WO2020173083A1 - 微内核进程间通讯方法和系统 - Google Patents

微内核进程间通讯方法和系统 Download PDF

Info

Publication number
WO2020173083A1
WO2020173083A1 PCT/CN2019/106833 CN2019106833W WO2020173083A1 WO 2020173083 A1 WO2020173083 A1 WO 2020173083A1 CN 2019106833 W CN2019106833 W CN 2019106833W WO 2020173083 A1 WO2020173083 A1 WO 2020173083A1
Authority
WO
WIPO (PCT)
Prior art keywords
kernel
page table
processes
microkernel
page
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/106833
Other languages
English (en)
French (fr)
Inventor
陈海波
糜泽羽
臧斌宇
管海兵
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shanghai Jiao Tong University
Original Assignee
Shanghai Jiao Tong University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shanghai Jiao Tong University filed Critical Shanghai Jiao Tong University
Publication of WO2020173083A1 publication Critical patent/WO2020173083A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/02—Addressing or allocation; Relocation
    • G06F12/08—Addressing or allocation; Relocation in hierarchically structured memory systems, e.g. virtual memory systems
    • G06F12/10—Address translation
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication

Definitions

  • the invention relates to the technical field of operating system microkernels, in particular to a microkernel inter-process communication method and system, in particular to an efficient and safe microkernel inter-process communication method and system.
  • microkernel Since the microkernel was proposed in the last century, after 30 years of research and development, its key design is to provide only the most basic mechanism of the operating system kernel, and move most of the other functions of the operating system kernel from the kernel mode to the user mode. Server process. This means that errors that occur in one server process will not affect other server processes, and will not affect the microkernel of the microkernel server. Therefore, such a design can enhance the robustness of the microkernel. At the same time, removing most of the functions from the kernel state can effectively reduce the trusted computing base (TCB), making the system less susceptible to attacks and easier to be formally verified. Based on the above advantages, microkernels are widely used in fields that are highly dependent on safety and reliability, such as aviation, in-vehicle systems, and medical equipment.
  • TDB trusted computing base
  • a microkernel In a microkernel, the communication between any two processes depends on the inter-process communication mechanism, but it is currently known that this mechanism is an important source of runtime overhead.
  • An inter-process communication first needs to call the system call to fall into the microkernel, then the microkernel finds the target process, and then copies the message to the target process. At the same time, it also needs two process address space switching (if you want to defend against the recent meltdown Meltdown attack), and finally Back to user mode. If you want to go back to the original process, such a process needs to be repeated completely.
  • seL4 uses a fast channel technical method for Call and ReplyWait system calls. This method directly transmits the message to the target process without scheduling. All the transmitted data is stored in the register, which also eliminates the overhead of data copy. But seL4 has flaws. First, the fast channel technology still needs to sink into the kernel, so its performance overhead is also relatively large; second, the fast channel path is only applicable to some system calls (Call and ReplyWait), and only a small amount of data can be transmitted at the same time.
  • the hardware-based modification scheme can greatly increase the cost of microkernel inter-process communication.
  • the dIPC project places all inter-process communication participants in the same virtual address space by modifying the hardware.
  • the subsequent inter-process communication is completely realized by hardware, allowing one The process directly calls the function of another process without the help of the operating system kernel.
  • the isolation between processes relies on the tag memory implemented by dIPC, which also needs to be implemented by modifying the hardware.
  • dIPC requires major changes to the software in order to use the interface proposed by dIPC.
  • major modifications to the operating system kernel are required to adapt to the new inter-process communication method. It still takes a long time to test the technical means of modifying hardware before it is actually used on a large scale. At the same time, this method is more difficult to deploy than the method of directly using mature commercial hardware. Therefore, this method is difficult to be accepted in a short time.
  • patent document CN103425538A discloses a process communication method, which allocates memory space according to process communication requests; stores communication data in the memory space; writes the logical address of the memory space into the message Queue; access the communication data through the logical address read from the message queue.
  • the above process communication method and system allocates memory space for storing communication data when receiving a process communication request. This eliminates the need to divide the communication data storage space in advance, and writes the logical address of the memory space into the message queue.
  • the reading of the logical address in the message queue is used to access the communication data, so that the data access process can access the communication data in an orderly manner by reading the logical addresses in the message queue one by one under the action of the message queue, and the communication between multiple processes There is no need to copy communication data during the process, which greatly improves the flexibility of data sharing.
  • the purpose of the present invention is to provide a microkernel inter-process communication method and system.
  • a method for communication between microkernel processes provided by the present invention includes:
  • Lightweight virtualization step starting the virtualization environment with hardware, constructing the micro-kernel into a sub-kernel, under which a root kernel is constructed, and the root kernel can interact with the virtualized environment;
  • Step of expanding page table constructing corresponding expanded page tables for different processes, the processes are divided into client processes and server processes, and the base address of the page table of the client process is filled into the extended page table of the server process;
  • Fast communication step provide an interface oriented to user mode processes, and the interface can switch between processes in the address space of user mode;
  • Binary modification steps Scan the code page in the process and replace illegal code jump instructions.
  • the lightweight virtualization step includes:
  • Root kernel initialization steps initialize the root kernel after the secondary kernel is started, dynamically move the secondary kernel to the non-privileged mode, and the root kernel provides an interface for managing the extended page table;
  • Process identification step allocate a memory page for the process to record the identity information of the process, which is recorded as the identity information page, and map the identity information page to the process extension page table and the virtual address space of the sub-kernel, so that The secondary kernel can access the identity information page of the current sinking process through the virtual address to identify the identity information of the sinking process.
  • the identity information page has the same customer physical address in the extended page tables of different processes.
  • the root kernel configures the VMCS domain so that the execution of the privileged instruction does not cause the virtual layer to sink; for the sink caused by the hardware event, the root kernel allows the hardware to fail.
  • the secondary kernel in the privileged mode inserts an external interrupt; for the sink caused by the violation of access to the extended page table, the root kernel uses a large-capacity page table to map the physical memory address to the secondary kernel.
  • the step of expanding the page table includes:
  • Initialization steps register the server process to the sub-kernel during initialization.
  • the sub-kernel notifies the root kernel to copy the extended page table for the client process and the server process respectively, and add the extended page table mapping;
  • the client process accesses the springboard code page to switch between processes.
  • the springboard code page calls the VMFUNC instruction to change the extended page table pointer from the extended page table of the client process to the extended page table of the server process, without modifying the CR3 register value.
  • the small data volume is transmitted through the CPU register; for large data volume transmission, a shared buffer is allocated, and the address of the shared buffer is mapped to the client process and the server process. Extended page table.
  • the implanted single VMFUNC instruction replace the single VMFUNC instruction with three null instructions; for illegal instructions pieced together by adjacent instructions, insert a null instruction between adjacent instructions ; For an illegal instruction that exists in a long instruction, replace the long instruction with multiple equivalent instructions before processing.
  • the secondary kernel is a microkernel running in an unprivileged mode;
  • the root kernel runs in a privileged mode, and includes a sink processing unit, an extension table management unit, and a self-virtualization unit;
  • the sink processing unit processes The sinking caused by the sub-kernel includes violations of access to the extended page table and sinking of the use of privileged instructions;
  • the extension table management unit dynamically manages the sub-kernel and the extended page tables of the processes in the sub-kernel;
  • the self-virtualization unit is dynamic when the system is started Downgrade the secondary kernel to unprivileged mode and initialize its VMCS and extended page tables.
  • a microkernel inter-process communication system provided according to the present invention includes:
  • Lightweight virtualization module starting the virtualization environment by hardware, constructing the micro-kernel into a sub-kernel, under which a root kernel is constructed, and the root kernel can interact with the virtualization environment;
  • Extended page table module constructs corresponding extended page tables for different processes, the process is divided into client process and server process, and the base address of the page table of the client process is filled in the extended page table of the server process;
  • Fast communication module provides an interface oriented to user mode processes, the interface can switch between processes in the user mode address space;
  • Binary Modification Module Scan the code page in the process and replace illegal code jump instructions.
  • the present invention has the following beneficial effects:
  • the present invention cleverly uses hardware virtualization technology to greatly improve the inter-process communication in the micro-kernel without any modification to the existing hardware architecture. performance.
  • the present invention can be applied to various micro-kernels of different designs, and only a small modification to the code of the micro-kernel can bring about a substantial performance improvement.
  • the present invention does not change the strong isolation of the original microkernel, and still has the defensive ability against attacks such as melting Meltdown.
  • Figure 1 is a schematic diagram of an embodiment of a communication device of the present invention
  • Figure 2 shows the use of the extended page table to control the contents of the client page table
  • FIG. 3 shows the process of starting the registration process
  • Figure 4 shows the switching process between user mode processes
  • Figure 5 shows the dynamic binary modification process
  • the method proposed by the present invention can allow one process to directly switch to the virtual address space of another process without the intervention of the microkernel during communication between microkernel processes.
  • the intervention of the microkernel is an important reason for the high cost of inter-process communication. If the microkernel is removed from the path of inter-process communication, the performance of inter-process communication will be greatly improved. Therefore, the present invention removes the microkernel from the inter-process communication. Without the intervention of the microkernel, it is ensured that a process will not maliciously use inter-process communication to access the data of other processes and execute the code of other processes.
  • the traditional method of inter-process communication requires the microkernel to check the legality of the communication and prevent any possible attacks.
  • the prior art can guarantee the safety of inter-process communication without the intervention of the operating system kernel, but the hardware needs to be modified.
  • the present invention needs to use mature commercial hardware to ensure the safety.
  • the present invention modifies the application program and the micro-kernel source code as little as possible, and the inter-process communication method is the core mechanism in the micro-kernel. Modification to it often means that a large number of changes to the application program and the micro-kernel source code are required, which will Greater difficulty of deployment. Therefore, the present invention modifies the application program and the microkernel source code as little as possible.
  • a method for communication between microkernel processes provided by the present invention includes:
  • Lightweight virtualization step starting the virtualization environment with hardware, constructing the micro-kernel into a sub-kernel, under which a root kernel is constructed, and the root kernel can interact with the virtualized environment;
  • Step of expanding page table constructing corresponding expanded page tables for different processes, the processes are divided into client processes and server processes, and the base address of the page table of the client process is filled into the extended page table of the server process;
  • Fast communication step provide an interface oriented to user mode processes, and the interface can switch between processes in the address space of user mode;
  • Binary modification steps Scan the code page in the process and replace illegal code jump instructions.
  • the lightweight virtualization step includes:
  • Root kernel initialization steps initialize the root kernel after the secondary kernel is started, dynamically move the secondary kernel to the non-privileged mode, and the root kernel provides an interface for managing the extended page table;
  • Process identification step allocate a memory page for the process to record the identity information of the process, which is recorded as the identity information page, and map the identity information page to the process extension page table and the address space of the sub-kernel, so that The secondary kernel can access the identity information page of the current sinking process through the virtual address to identify the identity information of the sinking process.
  • the identity information page has the same customer physical address in the extended page tables of different processes.
  • the root kernel configures the VMCS domain so that the execution of the privileged instruction does not cause the virtual layer to sink; for the sink caused by the hardware event, the root kernel allows the hardware to fail.
  • the secondary kernel in the privileged mode inserts an external interrupt; for the sink caused by the violation of access to the extended page table, the root kernel uses a large-capacity page table to map the physical memory address to the secondary kernel, and the capacity of the page table adopts a memory page size of 1GB.
  • the step of expanding the page table includes:
  • Initialization steps register the server process to the sub-kernel during initialization.
  • the sub-kernel notifies the root kernel to copy the extended page table for the client process and the server process respectively, and add the extended page table mapping;
  • the client process accesses the springboard code page to switch between processes.
  • the springboard code page calls the VMFUNC instruction to change the extended page table pointer from the extended page table of the client process to the extended page table of the server process, without modifying the CR3 register value.
  • the small data volume is transmitted through the CPU register; for large data volume transmission, a shared buffer is allocated, and the address of the shared buffer is mapped to the client process and the server process. Extended page table.
  • the secondary kernel is a microkernel running in an unprivileged mode;
  • the root kernel runs in a privileged mode and includes a sink processing unit, an extension table management unit, and a self-virtualization unit;
  • the sink processing unit processes The sinking caused by the sub-kernel includes violations of access to the extended page table and sinking of the use of privileged instructions;
  • the extension table management unit dynamically manages the sub-kernel and the extended page tables of the processes in the sub-kernel;
  • the self-virtualization unit is dynamic when the system is started Downgrade the secondary kernel to unprivileged mode and initialize its VMCS and extended page tables.
  • a microkernel inter-process communication system provided according to the present invention includes:
  • Lightweight virtualization module starting the virtualization environment by hardware, constructing the micro-kernel into a sub-kernel, under which a root kernel is constructed, and the root kernel can interact with the virtualization environment;
  • Extended page table module constructs corresponding extended page tables for different processes, the process is divided into client process and server process, and the base address of the page table of the client process is filled in the extended page table of the server process;
  • Fast communication module provides an interface oriented to user mode processes, the interface can switch between processes in the user mode address space;
  • Binary Modification Module Scan the code page in the process and replace illegal code jump instructions.
  • a microkernel is a kernel architecture composed of a minimal number of functions. These functions are responsible for implementing the most basic mechanisms that an operating system depends on, including physical address space management, process management, Inter-process communication (IPC).
  • a microkernel process is an application program running on the microkernel, and is the basic unit of the microkernel for resource allocation and resource scheduling.
  • Inter-process communication (IPC) is some technology or method for transferring data or signals between at least two processes or threads.
  • the present invention focuses on the inter-process communication of the microkernel.
  • the client process/server process is on the microkernel. Each instance of the client process can send a request to a server process, and the server process is responsible for providing various functional services.
  • the virtual address space is when the CPU is addressing, it is addressed according to the virtual address, and then the virtual address is converted into a physical address through the memory management unit (MMU).
  • MMU memory management unit
  • the virtual machine monitor can virtualize multiple guest virtual machines on one physical machine, and each guest virtual machine has the same functions as the real machine.
  • the processor uses the TLB to cache the address mapping stored in part of the page table. When a virtual address needs to be translated, the TLB will be queried first. If there is no corresponding mapping in the TLB, then the page table stored in the memory will be accessed to complete the address translation.
  • Guest virtual address (GVA)/guest physical address (GPA)/host physical address (HPA) is in a virtualized environment, the program in the guest virtual machine uses the guest virtual address to access the memory, and the physical memory of the guest virtual machine is the guest physical address .
  • the kernel of the guest virtual machine controls the conversion of the guest virtual address to the guest physical address by controlling the guest page table.
  • the host physical address represents the real memory of the physical machine, and the virtual machine monitor controls the conversion of the guest physical address to the host physical address through the extended page table.
  • CR3 control register used to control and determine the operating mode of the processor and the characteristics of the currently executing task.
  • CR3 contains the physical memory base address of the page directory table, so this register is also called the page directory base address register PDBR (Page-Directory Base) address Register).
  • PDBR Page-Directory Base address Register
  • the VMCS data field is a physical CPU that can obtain various information of each virtual CPU through the VMCS data field.
  • the invention utilizes hardware virtualization technology to allow a process to directly switch to the virtual address space of another process and call the target function without being trapped in the microkernel.
  • the present invention still allows different processes to have different virtual address spaces.
  • Such a design is consistent with the existing microkernel and can reduce the modification of the existing system.
  • the present invention constructs different extended page tables for different processes (controls the mapping of client physical addresses to host physical addresses) by introducing a very small virtual machine monitor, and uses hardware VMFUNC instructions to switch the extended page tables , In order to achieve the effect of switching the virtual address space in the user mode.
  • the present invention maps the base address of the page table of the sender process (the value of CR3 register) by configuring the extended page table of the receiver process To the host physical address corresponding to the base address of the receiver process page table (the value of the CR3 register). Therefore, after the sender process uses the hardware VMFUNC instruction to switch the extended page table, the value of its CR3 register will directly point to the page table of the receiver process.
  • the present invention provides a stack for each thread in the virtual address space of the receiver process.
  • the present invention provides shared buffers to transmit a large amount of information. These shared buffers are bound to each thread in the receiver process one by one to ensure that the present invention works in a highly concurrent environment. Good performance under.
  • Intel hardware virtualization technology allows to configure an extended page table for each user-mode process (at this stage, up to 512 extended page tables can be supported).
  • the base address of these extended page tables (that is, the pointer to the extended page table) needs to be stored in the extended page table pointer list.
  • the memory allocation of this list is initialized in the root kernel. Time to complete.
  • the micro-kernel initialization phase the micro-kernel runs directly on the physical machine, and directly manages the mapping of virtual addresses to host physical addresses through the page table of the micro-kernel. In the initial stage of the present invention, it is necessary to add a layer of main extended page table.
  • the original page table of the microkernel is responsible for the mapping of guest virtual addresses to client physical addresses
  • the main extended page table is responsible for the mapping of guest physical addresses to host physical addresses.
  • the base address of the main extended page table is stored by default in the first position of the extended page table pointer list (that is, the offset is 0).
  • Each subsequent start of a user mode process will first copy the main extended page table.
  • a copy-on-write mechanism is adopted. Only when the subsequent process modifies the extended page table entry, the new allocation Memory and establish a new mapping.
  • the client process registers itself with the server process, a mapping from the base address of the client process page table to the server process page table base address corresponding to the physical address of the host is added to the extended page table of the server process.
  • the extended page table is constructed when each user-mode process is started. During the start of each user-mode process, the virtual machine monitor will directly use the main extended page table. Only when the process is registered with the server, it is necessary to copy a master extended page table for each newly registered server process. At the same time, in this new extended page table, the physical address of the client of the page table base address of the registered process The host physical address that points to the base address of the page table of the server process (using a copy-on-write mechanism). Then fill the base address of the first-level memory page of the new extended page table generated by the copy into the corresponding offset item of the extended page table pointer list, and the offset depends on the process identifier of the current user process.
  • the overall architecture of the present invention includes four modules: a lightweight virtualization module, an extended page table management module, a fast inter-process communication module, and a dynamic binary modification module.
  • the lightweight virtualization module is responsible for starting an environment that supports virtualization technology with the help of hardware, using the original microkernel as a sub-kernel, and inserting a root kernel under it to handle the interaction between the remaining modules and the virtualized environment. This module is carefully configured to minimize the performance loss of the virtualized environment compared with the original environment under the premise of ensuring the correctness of the function.
  • the lightweight virtualization module first transforms the original environment into a virtualized environment with a privileged mode and an unprivileged mode, and puts various processes in the unprivileged mode.
  • the lightweight virtualization module For the virtualization design of the original microkernel, it is necessary to consider whether it needs to be placed in an unprivileged mode.
  • Known technologies that meet the above requirements are mainly divided into two categories: 1) Simulate mature virtual machine technology, treat the original process and kernel as a virtual machine system, and run in an unprivileged mode at the same time. 2) Put the kernel in privileged mode and keep the process running in unprivileged mode.
  • the first type of technology can utilize existing commercial hypervisors (such as KVM and Xen), but will cause a greater performance loss due to the virtualization layer.
  • the second type of technology will produce a large number of virtual layer sinks when the process and the kernel interact (such as system calls), and the cost of a virtual layer sink is much more expensive than the cost of a system call in a non-virtualized environment.
  • the lightweight virtualization module provides a new solution. Compared with the existing technology, it not only avoids the performance loss caused by the traditional virtualization solution, but also eliminates the additional overhead caused by a large number of virtual layer sinks: microkernel It is still placed in the non-privileged mode as a secondary kernel, and a lightweight small hypervisor root kernel that only contains the necessary functions is introduced in the privileged mode. It only provides extended page table management functions, dynamic self-virtualization modules, and Some basic virtual layer sink processing logic.
  • the lightweight virtualization module uses the following three methods, for example:
  • virtual layer sinks can be divided into three categories: sinks caused by privileged instructions, sinks caused by hardware events, and sinks caused by violations of extended page table entries. 1) For the depression caused by the execution of privileged instructions (such as changing the value of the CR3 register, halt (HLT) instruction, etc.), the root kernel can configure the VMCS domain so that the execution of these privileged instructions does not cause any virtual layer depression; 2) For hardware events The traditional hypervisor will configure the hardware to trigger a virtual layer sink when receiving such an event.
  • privileged instructions such as changing the value of the CR3 register, halt (HLT) instruction, etc.
  • the root kernel in the present invention also plays the same role to allow the hardware to go to an unprivileged mode.
  • the present invention makes the root kernel use the largest large page (in x86- The size of the 64 architecture is 1GB) to map most of the physical memory addresses to the secondary kernel, which can reduce the number of memory accesses of the processing logic after a TLB miss, and also reduce the number of TLB misses.
  • the root kernel still retains part of the virtual layer sink processing logic for management. For example, the VMCALL instruction will unconditionally trigger the virtual layer sink and the root kernel uses this instruction to implement a communication with the upper-level kernel. interface.
  • Initialization of the root kernel The booting method of the root kernel is different from the traditional virtualization hypervisor that is initialized with the physical machine. In order to avoid executing a large amount of error-prone initialization code during the startup process, the root kernel is selected after the secondary kernel is started. Initialize and dynamically move the secondary kernel to unprivileged mode. In order to enable the sub-kernel in the non-privileged mode to conveniently manage the extended page table of each process, the root kernel exposes an interface for managing the extended page table for the upper layer through the CPUID.
  • the extended page table management module is responsible for constructing corresponding extended page tables for different processes, and cooperates with the inter-process fast communication module to fill in the relevant mapping and data structure into the correct position in the extended page table of the called process.
  • the present invention needs to meet two requirements at the same time: 1) to ensure the isolation of virtual address spaces between different processes and 2) to provide a set of effective user-mode virtual address space switching methods for these processes.
  • the existing technical solutions can be divided into two categories: 1) Put different processes into the same virtual address space, but allocate a different extended page table for each process separately to be at the same virtual address Isolation is provided in the space, and the VMFUNC instruction is also used to bypass the kernel and directly execute the switch of the virtual address space in the user mode. 2) Use the hardware feature PKU proposed by Intel to switch different perspectives of different processes in the virtual address space.
  • the existing technology has the following disadvantages: the first type of technology has the advantage of being easy to implement when the number of processes is small, but when the number of processes increases, in order to avoid conflicts in the virtual address areas allocated by different processes, it needs to be managed very carefully The division of the virtual address space leads to a series of complicated tasks and increases the possibility of configuration errors.
  • the second type of technology also cannot solve potential virtual address region conflicts.
  • this hardware feature only provides a limited number of security domains, which obviously cannot meet the needs of microkernel scenarios.
  • the extended page table management module adopts the mapping management of the extended page table to implement.
  • the extended page table management module proposes a set of new solutions to map and manage the extended page tables before and after switching, which can retain the traditional virtual memory isolation and fast To switch between virtual address spaces. Different processes still retain their respective page tables.
  • the mapping from the value of the CR3 register of the client process to the physical address of the host corresponding to the value of the CR3 register of the server process is added to the extended page table of the server process, so as to enable the user mode.
  • the process of using the VMFUNC instruction to switch the extended page table does not need to modify the value in the CR3 register, and can directly perform the subsequent virtual address translation.
  • the client process and the server process have their own page tables, and the value of the base address of the page table is the client process CR3 value and the server process CR3 value, respectively.
  • the server process will first register its own process information (such as the value of CR3, etc.) to the secondary kernel.
  • the secondary kernel will notify the underlying root kernel to copy two new extended page tables for the two processes and establish appropriate mappings.
  • the value in the CR3 register of the host will keep the CR3 value of the client process unchanged.
  • the springboard code will call the VMFUNC instruction to change the extended page table pointer from the client process extended page table to the server process extended page table.
  • the client process can directly access any virtual address in the virtual address space of the current server process .
  • the inter-process fast communication module is responsible for providing a set of user-mode process-oriented interfaces for quickly and effectively switching between processes in the user-mode address space.
  • the inter-process communication module is responsible for mapping the springboard code page to the virtual address space of the process when each process registers itself with the sub-kernel, thereby providing a set of interfaces for fast inter-process switching for user-mode processes.
  • Each client process needs to fill all the server processes that need to be called into the springboard code page.
  • the sub-kernel will allocate a corresponding number of stacks according to the maximum number of parallel threads that can be supported when the server process registers itself, and map these stacks to the virtual server process In the address space.
  • the sender process needs to transmit some data to the receiver process through inter-process communication.
  • This module provides two methods according to different data sizes to be transmitted: 1) For transmission with a small amount of data, this module is based on x86 The calling convention under the -64 architecture puts the data to be transmitted into the registers of the CPU. 2) For transmission with a large amount of data, this module allocates a shared buffer for each pair of client process and server process and maps the address of the buffer to the page tables of the two processes.
  • the dynamic binary modification module is responsible for scanning all code pages of each process and replacing illegal VMUNFC instructions, thereby preventing users from maliciously using VMFUNC instructions to illegally jump to any code execution address.
  • the dynamic binary modification module can ensure the security of the system.
  • illegal VMFUNC instructions may appear due to accidental or malicious factors.
  • the existence of these illegal VMFUNC instructions may be attacked by the attacker. It jumps to an illegal code area for execution, so the present invention introduces a dynamic binary modification module to eliminate these illegal VMFUNC instructions.
  • the sub-kernel When a process registers itself, the sub-kernel will call this module to scan all code pages of the process. If an illegal VMFUNC instruction is found outside the specified springboard code page, it will replace the illegal instruction with some functionally equivalent instructions. The VMFUNC instruction. After the code page is dynamically modified, the original instruction will become two or more equivalent instructions, so that the space of the original code page cannot accommodate these equivalent instructions. Therefore, this module replaces the content in the original instruction location space with a jump instruction to jump to another code page for placing equivalent instructions. The code page storing the equivalent instructions is inserted into an unused virtual address by the sub-core.
  • the present invention adopts an illegal instruction replacement strategy, and there are several different possibilities for the existence of illegal VMFUNC instructions in the code page.
  • This module categorizes them into three situations and handles them separately: 1) The illegal VMFUNC instruction is indeed one The VMFUNC instruction is deliberately implanted. In this case, the module will replace this illegal VMFUNC instruction with three NOP instructions (instructions that do not do any work). 2) The illegal VMFUNC instruction is pieced together by two or more adjacent instructions. In this case, the module will insert a null instruction between these adjacent instructions to break the pieced together VMFUNC instruction. 3) The illegal VMFUNC instruction exists in a longer instruction that contains the code of the VMFUNC instruction. In this case, the module will replace this instruction with several other equivalent instructions to eliminate the illegal instruction.
  • the process startup registration process includes:
  • Step 1) When a user mode process is started, first judge whether its own process will serve as a server process to provide services for other client processes. If it is a server process, skip to step 2, otherwise skip to step 4.
  • Step 2 As a server process, it needs to register its own process information such as CR3 register value and save it in the secondary kernel.
  • Step 3) Judge whether its own process will be used as a client process to call services provided by other server processes. If yes, proceed to step 4, otherwise the registration process is completed.
  • Step 4 As a client process, it needs to register and inform the secondary kernel of the server process information that the process needs to call.
  • Step 5 The secondary kernel will then notify the root kernel to copy two client process extended page tables and server process extended page tables for the current client process and the corresponding server process respectively.
  • Step 6 The root kernel adds the mapping from the client process CR3 value to the server process CR3 value corresponding to the host physical address to the server process's extended page table, and the registration process is started and completed.
  • the springboard code page is a memory page, which contains simplified code logic, which is used to switch between different extended page tables and call function functions correctly.
  • the so-called springboard means that when the process runs to the first address of the code page, it will start to perform operations such as switching the extended page table, which is functionally embodied as the execution flow jumps from the client process to the server process.
  • the client process sets the data parameters to be transmitted and calls the corresponding interface to start executing the code in the springboard code page.
  • the springboard code page uses the VMFUNC instruction to switch to the extended page table of the server process. Due to the configuration described above, the function in the server process can be called normally and the return value can be obtained at this time.
  • the jumpboard code page uses the VMFUNC instruction to switch back to the original extended page table of the client process, restores the state of the register, etc., and the client process finally successfully obtains the return value from the server process.
  • the extended page address mapping is the mapping relationship between virtual addresses and physical addresses, and is usually used to query the corresponding physical address based on a virtual address.
  • the performance in the extended page table is as follows: Given a virtual address, the virtual address is divided into multiple parts (currently 4), and each part is used as the offset of the corresponding level of the extended page table, which is gradually translated to the extended page table. The lowermost layer finally obtains the content stored in the lowermost extended page table entry, which is the physical address corresponding to the given virtual address.
  • the essence of adding the mapping of the extended page table is to fill in the target physical address in the corresponding lowest-level extended page table entry according to the given virtual address.
  • extension page address mapping is in the process of the client process registering itself with the server process:
  • the secondary kernel will call the interface provided by the root kernel to allow the root kernel to bind the client process and the server process at the level of the extended page table.
  • the root kernel will query the extended page table, using the client physical address of the client process page table base address (CR3 register value) as the index, and translate it layer by layer in the extended page table of the server process, and finally in the extended page table Find the corresponding extended page table entry at the lowest level,
  • the root kernel fills in the content of the extended page table entry in the server process as the host physical address corresponding to the base address of the server process page table.
  • the base address of the page table of the client process will eventually be translated into the host physical address corresponding to the page table of the server process without changing the value of the CR3 register.
  • the user mode inter-process switching process includes:
  • Step 1) The client process sets the target server process parameters and calls the interface for switching between user mode processes provided by the present invention.
  • Step 2 The jumpboard code receives the process parameters of the target server and checks whether the size of the data to be transmitted exceeds the size of the register. If yes, skip to step 3, otherwise skip to step 4.
  • Step 3 The springboard code copies the data to be transmitted from the internal buffer of the client process to the shared buffer with the target server process.
  • Step 4) Use the VMFUNC instruction to change the extended page table pointer from the client process extended page table to the server process extended page table.
  • Step 5 The jumpboard code configures the stack that will be used during the execution of the server process, and then calls the function function registered in advance by the server process to start execution.
  • the dynamic binary modification process includes:
  • Step 1) Capture all code pages owned by the process when a process starts.
  • Step 2 The secondary kernel scans all code pages and identifies all illegal VMFUNC instructions. If there is no illegal VMFUNC instruction, the process ends, if there is, continue to step 3.
  • Step 3) Identify the cause of each identified illegal VMFUNC instruction, and allocate a memory page for storing equivalent replacement instructions in a specific unused virtual address space for each illegal VMFUNC instruction.
  • Step 4 For each illegal VMFUNC instruction, the corresponding replacement strategy mentioned above is adopted, and the equivalent instruction after replacement is put into the allocated memory page.
  • Step 5 Add a jump instruction at the end of each memory page where the equivalent instruction is placed, and the jump target address is the instruction address of the next line of the replaced instruction address.
  • Step 6 Replace the original illegal VMFUNC instruction with a jump instruction, and set the jump target address to the starting address of the corresponding memory page.
  • the dynamic binary modification process ends.
  • the present invention can defend against attacks in terms of security.
  • the dynamic binary modification technology provided by the present invention dynamically eliminates all illegal VMFUNC instructions during the startup of each process, and can effectively defend against users Malicious use of VMFUNC instructions to carry out illegal jump execution attacks; for fuse Meltdown attacks and its variants, the present invention does not modify the original page table isolation mechanism of the microkernel, because the microkernel’s own design naturally changes the user status
  • the page tables of the process and the microkernel are separated, and even if the user mode process is compromised, the kernel mode key data cannot be read; for denial of service attacks, the present invention provides a set of timeout mechanisms for when the server process does not respond for a long time Force the execution flow back to the client process.
  • the present invention provides a table that records the permissions of the client process to call the server process, which is used in each client process Before calling other server processes, check whether they have the legal rights to call. Therefore, the malicious process cannot arbitrarily call the server process without permission.
  • the invention uses hardware virtualization technology to accelerate the inter-process communication of the microkernel, and uses the extended page table to control the mapping of the client physical address to the host physical address, thereby realizing that the value of the base address of the process page table before and after switching between processes does not need to be modified, and new hardware instructions are used ,
  • the extended page table can be switched between user mode processes without sinking, realizing fast switching between microkernel processes; adopting a lightweight virtualized environment configuration method, using a small hypervisor inserted in the bottom layer, only for the original micro-kernel
  • apply virtualization technology to the existing microkernel configure the VMCS domain to eliminate most of the performance loss caused by the introduction of the virtualization layer; use dynamic binary modification protection methods and use mature binary Modification technology completely eliminates illegal instructions in the process when creating a new process to ensure that malicious switching between processes cannot occur, and eliminates malicious instructions without modifying or recompiling the source code of the process program.
  • the present invention proposes a lightweight and efficient virtualization system that uses an extended page table to control the page table content of a user-mode process, thereby realizing inter-process switching without modifying the base address of the process page table, and realizing application to microkernels through virtualized hardware characteristics Quickly switch between processes in user mode, combined with the existing mature binary modification technology, and completely eliminate specific malicious instructions without any modification to the process source code.
  • the present invention proposes a set of methods for accelerating the performance of inter-process communication by using hardware virtualization technology. While retaining the original features of the microkernel, the hardware has greatly improved the performance of inter-process communication, and only minor modifications have been made to the original microkernel code, which not only ensures safety but also improves overall performance.
  • the dynamic binary modification protection technology proposed by the present invention can also be used in various systems that need to replace specific instructions without modifying the program source code.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Memory System Of A Hierarchy Structure (AREA)

Abstract

本发明提供了一种微内核进程间通讯方法和系统，借助硬件启动虚拟化环境，将微内核构造成次内核，所述次内核之下构造根内核，所述根内核能够与虚拟化环境交互；为不同的进程构造对应的扩展页表，所述进程分成客户进程和服务器进程，将客户进程的页表基地址填入服务器进程的扩展页表中；提供面向用户态进程的接口，所述接口能够在用户态的地址空间中进行进程间切换；对进程中的代码页进行扫描，并替换非法的代码跳转指令。本发明利用硬件虚拟化技术，利用扩展页表控制用户态进程的页表内容，实现无需修改进程页表基地址的进程间切换，在对现有硬件架构无需做任何修改的情况下，大幅提升微内核中进程间通信的性能。

Description

微内核进程间通讯方法和系统 技术领域
本发明涉及操作系统微内核技术领域，具体地，涉及一种微内核进程间通讯方法和系统，尤其是涉及一种高效且安全的微内核进程间通讯方法和系统。
背景技术
微内核自上世纪提出以来，经过了30年的研究与发展，其关键的设计是将操作系统内核只提供最基础的机制，并将大部分操作系统内核的其他功能从内核态移到用户态服务器进程中。这意味着一个服务器进程内发生的错误不会影响到其他服务器进程，更不会影响到微内核服务器微内核。因此，这样的设计能够增强微内核的鲁棒性。同时，将大部分功能移除内核态，可以有效减小可信计算基(TCB)，使得系统更不容易被攻击，也更容易被形式化验证。基于上述优势，微内核被广泛应用于高度依赖于安全与可靠性的领域，例如航空、车载系统、医疗设备。
在一个微内核中，任何两个进程之间的通讯都依赖于进程间通讯机制，但是目前已知该机制是运行时开销的重要来源。一次进程间通讯首先需要调用系统调用陷入微内核，之后微内核查找到目标进程，再将消息拷贝到目标进程，同时还需要两次进程地址空间切换(如果要防御最近的熔断Meltdown攻击)，最后回到用户态。如果要回到原进程，这样的过程还需要完整的重复一遍。
研究人员一直在探索更加高效的优化方案，以便减少微内核进程间通讯的开销。目前已知软件和硬件两类优化方案。
目前已知性能最佳的微内核进程间通讯方法由seL4操作系统实现，该方案完全通过软件实现，目标将所有不必要的操作从进程间通讯的路径中去除。seL4为Call和ReplyWait系统调用使用快速通道的技术方法，该方法会直接将消息传送给目标进程，同时不需要调度。所有的传输的数据存放在寄存器中，也消除了数据拷贝的开销。但是seL4存在缺陷，首先，快速通道技术依然需要下陷进入内核，因此它的性能开销也较大；其次，快速通道路径只适用于部分系统调用(Call和ReplyWait)，同时只能传输少量数据，当使用其它系统调用或者传输数据超出一定限制，只能使用性能开销更大的慢速 通道技术，也就是传统的微内核进程间通讯方法。第三，当通讯的两个进程运行在不同的处理器上，一次进程间通讯需要使用跨处理器中断(Inter-Processor Interrupt)，该中断会极大的影响进程间通讯的性能。
基于硬件的修改方案可以大大提高微内核进程间通讯的开销，dIPC项目通过修改硬件的方式将所有进程间通讯参与方放置在同一个虚拟地址空间，之后的进程间通讯完全由硬件实现，允许一个进程直接调用另一个进程的函数，而无需操作系统内核的帮助。进程间的隔离依赖于dIPC实现的标签内存，该内存也需要通过修改硬件的方式实现。但是，使用dIPC需要对软件做出较大修改，以便利用dIPC提出的接口。同时也需要对操作系统内核做出较大修改，以便适应新的进程间通讯方式。修改硬件的技术手段距离真正被大规模使用依然需要长时间的时间检验，同时该方法与直接使用成熟商用硬件的方法相比，较难得到部署。因此该方法很难在短时间内得到接受。
与本申请相关的现有技术是专利文献CN103425538A，公开了一种进程通讯方法，根据进程通讯请求分配内存空间；将通讯数据存入所述内存空间；将所述内存空间的逻辑地址写入消息队列；通过从所述消息队列中读取的逻辑地址访问所述通讯数据。上述进程通讯方法及系统，在接收到进程通讯请求时分配用于存储通讯数据的内存空间，这将不需要预先划分通讯数据的存储空间，将内存空间的逻辑地址写入消息队列中，通过在消息队列中逻辑地址的读取进行通讯数据的访问，以在消息队列的作用下使得数据访问进程通过对消息队列中逻辑地址的逐一读取有序访问通讯数据，在多个进程之间的通讯过程中不需要进行通讯数据的复制，大大地提高了数据共享的灵活性。
发明内容
针对现有技术中的缺陷，本发明的目的是提供一种微内核进程间通讯方法和系统。
根据本发明提供的一种微内核进程间通讯方法，包括：
轻量级虚拟化步骤：借助硬件启动虚拟化环境，将微内核构造成次内核，所述次内核之下构造根内核，所述根内核能够与虚拟化环境交互；
扩展页表步骤：为不同的进程构造对应的扩展页表，所述进程分成客户进程和服务器进程，将客户进程的页表基地址填入服务器进程的扩展页表中；
快速通讯步骤：提供面向用户态进程的接口，所述接口能够在用户态的地址空间中进行进程间切换；
二进制修改步骤：对进程中的代码页进行扫描，并替换非法的代码跳转指令。
优选地，所述轻量级虚拟化步骤包括：
虚拟层下陷消除步骤：对虚拟层下陷进行处理；
根内核初始化步骤：在次内核启动后对根内核进行初始化，动态将次内核移动到非特权模式下，根内核提供用于管理扩展页表的接口；
进程识别步骤：为进程分配一个内存页用于记录进程的身份信息，记为身份信息页，并将所述身份信息页映射到所述进程扩展页表中以及次内核的虚拟地址空间中，使得次内核能够通过虚拟地址访问当前下陷进程的身份信息页以识别下陷进程的身份信息。所述身份信息页在不同进程扩展页表中拥有相同的客户物理地址。
优选地，所述对虚拟层下陷进行处理中，对于特权指令造成的下陷，根内核通过配置VMCS域令特权指令的执行不造成虚拟层下陷；对于硬件事件造成的下陷，根内核允许硬件向非特权模式下的次内核插入外部中断；对于访问扩展页表违规造成的下陷，根内核使用大容量页表将物理内存地址映射给次内核。
优选地，所述扩展页表步骤中包括：
初始化步骤：初始化时对服务器进程注册到次内核，当客户进程进行注册时，次内核通知根内核为客户进程、服务器进程分别复制扩展页表，添加扩展页表映射；
切换进程步骤：客户进程访问跳板代码页进行进程间切换，跳板代码页调用VMFUNC指令将扩展页表指针从客户进程的扩展页表改成指向服务器进程的扩展页表，无需修改CR3寄存器值。
优选地，所述快速通讯步骤，对于小数据量传输，所述小数据量通过CPU寄存器传输，对于大数据量传输，分配共享缓冲区，将共享缓冲区的地址映射到客户进程及服务器进程的扩展页表中。
优选地，所述二进制修改步骤中，对于植入的单条VMFUNC指令，将所述单条VMFUNC指令替换为三条空指令；对于由相邻指令拼凑的非法指令，令相邻指令之间插入一个空指令；对于存在于一条长指令之中的非法指令，令所述长指令替换成多个等价的指令后再处理。
优选地，所述次内核是运行在非特权模式下的微内核；所述根内核运行在特权模式下的，包括下陷处理单元、扩展表管理单元、自我虚拟化单元；所述下陷处理单元处理次内核引起的下陷，包括访问扩展页表违规和使用特权指令下陷；所述扩展表管理单元动态管理次内核、及次内核内进程的扩展页表；所述自我虚拟化单元 在系统启动时动态将次内核降级为非特权模式并初始化其VMCS和扩展页表。
根据本发明提供的一种微内核进程间通讯系统，包括：
轻量级虚拟化模块：借助硬件启动虚拟化环境，将微内核构造成次内核，所述次内核之下构造根内核，所述根内核能够与虚拟化环境交互；
扩展页表模块：为不同的进程构造对应的扩展页表，所述进程分成客户进程和服务器进程，将客户进程的页表基地址填入服务器进程的扩展页表中；
快速通讯模块：提供面向用户态进程的接口，所述接口能够在用户态的地址空间中进行进程间切换；
二进制修改模块：对进程中的代码页进行扫描，并替换非法的代码跳转指令。
与现有技术相比，本发明具有如下的有益效果：
1、对于存在已久的微内核进程间通信性能较差问题，本发明巧妙地利用硬件虚拟化技术，在对现有硬件架构无需做任何修改的情况下，大幅提升微内核中进程间通信的性能。
2、本发明可以应用在各种不同设计的微内核上，并且仅需对微内核的代码进行较小的修改即可带来大幅的性能提升。
3、本发明并未改变原本微内核的强隔离性，仍然对于熔断Meltdown等攻击具备防御能力。
附图说明
通过阅读参照以下附图对非限制性实施例所作的详细描述，本发明的其它特征、目的和优点将会变得更明显：
图1为本发明通讯装置的实施例示意图；
图2为利用扩展页表控制客户页表内容；
图3为进程启动注册流程；
图4为用户态进程间切换流程；
图5为动态二进制修改流程。
具体实施方式
下面结合具体实施例对本发明进行详细说明。以下实施例将有助于本领域的技术人员进一步理解本发明，但不以任何形式限制本发明。应当指出的是，对本领域的普通技 术人员来说，在不脱离本发明构思的前提下，还可以做出若干变化和改进。这些都属于本发明的保护范围。
本发明所提出的方法能够在微内核进程间通讯时，在无需微内核的介入的情况下，允许一个进程直接切换到另一个进程的虚拟地址空间。微内核的介入是进程间通讯开销大的重要原因，如果将微内核从进程间通讯的路径中去除，将极大提高进程间通讯的性能。因此，本发明将微内核从进程间通讯中去除。在无需微内核介入的情况下，保证一个进程不会恶意利用进程间通讯访问其他进程的数据和执行其他进程的代码。传统进程间通讯方法需要由微内核负责检查通讯的合法性，阻止任何可能的攻击。现有技术可以保证在没有操作系统内核介入情况下的进程间通讯安全，但是却需要修改硬件，本发明需要使用成熟的商用硬件来保证安全性。本发明尽可能小的修改应用程序与微内核源码，进程间通讯方法是微内核中的核心机制，对它的修改常常意味着需要对应用程序与微内核源码做出大量修改，这样会带来较大的部署难度。因此，本发明尽可能小的修改应用程序与微内核源码。
根据本发明提供的一种微内核进程间通讯方法，包括：
轻量级虚拟化步骤：借助硬件启动虚拟化环境，将微内核构造成次内核，所述次内核之下构造根内核，所述根内核能够与虚拟化环境交互；
扩展页表步骤：为不同的进程构造对应的扩展页表，所述进程分成客户进程和服务器进程，将客户进程的页表基地址填入服务器进程的扩展页表中；
快速通讯步骤：提供面向用户态进程的接口，所述接口能够在用户态的地址空间中进行进程间切换；
二进制修改步骤：对进程中的代码页进行扫描，并替换非法的代码跳转指令。
具体地，所述轻量级虚拟化步骤包括：
虚拟层下陷消除步骤：对虚拟层下陷进行处理；
根内核初始化步骤：在次内核启动后对根内核进行初始化，动态将次内核移动到非特权模式下，根内核提供用于管理扩展页表的接口；
进程识别步骤：为进程分配一个内存页用于记录进程的身份信息，记为身份信息页，并将所述身份信息页映射到所述进程扩展页表中，以及次内核的地址空间中，使得次内核能够通过虚拟地址访问当前下陷进程的身份信息页以识别下陷进程的身份信息。所述身份信息页在不同进程扩展页表中拥有相同的客户物理地址。
具体地，所述对虚拟层下陷进行处理中，对于特权指令造成的下陷，根内核通 过配置VMCS域令特权指令的执行不造成虚拟层下陷；对于硬件事件造成的下陷，根内核允许硬件向非特权模式下的次内核插入外部中断；对于访问扩展页表违规造成的下陷，根内核使用大容量页表将物理内存地址映射给次内核，所述页表的容量采用1GB的内存页大小。
具体地，所述扩展页表步骤中包括：
初始化步骤：初始化时对服务器进程注册到次内核，当客户进程进行注册时，次内核通知根内核为客户进程、服务器进程分别复制扩展页表，添加扩展页表映射；
切换进程步骤：客户进程访问跳板代码页进行进程间切换，跳板代码页调用VMFUNC指令将扩展页表指针从客户进程的扩展页表改成指向服务器进程的扩展页表，无需修改CR3寄存器值。
具体地，所述快速通讯步骤，对于小数据量传输，所述小数据量通过CPU寄存器传输，对于大数据量传输，分配共享缓冲区，将共享缓冲区的地址映射到客户进程及服务器进程的扩展页表中。
具体地，所述二进制修改步骤中，对于植入的单条VMFUNC指令，将所述单条VMFUNC指令替换为三条空指令；对于由相邻指令拼凑的非法指令，令相邻指令之间插入一个空指令；对于存在于一条长指令之中的非法指令，令所述长指令替换成多个等价的指令后再处理。
具体地，所述次内核是运行在非特权模式下的微内核；所述根内核运行在特权模式下的，包括下陷处理单元、扩展表管理单元、自我虚拟化单元；所述下陷处理单元处理次内核引起的下陷，包括访问扩展页表违规和使用特权指令下陷；所述扩展表管理单元动态管理次内核、及次内核内进程的扩展页表；所述自我虚拟化单元在系统启动时动态将次内核降级为非特权模式并初始化其VMCS和扩展页表。
根据本发明提供的一种微内核进程间通讯系统，包括：
轻量级虚拟化模块：借助硬件启动虚拟化环境，将微内核构造成次内核，所述次内核之下构造根内核，所述根内核能够与虚拟化环境交互；
扩展页表模块：为不同的进程构造对应的扩展页表，所述进程分成客户进程和服务器进程，将客户进程的页表基地址填入服务器进程的扩展页表中；
快速通讯模块：提供面向用户态进程的接口，所述接口能够在用户态的地址空间中进行进程间切换；
二进制修改模块：对进程中的代码页进行扫描，并替换非法的代码跳转指令。
关于本发明中涉及的术语作如下解释，微内核是一种内核架构，由数量最小化的功能组成，这些功能负责实现一个操作系统依赖的最基础的机制，包括物理地址空间管理，进程管理，进程间通讯(IPC)。微内核进程是运行在微内核之上的应用程序，是微内核进行资源分配和资源调度的基本单位。进程间通讯(IPC)是至少两个进程或线程间传送数据或信号的一些技术或方法。本发明专注于微内核的进程间通讯。客户进程/服务器进程是在微内核上，每一个客户端进程的实例都可以向一个服务器进程发出请求，服务器进程负责提供各种功能性的服务。虚拟地址空间是CPU在寻址的时候，是按照虚拟地址来寻址，然后通过内存管理单元(MMU)将虚拟地址转换为物理地址。虚拟机监视器能够在一台物理机器上虚拟出多台客户虚拟机，每台客户虚拟机拥有与真实机器一样的功能。为了提升虚拟地址到物理地址的翻译速度，处理器利用TLB缓存部分页表中储存的地址映射。当需要翻译某一虚拟地址时，将首先查询TLB，如果TLB中无对应映射，才访问储存于内存中的页表，完成地址翻译。客户虚拟地址(GVA)/客户物理地址(GPA)/主机物理地址(HPA)是在虚拟化环境中，客户虚拟机中的程序使用客户虚拟地址访问内存，客户虚拟机的物理内存为客户物理地址。客户虚拟机的内核通过控制客户页表，从而控制客户虚拟地址到客户物理地址的转换。主机物理地址代表物理机器的真实内存，虚拟机监视器通过扩展页表控制客户物理地址到主机物理地址的转换。CR3控制寄存器：用于控制和确定处理器的操作模式以及当前执行任务的特性，CR3中含有页目录表物理内存基地址，因此该寄存器也被称为页目录基地址寄存器PDBR(Page-Directory Base address Register)。VMCS数据域是一个物理CPU通过VMCS数据域能够获得每个虚拟CPU的各种信息。
本发明利用硬件虚拟化技术，允许一个进程在无需陷入微内核的情况下，直接切换到另一个进程的虚拟地址空间，并调用目标函数。具体来说，本发明依然允许不同进程拥有不同的虚拟地址空间，这样的设计与已有的微内核一致，可以减少对现有系统的修改。同时，本发明通过引入一个极小的虚拟机监控器，为不同的进程构造不同的扩展页表(控制客户物理地址到主机物理地址的映射)，并利用硬件的VMFUNC指令进行扩展页表的切换，以达到在用户态切换虚拟地址空间的效果。为此，对于两个客户进程(发送者进程)和服务器进程(接收者进程)，本发明通过配置接收者进程的扩展页表，将发送者进程的页表基地址(CR3寄存器的值)映射到接收者进程页表基地址(CR3寄存器的值)对应的主机物理地址。因此，发送者进程在利用硬件的VMFUNC指令进行扩展页 表的切换后，其CR3寄存器的值会直接指向接收者进程的页表。同时，本发明在接收者进程的虚拟地址空间内为其每个线程分别提供了一个栈。另外，为了支持长进程间通信，本发明提供了共享缓冲区用以在传输大量的信息，这些共享缓冲区和接收者进程中的每个线程一一绑定从而保证了本发明在高并发环境下的良好性能。
在虚拟机监控器为进程构造扩展页面的过程中，Intel硬件虚拟化技术允许为每个用户态进程配置一份扩展页表(现阶段最多可支持512份扩展页表)。为了便于对不同扩展页表进行翻译、切换等操作，这些扩展页表的基地址(即指向扩展页表的指针)需要存储在扩展页表指针列表中，该列表的内存分配是在根内核初始化时完成的。在微内核初始化阶段，微内核直接运行在物理机上，通过微内核的页表来直接管理虚拟地址到主机物理地址的映射。在初始化本发明阶段，需要增加一层主扩展页表，微内核原有页表负责客户虚拟地址到客户物理地址的映射，主扩展页表负责客户物理地址到主机物理地址的映射。主扩展页表的基地址默认存储在扩展页表指针列表的第一个位置(即偏移量为0)。
后续每启动一个用户态进程，都会先对主扩展页表进行拷贝，为了节省内存开销采取写时复制(Copy-on-write)机制，仅当后续进程对扩展页表项有修改时，新分配内存并建立新的映射。在客户进程向服务器进程注册自己时，会向服务器进程的扩展页表添加客户进程页表基地址到服务器进程页表基地址对应主机物理地址的映射。
构造扩展页表是每一个用户态进程启动时，在每个用户态进程的启动过程中，虚拟机监控器会直接使用主扩展页表。只有当该进程向服务器注册时，才需要为每一个新注册的服务器进程拷贝一份主扩展页表，同时在这个新的扩展页表中，将该注册进程的页表基地址的客户物理地址指向服务器进程的页表基地址的主机物理地址(采用写时复制机制)。然后将拷贝生成的新扩展页表的第一级内存页的基地址填入到扩展页表指针列表的对应偏移项中，偏移量取决于当前用户进程的进程标识符。
如图1所示，本发明总体架构包括四个模块：轻量级虚拟化模块，扩展页表管理模块，进程间快速通信模块以及动态二进制修改模块。
轻量级虚拟化模块负责借助硬件启动一个支持虚拟化技术的环境，将原本的微内核作为次内核，并在其下插入一个根内核用于处理其余模块与虚拟化环境相关的交互。该模块通过仔细的配置以在保证功能正确性的前提下，尽可能的减少虚拟化环境相较于原有环境所带来的性能损失。
具体地，为了使用VMFUNC指令，进程需要运行在虚拟化环境中的非特权模式下。 轻量级虚拟化模块首先将原本的环境转变为拥有特权模式和非特权模式的虚拟化环境，并将各种进程置于非特权模式中。对于原有微内核的虚拟化设计则需考量是否需要将其置于非特权模式下。满足上述需求的已知技术主要分为两大类：1)模拟成熟的虚拟机技术，将原有进程和内核视为一个虚拟机系统，同时运行在非特权模式下。2)将内核置于特权模式下，而保持进程运行在非特权模式下。然而现有技术具有以下缺点：第一类技术可以利用现有的商用虚拟机管理程序(例如KVM和Xen)，但是会因为虚拟化层造成较大的性能损失。第二类技术会在进程和内核交互(例如系统调用)时产生大量的虚拟层下陷，而一次虚拟层下陷的开销要比非虚拟化环境下一次系统调用的开销要昂贵的多。
轻量级虚拟化模块提供了一种新的解决方案，相比现有技术，既避免了传统的虚拟化方案带来的性能损失，又消除了大量的虚拟层下陷造成的额外开销：微内核仍然被置于非特权模式下作为次内核，而在特权模式引入了一个轻量级的只包含了必要功能的小型管理程序根内核，仅仅提供了扩展页表管理功能，动态自我虚拟化模块以及一些基础的虚拟层下陷处理逻辑。轻量级虚拟化模块采用以下三种方式，例如：
(1)不必要虚拟层下陷的消除：为了消除昂贵的虚拟层下陷开销，根内核通过仔细地设置VMCS域使得大部分的虚拟机行为不会触发任何的虚拟层下陷。总体上看，虚拟层下陷一共可以分为三大类：特权指令造成的下陷、硬件事件造成的下陷以及扩展页表项违规造成的下陷。1)对于执行特权指令造成的下陷(比如更改CR3寄存器的值，停机(HLT)指令等)，根内核可以配置VMCS域令这些特权指令的执行不造成任何虚拟层下陷；2)对于硬件事件造成的下陷(比如外部中断等)，传统的虚拟机管理程序会配置硬件在接收到此类事件时触发一个虚拟层下陷，本发明中的根内核也扮演同样的角色以允许硬件向非特权模式下的次内核插入外部中断；3)对于访问扩展页表项违规造成的虚拟层下陷，为了尽可能的减少二级地址翻译造成的性能损失，本发明使根内核使用最大的大型页(在x86-64架构下大小为1GB)来映射大部分的物理内存地址给次内核，既能减少TLB未命中后处理逻辑的内存访问次数，又能减少TLB未命中的次数。除上述三类下陷之外，根内核仍然保留有部分用于管理的虚拟层下陷处理逻辑，比如VMCALL指令会无条件的触发虚拟层下陷而根内核利用这条指令实现了一个和上层次内核通信的接口。
(2)根内核的初始化：根内核的启动方式与传统的随物理机器一同初始化的虚 拟化管理程序不同，为了避免启动过程中执行大量且易错的初始化代码，根内核选择在次内核启动后初始化并动态地将次内核移动到非特权模式下。为了使非特权模式下的次内核能够方便地管理每个进程的扩展页表，根内核通过CPUID为上层暴露了一个用于管理扩展页表的接口。
(3)进程误识别问题：当一个发送者进程正在一个接收者进程的虚拟地址空间中执行时，如果此时发送者进程接收到一个中断而导致其下陷到次内核中，则它会试图以接收者进程的身份去调用次内核提供的功能。然而此时的次内核仍然会将调用内核功能的进程识别为原本的发送者进程，这就是所谓的进程误识别问题。为了解决这个问题，本发明为每个进程分配了一个内存页用于记录每个进程的身份信息并将这个页映射到每个进程扩展页表中相同的客户物理地址。同时本发明通过将每个进程的身份信息页映射到次内核的地址空间中使得次内核可以通过一个虚拟地址访问当前下陷进程的身份信息页以正确地确定下陷进程的身份。
扩展页表管理模块负责为不同的进程构造对应的扩展页表，并配合进程间快速通信模块将有关的映射和数据结构填入被调用进程的扩展页表中的正确位置。
具体地，本发明需要同时满足两个需求：1)保证不同进程间的虚拟地址空间的隔离性2)为这些进程提供一套有效的用户态虚拟地址空间切换的方法。为满足上述需求，现有的技术方案可分为两类：1)将不同的进程放入同一个虚拟地址空间，但是为每一个进程单独分配一个用不同的扩展页表以在相同的虚拟地址空间中提供隔离性，同时也利用VMFUNC指令来绕过内核直接在用户态执行虚拟地址空间的切换。2)利用英特尔提出的硬件特性PKU来切换不同进程在虚拟地址空间中的不同视角。但是现有技术具有以下缺点：第一类技术在进程数量较少时拥有易于实现的优点，但是当进程数量增多时，为了避免不同进程分配到的虚拟地址区域产生冲突，就需要非常仔细地管理虚拟地址空间的划分，导致一系列繁杂的工作并且提高了配置出错的可能性。第二类技术同样无法解决潜在的虚拟地址区域冲突问题。此外该硬件特性仅提供了有限数量的安全域，显然无法满足微内核场景下的需求。扩展页表管理模块采用扩展页表的映射管理进行实现。
针对现有技术的缺陷，扩展页表管理模块提出了一套新的解决方案，对切换前后扩展页表进行映射管理，不需要经过大量的修改即可既保留传统的虚拟内存隔离性又能够快速地在虚拟地址空间之间进行切换。对于不同的进程仍然保留它们各自的页表，将客户进程的CR3寄存器的值到服务器进程的CR3寄存器值对应的 主机物理地址的映射添加到服务器进程的扩展页表中，这样就能够使得用户态的进程在利用VMFUNC指令切换扩展页表时无需修改CR3寄存器中的值，可以直接进行后续的虚拟地址翻译。
如图2所示，在虚拟地址空间切换流程中，客户进程和服务器进程拥有它们各自的页表，页表基地址的值分别为客户进程CR3值和服务器进程CR3值。在初始化过程中，服务器进程会首先将自己的进程信息(比如CR3的值等)注册到次内核。当客户进程进行注册时，次内核会通知底层的根内核为两个进程分别复制两份新的扩展页表并建立合适的映射。在执行进程间切换的过程中，主机的CR3寄存器中的值会保持客户进程CR3值不变。当客户进程调用相应的接口后，跳板代码会调用VMFUNC指令将扩展页表指针从客户进程扩展页表改指向服务器进程扩展页表，客户进程可以直接访问当前服务器进程虚拟地址空间中的任意虚拟地址。
进程间快速通信模块负责提供一套面向用户态进程的接口，用于快速有效地在用户态地址空间中进行进程间切换。
具体地，进程间通信模块负责在每个进程向次内核注册自己时将跳板代码页映射到该进程的虚拟地址空间中，从而为用户态的进程提供用于快速进程间切换的一套接口。每个客户进程都需要将所有需要调用的服务器进程填入跳板代码页中。当将一个客户进程绑定到一个服务器进程上时，次内核会根据服务器进程注册自己时设定的最大可支持的并行线程数量来分配对应数量的栈，并将这些栈映射到服务器进程的虚拟地址空间中。通常情况下，发送者进程需要通过进程间通信将一些数据传输至接受者进程，本模块根据不同的待传输数据大小提供了两种方式：1)对于数据量较小的传输，本模块按照x86-64架构下的调用约定将要传输的数据放入CPU的寄存器中。2)对于数据量较大的传输，本模块为每一对客户进程和服务器进程分配了一块共享缓冲区并将缓冲区的地址映射到了两个进程的页表中。
动态二进制修改模块负责扫描每个进程的所有代码页并替换非法的VMUNFC指令，由此防止用户恶意利用VMFUNC指令非法地跳转至任意代码执行地址。
具体地，动态二进制修改模块能够保证系统安全性，在用户态进程的代码页中，可能会出现因为偶然或恶意等因素拼凑出的非法VMFUNC指令，这些非法的VMFUNC指令的存在有概率被攻击者利用而跳转到非法的代码区域执行，所以本发明引入了动态二进制修改模块来消除这些非法的VMFUNC指令。
当一个进程注册自己时，次内核会调用本模块扫描这个进程的所有代码页，如果 在指定的跳板代码页之外发现了非法的VMFUNC指令则会用功能性等价的一些指令替换这条非法的VMFUNC指令。在代码页被动态修改后，原本的一条指令会变为两条甚至更多条的等价指令，这样原本代码页的空间就容不下这些等价指令了。因此，本模块会将原本的指令位置空间中的内容替换为一条跳转指令用以跳转到另一个用于放置等价指令的代码页。存放等价指令的代码页由次内核负责插入到一个未被使用的虚拟地址处。
其中，本发明采用非法指令替换策略，导致代码页中存在非法VMFUNC指令的因素有几种不同的可能，本模块将其归类为三种情况分别进行处理：1)非法的VMFUNC指令确实是一条被故意植入的VMFUNC指令，这种情况下本模块会将这条非法的VMFUNC指令替换为三条空(NOP)指令(不做任何工作的指令)。2)非法的VMFUNC指令由两条或多条相邻的指令拼凑出来，这种情况下本模块会在这些相邻的指令之间插入一个空指令来打破这个拼凑出的VMFUNC指令。3)非法的VMFUNC指令存在于一条较长的指令中包含了VMFUNC指令的编码，这种情况下本模块会将这条指令替换为其它几条等价的指令从而消除非法指令。
具体的实施操作流程可以参考图3、图4、图5，进程启动注册流程中，如图2所示，包括：
步骤1)当一个用户态进程启动时，首先判断自身进程是否会作为一个服务器进程为其他客户进程提供服务。如果自身是一个服务器进程，则跳转至步骤2，否则跳转至步骤4。
步骤2)作为一个服务器进程需要将自己的CR3寄存器值等进程信息注册并保存到次内核中。
步骤3)判断自身进程是否会作为一个客户进程去调用其他服务器进程提供的服务。是则继续步骤4，否则启动注册流程完成。
步骤4)作为一个客户进程需要注册通知次内核该进程需要调用的服务器进程信息。
步骤5)次内核接着会通知根内核为当前客户进程和对应的服务器进程分别复制两个客户进程扩展页表和服务器进程扩展页表。
步骤6)根内核将从客户进程CR3值映射到服务器进程CR3值对应主机物理地址的映射添加到服务器进程的扩展页表中，启动注册流程完成。
通过跳板代码页实现客户进程与服务器进程之间的通讯，首先明确跳板代码页是 一个内存页，其中包含了精简的代码逻辑，用于在不同的扩展页表中切换并正确调用函数功能。所谓跳板，即当进程运行到该代码页的首地址时，将开始执行扩展页表的切换等操作，功能上体现为执行流从客户进程跳转到了服务器进程。
在客户进程与服务器进程的初始化注册过程中，跳板代码页的映射已经被分别插入到二者的页表当中，当客户进程想要与服务器进程通信时：
1)首先客户进程设定好待传输的数据参数并调用相应的接口，开始执行跳板代码页中的代码，
2)跳板代码页中的代码将保存客户进程当前的寄存器等状态信息并配置相应的栈以供后续执行，
3)随后跳板代码页使用VMFUNC指令切换到服务器进程的扩展页表，由于前文所述的配置，此时可以正常调用服务器进程中的函数并获得返回值，
4)跳板代码页使用VMFUNC指令切换回原来的客户进程的扩展页表，恢复寄存器等状态，客户进程最后成功获得来自服务器进程的返回值。
扩展页地址映射是虚拟地址到物理地址的映射关系，通常用于根据一个虚拟地址查询对应的物理地址。在扩展页表中表现为：给定一个虚拟地址，将虚拟地址切分为多个部分(当前为4个)，每一部分作为扩展页表对应层级的偏移量，逐步翻译到扩展页表的最下层，最终获取到存储在最下层扩展页表项中的内容，该内容即给定虚拟地址对应的物理地址。添加扩展页表的映射，本质是根据给定的虚拟地址，在对应的最下层扩展页表项中，填入目标物理地址。
扩展页地址映射是在客户进程向服务器进程注册自己的过程中：
1)次内核会调用根内核提供的接口，让根内核在扩展页表的层面将客户进程与服务器进程绑定，
2)根内核将通过查询扩展页表的方式，以客户进程页表基地址(CR3寄存器值)的客户物理地址为索引，在服务器进程的扩展页表中逐层翻译，最终在扩展页表的最下层找到对应的扩展页表项，
3)根内核将服务器进程中的该扩展页表项内容填写为服务器进程页表基地址所对应的主机物理地址。
由此，当客户进程的页表和服务器进程的扩展页表搭配使用时，客户进程的页表基地址最终会翻译为服务器进程的页表所对应的主机物理地址，无需更改CR3寄存器的值。
如图3所示，用户态进程间切换流程中包括：
步骤1)客户进程设定好目标服务器进程参数，调用本发明提供的用户态进程间切换的接口。
步骤2)跳板代码收到目标服务器进程参数，并检查待传输的数据大小是否超出寄存器所能容纳的大小。是则跳转至步骤3，否则跳转至步骤4。
步骤3)跳板代码将要传输的数据从客户进程的内部缓冲区复制到与目标服务器进程的共享缓冲区中。
步骤4)利用VMFUNC指令将扩展页表指针从客户进程扩展页表改指向服务器进程扩展页表。
步骤5)跳板代码配置好服务器进程执行过程中会用到的栈，然后调用服务器进程提前注册好的功能函数使其开始执行。
如图4所示，动态二进制修改流程中包括：
步骤1)一个进程启动时捕获该进程拥有的所有代码页。
步骤2)次内核扫描所有的代码页并识别出所有的非法VMFUNC指令。若不存在非法VMFUNC指令则流程结束，若存在则继续步骤3。
步骤3)判别每个识别出的非法VMFUNC指令的产生原因，对于每个非法VMFUNC指令在特定的未被使用的虚拟地址空间分配一块用于存放等价替换指令的内存页。
步骤4)对于每个非法VMFUNC指令采取上文中提到的对应替换策略，将替换后的等价指令放入分配好的内存页中。
步骤5)在每个放置等价指令的内存页末尾添加一条跳转指令，跳转目标地址为被替换指令地址的下一行指令地址。
步骤6)将原本非法VMFUNC指令的位置中替换为一条跳转指令，跳转目标地址设为对应内存页的起始地址。动态二进制修改流程结束。
本发明在安全性方面能够防御攻击，对于恶意切换扩展页表攻击，利用本发明提供的动态二进制修改技术，动态地在每个进程启动过程中消除所有非法的VMFUNC指令，能够有效地防御来自用户态恶意利用VMFUNC指令进行非法跳转执行的攻击；对于熔断Meltdown攻击及其变体，本发明并未对微内核原有的页表隔离机制做出修改，由于微内核自身的设计天然将用户态进程和微内核的页表分开隔离，即使用户态进程被攻陷也无法读取内核态的关键数据；对于拒绝服务攻击，本发明提供了一套超时机制，用于在服务器进程长时间未响应时强制将执行流返回给客户进程。因此即便攻击者通过 恶意请求使服务器进程阻塞也不会造成其他进程的执行阻塞；对于恶意服务进程调用攻击，本发明提供了一个记录客户进程调用服务器进程权限的表，用于在每次客户进程调用其他服务器进程之前检查其是否拥有调用的合法权限。因此恶意进程无法任意调用没有权限的服务器进程。
本发明利用硬件虚拟化技术加速微内核的进程间通信，利用扩展页表控制客户物理地址到主机物理地址的映射，从而实现进程间切换前后无需修改进程页表基地址的值，利用新型硬件指令，无需下陷即可在用户态进程之间完成扩展页表切换，实现快速的微内核进程间切换；采用轻量化的虚拟化环境配置方法，利用底层插入的小型管理程序，在仅仅针对原有微内核添加一行代码的情况下，将虚拟化技术应用于现有微内核，配置VMCS域以消除绝大部分由于引入虚拟化层带来的性能损失；利用动态的二进制修改保护方法，运用成熟的二进制修改技术，在新建进程时完全消除掉进程中带有的非法指令，确保恶意的进程间切换无法发生，无需修改或重新编译进程程序源代码即可实现消除恶意指令。
本发明提出轻量化且高效的虚拟化系统，利用扩展页表控制用户态进程的页表内容，从而实现无需修改进程页表基地址的进程间切换，通过虚拟化硬件特性，实现针对微内核应用在用户态的进程间快速切换，结合现有成熟的二进制修改技术，在对进程源代码不做任何修改的情况下，完全消除特定的恶意指令。
与传统依靠软件优化进行微内核中进程间通信优化的方法不同，本发明提出了一套利用硬件虚拟化技术加速进程间通信性能的方法。在既保留了微内核原有特性的情况下，借助硬件大幅提升了进程间通信的性能，并仅仅对原有微内核代码进行了较小的修改，既保证了安全性又提升了整体性能。
同时，本发明提出的动态二进制修改保护技术，也能够被使用在各类需要在不修改程序源代码的情况下替换特定指令的系统之中。
本领域技术人员知道，除了以纯计算机可读程序代码方式实现本发明提供的系统、装置及其各个模块以外，完全可以通过将方法步骤进行逻辑编程来使得本发明提供的系统、装置及其各个模块以逻辑门、开关、专用集成电路、可编程逻辑控制器以及嵌入式微控制器等的形式来实现相同程序。所以，本发明提供的系统、装置及其各个模块可以被认为是一种硬件部件，而对其内包括的用于实现各种程序的模块也可以视为硬件部件内的结构；也可以将用于实现各种功能的模块视为既可以是实现方法的软件程序又可以是硬件部件内的结构。
以上对本发明的具体实施例进行了描述。需要理解的是，本发明并不局限于上述特定实施方式，本领域技术人员可以在权利要求的范围内做出各种变化或修改，这并不影响本发明的实质内容。在不冲突的情况下，本申请的实施例和实施例中的特征可以任意相互组合。

Claims (10)

  1. 一种微内核进程间通讯方法，其特征在于，包括：
    轻量级虚拟化步骤：借助硬件启动虚拟化环境，将微内核构造成次内核，所述次内核之下构造根内核，所述根内核能够与虚拟化环境交互；
    扩展页表步骤：为不同的进程构造对应的扩展页表，所述进程分成客户进程和服务器进程，将客户进程的页表基地址填入服务器进程的扩展页表中；
    快速通讯步骤：提供面向用户态进程的接口，所述接口能够在用户态的地址空间中进行进程间切换；
    二进制修改步骤：对进程中的代码页进行扫描，并替换非法的代码跳转指令。
  2. 根据权利要求1所述的微内核进程间通讯方法，其特征在于，所述轻量级虚拟化步骤包括：
    虚拟层下陷消除步骤：对虚拟层下陷进行处理；
    根内核初始化步骤：在次内核启动后对根内核进行初始化，动态将次内核移动到非特权模式下，根内核提供用于管理扩展页表的接口；
    进程识别步骤：为进程分配一个内存页用于记录进程的身份信息，记为身份信息页，并将所述身份信息页映射到所述进程扩展页表中，以及次内核的虚拟地址空间中，使得次内核能够通过虚拟地址访问当前下陷进程的身份信息页以识别下陷进程的身份信息。
  3. 根据权利要求2所述的微内核进程间通讯方法，其特征在于，所述对虚拟层下陷进行处理中，对于特权指令造成的下陷，根内核通过配置VMCS域令特权指令的执行不造成虚拟层下陷；对于硬件事件造成的下陷，根内核允许硬件向非特权模式下的次内核插入外部中断；对于访问扩展页表违规造成的下陷，根内核使用页表将物理内存地址映射给次内核。
  4. 根据权利要求1所述的微内核进程间通讯方法，其特征在于，所述扩展页表步骤中包括：
    初始化步骤：初始化时将服务器进程注册到次内核，当客户进程进行注册时，次内核通知根内核为客户进程、服务器进程分别复制扩展页表，添加扩展页地址映射；
    切换进程步骤：客户进程访问跳板代码页进行进程间切换，跳板代码页调用 VMFUNC指令将扩展页表指针从客户进程的扩展页表改成指向服务器进程的扩展页表，无需修改CR3寄存器值。
  5. 根据权利要求1所述的微内核进程间通讯方法，其特征在于，所述快速通讯步骤，对于小数据量传输，所述小数据量通过CPU寄存器传输，对于大数据量传输，分配共享缓冲区，将共享缓冲区的地址映射到客户进程及服务器进程的扩展页表中。
  6. 根据权利要求1所述的微内核进程间通讯方法，其特征在于，所述二进制修改步骤中，对于植入的单条VMFUNC指令，将所述单条VMFUNC指令替换为三条空指令；对于由相邻指令拼凑的非法指令，令相邻指令之间插入一个空指令；对于存在于一条长指令之中的非法指令，令所述长指令替换成多个等价的指令后再处理。
  7. 根据权利要求1所述的微内核进程间通讯方法，其特征在于，所述次内核是运行在非特权模式下的微内核；
    所述根内核运行在特权模式下的，包括下陷处理单元、扩展表管理单元、自我虚拟化单元；
    所述下陷处理单元处理次内核引起的下陷，包括访问扩展页表违规和使用特权指令下陷；
    所述扩展表管理单元动态管理次内核、及次内核内进程的扩展页表；
    所述自我虚拟化单元在系统启动时动态将次内核降级为非特权模式并初始化其VMCS和扩展页表。
  8. 根据权利要求4所述的微内核进程间通讯方法，其特征在于，所述跳板代码页是内存页，其中包含的代码逻辑能够在不同的扩展页表中切换，并进行函数调用。
  9. 根据权利要求4所述的微内核进程间通讯方法，其特征在于，所述扩展页地址映射是在客户进程注册过程中，通过次内核调用根内核提供的接口，对客户进程和服务器进程绑定，根内核通过查询扩展页表，能够将客户进程的页表基地址对应到服务器进程的主机物理地址。
  10. 一种微内核进程间通讯系统，其特征在于，包括：
    轻量级虚拟化模块：借助硬件启动虚拟化环境，将微内核构造成次内核，所述次内核之下构造根内核，所述根内核能够与虚拟化环境交互；
    扩展页表模块：为不同的进程构造对应的扩展页表，所述进程分成客户进程和服务器进程，将客户进程的页表基地址填入服务器进程的扩展页表中；
    快速通讯模块：提供面向用户态进程的接口，所述接口能够在用户态的地址空 间中进行进程间切换；
    二进制修改模块：对进程中的代码页进行扫描，并替换非法的代码跳转指令。
PCT/CN2019/106833 2019-02-28 2019-09-20 微内核进程间通讯方法和系统 Ceased WO2020173083A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910151836.4 2019-02-28
CN201910151836.4A CN109933441B (zh) 2019-02-28 2019-02-28 微内核进程间通讯方法和系统

Publications (1)

Publication Number Publication Date
WO2020173083A1 true WO2020173083A1 (zh) 2020-09-03

Family

ID=66986097

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/106833 Ceased WO2020173083A1 (zh) 2019-02-28 2019-09-20 微内核进程间通讯方法和系统

Country Status (2)

Country Link
CN (1) CN109933441B (zh)
WO (1) WO2020173083A1 (zh)

Families Citing this family (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109933441B (zh) * 2019-02-28 2020-11-17 上海交通大学 微内核进程间通讯方法和系统
CN110348224B (zh) * 2019-07-08 2020-06-30 沈昌祥 基于双体系结构可信计算平台的动态度量方法
CN110688330B (zh) * 2019-09-23 2021-08-31 北京航空航天大学 一种基于内存映射相邻性的虚拟内存地址翻译方法
CN110740102B (zh) 2019-09-29 2021-10-15 苏州浪潮智能科技有限公司 一种通信方法、系统、设备及计算机可读存储介质
WO2021217529A1 (zh) * 2020-04-29 2021-11-04 华为技术有限公司 一种进程间通信的方法及系统
CN114090273B (zh) * 2020-07-30 2024-07-05 华为技术有限公司 一种进程间通信的方法、装置及计算机存储介质
CN111949596A (zh) * 2020-08-05 2020-11-17 上海交通大学 基于mpk技术的微内核模块间通讯方法、系统及介质
CN112131018A (zh) * 2020-09-17 2020-12-25 国网宁夏电力有限公司营销服务中心(国网宁夏电力有限公司计量中心) 微内核操作系统进程间快速通信方法
CN112199678B (zh) * 2020-09-25 2024-04-09 杭州安恒信息技术股份有限公司 一种在线取证的方法、装置、计算机设备和可读存储介质
CN112395095A (zh) * 2020-11-09 2021-02-23 王志平 一种基于cpoc的进程同步方法
CN113296935B (zh) * 2020-11-27 2025-02-14 阿里巴巴集团控股有限公司 微服务运行优化方法、微服务运行系统和服务器系统
CN113157432B (zh) * 2021-02-04 2022-10-04 无锡江南计算技术研究所 一种基于RISC处理器的firmware替换方法
CN113220469B (zh) * 2021-03-23 2024-04-16 黑芝麻智能科技(上海)有限公司 进程间通信方法、装置和计算机设备和计算机可读介质
CN113064697B (zh) * 2021-04-01 2022-09-23 上海交通大学 利用多硬件特性加速微内核进程间通信的方法
CN112989326A (zh) * 2021-04-08 2021-06-18 北京字节跳动网络技术有限公司 一种指令发送方法及装置
CN113704007B (zh) * 2021-09-14 2023-11-07 上海交通大学 利用硬件特性的无服务器计算平台加速系统
CN115878210B (zh) * 2021-09-29 2024-08-27 华为技术有限公司 一种系统配置处理方法及相关设备
CN113867820B (zh) * 2021-09-29 2024-05-28 深圳市智微智能软件开发有限公司 一种动态修改framebuffer的方法、装置、设备及存储介质
CN113886105B (zh) * 2021-09-30 2023-07-21 抖音视界有限公司 跨进程的调用方法、装置、存储介质及电子设备
CN116048827B (zh) * 2021-10-28 2026-02-13 华为技术有限公司 一种进程间的函数调用方法及相关设备
CN114328114B (zh) * 2021-12-29 2025-01-14 北京和利时系统工程有限公司 程序异常信息的记录方法、装置、设备及可读存储介质
CN117407925A (zh) * 2022-07-08 2024-01-16 华为技术有限公司 扩展内存隔离域的方法和电子设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050246453A1 (en) * 2004-04-30 2005-11-03 Microsoft Corporation Providing direct access to hardware from a virtual environment
CN103425538A (zh) * 2012-05-24 2013-12-04 深圳市腾讯计算机系统有限公司 进程通讯方法及系统
CN104572313A (zh) * 2013-10-22 2015-04-29 华为技术有限公司 一种进程间的通信方法及装置
CN107368379A (zh) * 2017-07-14 2017-11-21 中南大学 面向EVP的跨GuestOS进程间通信方法及系统
CN107667350A (zh) * 2015-06-15 2018-02-06 英特尔公司 基于虚拟化的平台保护技术
CN109933441A (zh) * 2019-02-28 2019-06-25 上海交通大学 微内核进程间通讯方法和系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101226577A (zh) * 2008-01-28 2008-07-23 南京大学 基于可信硬件与虚拟机的微内核操作系统完整性保护方法
US9043562B2 (en) * 2011-04-20 2015-05-26 Microsoft Technology Licensing, Llc Virtual machine trigger
CN104123265B (zh) * 2013-04-26 2017-12-22 华为技术有限公司 一种众核间通信方法及系统
WO2017132417A1 (en) * 2016-01-26 2017-08-03 Enterpriseweb Llc Unified operating system for distributed computing
CN106802863A (zh) * 2016-12-16 2017-06-06 华东师范大学 基于微内核原型的进程间通信安全性形式化分析验证系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050246453A1 (en) * 2004-04-30 2005-11-03 Microsoft Corporation Providing direct access to hardware from a virtual environment
CN103425538A (zh) * 2012-05-24 2013-12-04 深圳市腾讯计算机系统有限公司 进程通讯方法及系统
CN104572313A (zh) * 2013-10-22 2015-04-29 华为技术有限公司 一种进程间的通信方法及装置
CN107667350A (zh) * 2015-06-15 2018-02-06 英特尔公司 基于虚拟化的平台保护技术
CN107368379A (zh) * 2017-07-14 2017-11-21 中南大学 面向EVP的跨GuestOS进程间通信方法及系统
CN109933441A (zh) * 2019-02-28 2019-06-25 上海交通大学 微内核进程间通讯方法和系统

Also Published As

Publication number Publication date
CN109933441B (zh) 2020-11-17
CN109933441A (zh) 2019-06-25

Similar Documents

Publication Publication Date Title
CN109933441B (zh) 微内核进程间通讯方法和系统
US12061919B2 (en) Dynamic I/O virtualization system having guest memory management for mapping virtual addresses using virtualization application programming interface (API) in guest kernal
Steinberg et al. NOVA: A microhypervisor-based secure virtualization architecture
CN112035272B (zh) 进程间通信的方法、装置以及计算机设备
US8464022B2 (en) Virtualization with shadow page tables
Bugnion et al. Bringing virtualization to the x86 architecture with the original vmware workstation
EP2955634B1 (en) Paravirtualization-based interface for memory management in virtual machines
EP4055488B1 (en) Confidential computing mechanism
EP3819774B1 (en) Confidential computing mechanism
CN119440734A (zh) 基于微内核Hypervisor的虚拟机跨操作系统通信方法
Vahidi et al. VETE: Virtualizing the Trusted Execution Environment
CN120762929A (zh) 微内核Hypervisor上的用户程序与虚拟机通信方法
Bugnion et al. Virtualization without Architectural Support
CN116107919A (zh) 一种针对跨架构的多地址空间虚拟化内存域隔离方法
Bugnion Using Virtual Machines in Modern Computing Environments with Limited Architectural Support
Blattmann Universität Karlsruhe (TH)

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19917002

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 04.02.2022)

122 Ep: pct application non-entry in european phase

Ref document number: 19917002

Country of ref document: EP

Kind code of ref document: A1