WO2019237862A1

WO2019237862A1 - Layout method for linear address space, and computing device

Info

Publication number: WO2019237862A1
Application number: PCT/CN2019/086492
Authority: WO
Inventors: 杨力祥
Original assignee: 杨力祥
Priority date: 2018-06-12
Filing date: 2019-05-11
Publication date: 2019-12-19
Also published as: CN110597641A

Abstract

A layout method for a linear address space, and a computing device, relating to the field of information security. Both a process and a kernel independently possess a complete linear address space; a kernel page directory list register and a target process page directory list register are added in the computing device for respectively storing the physical address of a page directory list of the kernel and the physical address of a page directory list of the process. According to the method and the computing device, an attacker is unable to directly use an attack program prepared in advance in a user state, and is also unable to transfer data obtained by the attack to an address field occupied by a user state program without conversion of a linear address space.

Description

Layout method and calculation device of linear address space

Technical field

The present application relates to the field of information technology, and in particular, to a method and a computing device for establishing an exclusive and fully linear address space for a kernel and a process.

Background technique

The memory layout of existing operating systems and applications usually uses a linear address space shared by kernel mode and user mode. The kernel occupies part of the address segment, and user mode programs occupy another part of the address segment. This pattern provides an opportunity for the attacker to prepare the attack program in the user mode code area in advance. When the attack occurs, the execution order jumps from the kernel mode to the user mode attack program. At this time, the user mode program has the kernel mode. Privilege level with great attack power.

On this basis, the attacker can modify the authorization information and change the authorization status, thereby obtaining a status beyond authorization. Further operations such as:

1. Beyond authorization to read user data (including memory and peripheral data).

2. Beyond authorization to write (including tampering, delete) user data.

3. Execute system calls beyond authorization.

4. Go beyond authorization to execute applications.

Summary of the Invention

Aiming at the problems in the prior art that an attacker can directly use the user program prepared in advance to go beyond authorization, the invention discloses a method for establishing an exclusive and fully linear address space for the kernel and process to ensure the attacker It cannot directly use its attack program prepared in the user mode in advance, nor can it transfer the data obtained from the attack back to the address segment occupied by the user mode program without converting the linear address space. Further, a related redesigned interrupt and other instructions related to privilege level switching are needed, so that when the privilege level switching instruction is executed, the hardware automatically switches the value of the page management structure base address register at the same time. The page management structure base address register refers to a page directory base address register or a first-level page table base address register, such as a CR3 register in the INTEL system.

In order to achieve the above object, the present invention discloses a method for laying out a linear address space. The method includes: a process and a kernel share a complete linear address space exclusively. If there are other privileged program forms in addition to the process, each privileged program form has an independent linear address space. For the management form, see process.

Because the user mode of each process occupies a complete linear address space, there is no part of the kernel mode; the kernel alone occupies an independent and complete linear address space. Under this condition, the kernel's instruction pointer (for example, eip) cannot in any case directly jump to the user-mode linear address space of the process. The possibility of an attacker preparing the attack code in advance in the user-mode linear address space is thorough. eliminate.

In a specific implementation manner of the present invention, the page management structure and page table of the process are managed by the kernel, and there is no kernel code and data in the linear address space of the process, nor any data segment with 0 privilege level and Snippet.

Each process has its own user stack when in user mode. During the duration of the process, the process always uses its own user stack. When switching between processes, the user stack also switches accordingly;

The kernel also allocates a kernel stack for each process in the linear address space of the kernel. When the process initiates a system call to enter the kernel, the kernel uses this stack.

In a specific implementation manner of the present invention, a kernel stack dedicated to an interrupt service program is set in the kernel, and when an interrupt occurs, it is directly switched to the interrupted kernel stack without using the kernel stack of any process.

In a specific implementation manner of the present invention, when a process initiates a system call, it includes the following steps:

S1: The process pushes parameters into the process stack in a fixed format, and provides the type, number, and length of the parameters;

S2: After switching to the kernel through soft interrupt or fast system call, the kernel copies the parameters in the process stack to the kernel stack of the process; then executes the system call function;

S3: When the kernel needs to return data to the user mode, write the data to be copied into the user stack of the process, and then switch to the process;

In a specific implementation of the present invention, when the kernel switches to a process, the value of the page management structure base address register switches to the physical address of the page management structure of the specified process; when the process switches to the kernel, the page management structure base address The value of the register switches to the physical address of the kernel's page management structure; a process is not allowed to switch directly to another process. The page management structure refers to a page directory table or a first-level page table.

Further, in order to enable the CPU to automatically find the kernel page management structure and the target process page management structure, two registers are added, the kernel page management structure base address register and the target process page management structure base address register, which are respectively used to store kernel page management The physical address of the structure and the process page manage the physical address of the structure. Among them, the value of the process page management structure base address register is set in the kernel as the physical address of the page management structure of a specific process. When you need to switch to the kernel, set the page management structure base address register to the value of the kernel page management structure base address register; when you need to switch to the process, set the page management structure base address register to the process page management structure base address register. value. The page management structure base register is the register accessed by the CPU when it is addressed.

In a specific implementation of the present invention, when an interrupt occurs, the CPU first assigns the value of the kernel page management structure base address register to the page management structure base address register before performing other actions.

When a privilege level change is returned by an interrupt return instruction, the corresponding privilege level check is performed first, and after the return address in the stack is popped, the CPU automatically assigns the value of the process page management structure base address register to the page management structure base address register. ; If the value of the process page management structure base register is 0, an exception occurs.

Among them, the specific way to perform the privilege level check can refer to the way of the existing CPU; under the Intel system, the page management structure base address register refers to the CR3 register; under the Intel system, the interrupt return instruction refers to the iret instruction .

When an interrupt occurs, the CPU judges whether the user program or the kernel program is currently executing according to the privilege level of the code segment register (such as the CS register under the Intel system). If the user program is executing, the page management structure base address register is determined. Assign the value of the kernel page management structure base address register. The remaining actions (such as finding the IDT table, privilege level processing, etc.) are similar to the prior art, and then push the key register values into the kernel stack and save the values of other registers. In tss, save tss in the process management information; if you are executing the kernel program, you do not need to switch the page management structure base address register, and other actions are the same.

The key register includes a code segment register, a data segment register, a stack segment register, an instruction pointer, a stack register, and the like; for example, under the Intel system, the key register may include CS, DS, SS, IP, SP.

When the kernel needs to access process data, the specific steps include:

The kernel first calculates the actual physical address corresponding to this address according to the linear address provided by the process and the page management structure of the process stored in memory;

Temporarily map a new linear address in the linear space of the kernel for the above physical address;

The kernel reads and writes data through temporary linear addresses;

After reading and writing, the kernel releases the temporary mapping relationship to the physical address.

A computing device is characterized in that two registers are added, a kernel page management structure base address register and a target process page management structure base address register, which are respectively used to store the physical address of the kernel's page management structure and the process's page management structure. Physical address. When switching to the kernel, the page management structure base address register is set to the value of the kernel page management structure base register; when switching to the process, the page management structure base address register is set to the value of the process page management structure base address register; page management The structure base register is the register accessed by the CPU when it is addressed.

If the device supports more privilege levels, a page management structure base address register is added for each privilege level to store the page management structure base address of the linear address space corresponding to the privilege level.

The technical solution of the present invention can achieve the following technical effects:

1) The attacker cannot directly use the attack program prepared in the user mode in advance, and cannot transfer the data obtained from the attack back to the address segment occupied by the user mode program without converting the linear address.

2), can prevent possible errors in the CPU hardware, such as the CPU in the hardware out of control over cross-privileged access, that is, the program under 3 privilege level can directly access the program under 0 privilege level, cross-privileged access in this solution must switch pages Manage the structure base address register. In this way, except for the normal system call (with the management page base structure register switching page), the 3 privilege level program cannot directly access the program under the 0 privilege level.

3) It can prevent attacks to the greatest extent in areas with relatively small memory space (such as embedded) with minimal protection costs.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly explain the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description are merely These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without paying creative labor.

Figure 1: Schematic diagram of the prior art linear address space layout

Figure 2: Schematic diagram of the linear address space layout of the present invention

detailed description

In the following, the technical solutions in the embodiments of the present invention will be clearly and completely described with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by a person of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

Figure 1 is a schematic diagram of the linear address space layout in the prior art. In the linear address space distribution of most existing operating systems, the concept of a kernel in the strict sense does not exist. In each linear address space, only processes User mode and the kernel mode of the process. When the process is in user mode, it only has access to the access range of user mode code in the linear address space. When the process is in kernel mode, the range of kernel mode code can access the entire linear address space. For example, the user mode program of process A can only access the user mode code access range in the linear address space in the figure; when entering the process A kernel mode through a system call, the process A kernel mode program has access to the kernel mode code access range.

Under attack conditions, if the attacker changes the return address to a user-mode address space and prepares attack code at this location, an attack execution order branch will be formed. Especially because the attack occurs at the system privilege level (such as 0 privilege level), the accessible range of the code in the system privilege level covers the entire linear address space including the user-mode linear address space, so once it jumps to the attacked The modified position is in the user-mode linear address space, and the attacker prepares the attack code or the attack code disguised as data at the position. Since the attack code is at the system privilege level, the above attack code will be at the system privilege level. Be executed. These codes are carefully prepared by the attacker, which can implement all the functions the attacker wants to have, and the attack power is very strong.

In view of the above problems, the present invention establishes a complete linear address space for the user mode of each process, and there is no part of the kernel mode. Create an independent, complete linear address space for the kernel. Achieve linear isolation between kernel and process.

The layout of the linear address space in the present invention is shown in FIG. 2, and both the process and the kernel share a complete linear address space. In the original mode, the process and the kernel share a linear address space, which means that the physical address corresponding to a linear address in user mode still corresponds to the original physical address after entering kernel mode. The switch from user mode to kernel mode is essentially a privilege level switch. In kernel mode, in theory, you can directly jump to any code in the current linear address space and directly access any data in this space. At this point, the process and the kernel are not isolated.

Under the linear address space layout of the present invention, each process enjoys a complete linear space exclusively. The page management structure of a process is managed by the kernel. There is no kernel code and data in the linear address space of the process, nor any data segment or code segment with 0 privilege level. Therefore, when the kernel executes, it is impossible to directly jump to code execution in the linear address space of any process, and it is also impossible to directly access data in the linear address space of the process.

In a specific embodiment, the improvement mainly includes the following aspects:

Processes have independent linear address spaces

The starting position of the cs, ds, and ss segments used by the process is 0, the segment length is the maximum addressing space of the CPU, and the privilege level is 3.

Each process has a kernel-independent page management structure.

A process can be arbitrarily addressed from 0 to the maximum addressing space. If a page fault occurs, the kernel allocates pages by causing a page fault interrupt. The physical page corresponding to the entire linear space is in the page management structure and the page table. The flags are all 1. A complete linear space is no longer cut into kernel-accessible space and user-process accessible space. When currently in user mode, the entire linear address space belongs to the process.

Kernel has independent linear address space

The starting position of the cs, ds, and ss segments used by the kernel is 0, the segment length is the maximum addressing space of the CPU, and the privilege level is 0.

The kernel has a page management structure that is independent of all processes.

The kernel can also be arbitrarily addressed from 0 to the maximum addressing space. If a page fault occurs, the kernel allocates pages by causing a page fault interrupt. The U / S flag bit of the physical page corresponding to the entire linear space in the page management structure. Both are 0. The kernel manages the page management structure of all processes.

Process stack and kernel stack

Each process has its own user stack in user mode. The pages of the stack are allocated by the kernel and belong to the user mode. They are in the linear address space of the process. During the lifetime of a process, the process always uses its own user stack. When switching between processes, the user stack also switches.

After each process is created, the kernel allocates a kernel stack for the process. In the linear address space of the kernel, when the process initiates a system call to enter the kernel, the kernel uses this stack.

In addition to the kernel stack of the process, there is also a kernel stack for interrupt service routines. When an interrupt occurs, switch to the interrupted kernel stack without using the kernel stack of any process.

Each independent thread in the kernel also has its own kernel stack and is not mixed with other kernel stacks.

The user stack and the kernel stack of the process are recorded in the tss structure of the process, respectively, and the CPU can automatically find the corresponding stack segment, stack top pointer, and stack bottom pointer when switching, to achieve switching.

Process and kernel parameter passing

When a process makes a system call, it may be necessary to pass parameters.

A preferred solution is:

The process pushes parameters into the process stack in a fixed format and provides the type, number, and length of the parameters.

After switching to the kernel through soft interrupt or fast system call, the kernel copies the parameters in the process stack to the kernel stack of the process. Then execute the system call function.

When the kernel needs to return data to the user mode, it first writes the data to be copied into the user mode stack of the process, and then switches to the process.

Kernel and process switching

In the present invention, there are the following ways to cause a linear address space switch:

a) The kernel switches to a process.

This is basically similar to the process switching in the prior art. In the kernel, the process target to be switched is selected, and then the tss and various registers are switched. The difference is that in the prior art, the value of the page management structure base address register is switched from the physical address of the page management structure of one process to the physical address of the page management structure of another process; while in the present invention, the target is The physical address of the page management structure of the process is assigned to the value of the process page management structure base register, and then the value of the process page management structure base register is assigned to the page management structure base register.

b) An interrupt occurs, switching to the kernel

In the existing system, when the system is in the kernel state when an interrupt occurs, neither the privilege level nor the linear address space needs to be switched, and only the corresponding interrupt service routine needs to be jumped to; if the interrupt occurs, it is in the user State, then you need to switch the privilege level to 0, but you do not need to switch the linear address space. The kernel stack used is the kernel stack of the process that was just running. So when an interrupt occurs, the hardware will automatically complete the privilege level switch, but will not make any changes to the linear address space.

In the present invention, the process and the kernel are in different linear address spaces. When an interrupt occurs while the process is running, the CPU must automatically switch the privilege level and switch the linear address space from the user's linear address space to the kernel's linear address space. The IDTR register of the CPU records the address of the interrupt descriptor table (IDT). This address is a linear address and is a linear address in the kernel space. Therefore, before accessing the code address in front of the IDT table, the CPU must first record the value of the page management structure base address register register as the physical address of the kernel page management structure, so that the CPU can access the IDT normally.

Another embodiment of the present invention is as follows:

The CPU adds two registers: the kernel page management structure base address register, which stores the physical address of the kernel's page management structure; the target process page management structure base address register, which stores the physical address of the page management structure of the process to be executed.

After the kernel page management structure is created, the kernel code assigns the physical address of the page management structure to the kernel page management structure base address register. The value of the register is no longer modified until the system exits.

After the kernel selects the process to be switched, the kernel code assigns the physical address of the process's page management structure to the target process's page management structure base address register, which is automatically cleared to 0 after the switch is completed.

When an interrupt signal (including hardware interrupt, software interrupt, exception) occurs, the CPU first assigns the value of the kernel page management structure base address register to the page management structure base address register before performing other actions, so as to switch the current linear address space to The linear address space of the kernel.

When returning privilege level changes through the iret instruction, the corresponding privilege level check is performed first. This part is the same as the existing CPU. After the return address in the stack is popped, the CPU automatically assigns the value of the process page management structure base register to Page management structure base register. If the value of the process page management structure base register is 0, an exception occurs.

c) The process initiates a system call and switches to the kernel

The following takes the fast system call in the INTEL system as an example:

When a process initiates a system call, it enters the kernel through soft interrupts or fast system call instructions. In the existing system, this only brings about the switching of the privilege level and the switching of the stack. In the present invention, it also brings about the switching of the base address register of the page management structure.

1) Fast system call

The specific scheme is as follows:

Increase SYSENTER_CR_MSR register

SYSENTER instruction: During execution, CR3 is the first address of the page management structure of the process, and the value of the kernel page management structure base address register is the first address of the kernel page management structure. Before other operations, the process page management structure base address register is first set. The value is assigned to CR3. After completion, the value of CR3 (the first address of the page management structure of the process) is assigned to the SYSENTER_CR_MSR register. Follow-up actions are the same as now

SYSEXIT instruction: Before EIP jump, read the value of SYSENTER_CR_MSR register and assign it to CR3.

Stack switching is the same as it is now.

2) Soft interrupt

Soft interrupts are also a type of interrupt. The method is basically the same as the interrupt that caused the switch to the kernel. The difference is that after entering the kernel through the soft interrupt, the kernel uses the kernel stack of the process that initiated the system call. The kernel stack information is obtained from the process. tss.

Kernel access to process data

The kernel may need to read and write data in the user's linear space. For example, when a file is read or written, a new linear address is temporarily mapped in the kernel's linear space for the address. After the reading and writing is completed, the mapping relationship is released.

The kernel must calculate the actual physical address based on the process's page management structure, page table, and specific linear address, and then derive the linear address in the kernel from the actual physical address, and then read and write according to the linear address in the kernel.

The specific steps are:

The kernel first calculates the actual physical address of this memory according to the linear address provided by the process and the page management structure of the process stored in memory; temporarily maps a new linear address in the kernel for the physical address, and reads and writes.

In this way, the kernel-state eip cannot directly jump to the user-mode linear address space in any case, and the possibility of an attacker preparing the attack code in the user-mode linear address space in advance is completely eliminated.

Through the above specific implementations, those skilled in the art can clearly understand that in the current CPU system, the software cannot achieve complete isolation of the process from the linear address space of the kernel, and the present invention makes a series of modifications to the CPU.

Based on the linear address space isolation design of the transformed CPU system, even if the attack program can change the kernel execution order, it can only make the changed kernel execution order jump to other instructions in the kernel itself, or jump to a Meaningful address. If it jumps to a meaningless address, the kernel will immediately or various execution exceptions occur; if it jumps to the kernel's inherent instructions, the attack effect can be very limited. Compared with the execution code arranged by the kernel to the user program, the consequences of these two situations are much weaker, which can effectively curb the effect of the attack.

The above descriptions are merely preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, and improvement made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

A linear address space layout method is characterized in that both the process and the kernel share a complete linear address space.
The method according to claim 1, characterized in that the page management structure of the process is managed by the kernel, and there is no kernel code and data in the linear address space of the process, nor any data segment and code segment with 0 privilege level The page management structure refers to a page directory table or a first-level page table.
The method according to any one of claims 1-2, characterized in that:

Each process has its own user stack when in user mode. During the duration of the process, the process always uses its own user stack. When switching between processes, the user stack also switches accordingly;

The kernel also allocates a kernel stack for each process in the linear address space of the kernel. When the process initiates a system call to enter the kernel, the kernel uses this stack.
The method according to any one of claims 1-3, characterized in that: a kernel stack dedicated to an interrupt service program is set in the kernel, and when an interrupt occurs, it is directly switched to the interrupted kernel stack without using any one of the processes. The kernel stack.
The method according to claim 1, characterized in that, when the process initiates a system call, the method comprises the following steps:

The process pushes parameters into the process stack in a fixed format, and provides the type, number, and length of the parameters;

After switching to the kernel through soft interrupt or fast system call, the kernel copies the parameters in the process stack to the kernel stack of the process. Then execute the system call function;

When the kernel needs to return data to the user mode, it first writes the data to be copied into the user stack of the process, and then switches to the process.
The method according to claim 1, characterized in that when the kernel is switched to a process, the value of the page management structure base address register is switched to the physical address of the page management structure of the specified process; when the process is switched to the kernel, the page management structure The value of the base register is switched to the physical address of the kernel's page management structure; the process is not allowed to switch directly to another process. The page management structure base register is the register accessed by the CPU when it is addressed.
The method according to claim 1, characterized in that: two registers are added, a kernel page management structure base address register and a target process page management structure base address register, respectively for storing a physical address of the kernel page management structure and a process page management. The physical address of the structure.
The method according to claim 7, wherein, when an interrupt occurs, the CPU first assigns the value of the kernel page management structure base address register to the page management structure base address register before performing other actions.
The method according to claim 7, characterized in that when returning a privilege level change by an interrupt return instruction, first perform a corresponding privilege level check, and then pop the return address in the stack, and the CPU automatically manages the process page management structure The value of the base register is assigned to the page management structure base register.
The method according to claim 7, characterized in that: when an interrupt occurs, the CPU determines whether the user program or the kernel program is currently being executed according to the privilege level of the code segment register, and if the user program is executing, the page management The structure base register is assigned the value of the kernel page management structure base register.
The method according to any one of claims 6 to 10, wherein the base address of the page management structure refers to a page directory table base address or a first-level page table base address.
The method according to claim 1, characterized in that when the kernel needs to access process data, the specific steps include:

The kernel first calculates the actual physical address corresponding to this address according to the linear address provided by the process and the page management structure of the process stored in memory;

Temporarily map a new linear address in the linear space of the kernel for the above physical address;

The kernel reads and writes data through temporary linear addresses;

After reading and writing, the kernel releases the temporary mapping relationship to the physical address.
A computing device is characterized by adding two registers, a kernel page management structure base address register and a process page management structure base address register, respectively for storing the physical address of the kernel's page management structure and the physical of the process's page management structure. address.
The device according to claim 13, characterized in that: when switching to the kernel, the page directory base address register is assigned to the value of the kernel page management structure base address register; when switching to the process, the page directory base address register is assigned to the process The value of the page management structure base register.
The device according to any one of claims 13 to 14, wherein if the device supports more privilege levels, a page management structure base address register is added for each privilege level to store the corresponding privilege level. The base address of the page management structure of the linear address space.