  • the kernel space When it is necessary to register a user space driven interrupt, the kernel space establishes a separate interrupt processing thread for the driver that the interrupt needs to respond; the kernel space saves the established interrupt processing thread, the user space interrupt processing function, and Corresponding relationship of the interrupt number of the registered interrupt, registering an interrupt processing function common to the user space driving device; when an interrupt is generated, the kernel space calls a general interrupt processing function according to the corresponding interrupt in the corresponding relationship The corresponding interrupt number wakes up the corresponding interrupt processing thread, and transmits the entry address of the driving user space interrupt processing function to the wake-up interrupt processing thread.
  • the technical solution of the present application at least includes: configuring a property of the driver TA in the user space; when loading the driver in the kernel space, parsing the attribute of the driver TA to complete the allocation of the resource, registering the driver, and mapping the physical address of the device to the corresponding virtual address space. At least one feature.
  • the code of the driver is in the user space, and no need to be integrated with the OS, and the development, integration and management of the user driver in the form of TA is completely realized.
  • sysfs to record information such as memory mapping of user space drivers. All user space drive information is only in the driver TA and TEE dynamically running memory, so no information leakage is caused, and the driver is guaranteed. safety.
  • the application further includes: when registering the user space-driven interrupt, the kernel space establishes a separate interrupt processing thread for the driver TA that the interrupt needs to respond; the kernel space saves the established interrupt processing thread, and the user space interrupts.
  • the correspondence between the processing function and the interrupted interrupt number of the registered register registers the interrupt processing function common to the user space driving device; when an interrupt is generated, the kernel space calls a general interrupt processing function according to the interrupt corresponding to the generated interrupt in the corresponding relationship. The number wakes up the corresponding interrupt processing thread, and passes the entry address of the driven user space interrupt handler to the awakened interrupt handler thread.
  • interrupt registration can still use the scheme of calling the interrupt registration API, so the user does not need to perceive the internal processing flow; only need to use separate high-priority threads to handle the interrupt, thus ensuring the timeliness of the interrupt response to the greatest extent.
  • FIG. 1 is a schematic diagram of the composition of a system for implementing driving according to the present application
  • FIG. 2 is a flow chart of a method for implementing driving according to the present application.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory.
  • RAM random access memory
  • ROM read only memory
  • Memory is an example of a computer readable medium.
  • Computer readable media includes both permanent and non-persistent, removable and non-removable media.
  • Information storage can be implemented by any method or technology.
  • the information can be computer readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transportable media can be used to store information that can be accessed by a computing device.
  • computer readable media does not include non-transitory computer readable media, such as modulated data signals and carrier waves.
  • TEE Trusted Execution Environment
  • DRM digital rights protection
  • FIG. 1 is a schematic diagram of a system for implementing a driver according to the present application.
  • the user space and the kernel space are included, wherein at least a first TEE internal application programming interface (API, Application) is set in the user space.
  • API application programming interface
  • TA Security Application
  • TA Trusted Application
  • drivers such as driver TA (Driver TA)
  • at least the kernel space is set: second TEE Internal API, TEE framework (Framework), and secure operating system (Secure OS) );among them,
  • the first TEE Internal API and the second TEE Internal API are used to implement internal calls within the user space, inside the kernel space, and between the user space and the kernel space.
  • the TA calls the first TEE Internal AP
  • the first TEE Internal API of the user space invokes the second TEE Internal API of the kernel space through sysycall, so that the second TEE Internal API can call the interface of other modules in the kernel space, and implement the terminology.
  • Well-known techniques of those skilled in the art are not intended to limit the scope of the invention.
  • the configuration is similar to that of the normal TA. These properties are placed in a special section when compiled.
  • the TEE framework based on the security OS, parses the attributes of the driver TA when loading the driver to complete at least one of the functions of allocating resources, registering drivers, and mapping device physical addresses to corresponding virtual address spaces.
  • the driver code is in the user space driver TA, and does not need to be integrated with the OS, and fully realizes the development integration and management of the user driver in the form of TA. Moreover, there is no need to use sysfs to record information such as memory mapping of user space drivers. All user space drive information is only in the driver TA and TEE dynamically running memory, so no information leakage is caused, and the driver is guaranteed. safety.
  • the related functions such as calling mmap(), driver registration, etc. displayed by the developer that does not need to be driven by the driver need to simply configure the attributes of the driver TA, and the development method of the ordinary TA is kept as much as possible. Consistently, this reduces the workload of third-party driver developers; moreover, it does not require the participation of sysfs, which realizes the hidden danger of driverless information leakage and ensures the security of the driver.
  • the third-party driver has been integrated into the TEE in a TA manner, thus implementing a dynamic update using TAM, which reduces driver integration costs.
  • the TEE framework is also used to: when an external developer such as a driver needs to register a user space driven interrupt, establish a separate interrupt processing thread for the driver TA that needs to respond to the interrupt;
  • the interrupt processing thread switches to the interrupt handler that drives the user space and handles the interrupt.
  • the code of the interrupt driver is driven in the user space TA, and does not need to be integrated with the OS, and fully realizes development, integration and management of the user driver in the form of TA.
  • the interrupt registration can still adopt the scheme of calling the interrupt registration API, so the user does not need to perceive the internal processing flow; when an interrupt occurs, the interrupt is only processed by a separate high-priority thread, so that To ensure the timeliness of the interrupt response to the greatest extent.
  • the developer of the driver is not required to perceive the memory mapping, the registration driver, the user space response interrupt needs to wait for the device read operation, etc.
  • the implementation-driven provided in the present application In the system, memory mapping, driver registration only need to configure the driver's attributes, and the interrupt still uses the method of calling the interrupt registration function, which is consistent with the related technology in the kernel space development driver, which greatly reduces the driver. The complexity of development.
  • FIG. 2 is a flowchart of a method for implementing driving according to the present application. As shown in FIG. 2, the method includes:
  • the attributes include, but are not limited to, a name of the driver, a physical address to be mapped, and a corresponding virtual address.
  • the configuration is similar to that of the normal TA. These properties are placed in a special section when compiled.
  • the driver TA includes one or more, and a third-party TA may correspond to one driver TA.
  • Step 201 Based on the security OS, when the kernel space loads the driver, parse the attribute of the driver TA to complete at least one function of allocating resources, registering the driver, and mapping the device physical address to the corresponding virtual address space.
  • the driver code is in the user space driver TA, and does not need to be integrated with the OS, and fully realizes development, integration and management of the user driver in the form of TA. Moreover, there is no need to use sysfs to record information such as memory mapping of user space drivers. All user space drive information is only in the driver TA and TEE dynamically running memory, so no information leakage is caused, and the driver is guaranteed. safety.
  • the method for implementing the driver does not require the driver to display the related functions of calling mmap(), driver registration, etc., and only needs to simply configure the attributes of the driver TA, and the development method of the ordinary TA is kept as much as possible. Consistently, this reduces the workload of third-party driver developers; moreover, it does not require the participation of sysfs, which realizes the hidden danger of driverless information leakage and ensures the security of the driver.
  • the third-party driver has been integrated into the TEE in a TA manner, thus implementing a dynamic update using TAM, which reduces driver integration costs.
  • the method for implementing the driving of the application further includes:
  • the kernel space When it is necessary to register a user space driven interrupt, the kernel space establishes a separate interrupt processing thread for the driver TA that the interrupt needs to respond to;
  • the kernel space saves the correspondence between the interrupt processing thread established in the user space, the interrupt processing function in the user space, and the interrupt number of the registered interrupt, and registers the interrupt processing function common to the user space driving device;
  • the kernel space calls a general interrupt processing function, and wakes up the corresponding interrupt processing thread according to the interrupt number corresponding to the generated interrupt in the corresponding relationship, and transmits the entry address of the driving user space interrupt processing function to the wake-up interrupt processing. Thread.
  • the interrupt processing thread switches to the interrupt handler that drives the user space and handles the interrupt.
  • the code of the interrupt driver is driven in the user space TA, and the integration processing with the OS is not required, and the development, integration and management of the user driver in the form of TA are completely realized.
  • the interrupt registration can still adopt the scheme of calling the interrupt registration API, so the user does not need to perceive the internal processing flow; when an interrupt occurs, the interrupt is only processed by a separate high priority thread, so that To ensure the timeliness of the interrupt response to the greatest extent.
  • the developer of the driver is not required to perceive the memory mapping, the registration driver, the user space response interrupt needs to wait for the operation on the device, and the like, and the implementation-driven provided in the present application
  • memory mapping, driver registration only need to configure the driver's attributes, and the interrupt still uses the method of calling the interrupt registration function, which is consistent with the related technology in the kernel space development driver, which greatly reduces the driver.
  • the complexity of development is to say, through the method for implementing the driver provided by the application, the developer of the driver is not required to perceive the memory mapping, the registration driver, the user space response interrupt needs to wait for the operation on the device, and the like, and the implementation-driven provided in the present application
  • the driver is integrated in the manner of TA, which not only facilitates the development and integration of the driver, but also facilitates the dynamic installation, deletion and update operations of the driver using TAM.
  • the application further provides a computer readable storage medium storing computer executable instructions for performing the method of implementing the driving described in any of the above.
  • the present application also provides an apparatus for implementing a driver, including a memory and a processor, wherein the memory stores the following instructions executable by the processor: when the kernel space loads the TA, parsing the attributes of the driver TA to complete the allocation of resources And registering the driver, mapping the device physical address to at least one function in the corresponding virtual address space, wherein the attribute of the driving security application is configured in the user space.
  • the memory further stores the following instructions executable by the processor:
  • the kernel space When registering a user space driven interrupt, the kernel space establishes a separate interrupt processing thread for the driver TA that the interrupt needs to respond to; the kernel space saves the established interrupt processing thread, and drives the interrupt processing function in the user space.
  • the kernel space corresponds to the interrupt number of the interrupt, registering an interrupt processing function common to the user space driving device; when an interrupt is generated, the kernel space wakes up the corresponding interrupt processing thread according to the interrupt number, and drives the user space interrupt processing function.
  • the entry address is passed to the wakeup interrupt handler thread.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Stored Programmes (AREA)
  • Storage Device Security (AREA)
  • Vehicle Body Suspensions (AREA)
  • Control Of Multiple Motors (AREA)
  • Diaphragms For Electromechanical Transducers (AREA)

Abstract

本申请公开了一种实现驱动的系统及方法，包括：在用户空间配置驱动TA的属性；内核空间加载驱动程序时，解析驱动TA的属性，以完成分配资源、注册驱动、将设备物理地址映射到对应的虚拟地址空间上中的至少一个功能。通过本申请提供的方案，驱动程序的代码均在用户空间，不需要再与OS进行集成处理，完全实现了以TA的形式对用户的驱动程序进行开发集成和管理。而且，不需要使用sysfs记录用户空间驱动的内存映射等信息，所有的用户空间的驱动信息都只在驱动的TA中和TEE动态运行的内存中，因此不会造成信息泄露，保证了驱动程序的安全性。

Description

一种实现驱动的系统及方法
本申请要求2017年11月06日递交的申请号为201711078956.3、发明名称为“一种实现驱动的系统及方法”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及但不限于计算机技术，尤指一种实现驱动的系统及方法。
背景技术
目前，在驱动的实现中，以Linux内核(Linux kernel)中实现用户空间的输入/输出接口(UIO)驱动为例，UIO的用户空间(Userspace)实现了mmap()，用于处理设备内存的映射。如果UIO的驱动程序在用户空间要等待一个中断，需要简单的阻塞在/dev/uioX的读read()操作上，UIO驱动的内核空间(Kernelspace)仍需要设置中断处理函数，这样，当设备产生中断时，内核空间应答中断，中断计算器加1，read()操作立即返回。另外，UIO的驱动程序实现了poll()系统调用，可以使用select()函数来等待中断的发生。注册的UIO设备将会出现在/sys/class/uioX下，对设备的控制可以通过对/sys/class/uioX下的各文件读写来完成。
从相关技术中在Linux内核中实现用户空间的UIO驱动的方案来看，一方面，一部分驱动程序仍然运行在内核空间，因此，是无法以安全应用(TA，Trusted Application)的方式对用户空间的驱动进行开发集成的，也就无法使用可信应用管理(TAM)程序进行动态安装、升级。另一方面，需要驱动程序的开发者显示的调用mmap()、驱动注册等函数，增加了设计的复杂度，不适合在小型的操作系统(OS，Operation System)中使用，而且sysfs中的信息存在安全泄漏问题，不适合在可信执行环境(TEE)中使用；再者，用户空间等待一个中断需要等待(wait)在设备的读操作上，与原有非UIO驱动程序的开发行为不统一，对于初始开发者，无疑增加了理解复杂度。
发明内容
为了解决上述技术问题，本发明提供一种实现驱动的系统及方法，能够实现以TA的方式对用户的驱动程序进行管理，而且能够很大程度上减轻程序开发的复杂度。
为了达到本发明目的，本发明提供了一种实现驱动的系统，包括：用户空间和内核 空间，其中，用户空间中设置有：第一可信执行环境内部应用程序编程接口、安全应用，以及驱动程序；内核空间中设置有：第二可信执行环境内部应用程序编程接口、可信执行环境框架，以及安全操作系统；其中，
所述驱动程序中配置有驱动所述安全应用的属性；
所述第一可信执行环境内部应用程序编程接口与所述第二可信执行环境内部应用程序编程接口，用于实现用户空间内部、内核空间内部，以及用户空间与内核空间之间的相互调用；
所述可信执行环境框架，基于所述安全操作系统，在加载所述驱动程序时，解析驱动所述安全应用的属性，以完成分配资源、注册驱动、将设备物理地址映射到对应的虚拟地址空间中的至少一个功能。
可选地，所述内核空间中还设置有：用户空间驱动框架；
所述可信执行环境框架还用于：在需要注册用户空间驱动的中断时，为该中断需要响应的驱动程序建立一个单独的中断处理线程；
用户空间驱动框架，用于保存所述可信执行环境框架建立的中断处理线程、用户空间中中断处理函数和该中断的中断号的对应关系，被所述第二可信执行环境内部应用程序编程接口调用注册用户空间驱动设备通用的中断处理函数；当有中断产生时，用户空间驱动框架调用通用的中断处理函数，根据对应关系中与产生的中断对应的中断号唤醒对应的中断处理线程，将用户空间中断处理函数的入口地址传给唤醒的中断处理线程。
本申请还提供了一种实现驱动的方法，包括：
内核空间加载驱动程序时，解析驱动安全应用的属性，以完成分配资源、注册驱动、将设备物理地址映射到对应的虚拟地址空间上中的至少一个功能，其中，所述驱动安全应用的属性在用户空间配置。
可选地，所述方法还包括：
在需要注册用户空间驱动的中断时，所述内核空间为该中断需要响应的驱动程序建立一个单独的中断处理线程；
所述内核空间保存建立的中断处理线程、所述用户空间中中断处理函数和该所述注册的中断的中断号的对应关系，注册所述用户空间驱动设备通用的中断处理函数；
当有中断产生时，所述内核空间调用通用的中断处理函数，根据对应关系中与产生的中断对应的中断号唤醒对应的中断处理线程，将驱动用户空间中断处理函数的入口地址传给唤醒的中断处理线程。
本申请又提供了一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行上述任一项所述的实现驱动的方法。
本申请再提供了一种用于实现驱动的装置，包括存储器和处理器，其中，存储器中存储有以下可被处理器执行的指令：内核空间加载驱动程序时，解析驱动安全应用的属性，以完成分配资源、注册驱动、将设备物理地址映射到对应的虚拟地址空间上中的至少一个功能，其中，所述驱动安全应用的属性在用户空间配置。
可选地，所述存储器中还存储有以下可被处理器执行的指令：
在需要注册用户空间驱动的中断时，所述内核空间为该中断需要响应的驱动程序建立一个单独的中断处理线程；所述内核空间保存建立的中断处理线程、所述用户空间中中断处理函数和所述注册的中断的中断号的对应关系，注册所述用户空间驱动设备通用的中断处理函数；当有中断产生时，所述内核空间调用通用的中断处理函数，根据对应关系中与产生的中断对应的中断号唤醒对应的中断处理线程，将驱动用户空间中断处理函数的入口地址传给唤醒的中断处理线程。
本申请技术方案至少包括：在用户空间配置驱动TA的属性；内核空间加载驱动程序时，解析驱动TA的属性，以完成分配资源、注册驱动、将设备物理地址映射到对应的虚拟地址空间上中的至少一个功能。通过本申请提供的方案，驱动程序的代码均在用户空间，不需要再与OS进行集成处理，完全实现了以TA的形式对用户的驱动程序进行开发集成和管理。而且，不需要使用sysfs记录用户空间驱动的内存映射等信息，所有的用户空间的驱动信息都只在驱动的TA中和TEE动态运行的内存中，因此不会造成信息泄露，保证了驱动程序的安全性。
可选地，本申请还包括：在注册用户空间驱动的中断时，内核空间为该中断需要响应的驱动的TA建立一个单独的中断处理线程；内核空间保存建立的中断处理线程、用户空间中中断处理函数和该注册的中断的中断号的对应关系注册用户空间驱动设备通用的中断处理函数；当有中断产生时，内核空间调用通用的中断处理函数，根据对应关系中与产生的中断对应的中断号唤醒对应的中断处理线程，将驱动用户空间中断处理函数的入口地址传给唤醒的中断处理线程。本申请提供的实现驱动的方案中，一方面，中断驱动程序的代码均在用户空间，不需要再与OS进行集成处理，完全实现了以TA的形式对用户的驱动程序进行开发集成和管理。另一方面，中断注册仍可以采用调用中断注册API的方案，因此，用户无需感知内部处理流程；只需利用单独高优先级线程处理中断，这样，最大程度上保证了中断响应的及时性。
本发明的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本发明而了解。本发明的目的和其他优点可通过在说明书、权利要求书以及附图中所特别指出的结构来实现和获得。
附图说明
附图用来提供对本申请技术方案的进一步理解，并且构成说明书的一部分，与本申请的实施例一起用于解释本申请的技术方案，并不构成对本申请技术方案的限制。
图1为本申请实现驱动的系统的组成示意图；
图2为本申请实现驱动的方法的流程图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚明白，下文中将结合附图对本申请的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
在本申请一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括非暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行。并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的 顺序执行所示出或描述的步骤。
可信执行环境(TEE)通过硬件的隔离，可确保在一个孤立、可信的环境中存储、处理和保护敏感数据。TEE广泛用于各种安全应用，如支付、指纹和数字版权保护(DRM)等。TEE在用户空间实现驱动程序，能够满足更高安全级别的要求，同时，用户的驱动程序可以以运行在TEE内部的安全应用(TA，Trusted Application)的方式进行开发集成和管理。
图1为本申请实现驱动的系统的组成示意图，如图1所示，包括用户空间和内核空间，其中，用户空间中至少设置有：第一TEE内部(Internal)应用程序编程接口(API，Application Programming Interface)、安全应用(TA，Trusted Application)，以及驱动程序如驱动TA(Driver TA)；内核空间中至少设置有：第二TEE Internal API、TEE框架(Framework)，以及安全操作系统(Secure OS)；其中，
第一TEE Internal API与第二TEE Internal API，用于实现用户空间内部、内核空间内部，以及用户空间与内核空间之间的相互调用。比如：TA调用第一TEE Internal AP、用户空间的第一TEE Internal API通过sysycall调用内核空间的第二TEE Internal API，这样，第二TEE Internal API才能调用内核空间的其他模块的接口，具体实现术语本领域技术人员的公知技术，并不用于限定本发明的保护范围。
驱动TA中配置有驱动TA的属性，比如：驱动的名称、需要映射的物理地址和对应的虚拟地址等。
配置方式与普通TA的属性配置方式类似。这些属性在编译的时候，会被放在一个特殊的段里。
驱动TA包括一个或一个以上，一个第三方的TA可以对应一个驱动TA。
TEE框架，基于安全OS，在加载驱动程序时，解析驱动TA的属性，以完成分配资源、注册驱动、将设备物理地址映射到对应的虚拟地址空间上中的至少一个功能。
本申请提供的实现驱动的架构中，驱动程序的代码均在用户空间的驱动TA，不需要再与OS进行集成处理，完全实现了以TA的形式对用户的驱动程序进行开发集成和管理。而且，不需要使用sysfs记录用户空间驱动的内存映射等信息，所有的用户空间的驱动信息都只在驱动的TA中和TEE动态运行的内存中，因此不会造成信息泄露，保证了驱动程序的安全性。
通过本申请提供的实现驱动的架构，不需要驱动的开发者显示的调用mmap()、驱动的注册等相关函数，只需要简单地配置驱动TA的属性，而与普通TA的开发方式尽量保 持了一致，这样，减少了第三方驱动开发者的工作量；而且，也不需要sysfs的参与，实现了无驱动信息泄漏的隐患，保证了驱动程序的安全性。第三方的驱动已TA的方式集成到TEE中，因此，实现了采用TAM的方式动态的更新，减少了驱动程序集成成本。
可选地，内核空间中还设置有：用户空间驱动程序框架(Userspace Driver Framework)；相应地，
TEE框架还用于：在外部如驱动的开发者需要注册用户空间驱动的中断时，为该中断需要响应的驱动的TA建立一个单独的中断处理线程；
用户空间驱动程序框架，用于保存TEE框架建立的中断处理线程、用户空间中中断处理函数和该注册的中断的中断号的对应关系，被TEE内核空间的第二TEE Internal API调用注册用户空间驱动设备通用的中断处理函数；当有中断产生时，先调用通用的中断处理函数，再根据对应关系中与产生的中断对应的中断号唤醒对应的中断处理线程，将驱动用户空间中断处理函数的入口地址传给唤醒的中断处理线程。
这样，中断处理线程会切换到驱动用户空间的中断处理函数并处理中断。
本申请提供的实现驱动的系统中，中断驱动程序的代码均在用户空间的驱动TA，不需要再与OS进行集成处理，完全实现了以TA的形式对用户的驱动程序进行开发集成和管理。
通过本申请提供的实现驱动的系统，中断注册仍可以采用调用中断注册API的方案，因此，用户无需感知内部处理流程；当有中断产生时，只需利用单独高优先级线程处理该中断，这样，最大程度上保证了中断响应的及时性。
也就是说，通过本申请提供的实现驱动的系统，不需要驱动程序的开发者感知内存映射、注册驱动、用户空间响应中断需要等待在设备读操作上等操作，在本申请提供的实现驱动的系统中，内存的映射、驱动注册只需简单的配置驱动的属性，而中断仍采用调用中断注册函数的方式，与相关技术中在内核空间开发驱动的方案保持一致，这样极大地减小了驱动开发的复杂性。
图2为本申请实现驱动的方法的流程图，如图2所示，包括：
步骤200：在用户空间配置驱动TA的属性。
可选地，属性包括但不限于：驱动的名称、需要映射的物理地址和对应的虚拟地址等。
配置方式与普通TA的属性配置方式类似。这些属性在编译的时候，会被放在一个特殊的段里。
驱动TA包括一个或一个以上，一个第三方的TA可以对应一个驱动TA。
步骤201：基于安全OS，内核空间加载驱动程序时，解析驱动TA的属性，以完成分配资源、注册驱动、将设备物理地址映射到对应的虚拟地址空间上中的至少一个功能。
本申请提供的实现驱动的方法中，驱动程序的代码均在用户空间的驱动TA，不需要再与OS进行集成处理，完全实现了以TA的形式对用户的驱动程序进行开发集成和管理。而且，不需要使用sysfs记录用户空间驱动的内存映射等信息，所有的用户空间的驱动信息都只在驱动的TA中和TEE动态运行的内存中，因此不会造成信息泄露，保证了驱动程序的安全性。
通过本申请提供的实现驱动的方法，不需要驱动的开发者显示的调用mmap()、驱动的注册等相关函数，只需要简单地配置驱动TA的属性，而与普通TA的开发方式尽量保持了一致，这样，减少了第三方驱动开发者的工作量；而且，也不需要sysfs的参与，实现了无驱动信息泄漏的隐患，保证了驱动程序的安全性。第三方的驱动已TA的方式集成到TEE中，因此，实现了采用TAM的方式动态的更新，减少了驱动程序集成成本。
本申请实现驱动的方法还包括：
在需要注册用户空间驱动的中断时，内核空间为该中断需要响应的驱动的TA建立一个单独的中断处理线程；
内核空间保存建立的中断处理线程、用户空间中中断处理函数和该注册的中断的中断号的对应关系，注册用户空间驱动设备通用的中断处理函数；
当有中断产生时，内核空间调用通用的中断处理函数，根据对应关系中与产生的中断对应的中断号唤醒对应的中断处理线程，将驱动用户空间中断处理函数的入口地址传给唤醒的中断处理线程。
这样，中断处理线程会切换到驱动用户空间的中断处理函数并处理中断。
本申请提供的实现驱动的方法中，中断驱动程序的代码均在用户空间的驱动TA，不需要再与OS进行集成处理，完全实现了以TA的形式对用户的驱动程序进行开发集成和管理。
通过本申请提供的实现驱动的方法，中断注册仍可以采用调用中断注册API的方案，因此，用户无需感知内部处理流程；当有中断产生时，只需利用单独高优先级线程处理该中断，这样，最大程度上保证了中断响应的及时性。
也就是说，通过本申请提供的实现驱动的方法，不需要驱动程序的开发者感知内存映射、注册驱动、用户空间响应中断需要等待在设备读操作上等操作，在本申请提供 的实现驱动的架构中，内存的映射、驱动注册只需简单的配置驱动的属性，而中断仍采用调用中断注册函数的方式，与相关技术中在内核空间开发驱动的方案保持一致，这样极大地减小了驱动开发的复杂性。
在实际的应用中，为了保证安全性，有很多的驱动程序是需要配置成只有TEE才可以访问的，比如加密引擎，这种情况下，需要在TEE中集成这些驱动程序。利用本申请提供的实现驱动的架构及方法，在高安全级别的需求下，这些第三方的驱动程序会集成在用户空间，这样，第三方的驱动程序的错误(bug)不会导致TEE有bug而受人攻击；驱动程序崩溃(crash)时也不会导致整个TEE崩溃，方便了驱动程序的开发者开发和调试。同时，利用本申请提供的实现驱动的架构及方法，以TA的方式集成驱动程序，既方便了驱动程序的开发集成，又方便了使用TAM进行驱动的动态安装、删除、更新等操作。
本申请还提供一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行上述任一项所述的实现驱动的方法。
本申请还提供一种用于实现驱动的装置，包括存储器和处理器，其中，存储器中存储有以下可被处理器执行的指令：内核空间加载TA时，解析驱动TA的属性，以完成分配资源、注册驱动、将设备物理地址映射到对应的虚拟地址空间上中的至少一个功能，其中，所述驱动安全应用的属性在用户空间配置。
可选地，所述存储器中还存储有以下可被处理器执行的指令：
在注册用户空间驱动的中断时，所述内核空间为该中断需要响应的驱动的TA建立一个单独的中断处理线程；所述内核空间保存建立的中断处理线程，驱动所述用户空间中中断处理函数和该中断的中断号的对应关系，注册所述用户空间驱动设备通用的中断处理函数；当有中断产生时，所述内核空间根据中断号唤醒对应的中断处理线程，将驱动用户空间中断处理函数的入口地址传给唤醒的中断处理线程。
虽然本申请所揭露的实施方式如上，但所述的内容仅为便于理解本申请而采用的实施方式，并非用以限定本申请。任何本申请所属领域内的技术人员，在不脱离本申请所揭露的精神和范围的前提下，可以在实施的形式及细节上进行任何的修改与变化，但本申请的专利保护范围，仍须以所附的权利要求书所界定的范围为准。

Claims (7)

  1. 一种实现驱动的系统，其特征在于，包括：用户空间和内核空间，其中，用户空间中设置有：第一可信执行环境内部应用程序编程接口、安全应用，以及驱动程序；内核空间中设置有：第二可信执行环境内部应用程序编程接口、可信执行环境框架，以及安全操作系统；其中，
    所述驱动程序中配置有驱动所述安全应用的属性；
    所述第一可信执行环境内部应用程序编程接口与所述第二可信执行环境内部应用程序编程接口，用于实现用户空间内部、内核空间内部，以及用户空间与内核空间之间的相互调用；
    所述可信执行环境框架，基于所述安全操作系统，在加载所述驱动程序时，解析驱动所述安全应用的属性，以完成分配资源、注册驱动、将设备物理地址映射到对应的虚拟地址空间中的至少一个功能。
  2. 根据权利要求1所述的系统，其特征在于，所述内核空间中还设置有：用户空间驱动框架；
    所述可信执行环境框架还用于：在需要注册用户空间驱动的中断时，为该中断需要响应的驱动程序建立一个单独的中断处理线程；
    用户空间驱动框架，用于保存所述可信执行环境框架建立的中断处理线程、用户空间中中断处理函数和该中断的中断号的对应关系，被所述第二可信执行环境内部应用程序编程接口调用注册用户空间驱动设备通用的中断处理函数；当有中断产生时，用户空间驱动框架调用通用的中断处理函数，根据对应关系中与产生的中断对应的中断号唤醒对应的中断处理线程，将用户空间中断处理函数的入口地址传给唤醒的中断处理线程。
  3. 一种实现驱动的方法，其特征在于，包括：
    内核空间加载驱动程序时，解析驱动安全应用的属性，以完成分配资源、注册驱动、将设备物理地址映射到对应的虚拟地址空间上中的至少一个功能，其中，所述驱动安全应用的属性在用户空间配置。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    在需要注册用户空间驱动的中断时，所述内核空间为该中断需要响应的驱动程序建立一个单独的中断处理线程；
    所述内核空间保存建立的中断处理线程、所述用户空间中中断处理函数和该所述注册的中断的中断号的对应关系，注册所述用户空间驱动设备通用的中断处理函数；
    当有中断产生时，所述内核空间调用通用的中断处理函数，根据对应关系中与产生的中断对应的中断号唤醒对应的中断处理线程，将驱动用户空间中断处理函数的入口地址传给唤醒的中断处理线程。
  5. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行上述权利要求3～权利要求4任一项所述的实现驱动的方法。
  6. 一种用于实现驱动的装置，包括存储器和处理器，其中，存储器中存储有以下可被处理器执行的指令：内核空间加载驱动程序时，解析驱动安全应用的属性，以完成分配资源、注册驱动、将设备物理地址映射到对应的虚拟地址空间上中的至少一个功能，其中，所述驱动安全应用的属性在用户空间配置。
  7. 根据权利要求6所述的装置，其特征在于，所述存储器中还存储有以下可被处理器执行的指令：
    在需要注册用户空间驱动的中断时，所述内核空间为该中断需要响应的驱动程序建立一个单独的中断处理线程；所述内核空间保存建立的中断处理线程、所述用户空间中中断处理函数和所述注册的中断的中断号的对应关系，注册所述用户空间驱动设备通用的中断处理函数；当有中断产生时，所述内核空间调用通用的中断处理函数，根据对应关系中与产生的中断对应的中断号唤醒对应的中断处理线程，将驱动用户空间中断处理函数的入口地址传给唤醒的中断处理线程。
PCT/CN2018/111815 2017-11-06 2018-10-25 一种实现驱动的系统及方法 WO2019085811A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711078956.3A CN109753347B (zh) 2017-11-06 2017-11-06 一种实现驱动的系统及方法
CN201711078956.3 2017-11-06

Publications (1)

Publication Number Publication Date
WO2019085811A1 true WO2019085811A1 (zh) 2019-05-09

Family

ID=66332819

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/111815 WO2019085811A1 (zh) 2017-11-06 2018-10-25 一种实现驱动的系统及方法

Country Status (3)

Country Link
CN (1) CN109753347B (zh)
TW (1) TWI783034B (zh)
WO (1) WO2019085811A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110442462A (zh) * 2019-07-16 2019-11-12 阿里巴巴集团控股有限公司 Tee系统中的多线程数据传输方法和装置
US10943006B2 (en) 2019-07-16 2021-03-09 Advanced New Technologies Co., Ltd. Method and apparatus for multithreaded data transmission in a TEE system
US11042642B2 (en) 2019-07-16 2021-06-22 Advanced New Technologies Co., Ltd. Method and apparatus for data transmission in a TEE system

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116484438A (zh) * 2022-01-17 2023-07-25 荣耀终端有限公司 信息处理方法和装置
CN116049809B (zh) * 2022-06-14 2023-11-07 荣耀终端有限公司 一种驱动调用方法和设备

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101453572A (zh) * 2007-11-30 2009-06-10 上海复旦上科多媒体有限公司 多媒体表演系统设备的控制方法
CN102193862A (zh) * 2010-03-10 2011-09-21 微软公司 在多个执行环境中测试用户界面
CN103679006A (zh) * 2013-10-25 2014-03-26 华为技术有限公司 一种运行驱动程序的方法及装置

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB0102518D0 (en) * 2001-01-31 2001-03-21 Hewlett Packard Co Trusted operating system
WO2006115533A2 (en) * 2005-04-22 2006-11-02 Microsoft Corporation Protected computing environment
TW200722992A (en) * 2005-12-14 2007-06-16 Inventec Corp Physical memory testing method under Linux system
CN1988534B (zh) * 2005-12-23 2011-05-25 联想(北京)有限公司 可信计算系统和在内核态下访问tpm服务的方法
CN103593189A (zh) * 2013-11-14 2014-02-19 昆明理工大学 一种嵌入式Linux下用户态驱动程序的实现方法
CN106936774B (zh) * 2015-12-29 2020-02-18 中国电信股份有限公司 可信执行环境中的认证方法和系统
CN106775833B (zh) * 2016-11-28 2021-03-16 青岛海信移动通信技术股份有限公司 设备驱动程序加载方法、终端及系统
CN107247578A (zh) * 2017-06-12 2017-10-13 北京奇虎科技有限公司 配置参数存储方法及装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101453572A (zh) * 2007-11-30 2009-06-10 上海复旦上科多媒体有限公司 多媒体表演系统设备的控制方法
CN102193862A (zh) * 2010-03-10 2011-09-21 微软公司 在多个执行环境中测试用户界面
CN103679006A (zh) * 2013-10-25 2014-03-26 华为技术有限公司 一种运行驱动程序的方法及装置

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110442462A (zh) * 2019-07-16 2019-11-12 阿里巴巴集团控股有限公司 Tee系统中的多线程数据传输方法和装置
US10884830B1 (en) 2019-07-16 2021-01-05 Advanced New Technologies Co., Ltd. Method and apparatus for multithreaded data transmission in a tee system
US10896075B1 (en) 2019-07-16 2021-01-19 Advanced New Technologies Co., Ltd. Method and apparatus for multithreaded data transmission in a TEE system
US10943006B2 (en) 2019-07-16 2021-03-09 Advanced New Technologies Co., Ltd. Method and apparatus for multithreaded data transmission in a TEE system
US11042642B2 (en) 2019-07-16 2021-06-22 Advanced New Technologies Co., Ltd. Method and apparatus for data transmission in a TEE system

Also Published As

Publication number Publication date
TW201923568A (zh) 2019-06-16
CN109753347A (zh) 2019-05-14
TWI783034B (zh) 2022-11-11
CN109753347B (zh) 2023-03-21

Similar Documents

Publication Publication Date Title
WO2019085811A1 (zh) 一种实现驱动的系统及方法
JP6110038B2 (ja) 異種マルチプロセッサシステムにおける共有メモリ領域のための動的なアドレスのネゴシエーション
US8181176B2 (en) Uniform storage device access using partial virtual machine executing within a secure enclave session
US9058197B2 (en) Method for sharing memory of virtual machine and computer system using the same
KR102104695B1 (ko) 하드웨어 디바이스에 대한 소프트웨어 인터페이스
CN112231007B (zh) 基于用户态与内核态驱动协同处理框架的设备驱动方法
US11836091B2 (en) Secure memory access in a virtualized computing environment
CN112740211A (zh) 引导固件沙箱化
US20160321116A1 (en) Translating operating system processes
US9323543B2 (en) Capability based device driver framework
US20040044888A1 (en) Method and apparatus for using a memory region to pass parameters between a run time environment and SMM handler
US10430223B2 (en) Selective monitoring of writes to protected memory pages through page table switching
US10169113B2 (en) Storage and application intercommunication using ACPI
US9384015B2 (en) Techniques for dynamically redirecting device driver operations to user space
US10127064B2 (en) Read-only VM function chaining for secure hypervisor access
US11074200B2 (en) Use-after-free exploit prevention architecture
US11385927B2 (en) Interrupt servicing in userspace
TW201317781A (zh) 虛擬機器記憶體的分享方法與電腦系統
EP2941695A1 (en) High throughput low latency user mode drivers implemented in managed code
KR102498319B1 (ko) 반도체 장치
CN112347058A (zh) 一种数据加解密的方法、系统及设备
Dibble et al. Programming embedded systems: interacting with the embedded platform

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18871832

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18871832

Country of ref document: EP

Kind code of ref document: A1