WO2021098244A1 - 第一操作系统访问第二操作系统资源的方法和装置 - Google Patents

第一操作系统访问第二操作系统资源的方法和装置 Download PDF

Info

Publication number
WO2021098244A1
WO2021098244A1 PCT/CN2020/102032 CN2020102032W WO2021098244A1 WO 2021098244 A1 WO2021098244 A1 WO 2021098244A1 CN 2020102032 W CN2020102032 W CN 2020102032W WO 2021098244 A1 WO2021098244 A1 WO 2021098244A1
Authority
WO
WIPO (PCT)
Prior art keywords
operating system
kernel
page table
address space
information
Prior art date
Application number
PCT/CN2020/102032
Other languages
English (en)
French (fr)
Inventor
左鹏
杜小强
陈勇
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to JP2022529685A priority Critical patent/JP7443519B2/ja
Priority to EP20890467.2A priority patent/EP4053700A4/en
Priority to KR1020227020341A priority patent/KR20220093379A/ko
Publication of WO2021098244A1 publication Critical patent/WO2021098244A1/zh
Priority to US17/749,627 priority patent/US12007906B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G06F9/5005—Allocation of resources, e.g. of the central processing unit [CPU] to service a request
    • G06F9/5027—Allocation of resources, e.g. of the central processing unit [CPU] to service a request the resource being a machine, e.g. CPUs, Servers, Terminals
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/02—Addressing or allocation; Relocation
    • G06F12/08—Addressing or allocation; Relocation in hierarchically structured memory systems, e.g. virtual memory systems
    • G06F12/10—Address translation
    • G06F12/109—Address translation for multiple virtual address spaces, e.g. segmentation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • G06F9/545—Interprogram communication where tasks reside in different layers, e.g. user- and kernel-space
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/02—Addressing or allocation; Relocation
    • G06F12/08—Addressing or allocation; Relocation in hierarchically structured memory systems, e.g. virtual memory systems
    • G06F12/10—Address translation
    • G06F12/1009—Address translation using page tables, e.g. page table structures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/02—Addressing or allocation; Relocation
    • G06F12/08—Addressing or allocation; Relocation in hierarchically structured memory systems, e.g. virtual memory systems
    • G06F12/10—Address translation
    • G06F12/1027—Address translation using associative or pseudo-associative address translation means, e.g. translation look-aside buffer [TLB]
    • G06F12/1036—Address translation using associative or pseudo-associative address translation means, e.g. translation look-aside buffer [TLB] for multiple virtual address spaces, e.g. segmentation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14—Protection against unauthorised use of memory or access to memory
    • G06F12/1458—Protection against unauthorised use of memory or access to memory by checking the subject access rights
    • G06F12/1491—Protection against unauthorised use of memory or access to memory by checking the subject access rights in a hierarchical protection system, e.g. privilege levels, memory rings
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/4401—Bootstrapping
    • G06F9/4406—Loading of operating system
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2209/00—Indexing scheme relating to G06F9/00
    • G06F2209/46—Indexing scheme relating to G06F9/46
    • G06F2209/463—Naming
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/10—Providing a specific technical effect
    • G06F2212/1016—Performance improvement
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/10—Providing a specific technical effect
    • G06F2212/1052—Security improvement
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/65—Details of virtual memory and virtual address translation
    • G06F2212/657—Virtual address space management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system

Definitions

  • This application relates to the field of computer technology, and more specifically, to a method and device for a first operating system to access resources of a second operating system.
  • TEE operating system is an operating environment that coexists with REE OS on electronic equipment. It provides reliable security services for REE OS. It has its own execution space and has a higher security level than REE OS, and TEE OS can The software and hardware resources to be accessed are separated from the REE OS, which is an isolated operating system.
  • the present application provides a method and device for a first operating system to access resources of a second operating system by reserving high-order address space in the first operating system, and the first operating system multiplexes the registers of the kernel page table of the second operating system
  • the configuration enables the first operating system to directly access the resources of the kernel space of the second operating system by enabling the upper address space, thereby improving the performance of the first operating system to access the resources of the second operating system.
  • a method for a first operating system to access resources of a second operating system is provided, which can be executed by the first operating system, or can be executed by a chip or circuit in the first operating system.
  • An operating system executes the method as an example for description.
  • the method for the first operating system to access the resources of the second operating system includes: configuring the kernel space and user space of the first operating system in the first address space of the first operating system, and reserve for the second operating system A second address space, wherein the memory virtual address space of the first operating system includes the first address space and the second address space; the first operating system obtains the kernel page table of the second operating system The register configuration information; the first operating system configures the second register of the first operating system according to the register configuration information of the kernel page table of the second operating system, and the second register corresponds to the first operating system The second address space; the first operating system uses the second address space to access resources in the kernel space of the second operating system.
  • the first operating system is configured by reserving the high address space in the first operating system and the register configuration information based on the kernel page table of the second operating system
  • the second register corresponding to the upper address space of the first operating system enables the first operating system to directly access the resources of the kernel space of the second operating system when the reserved upper address space is enabled, thereby improving the access of the first operating system to the second operation The performance of system resources.
  • the first address space is an upper address space; the second address space is a lower address space, and the upper address space of the first operating system is The kernel address space range of the second operating system is consistent.
  • first address space and second address space respectively refer to the lower address space and the upper address space in the first operating system. In order to avoid the limitation of description, they are described as “first address space”. And the “second address space” do not limit the scope of protection of this application.
  • the above-mentioned upper address space of the first operating system is consistent with the range of the kernel address space of the second operating system.
  • the method further includes: the first operating system receives kernel symbol table information sent by the second operating system;
  • the kernel symbol table information the obtained conversion relationship of the upper address space of the second operating system, the base address information of the user page table of the user process is obtained, the content of the user page table entry is read level by level using the conversion relationship, and the second operation is accessed The resources of the user space of the system.
  • the above-mentioned first operating system can obtain the kernel symbol table information of the second operating system, and the conversion relationship between the high-order address space of the above-mentioned second operating system and the base address information of the user page table of the user process can be obtained after the conversion relationship is known. Under the premise of, you can read the content of the user page table entry level by level to access the resources of the user space of the second operating system.
  • configuring the kernel space and the user space of the first operating system in the first address space of the first operating system includes: The kernel page table and user page table in the first operating system are stored in the page table memory of the first address space; the first operating system configures the page table memory of the first address space to the first operating system. register.
  • reserving a second address space for the second operating system includes: the first operating system reserving a second address based on the upper address space of the second operating system space.
  • the first operating system reserves the upper address space, it refers to the range of the upper address space in the second operating system, so that the first operating system can successfully base the register configuration information of the kernel page table of the second operating system Configure the second register corresponding to the upper address space of the first operating system.
  • the method further includes: the first operating system receives a request message sent by the second operating system, and the request message carries kernel symbol table information and the second operating system. 2. Register configuration information of the kernel page table of the operating system.
  • the first ashamed system can obtain the above-mentioned kernel symbol table information and the register configuration information of the kernel page table of the second operating system.
  • the request message sent by the second operating system carries kernel symbol table information and register configuration information of the kernel page table of the second operating system.
  • deploying a client application CA in the first operating system; and reserving a second address space for the second operating system by the first operating system includes: During the CA initialization process, the register configuration of the kernel page table of the first operating system is modified based on the register configuration information of the second operating system, so that the configuration of the second register of the first operating system is the same as the high bit of the second operating system.
  • the register configuration is the same.
  • a client application (CA) is deployed in the first operating system, and the CA is initialized based on the received second operating system
  • the register configuration information modifies the register configuration of the first operating system, so that the configuration of the second register of the first operating system is the same as the configuration of the high-order register of the second operating system, which is how the first operating system reuses the second operating system
  • the register configuration provides a feasible solution.
  • the method before storing the kernel page table and the user page table in the first operating system in the page table memory of the first address space, the method further includes : The first operating system adds user inaccessibility control on the kernel page table; the first operating system adds non-executable privilege PXN protection on the user page table.
  • the kernel page table and the user page table in the first operating system are stored in the same page table memory, in order to meet the requirements of the kernel page table and the user page table.
  • Security requirements include adding user inaccessibility control to the kernel page table, and adding non-executable privilege PXN protection to the user page table, so that the kernel page table and the user page table are safe and independent.
  • the register configuration information of the kernel page table of the second operating system includes: address translation controller configuration information, memory attribute controller configuration information, and kernel space page table base Address register configuration information.
  • the register configuration information of the second operating system received by the first operating system includes multiple configuration information, and the second operation is multiplexed for the first operating system
  • the register configuration of the system provides a more comprehensive choice.
  • a dynamic measurement module is deployed in the first operating system, and the dynamic measurement module is configured to provide security services for the second operating system.
  • the first operating system may include a dynamic measurement module to provide security protection for the second operating system.
  • the first operating system when the first operating system accesses the resources of the kernel space of the second operating system abnormally, the first operating system sends the abnormal information to the second operating system. Two operating systems.
  • the first operating system in the case of an abnormality in accessing resources across systems, can notify the accessed second operating system of information related to the abnormal situation , So that the second operating system can learn that an access exception occurs.
  • the remote program debugging RPC service is deployed in the first operating system; the first operating system sends the abnormal information related to the second operating system includes : The RPC service sends the abnormal information to the second operating system.
  • the remote program debugging RPC service can be deployed in the first operating system.
  • the first operating system uses the RPC service Notify the second operating system of abnormal situation information.
  • a method for a first operating system to access resources of a second operating system is provided, which can be executed by the second operating system, or can be executed by a chip or circuit in the second operating system.
  • the operating system executes the method as an example for description.
  • the method for the first operating system to access resources of the second operating system includes: the second operating system obtains register configuration information of the kernel page table of the second operating system; and the second operating system sends the first operating system to the first operating system. 2. Register configuration information of the kernel page table of the operating system.
  • the method for the first operating system to access the resources of the second operating system can obtain the register configuration information of the kernel page table of the second operating system in the second operating system of the accessed resource in the cross-system access resource scenario,
  • the register configuration information of the kernel page table of the second operating system is sent to the first operating system, so that the first operating system can reuse the register configuration of the kernel page table of the second operating system, thereby improving the performance of resource access between systems.
  • the method further includes: the second operating system obtains kernel symbol table information of the second operating system; The first operating system sends the kernel symbol table information.
  • the method for the first operating system to access the resources of the second operating system can obtain the kernel symbol table information of the second operating system in the second operating system of the accessed resource in the cross-system access resource scenario, and combine the The kernel symbol table information is sent to the first operating system, so that the first operating system can access the user page table of the second operating system level by level, thereby improving the performance of resource access between systems.
  • a kernel driver module is deployed in the second operating system; the second operating system obtains the information of the kernel symbol table and/or the information of the kernel page table of the second operating system Register configuration information: The kernel driver module obtains the kernel symbol table information and/or the register configuration information of the kernel page table of the second operating system.
  • the second operating system can obtain its own kernel symbol table information and the register configuration information of the second operating system may be in the second operating system
  • the kernel driver module is deployed, and the kernel symbol table information and the register configuration information of the second operating system are obtained through the kernel driver module.
  • the register configuration information of the kernel page table of the second operating system includes: address translation controller configuration information, memory attribute controller configuration information, and kernel space page table base Address register configuration information.
  • the register configuration information of the second operating system includes various configuration information, which provides a more comprehensive way for the first operating system to reuse the register configuration of the second operating system s Choice.
  • an apparatus for a first operating system to access resources of a second operating system includes a processor, configured to implement the method described in the first aspect above. A function of the operating system.
  • the apparatus for the first operating system to access resources of the second operating system may further include a memory, the memory is coupled to the processor, and the processor is configured to implement the first operation in the method described in the first aspect.
  • the memory is used to store program instructions and data.
  • the memory is coupled with the processor, and the processor can call and execute program instructions stored in the memory to implement the function of the first operating system in the method described in the first aspect.
  • the apparatus for the first operating system to access the resources of the second operating system may further include a communication interface, and the communication interface is used for the apparatus for accessing the resources of the second operating system by the first operating system to communicate with other devices.
  • the communication interface is a transceiver, an input/output interface, or a circuit.
  • the device for the first operating system to access resources of the second operating system includes a processor and a communication interface
  • the processor is configured to run a computer program, and any one of the methods described in the first aspect is implemented by the device for the first operating system to access resources of the second operating system;
  • the processor communicates with the outside by using the communication interface.
  • the exterior may be an object other than the processor, or an object other than the device.
  • the device for the first operating system to access the resources of the second operating system is a chip or a chip system.
  • the communication interface may be an input/output interface, an interface circuit, an output circuit, Input circuit, pin or related circuit, etc.
  • the processor may also be embodied as a processing circuit or a logic circuit.
  • an apparatus for a first operating system to access resources of a second operating system includes a processor, configured to implement the method described in the second aspect above. 2. The function of the operating system.
  • the apparatus for the first operating system to access resources of the second operating system may further include a memory, the memory is coupled to the processor, and the processor is configured to implement the second operation in the method described in the second aspect.
  • the memory is used to store program instructions and data.
  • the memory is coupled with the processor, and the processor can call and execute the program instructions stored in the memory to implement the function of the second operating system in the method described in the second aspect.
  • the apparatus for the first operating system to access the resources of the second operating system may further include a communication interface, and the communication interface is used for the apparatus for accessing the resources of the second operating system by the first operating system to communicate with other devices.
  • the communication interface is a transceiver, an input/output interface, or a circuit.
  • the device for the first operating system to access resources of the second operating system includes a processor and a communication interface
  • the processor communicates with the outside by using the communication interface
  • the processor is configured to run a computer program, and any one of the methods described in the second aspect above can be implemented by the means for the first operating system to access resources of the second operating system.
  • the exterior may be an object other than the processor, or an object other than the device.
  • the first operating system accesses the device chip or chip system of the second operating system resource.
  • the communication interface may be an input/output interface, interface circuit, output circuit, input circuit, pin or related circuit on the chip or chip system.
  • the processor may also be embodied as a processing circuit or a logic circuit.
  • a computer-readable storage medium on which a computer program is stored.
  • the communication device When the computer program is executed by a communication device, the communication device enables the communication device to implement the first aspect and any possible implementation manner of the first aspect In the method.
  • a computer-readable storage medium on which a computer program is stored.
  • the communication device When the computer program is executed by a communication device, the communication device enables the communication device to implement the second aspect and any possible implementation manner of the second aspect In the method.
  • a computer program product containing instructions when the instructions are executed by a computer, the communication device realizes the first aspect and the method in any possible implementation manner of the first aspect.
  • a computer program product containing instructions, which when executed by a computer, cause a communication device to implement the second aspect and the method in any possible implementation manner of the second aspect.
  • an electronic device including the apparatus for accessing resources of the second operating system by the first operating system shown in the third aspect and the apparatus for accessing resources of the second operating system by the first operating system shown in the fourth aspect.
  • Figure 1 is a schematic block diagram of two operating systems.
  • Fig. 2 is a schematic block diagram of a shared memory provided by an embodiment of the present application.
  • FIG. 3 shows a schematic diagram of the structure of the electronic device 300.
  • FIG. 4 is a schematic flowchart of a method for a first operating system to access resources of a second operating system according to an embodiment of the present application.
  • FIG. 5 is a schematic block diagram of a first operating system accessing resources of a second operating system according to an embodiment of the present application.
  • Fig. 6 is a schematic diagram of a flow of accessing a user page table provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a processing flow for page fault exception provided by an embodiment of the present application.
  • Fig. 8 is a schematic diagram of an exception handling process provided by an embodiment of the present application.
  • Fig. 9 is a schematic block diagram of an operating system software provided by an embodiment of the present application.
  • FIG. 10 is a schematic diagram of the device 10 for accessing resources of the second operating system by the first operating system proposed by the present application.
  • FIG. 11 is a schematic structural diagram of a first operating system applicable to an embodiment of the present application.
  • FIG. 12 is a schematic diagram of the apparatus 20 for accessing resources of the second operating system by the first operating system proposed in the present application.
  • FIG. 13 is a schematic structural diagram of a second operating system applicable to an embodiment of the present application.
  • Figure 1 is a schematic block diagram of two operating systems.
  • the two operating systems include a local operating system and a peer operating system.
  • the local operating system and the peer operating system have their own independent central processing unit (CPU) and a memory management unit ( Internal modules such as memory management unit (MMU), translation lookaside buffer (TLB), and page global directory (PGD) can also have their own independent external devices.
  • CPU central processing unit
  • MMU memory management unit
  • TLB translation lookaside buffer
  • PTD page global directory
  • the operating system is not shown in Figure 1 External equipment, this application is not limited to this.
  • a program in the local operating system is divided into multiple programs and loaded into the memory respectively.
  • the multiple programs do not need to be connected to each other physically.
  • the page table is logically used to string together discretely distributed multiple programs. Logically continuous program. Among them, the program is divided into small blocks of equal length. These small blocks are called pages.
  • the memory is divided into frames of the same size as the pages. A page can be packed into a page frame and needs to be provided to the CPU. In the page table of the current task, the CPU searches for a certain page in a certain page frame of the memory according to the page table when executing the program, thereby completing the mapping from the logical address to the physical address.
  • the local operating system finds the corresponding physical address #1 according to the virtual address #1 based on the page table in the local operating system, and the physical address #1 corresponds to the physical memory block #1, and the counterpart operation
  • the system finds the corresponding physical address #2 based on the above virtual address #1 based on the page table in the opposite operating system.
  • the physical address #2 corresponds to the physical memory block #2, and the physical memory block #1 is different from the physical memory block #2. Therefore, the local operating system and the peer operating system access different physical memory blocks based on different page tables.
  • the page tables in the local operating system and the opposite operating system need to include virtual addresses #1 and The mapping relationship between physical memory block #2, that is to say, the page table in the local operating system needs to be updated, so that the local operating system finds the corresponding physical address according to the virtual address #1 based on the page table in the local operating system# 2.
  • the specific process of the operating system accessing the physical memory block based on the page table is not limited, and the provisions of the current protocol can be referred to.
  • the local operating system can be referred to as the first operating system, and the opposite operating system can be referred to as the second operating system; the local operating system can also be referred to as a secure isolation operating system, and the opposite operating system can also be referred to as It is the mainstream operating system.
  • the two operating systems can also be referred to as dual systems, multi-processor systems, and so on.
  • the security issues of REE OS include confidentiality, integrity, and availability.
  • a possible implementation is to use dynamic measurement technology to provide integrity security services for REE OS.
  • dynamic measurement technology analyzes REE OS memory data and detects whether REE OS is threatened to protect REE OS memory data from unauthorized access. modify.
  • the security of the dynamic measurement module can be protected by deploying the dynamic measurement module in the TEE OS to ensure the security of the dynamic measurement module.
  • the dynamic measurement module is deployed in the TEE OS and accessing REE OS resources mainly involves accessing REE OS. Measurement objects such as user process code segment, kernel code segment, dynamic shared library code segment, etc.
  • the dynamic measurement module deployed in TEE OS needs to monitor the integrity of REE OS resources to ensure that the REE OS is trustworthy.
  • the dynamic measurement module cannot access REE OS resources efficiently and in real time.
  • the method for the first operating system to access the resources of the second operating system provided in the embodiments of the present application can improve the performance of the dynamic measurement module deployed in the TEE OS to access the resources of the REE OS in this case, which will be described below in conjunction with the embodiments.
  • the REE OS involved in this application includes a Linux operating system, an Android operating system, and the like.
  • the first, second, and various numerical numbers in this application are used to distinguish similar objects, and are not necessarily used to describe a specific sequence or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances. It is not used to limit the scope of the embodiments of the present application. For example, distinguish different operating systems, etc. In the same way, the labels "#1" and "#2" in this application are also used to distinguish similar objects, for example, to distinguish different addresses.
  • FIG. 2 is a schematic block diagram of a shared memory provided by an embodiment of the present application.
  • the local operating system accesses the application code segment running in the opposite operating system, and the physical address of the application code segment running in the opposite operating system needs to be known in advance.
  • the opposite operating system actively transfers the physical address to the local operating system.
  • the local operating system After the local operating system receives the physical address, it actively maps the physical page frame and adds it to the page table entry of the local operating system, so that the peer operating system and the local operating system can directly access this through a similar shared memory method. Block of memory.
  • the local operating system needs to map a lot of physical memory blocks, the performance is very poor, and the local operating system maps all of the peer operating system Resources, the security of the local operating system is affected; when the local operating system cannot identify the content of the physical memory block, it will also affect the content of the memory block used by the local operating system; when the peer operating system is page swapped , The local operating system accesses the data in the peer operating system out of synchronization.
  • the local operating system can also achieve the purpose of accessing the resources of the opposite operating system by copying the page table resources of the opposite operating system.
  • the local operating system copies all entries of the kernel page table (or user page table) of the peer operating system to the page table memory of the local operating system through software traversal, and the local operating system completes the page table entry mapping step by step. In this way, the local operating system and the opposite operating system can use the same page table conversion relationship to access the same page frame content.
  • the page global directory contains the addresses of several page upper directories (PUD), and the PUD in turn contains the addresses of several page middle directories (PMD).
  • PUD contains the addresses of several page table entries (PTE), and each PTE points to a page frame.
  • the local operating system knows the virtual address (VA) of the user program in the peer operating system, and the user process page table base address (usually the PGD address is directly filled in the page table base address register) .
  • VA virtual address
  • the user process page table base address usually the PGD address is directly filled in the page table base address register
  • the PGD physical address is mapped to the kernel page table of the local operating system.
  • the PGD virtual address is obtained through the page table conversion relationship in the local operating system, and the content of this virtual address is read.
  • the content of the entry is obtained, and the physical address of the first-level page table (page upper-level directory, PUD) is stored; the same mechanism is used to obtain the virtual address of the PUD entry to determine whether the current PUD entry contains the VA that currently needs to be mapped, if it does not contain the current VA, then the PUD entry is shifted by one level of page table granularity, continue to determine whether the PUD entry contains this VA, and if it does not, return an empty address. If included, the middle directory entry of the Walk page uses the same method until the real PTE is found level by level, and finally the corresponding PTE is mapped to the local operating system for use.
  • PUD page upper-level directory
  • this application provides a method for the first operating system to access the resources of the second operating system.
  • the local operating system reuses the register configuration of the opposite operating system to avoid pages. Table copy, page table synchronization, etc. realize fast access to resources.
  • TEE is a concept proposed by the global platform (GP).
  • TEE OS is an operating environment that coexists with REE OS on the device and provides security services for REE OS.
  • TEE OS has its own execution space, which has a higher security level than REE OS. This application will take REE OS and TEE OS as examples.
  • TEE OS runs in electronic equipment and provides a safety framework between REE OS and safe environment (SE). For example, for certain small payments, corporate virtual private networks (virtual private networks, VPNs), etc., the required security protection strength is not high, and a separate SE is not needed for protection, nor can it be directly placed in REE OS. , In case of being attacked due to the openness of REE OS. Therefore, for such applications, TEE OS can provide security protection.
  • SE safe environment
  • TEE OS provides a secure execution environment for trusted applications (TA), while also protecting the confidentiality, integrity, and access rights of TA's resources and data.
  • TA trusted applications
  • each TA is independent of each other and cannot access each other without authorization.
  • the electronic device may also include other functions such as portable electronic devices, such as mobile phones, tablet computers, wearable electronic devices with wireless communication functions (such as smart watches), and so on.
  • portable electronic devices include, but are not limited to, carrying Or portable electronic devices with other operating systems.
  • the above-mentioned portable electronic device may also be other portable electronic devices, such as a laptop computer (Laptop) and the like. It should also be understood that, in some other embodiments, the above-mentioned electronic device may not be a portable electronic device, but a desktop computer.
  • the electronic device may be a smart home appliance, such as a smart speaker or a smart home device.
  • the electronic device may be an in-vehicle device, a vehicle, or the like.
  • the vehicle-mounted device may be a device with processing capabilities such as an intelligent driving computing platform or an in-vehicle data processing platform, and the aforementioned first operating system and second operating system run on the intelligent driving computing platform or an in-vehicle data processing platform.
  • the intelligent driving computing platform or the vehicle-mounted data processing platform may be a mobile data center (mobile data center, MDC).
  • FIG. 3 shows a schematic structural diagram of the electronic device 300.
  • the electronic device 300 may include a processor 310, an external memory interface 320, an internal memory 323, a universal serial bus (USB) interface 330, a charging management module 340, a power management module 343, a battery 342, an antenna 1, and an antenna 2.
  • Mobile communication module 350 wireless communication module 360, audio module 370, speaker 370A, receiver 370B, microphone 370C, earphone jack 370D, sensor module 380, buttons 390, motor 393, indicator 392, camera 393, display 394, and Subscriber identification module (subscriber identification module, SIM) card interface 395, etc.
  • SIM Subscriber identification module
  • the sensor module 380 can include pressure sensor 380A, gyroscope sensor 380B, air pressure sensor 380C, magnetic sensor 380D, acceleration sensor 380E, distance sensor 380F, proximity light sensor 380G, fingerprint sensor 380H, temperature sensor 380J, touch sensor 380K, ambient light Sensor 380L, bone conduction sensor 380M, etc.
  • the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the electronic device 300.
  • the electronic device 300 may include more or fewer components than shown, or combine certain components, or split certain components, or arrange different components.
  • the illustrated components can be implemented in the form of hardware or a combination of software and hardware.
  • the electronic device 300 may not include the sensor module 380, the speaker 370A, the receiver 370B, the microphone 370C and other components, but may communicate with the sensor in a wired or wireless form.
  • the module 380, the speaker 370A, the receiver 370B, and the microphone 370C perform data transmission.
  • the page table is a special data structure that is placed in the page table area of the operating system space and stores the mapping from virtual addresses to physical addresses.
  • the logical address refers to the address generated by the central processing unit (CPU). Specifically, the logical address generated by the CPU is divided into a page number (p) and a page offset (d).
  • the page number contains each The base address of the page in the physical memory is used as the index of the page table, and the page offset is combined with the base address to determine the physical memory address of the device; the physical address refers to the address seen by the memory unit.
  • the logical address space is 2 ⁇ m, and the page size is 2 ⁇ n, then the high m-n bits of the logical address represent the page number, and the low n bits represent the page offset. Realize the address mapping from page number to physical block number.
  • the process of converting a logical address into a physical address is: use the page number p to retrieve the page table, get the physical block number of the page from the page table, and load it into the physical address register. At the same time, the address d in the page is directly sent to the address field in the block of the physical address register. In this way, the content of the physical address register is the actual memory access address that is spliced by the two, thus completing the conversion from the logical address to the physical address.
  • fixed-size pages are used to describe the logical address space
  • page frames of the same size are used to describe the physical memory space.
  • the operating system implements page mapping from logical pages to physical page frames, and is responsible for the management and processing of all pages. Operational control.
  • Translation lookaside buffer translation lookaside buffer, TLB.
  • each row in the TLB stores a block composed of a single page table entry (PTE), and these blocks are currently the most likely page table entries to be accessed. If the page number is in the TLB, get the frame number to access the memory; otherwise, get the frame number from the page table in the memory and store it in the TLB access memory.
  • PTE page table entry
  • the working principle includes periodically/actively measuring the unchanging part of the memory when the operating system is running, calculating the hash value representing its integrity, comparing the hash value with the benchmark value, and judging whether it is malicious based on this
  • the attack tampered with the memory image of the measurement object.
  • the baseline value can be calculated from the memory image when the process is first loaded into the memory, or it can be established offline according to the ELF file corresponding to the application.
  • used to indicate can include both used for direct indication and used for indirect indication.
  • the indication information can directly indicate A or indirectly indicate A, but it does not mean that A must be included in the indication information.
  • the information used for the indication can be called the information to be indicated.
  • the information to be indicated may be directly indicated, such as the information to be indicated itself or the index of the information to be indicated.
  • the information to be indicated can also be indicated indirectly by indicating other information, where there is an association relationship between the other information and the information to be indicated. It is also possible to indicate only a part of the information to be indicated, while other parts of the information to be indicated are known or agreed in advance. For example, it is also possible to realize the indication of specific information by means of the pre-arranged order (for example, stipulated in the agreement) of the various information, thereby reducing the indication overhead to a certain extent.
  • the first, second, and various numbers are only for easy distinction for description, and are not used to limit the scope of the embodiments of this application. For example, distinguish different operating systems, etc.
  • saving may mean saving in one or more memories.
  • the one or more memories may be provided separately or integrated in an encoder, decoder, processor, or communication device.
  • the one or more memories may also be partly provided separately, and partly integrated in the encoder, decoder, processor, or communication device.
  • the type of the memory can be any form of storage medium, which is not limited in this application.
  • FIG. 4 is a schematic flowchart of a method for a first operating system to access resources of a second operating system according to an embodiment of the present application.
  • the execution body includes a first operating system and a second operating system, and the method for the first operating system to access resources of the second operating system is explained from the interaction between the first operating system and the second operating system.
  • the method for the first operating system to access the resources of the second operating system can be applied to the two operating system scenarios described in FIG. 1, where the first operating system and the second operating system constitute two operating system scenarios.
  • the first operating system and the second operating system belong to the same architecture, for example, the first operating system and the second operating system both belong to the x86 architecture, or the first operating system and the second operating system belong to both ARM Architecture.
  • the method for the first operating system to access the resources of the second operating system includes all or part of the following steps.
  • the first operating system stores the kernel page table and the user page table in the first operating system in the page table memory of the lower address space.
  • the first operating system includes generating the above-mentioned kernel page table and user page table Module.
  • the kernel page table involved in the embodiment of this application includes a section of memory stored in the main kernel page global directory.
  • the hardware is not directly used.
  • the content of the kernel page table is shared by all processes, and the kernel page table is maintained and updated by the kernel.
  • the user page table involved in the embodiment of the present application includes its own page table for each process, which is placed in the page directory of the process.
  • the embodiment of the present application mainly relates to the register that stores the memory configuration of the page table.
  • the first operating system After the first operating system stores the kernel page table and user page table in the first operating system in the page table memory of the lower address space, it configures the page table memory of the lower address space to the first register, and the first register corresponds to the first register.
  • An address space The first operating system reserves a second address space based on the upper address space of the second operating system. The first address space is used by the user and the kernel. The first address space is different from the second address space. The address space is an address space in the virtual address space in the first operating system except for the first address space that has been used.
  • the current operating system adopts a virtual memory design.
  • the virtual address space of a 32-bit Linux memory is usually divided into 0 ⁇ 3G as user space and 3 ⁇ 4G as kernel space.
  • 0 ⁇ 3G are understood as the low address space
  • 3 ⁇ 4G are understood as the high address space.
  • the high address space is used by the Linux system kernel and cannot be accessed by application programs.
  • the lower address space is accessible by the user program.
  • the kernel space and user space of the first operating system in the embodiments of this application both use the first address space.
  • the first address space is understood as the lower address space in the memory virtual address space of the first operating system.
  • the first register can be understood as the register corresponding to the lower address space.
  • the first operating system reserves the second address space, which is not used by the kernel of the first operating system, and the second address space is understood as the upper address space. That is to say, during the initialization process of the first operating system, the high address space of the first operating system is reserved based on the high address space in the virtual address space of the second operating system.
  • the second operating system is 32 bits For Linux system
  • the virtual address space of the second operating system is divided from 0 to 3G as user space, and 3 to 4G as kernel space.
  • the first operating system can reserve 3 to 4G of the upper address space of the first operating system. come out.
  • the address space of the first operating system is divided
  • the division of the address space with the second operating system should be consistent.
  • the virtual address space divisions of the first operating system and the second operation are both 0 ⁇ 3G for the low address space, and 3 ⁇ 4G for the high address space.
  • the virtual address space of the first operating system and the second operating system are both divided 0 ⁇ 3G is the low address space, and 3 ⁇ 4G is the high address space are just examples, and do not constitute any limitation to the scope of protection of this application.
  • Other possible system low address space and high address space division can refer to the existing division method. This application will not go into details here.
  • PXN privileged execute never
  • the first operating system in the embodiment of the present application can obtain the register configuration information of the kernel page table of the second operating system.
  • the first operating system actively obtains the register configuration information of the kernel page table of the second operating system.
  • an acquisition module is deployed in the first operating system for acquiring register configuration information of the kernel page table of the second operating system.
  • the first operating system receives the register configuration information of the kernel page table of the second operating system from the second operating system.
  • a receiving module is deployed in the first operating system for receiving register configuration information of the kernel page table of the second operating system.
  • the first operating system can also obtain the kernel symbol table information of the second operating system, and parse the kernel symbol table information to obtain the conversion relationship of the upper address space of the second operating system, and obtain the user page table base address information of the user process, Use the conversion relationship to read the content of the user page table entry level by level, and access the resources of the user space of the second operating system.
  • the kernel symbol table information includes the information of the kernel stack of the user process and the structure offset (the address space descriptor of the process (for example, code segment, data segment, stack, file system information, etc.), process descriptor). Obtain the address range of the code segment or data segment according to the information of the kernel stack and the structure offset.
  • a kernel driver module may be deployed in the second operating system, and the kernel driver module is used to obtain kernel symbol table information of the second operating system and register configuration information of the kernel page table of the second operating system.
  • the kernel driver module obtains the above-mentioned kernel symbol table information of the second operating system and the register configuration information of the kernel page table of the second operating system, it can be stored in the local storage module of the second operating system. , So that the first operating system can be actively obtained.
  • the kernel driver module after the kernel driver module obtains the above-mentioned kernel symbol table information of the second operating system and the register configuration information of the kernel page table of the second operating system, it can initiate an active request to transfer the obtained first.
  • the kernel symbol table information of the second operating system and the register configuration information of the kernel page table of the second operating system are notified to the first operating system, and the method flow shown in FIG. 4 may further include:
  • S120 The second operating system sends a request message to the first operating system.
  • the request message carries the aforementioned kernel symbol table information and/or register configuration information of the kernel page table of the second operating system, and the request message is used to request the first operating system to modify the register configuration of the first operating system.
  • the request message includes the above-mentioned kernel symbol table information of the second operating system and/or the register configuration information of the kernel page table of the second operating system
  • the first operating system may be based on the received
  • the register configuration information of the kernel page table of the second operating system configures the register configuration of the first operating system, so that the register configuration corresponding to the high address space of the first operating system is the same as the register configuration corresponding to the high address space of the second operating system. It is understood that the register configuration corresponding to the high address space of the first operating system multiplexes the register configuration corresponding to the high address space of the second operating system. That is, the method flow shown in FIG. 4 further includes: S130, the first operating system configuration register.
  • a client application is deployed in the first operating system before receiving the above request message, and the CA is based on the received register configuration of the kernel page table of the second operating system The information configures the register configuration corresponding to the upper address space of the first operating system;
  • the above CA is deployed in the first operating system, and the CA configures the first operating system based on the received register configuration information of the kernel page table of the second operating system.
  • the register configuration corresponding to the upper address space of;
  • the above CA is deployed in the first operating system when the above request message is received, and the CA configures the first operating system based on the received register configuration information of the kernel page table of the second operating system The register configuration corresponding to the upper address space of the.
  • the register configuration of the kernel page table of the second operating system includes the configuration of the address translation controller, the memory attribute controller, and the upper space page table base address register. After the first operating system completes the register configuration corresponding to the upper address space of the first operating system, the first operating system and the second operating system have the same upper space page table base address register configuration.
  • the first operating system may obtain the kernel symbol table information of the second operating system, and the first operating system may store the aforementioned kernel symbol table information of the second operating system.
  • the first operating system configures the second register corresponding to the upper address space of the first operating system according to the register configuration information of the kernel page table of the second operating system
  • the first operating system After the first operating system enables the upper address space, the first operating system An operating system has the authority to directly access resources in the kernel space of the second operating system, and can access the same high address space as the second operating system.
  • the first operating system After the first operating system receives the above-mentioned kernel symbol table information, it can obtain the conversion relationship of the upper address space of the second operating system, obtain the user page table base address information of the user process, and use the conversion relationship to read the user page table entries level by level. Content, access to the resources of the user space of the second operating system.
  • FIG. 5 is a schematic block diagram of a first operating system accessing resources of a second operating system according to an embodiment of the present application.
  • Linux OS usually uses 128T addresses of 0x0000-0000-0000 ⁇ 0x0000-7fff-fff-f000 in the 64-bit address space for user space, and 0xffff-8000 ⁇ 0000-0000 are system kernel space addresses.
  • the kernel page table and user page table are stored in the same continuous memory, and the memory base address is configured in TTBR0_EL1 (lower space page table base address register), and both the kernel space and user space use low addresses space.
  • the first operating system configures the kernel page table, the user mode inaccessibility control is added, the user page table is configured, and the PXN protection is added; and it is necessary to ensure the high address space range of the first operating system and the kernel address of the second operating system The space is kept consistent (for example, it is ensured that 0xffff-8000 ⁇ 0000-0000 in the 64-bit address space of the first operating system are high-order address spaces).
  • the kernel driver module to Linux OS to obtain the kernel symbol table information of Linux OS and some key system register configuration (register configuration information related to the kernel page table, for example, TCR_EL1 (address translation controller configuration), TTBR1_EL1 (Low space page table base address register), MAIR_EL1 (memory attribute register) and other register configurations), and send the obtained kernel symbol table information and some key system register configurations to the first operating system, so that the first operating system is reused
  • the upper address space of the second operating system is configured, so the first operating system can access data in the upper address space range of the second operating system.
  • the operating system architecture of the X86 system is also similar, and the register configuration also needs to ensure that the upper address space range of the local operating system (first operating system) needs to be consistent with the kernel address space range of the opposite operating system (second operating system).
  • the register name may be different from the operating system architecture of the ARM system, but the principle is the same, which will not be repeated in this application.
  • the first operating system can access the user page table resources of the second operating system in the form of software (software relationship: Table_Entry[(VA>>(39-Level*9))&0x1FF], Level is the page table level), namely
  • the method flow shown in FIG. 4 further includes S140: the first operating system accesses the user page table resource of the second operating system.
  • FIG. 6 is a schematic diagram of a flow of accessing a user page table provided by an embodiment of the present application.
  • the second operating system has a four-level paging mechanism: PGD includes addresses of several PUDs, PUD includes addresses of several PMDs, PMD includes addresses of several PTEs, and each PTE points to a page frame.
  • the first operating system needs to access the content of the physical page frame corresponding to a certain VA.
  • the specific visit process is as follows:
  • the first operating system uses the existing high-order address translation relationship (there is no need to copy the page table resources of the second operating system as shown in the previous article) to obtain the VA corresponding to the user process PGD in the second operating system.
  • PUD entry physical address determine whether the second-level page table entry is a valid entry. If it is a valid entry, use PUD[(VA>>(39-2*9))&0x1FF] to obtain the physical address of the second-level page table entry.
  • the real page frame corresponding to the process code segment can be obtained.
  • use the linear relationship between the high address of the second operating system to convert the virtual address of the PTE page frame, and the first operating system can access the content of the virtual address of the second operating system; the whole requires only 4 simple linear conversion steps to quickly obtain the first operating system.
  • Resources on the specific physical page frame of the operating system That is, the user page table resource is accessed, and the first operating system can quickly access it through software quick indexing.
  • the first operating system can access all peripherals connected to the address bus through the address bus, including physical memory, IO devices, etc., but the access address sent from the first operating system is not the physical address of these peripherals on the address bus , But a virtual address.
  • the MMU converts the virtual address into a physical address and then sends it out from the address bus. The conversion relationship between the virtual address and the physical address on the MMU needs to be created. When a virtual address to a physical address is not created If an illegal address is accessed due to incorrect mapping or programming, the MMU will notify the first operating system to generate a page fault exception.
  • the first operating system when the first operating system accesses the resources of the second operating system abnormally, the first operating system sends the abnormal information to the second operating system, specifically in the first operating system A remote procedure call (remote procedure call, RPC) service is deployed, and the RPC service sends the abnormality-related information to the second operating system.
  • RPC remote procedure call
  • FIG. 7 is a schematic diagram of a page fault processing flow provided by an embodiment of the present application.
  • the RPC service is deployed in the first operating system.
  • the CA program in the first operating system transparently transmits the abnormal RPC request for page faults back to the second operating system through the RPC service, and actively transmits the page fault process number and the virtual address corresponding to the page fault.
  • the second operating system uses the page fault handler of the second operating system to set the relevant memory page, locks the memory page in the memory, and responds to the first operating system’s RPC request.
  • the CA in the first operating system performs subsequent corresponding processing according to the result returned by the second operating system. If the result returned by the second operating system is successful, the second operating system can normally access the user process resource, otherwise the access is denied.
  • FIG. 8 is a schematic diagram of an exception handling process provided by an embodiment of the present application.
  • the first operating system performs exception handling. First, it needs to analyze the source of the address. If it is the first operating system address access error, enter the first operating system exception handler for processing, otherwise, use the RPC service to route back to the second operating system for processing. Handed over to the second operating system for processing.
  • the method shown in Figure 4 can be used in the different operating system shown in Figure 1.
  • the software operating system corresponding to the different operating system shown in Map 1 is shown in Figure 9, and Figure 9
  • Figure 9 It is a schematic block diagram of operating system software provided by an embodiment of the present application.
  • the block started by symbol (BSS) segment usually refers to a memory area used to store uninitialized global variables in the program.
  • the BSS segment belongs to static memory allocation.
  • Data segment usually refers to a memory area used to store initialized global variables in the program.
  • the data segment belongs to static memory allocation.
  • Code segment usually refers to a memory area used to store program execution code. The size of this area is determined before the program runs, and the memory area is usually read-only. Certain architectures also allow the code segment to be writable, that is, the program is allowed to be modified. In the code segment, there may also be some read-only constant variables, such as string constants.
  • the user stores the local variables temporarily created by the program.
  • the stack can be regarded as a memory area for registering and exchanging temporary data. It is allocated by the operating system and the memory application and recovery are managed by the system.
  • BIN files are raw binary files, which only contain machine code.
  • the ELF file also contains other additional information, such as the load address of the segment, the run address, the relocation table, the symbol table, and so on.
  • the specific division of operating system software is not limited, and reference may be made to the software division of the current two operating systems.
  • the above operating system software is divided into two domains: a secure domain and a non-secure domain, where the secure domain corresponds to a securely isolated operating system, and the non-secure domain corresponds to a mainstream operating system.
  • a dynamic integrity measurement (DIM) module can be deployed in the security isolation operating system.
  • the security isolation operating system may be referred to as the local operating system, or the first operating system, and the mainstream operating system.
  • the peer operating system can also be called the second operating system. That is to say, a dynamic measurement module can be deployed in the first operating system in this application to provide security protection for the second operating system.
  • the method for the first operating system to access the resources of the second operating system provided in this application can be applied in the field of autonomous driving. For example, the second operating system interacts with the user, and the software security service access is deployed in the first operating system.
  • the size of the sequence numbers of the foregoing processes does not mean the order of execution, and the execution order of the processes should be determined by their functions and internal logic, and should not constitute the implementation process of the embodiments of this application. Any restrictions.
  • FIG. 10 is a schematic diagram of an apparatus 10 for accessing resources of a second operating system by a first operating system proposed in the present application.
  • the device 10 includes a processing unit 110 and a receiving unit 120.
  • the processing unit 110 is configured to configure the kernel space and user space of the first operating system in the first address space of the first operating system, and reserve a second address space for the second operating system, where the The memory virtual address space of the first operating system includes the first address space and the second address space;
  • the receiving unit 120 is configured to obtain register configuration information of the kernel page table of the second operating system
  • the processing unit 110 is further configured to configure the second register of the first operating system according to the register configuration information of the kernel page table of the second operating system, and the second register corresponds to all the registers of the first operating system.
  • the processing unit 110 is further configured to use the second address space to access resources of the kernel space of the second operating system.
  • the device 10 completely corresponds to the first operating system in the method embodiment, and the device 10 may be the first operating system in the method embodiment, or a chip or functional module inside the first operating system in the method embodiment.
  • the corresponding unit of the device 10 is used to execute the corresponding steps executed by the first operating system in the method embodiment shown in FIG. 4.
  • processing unit 110 in the device 10 executes the steps implemented or processed internally by the first operating system in the method embodiment.
  • executing step S110 of initialization in FIG. 4 is also used to execute step S130 of configuring registers in FIG. 4.
  • the receiving unit 120 executes the steps received by the first operating system in the method embodiment. For example, step S120 of receiving a request message from the second operating system in FIG. 4 is performed.
  • the apparatus 10 may further include a sending unit, configured to execute the steps sent by the first operating system, for example, sending information to other devices.
  • the sending unit and the receiving unit 120 may constitute a transceiver unit, and have the functions of receiving and sending at the same time.
  • the processing unit 110 may be a processor.
  • the sending unit may be a transmitter, and the receiving unit 120 may be a receiver. The receiver and transmitter can be integrated to form a transceiver.
  • FIG. 11 is a schematic structural diagram of a first operating system applicable to an embodiment of the present application.
  • the first operating system can be applied to the two operating systems shown in FIG. 1.
  • FIG. 11 only shows the main components of the first operating system.
  • the first operating system includes a processor 1110 (corresponding to the processing unit 110 shown in FIG. 10), a memory 1120, and a transceiver 1130 (corresponding to the receiving unit 120 shown in FIG. 10).
  • the processor is used to control the transceiver to send and receive information
  • the memory is used to store a computer program
  • the processor is used to call and run the computer program from the memory to execute the method for the first operating system to access the resources of the second operating system proposed in this application.
  • FIG. 11 only shows a memory and a processor. In the actual first operating system, there may be multiple processors and memories.
  • the memory may also be referred to as a storage medium or a storage device, etc., which is not limited in the embodiment of the present application.
  • FIG. 12 is a schematic diagram of an apparatus 20 for a first operating system to access resources of a second operating system proposed in the present application.
  • the device 20 includes a processing unit 210 and a sending unit 220.
  • the processing unit 210 is configured to obtain register configuration information of the kernel page table of the second operating system
  • the sending unit 220 is configured to send register configuration information of the kernel page table of the second operating system to the first operating system.
  • the device 20 completely corresponds to the second operating system in the method embodiment, and the device 20 may be the second operating system in the method embodiment, or a chip or functional module inside the second operating system in the method embodiment.
  • the corresponding unit of the device 20 is used to execute the corresponding steps executed by the second operating system in the method embodiment shown in FIG. 4.
  • the sending unit 220 in the device 20 executes the steps sent by the second operating system in the method embodiment. For example, step S120 of sending a request message to the first operating system in FIG. 4 is performed.
  • the processing unit 210 in the device 20 executes the steps implemented or processed internally by the second operating system in the method embodiment.
  • the apparatus 20 may further include a receiving unit, configured to execute the steps received by the second operating system, for example, receiving information sent by other devices.
  • the receiving unit and the sending unit 210 may constitute a transceiver unit, and have the functions of receiving and sending at the same time.
  • the processing unit 110 may be a processor.
  • the transmitting unit 210 may be a transmitter.
  • the receiving unit may be a receiver. The receiver and transmitter can be integrated to form a transceiver.
  • FIG. 13 is a schematic structural diagram of a second operating system applicable to an embodiment of the present application.
  • This second operating system can be applied to the two operating systems shown in FIG. 1.
  • FIG. 13 only shows the main components of the second operating system.
  • the first operating system includes a processor 1310 (corresponding to the processing unit 210 shown in FIG. 12), a memory 1320, and a transceiver 1330 (corresponding to the sending unit 220 shown in FIG. 12).
  • the processor is used to control the transceiver to send and receive information
  • the memory is used to store a computer program
  • the processor is used to call and run the computer program from the memory to execute the method for the first operating system to access the resources of the second operating system proposed in this application.
  • An embodiment of the present application also provides an electronic device, which includes the aforementioned first operating system and second operating system.
  • the electronic device may also include other peripherals. As shown in FIG. 3, both the first operating system and the second operating system may be provided in the processor 310.
  • the present application also provides a computer-readable storage medium that stores instructions in the computer-readable storage medium.
  • the computer executes the first operating system in the method shown in FIG. 4 The various steps.
  • the present application also provides a computer-readable storage medium that stores instructions in the computer-readable storage medium.
  • the computer executes the second operating system in the method shown in FIG. 4 The various steps.
  • This application also provides a computer program product containing instructions.
  • the computer program product runs on a computer, the computer executes the steps executed by the first operating system in the method shown in FIG. 4.
  • This application also provides a computer program product containing instructions.
  • the computer program product runs on a computer, the computer executes the steps executed by the second operating system in the method shown in FIG. 4.
  • the application also provides a chip including a processor.
  • the processor is used to read and run the computer program stored in the memory to execute the corresponding operation and/or process executed by the first operating system in the method for the first operating system to access the resources of the second operating system provided in the present application.
  • the chip further includes a memory, the memory and the processor are connected to the memory through a circuit or a wire, and the processor is used to read and execute the computer program in the memory.
  • the chip further includes a communication interface, and the processor is connected to the communication interface.
  • the communication interface is used to receive data and/or information that needs to be processed, and the processor obtains the data and/or information from the communication interface, and processes the data and/or information.
  • the communication interface may be an input/output interface, interface circuit, output circuit, input circuit, pin or related circuit on the chip.
  • the processor may also be embodied as a processing circuit or a logic circuit.
  • the application also provides a chip including a processor.
  • the processor is used to read and run a computer program stored in the memory to execute the corresponding operations and/or processes executed by the second operating system in the method for the first operating system to access resources of the second operating system provided in this application.
  • the chip further includes a memory, the memory and the processor are connected to the memory through a circuit or a wire, and the processor is used to read and execute the computer program in the memory.
  • the chip further includes a communication interface, and the processor is connected to the communication interface.
  • the communication interface is used to receive data and/or information that needs to be processed, and the processor obtains the data and/or information from the communication interface, and processes the data and/or information.
  • the communication interface may be an input/output interface, interface circuit, output circuit, input circuit, pin or related circuit on the chip.
  • the processor may also be embodied as a processing circuit or a logic circuit.
  • the disclosed system, device, and method may be implemented in other ways.
  • the device embodiments described above are merely illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of the present application essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disks or optical disks and other media that can store program codes. .
  • the term "and/or” in this application is only an association relationship that describes associated objects, which means that there can be three types of relationships, for example, A and/or B, which can mean that A alone exists, and both A and B exist. , There are three cases of B alone.
  • the character "/" in this document generally means that the associated objects before and after are in an "or” relationship; the term “at least one” in this application can mean “one” and "two or more", for example, A At least one of, B and C can mean: A alone exists, B alone exists, C alone exists, A and B exist alone, A and C exist at the same time, C and B exist at the same time, A and B and C exist at the same time, this Seven situations.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Mathematical Physics (AREA)
  • Storage Device Security (AREA)
  • Memory System Of A Hierarchy Structure (AREA)

Abstract

本申请提供了一种第一操作系统访问第二操作系统资源的方法和装置。该第一操作系统访问第二操作系统资源的方法包括：第一操作系统初始化时，将存储内核页表和用户页表的内存配置到低位地址空间，预留出高位地址空间，并且从第二操作系统获取该第二操作系统的内核页表的寄存器配置信息，基于该第二操作系统的内核页表的寄存器配置信息配置第一操作系统的高位地址空间的寄存器，从而启用高位地址空间直接访问第二操作系统的内核资源。本申请提供的技术方案能够提高第一操作系统直接访问第二操作系统资源的性能。

Description

第一操作系统访问第二操作系统资源的方法和装置
本申请要求于2019年11月22日提交中国专利局、申请号为201911156149.8、申请名称为“第一操作系统访问第二操作系统资源的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，并且更具体地，涉及一种第一操作系统访问第二操作系统资源的方法和装置。
背景技术
随着计算机技术的不断发展，电子设备安全问题越来越受到关注。电子设备上的一般运行环境(rich execution environment，REE)技术已经无法满足安全要求，为了提高安全性，提出可信执行环境(trusted execution environment，TEE)的概念，确保敏感数据在安全可信的隔离操作系统中处理，不被其它恶意第三方软件应用所篡改。TEE操作系统(operating system，OS)是与电子设备上的REE OS并存的运行环境，给REE OS提供可靠安全服务，具有自身的执行空间，比REE OS的安全级别更高，且TEE OS所能访问的软硬件资源与REE OS是分离的，是一个隔离操作系统。TEE OS需要访问对端REE OS资源时，受限于两个操作系统中不同的页表(page table)，TEE OS无法直接访问到REE OS资源，从而导致部署在TEE OS中的动态度量模块为REE OS提供完整性保护的性能较差。因此，如何提高第一操作系统访问第二操作系统资源的性能，成为亟待解决的问题。
发明内容
本申请提供一种第一操作系统访问第二操作系统资源的方法和装置，通过预留第一操作系统中的高位地址空间，并且第一操作系统复用第二操作系统的内核页表的寄存器配置，使得第一操作系统能够通过启用高位地址空间直接访问第二操作系统的内核空间的资源，提高第一操作系统访问第二操作系统资源的性能。
第一方面，提供了一种第一操作系统访问第二操作系统资源的方法，可以由第一操作系统执行，也可以由第一操作系统中的芯片或者电路执行，为了便于描述下文中以第一操作系统执行该方法为例进行说明。
该第一操作系统访问第二操作系统资源的方法包括：在所述第一操作系统的第一地址空间配置所述第一操作系统的内核空间和用户空间，为所述第二操作系统预留第二地址空间，其中，所述第一操作系统的内存虚拟地址空间包括所述第一地址空间和所述第二地址空间；所述第一操作系统获取所述第二操作系统的内核页表的寄存器配置信息；所述第一操作系统根据所述第二操作系统的内核页表的寄存器配置信息配置所述第一操作系统的第二寄存器，所述第二寄存器对应所述第一操作系统的所述第二地址空间；所述第一操作 系统使用所述第二地址空间访问所述第二操作系统的内核空间的资源。
本申请实施例提供的第一操作系统访问第二操作系统资源的方法，第一操作系统通过预留第一操作系统中的高位地址空间以及基于第二操作系统的内核页表的寄存器配置信息配置第一操作系统高位地址空间对应的第二寄存器，使得第一操作系统启用预留的高位地址空间时能够直接访问第二操作系统的内核空间的资源，从而提高了第一操作系统访问第二操作系统资源的性能。
结合第一方面，在第一方面的某些实现方式中，所述第一地址空间为高位地址空间；所述第二地址空间为低位地址空间，所述第一操作系统的高位地址空间与所述第二操作系统的内核地址空间范围一致。
应理解，上述的“第一地址空间”和“第二地址空间”分别指代第一操作系统中的低位地址空间和高位地址空间，为了避免描述上的限定，描述为“第一地址空间”和“第二地址空间”，对本申请的保护范围不构成限定。
另外，为了第一操作系统启用预留的高位地址空间时能够直接访问第二操作系统的内核空间的资源，上述的第一操作系统的高位地址空间与第二操作系统的内核地址空间范围一致。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：所述第一操作系统接收所述第二操作系统发送的内核符号表信息；所述第一操作系统解析所述内核符号表信息，得到的所述第二操作系统高位地址空间转换关系，获取用户进程的用户页表基地址信息，利用所述转换关系逐级读取用户页表条目内容，访问第二操作系统的用户空间的资源。
进一步地，上述的第一操作系统可以获取第二操作系统的内核符号表信息，从而得到的上述第二操作系统高位地址空间转换关系和用户进程的用户页表基地址信息，在已知转换关系的前提下，可以逐级读取用户页表条目内容，访问第二操作系统的用户空间的资源。
结合第一方面，在第一方面的某些实现方式中，在所述第一操作系统的第一地址空间配置所述第一操作系统的内核空间和用户空间包括：该第一操作系统将该第一操作系统中的内核页表和用户页表存储在第一地址空间的页表内存中；该第一操作系统将该第一地址空间的页表内存配置到该第一操作系统的第一寄存器。
提供一种预留高位地址空间的方式：将内核页表和用户页表均存储在低位地址空间的页表内存中。
结合第一方面，在第一方面的某些实现方式中，为所述第二操作系统预留第二地址空间包括：该第一操作系统基于第二操作系统的高位地址空间预留第二地址空间。
具体地，第一操作系统在预留高位地址空间的时候，参考了第二操作系统中高位地址空间的范围，从而使得第一操作系统能够成功基于第二操作系统的内核页表的寄存器配置信息配置第一操作系统高位地址空间对应的第二寄存器。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：该第一操作系统接收该第二操作系统发送的请求消息，该请求消息中携带内核符号表信息和该第二操作系统的内核页表的寄存器配置信息。
本申请实施例提供的第一操作系统访问第二操作系统资源的方法，第一惭怍系统获取到上述的内核符号表信息和第二操作系统的内核页表的寄存器配置信息可以是接收到的第二操作系统发送的请求消息中携带有内核符号表信息和第二操作系统的内核页表的寄 存器配置信息。
结合第一方面，在第一方面的某些实现方式中，该第一操作系统中部署客户端应用程序CA；该第一操作系统为所述第二操作系统预留第二地址空间包括：该CA初始化过程中，基于该第二操作系统的寄存器配置信息修改该第一操作系统的内核页表的寄存器的配置，使得该第一操作系统的第二寄存器的配置与该第二操作系统的高位寄存器配置相同。
本申请实施例提供的第一操作系统访问第二操作系统资源的方法，第一操作系统中部署了客户端应用程序(client application，CA)，通过初始化该CA，基于接收到的第二操作系统的寄存器配置信息修改第一操作系统的寄存器的配置，使得该第一操作系统的第二寄存器的配置与该第二操作系统的高位寄存器配置相同，为第一操作系统如何复用第二操作系统的寄存器配置提供可行的方案。
结合第一方面，在第一方面的某些实现方式中，将该第一操作系统中的内核页表和用户页表存储在所述第一地址空间的页表内存中之前，该方法还包括：该第一操作系统在该内核页表上增加用户不可访问权限控制；该第一操作系统在该用户页表上增加不可执行特权PXN防护。
本申请实施例提供的第一操作系统访问第二操作系统资源的方法，第一操作系统中的内核页表和用户页表存储在同一个页表内存，为了满足内核页表和用户页表的安全需求，为内核页表上增加用户不可访问权限控制、为用户页表上增加不可执行特权PXN防护，使得内核页表和用户页表之间安全独立。
结合第一方面，在第一方面的某些实现方式中，该第二操作系统的内核页表的寄存器配置信息包括：地址翻译控制器配置信息、内存属性控制器配置信息和内核空间页表基地址寄存器配置信息。
本申请实施例提供的第一操作系统访问第二操作系统资源的方法，第一操作系统接收到的第二操作系统的寄存器配置信息包括多种配置信息，为第一操作系统复用第二操作系统的寄存器配置提供更加全面的选择。
结合第一方面，在第一方面的某些实现方式中，该第一操作系统中部署有动态度量模块，所述动态度量模块用于为所述第二操作系统提供安全服务。
本申请实施例提供的第一操作系统访问第二操作系统资源的方法，第一操作系统中可以包括动态度量模块，为第二操作系统提供安全防护。
结合第一方面，在第一方面的某些实现方式中，当该第一操作系统访问该第二操作系统的内核空间的资源异常时，该第一操作系统将该异常相关信息发送给该第二操作系统。
本申请实施例提供的第一操作系统访问第二操作系统资源的方法，跨系统访问资源出现异常的情况下，第一操作系统可以将该异常情况的相关信息通知给被访问的第二操作系统，使得第二操作系统能够获知到发生访问异常。
结合第一方面，在第一方面的某些实现方式中，该第一操作系统中部署有远端程序调录RPC服务；该第一操作系统将该异常相关信息发送给该第二操作系统包括：该RPC服务将该异常相关信息发送给该第二操作系统。
本申请实施例提供的第一操作系统访问第二操作系统资源的方法，第一操作系统中可以部署有远端程序调录RPC服务，当发生访问异常的情况下，第一操作系统通过RPC服务向第二操作系统通知异常情况信息。
第二方面，提供了一种第一操作系统访问第二操作系统资源的方法，可以由第二操作系统执行，也可以由第二操作系统中的芯片或者电路执行，为了便于描述下文中以第二操作系统执行该方法为例进行说明。
该第一操作系统访问第二操作系统资源的方法包括：该第二操作系统获取该第二操作系统的内核页表的寄存器配置信息；该第二操作系统向该第一操作系统发送所述第二操作系统的内核页表的寄存器配置信息。
本申请实施例提供的第一操作系统访问第二操作系统资源的方法，跨系统访问资源场景下的被访问资源的第二操作系统中能够获取第二操作系统的内核页表的寄存器配置信息，并将该第二操作系统的内核页表的寄存器配置信息发送给第一操作系统，使得第一操作系统能够复用第二操作系统的内核页表的寄存器配置，提高系统间资源访问的性能。
结合第二方面，在第二方面的某些实现方式中，所述方法还包括：所述第二操作系统获取所述第二操作系统的内核符号表信息；所述第二操作系统向所述第一操作系统发送所述内核符号表信息。
本申请实施例提供的第一操作系统访问第二操作系统资源的方法，跨系统访问资源场景下的被访问资源的第二操作系统中能够获取第二操作系统的内核符号表信息，并将该内核符号表信息发送给第一操作系统，使得第一操作系统能够逐级访问第二操作系统的用户页表，提高系统间资源访问的性能。
结合第二方面，在第二方面的某些实现方式中，该第二操作系统中部署内核驱动模块；该第二操作系统获取内核符号表信息和/或该第二操作系统的内核页表的寄存器配置信息：该内核驱动模块获取该内核符号表信息和/或该第二操作系统的内核页表的寄存器配置信息。
本申请实施例提供的第一操作系统访问第二操作系统资源的方法，第二操作系统中能够获取自身的内核符号表信息和该第二操作系统的寄存器配置信息可以是在第二操作系统中部署内核驱动模块，通过该内核驱动模块获取该内核符号表信息和该第二操作系统的寄存器配置信息。
结合第二方面，在第二方面的某些实现方式中，该第二操作系统的内核页表的寄存器配置信息包括：地址翻译控制器配置信息、内存属性控制器配置信息和内核空间页表基地址寄存器配置信息。
本申请实施例提供的第一操作系统访问第二操作系统资源的方法，第二操作系统的寄存器配置信息包括多种配置信息，为第一操作系统复用第二操作系统的寄存器配置提供更加全面的选择。
第三方面，提供一种第一操作系统访问第二操作系统资源的装置，所述第一操作系统访问第二操作系统资源的装置包括处理器，用于实现上述第一方面描述的方法中第一操作系统的功能。
可选地，所述第一操作系统访问第二操作系统资源的装置还可以包括存储器，所述存储器与所述处理器耦合，所述处理器用于实现上述第一方面描述的方法中第一操作系统的功能。在一种可能的实现中，所述存储器用于存储程序指令和数据。所述存储器与所述处理器耦合，所述处理器可以调用并执行所述存储器中存储的程序指令，用于实现上述第一方面描述的方法中第一操作系统的功能。
可选地，所述第一操作系统访问第二操作系统资源的装置还可以包括通信接口，所述通信接口用于所述第一操作系统访问第二操作系统资源的装置与其它设备进行通信。当该第一操作系统访问第二操作系统资源的装置为第一操作系统时，所述通信接口为收发器、输入/输出接口、或电路等。
在一种可能的设计中，所述第一操作系统访问第二操作系统资源的装置包括：处理器和通信接口，
所述处理器用于运行计算机程序，以是的所述第一操作系统访问第二操作系统资源的装置实现上述第一方面描述的任一种方法；
所述处理器利用所述通信接口与外部通信。
可以理解，所述外部可以是处理器以外的对象，或者是所述装置以外的对象。
在另一种可能的设计中，该第一操作系统访问第二操作系统资源的装置为芯片或芯片系统所述通信接口可以是该芯片或芯片系统上输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。所述处理器也可以体现为处理电路或逻辑电路。
第四方面，提供一种第一操作系统访问第二操作系统资源的装置，所述第一操作系统访问第二操作系统资源的装置包括处理器，用于实现上述第二方面描述的方法中第二操作系统的功能。
可选地，所述第一操作系统访问第二操作系统资源的装置还可以包括存储器，所述存储器与所述处理器耦合，所述处理器用于实现上述第二方面描述的方法中第二操作系统的功能。在一种可能的实现中，所述存储器用于存储程序指令和数据。所述存储器与所述处理器耦合，所述处理器可以调用并执行所述存储器中存储的程序指令，用于实现上述第二方面描述的方法中第二操作系统的功能。可选地，所述第一操作系统访问第二操作系统资源的装置还可以包括通信接口，所述通信接口用于所述第一操作系统访问第二操作系统资源的装置与其它设备进行通信。当该第一操作系统访问第二操作系统资源的装置为第二操作系统时，所述通信接口为收发器、输入/输出接口、或电路等。
在一种可能的设计中，所述第一操作系统访问第二操作系统资源的装置包括：处理器和通信接口，
所述处理器利用所述通信接口与外部通信；
所述处理器用于运行计算机程序，以是的所述第一操作系统访问第二操作系统资源的装置实现上述第二方面描述的任一种方法。
可以理解，所述外部可以是处理器以外的对象，或者是所述装置以外的对象。
在另一种可能的设计中，该第一操作系统访问第二操作系统资源的装置芯片或芯片系统。所述通信接口可以是该芯片或芯片系统上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。所述处理器也可以体现为处理电路或逻辑电路。
第五方面，提供一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序被通信装置执行时，使得所述通信装置实现第一方面以及第一方面的任一可能的实现方式中的方法。
第六方面，提供一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序被通信装置执行时，使得所述通信装置实现第二方面以及第二方面的任一可能的实现方式中的方法。
第七方面，提供一种包含指令的计算机程序产品，所述指令被计算机执行时使得通信装置实现第一方面以及第一方面的任一可能的实现方式中的方法。
第八方面，提供一种包含指令的计算机程序产品，所述指令被计算机执行时使得通信装置实现第二方面以及第二方面的任一可能的实现方式中的方法。
第九方面，提供了一种电子设备，包括第三方面所示的第一操作系统访问第二操作系统资源的装置和第四方面所示的第一操作系统访问第二操作系统资源的装置。
附图说明
图1是两个操作系统的示意性框图。
图2是本申请实施例提供的一种共享内存的示意性框图。
图3示出了电子设备300的结构示意图。
图4是本申请实施例提供的一种第一操作系统访问第二操作系统资源的方法的示意性流程图。
图5是本申请实施例提供的一种第一操作系统访问第二操作系统资源的示意性框图。
图6是本申请实施例提供的一种用户页表访问的流程示意图。
图7是本申请实施例提供的一种缺页异常处理流程示意图。
图8是本申请实施例提供的一种异常处理流程示意图。
图9是本申请实施例提供的一种操作系统软件示意性框图。
图10是本申请提出的第一操作系统访问第二操作系统资源的装置10的示意图。
图11是适用于本申请实施例的第一操作系统的结构示意图。
图12是本申请提出的第一操作系统访问第二操作系统资源的装置20的示意图。
图13是适用于本申请实施例的第二操作系统的结构示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例的技术方案可以应用于两个操作系统中。图1是两个操作系统的示意性框图。如图1所示两个操作系统包括本端操作系统和对端操作系统，其中，本端操作系统和对端操作系统具有各自独立的中央处理单元(central processing unit，CPU)、内存管理单元(memory management unit，MMU)、转换检测缓冲区(translation lookaside buffer，TLB)以及页全局目录(page global directory，PGD)等内部模块，还可以具有各自独立的外部设备，图1中未示出操作系统外部设备，本申请对此也并不限制。
具体地，本端操作系统中的某个程序被分割成多块程序分别装入内存，在物理上该多块程序不用彼此相连，在逻辑上使用页表将离散分布的多块程序串起来形成逻辑上连续的程序。其中，将程序分成等长的小块，这些小块叫做页(page)，同样内存也被分成和页同样大小的页框(frame)，一个页可以装到一个页框里，需要给CPU提供当前任务的页表，CPU在执行程序的时候根据页表去查找某个页在内存的某个页框中，由此完成逻辑地址到物理地址的映射。图1所示的两个操作系统中本端操作系统需要访问对端操作系统资源时，受限于本端操作系统和对端操作系统不同的页表，本端操作系统无法直接访问对端操作系统资源。不同的操作系统需要访问同一物理内存的数据资源时，该不同的操作系统 均需要建立新的页表关系。
例如，图1中所示的，本端操作系统基于本端操作系统中的页表根据虚拟地址#1找到对应的物理地址#1，该物理地址#1对应物理内存块#1、对端操作系统基于对端操作系统中的页表根据上述的虚拟地址#1找到对应的物理地址#2，该物理地址#2对应物理内存块#2，物理内存块#1与物理内存块#2相异，所以本端操作系统和对端操作系统基于不同的页表，访问到不同的物理内存块。如果需要本端操作系统和对端操作系统基于上述的虚拟地址#1均能找到上述的物理内存块#2，则本端操作系统和对端操作系统中的页表需要包括虚拟地址#1和物理内存块#2之间的映射关系，也就是说需要更新本端操作系统中的页表，使得本端操作系统基于本端操作系统中的页表根据虚拟地址#1找到对应的物理地址#2。
应理解，本申请实施例中对于操作系统基于页表访问物理内存块的具体流程并不限制，可以参考目前协议的规定。还应理解，本申请中将两个操作系统中的两个不同的操作系统称为本端操作系统和对端操作系统只是举例，对本申请的保护范围不构成任何限定。例如，本端操作系统可以称之为第一操作系统、对端操作系统可以称之为第二操作系统；本端操作系统还可以称之为安全隔离操作系统、对端操作系统还可以称之为主流操作系统。还应理解，两个操作系统也可以称之为双系统、多处理器系统等。
当第一操作系统为TEE OS，第二操作系统为REE OS的情况下。REE OS的安全问题包括机密性、完整性以及可用性等。一种可能的实现方式，使用动态度量技术为REE OS提供完整性安全服务，具体地，动态度量技术通过分析REE OS内存数据，探测REE OS是否受到的威胁从而保护REE OS内存数据避免未授权的修改。而动态度量模块的自身安全性保护，可以通过将动态度量模块部署在TEE OS中以保证动态度量模块的自身安全性，动态度量模块部署在TEE OS中，访问REE OS资源，主要涉及访问REE OS用户进程代码段、内核代码段、动态共享库代码段等度量对象。
但是部署在TEE OS中的动态度量模块需要通过监控REE OS资源完整性以确保REE OS可信，在此情况下，由于TEE OS和REE OS隔离，导致动态度量模块无法高效实时地访问REE OS资源。本申请实施例提供的第一操作系统访问第二操作系统资源的方法，在该情况下能够提高部署在TEE OS中的动态度量模块访问REE OS资源的性能，下文中将结合实施例进行说明。
可选地，本申请中涉及的REE OS包括Linux操作系统、安卓(Android)操作系统等。具体地，本申请中第一、第二以及各种数字编号是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换。并不用来限制本申请实施例的范围。例如，区分不同的操作系统等。同理，本申请中“#1”、“#2”等标号也是用于区别类似的对象，例如，区分不同的地址等。
进一步地，不同的操作系统能够共享内存。如果采用共享内存的机制，可以使得本端操作系统和对端操作系统访问同一个物理内存块。具体实现流程如图2所示，图2是本申请实施例提供的一种共享内存的示意性框图。
从图2中可以看出，本端操作系统访问对端操作系统中运行的应用程序代码段，需要提前知道对端操作系统中运行的应用程序代码段物理地址。通过操作系统间物理地址交互，对端操作系统主动将该物理地址传递给本端操作系统。本端操作系统收到该物理地址 后，主动映射此物理页框，添加到本端操作系统的页表条目中，这样对端操作系统、本端操作系统就可以通过类似共享内存方式直接访问这块内存块。
应理解，当对端操作系统中的进程代码段的物理地址不连续，呈现离散分布，本端操作系统需要映射很多的物理内存块，性能非常差，并且本端操作系统映射对端操作系统所有资源，本端操作系统的安全性受影响；当本端操作系统无法识别物理内存块的内容时，也会影响本端操作系统使用内存块的内容；当对端操作系统发生页交换的情况下，本端操作系统访问对端操作系统中的数据存在不同步问题。
进一步地，本端操作系统还可以通过拷贝对端操作系统的页表资源实现访问对端操作系统资源的目的。例如，本端操作系统通过软件遍历方式，拷贝对端操作系统的内核页表(或用户页表)所有条目到本端操作系统页表内存中，本端操作系统依次逐级完成页表条目映射，如此本端操作系统和对端操作系统可以利用同等页表转换关系访问到同一个页框内容。
在Linux中的分页机制中，页全局目录(page global directory，PGD)包含若干页上级目录(page upper directory，PUD)的地址，PUD又依次包含若干页中间目录(page middle directory，PMD)的地址，而PUD又包含若干页表(page table entry，PTE)的地址，每一个PTE指向一个页框。
以Linux用户页表为例，假设本端操作系统已知对端操作系统中用户程序虚拟地址(visual address，VA)，用户进程页表基地址(通常PGD地址直接填入页表基地址寄存器)。从用户页表基地址开始遍历，将PGD物理地址映射到本端操作系统内核页表中，映射完之后，通过本端操作系统中页表转换关系得到PGD虚拟地址，读取此虚拟地址内容，获取到条目内容，存储的是一级页表(页上级目录，PUD)物理地址；利用同样机制，获取到PUD条目虚拟地址，判断当前PUD条目是否包含当前需要映射的VA，如果不包含当前的VA，则PUD条目偏移一个一级页表粒度，继续判断此PUD条目是否包含此VA，如果不包含，则返回空地址。如果包含，则Walk页中间目录条目，利用同样的方法，直到逐级找到真正的PTE，最后将对应的PTE映射给本端操作系统使用。
应理解，当对端操作系统中的页表条目很多的情况下，本端操作系统拷贝页表消耗的时间非常长。为了提高第一操作系统访问第二操作系统资源的性能，本申请提供一种第一操作系统访问第二操作系统资源的方法，本端操作系统复用对端操作系统的寄存器配置，从而免页表拷贝、页表同步等实现快速访问资源。
首先，为了便于理解本申请实施例中提供的第一操作系统访问第二操作系统资源的方法，下面简单介绍本申请中涉及到的几个基本概念：
1、TEE。
TEE是全球平台(global platform，GP)提出的概念。TEE OS是与设备上的REE OS并存的运行环境，并且给REE OS提供安全服务。TEE OS具有其自身的执行空间，比REE OS的安全级别更高。本申请中将以REE OS和TEE OS为例进行说明。
TEE OS是运行在电子设备中的，提供介于REE OS和安全环境(safe environment，SE)之间的安全性的框架。例如对于某些小额的支付，企业虚拟私人网络(virtual private network，VPN)等，所需要的安全保护强度并不高，还不需要一个单独的SE来保护，也不能直接放在REE OS中，以防由于REE OS的开放性被攻击。所以对于这类应用，可以 通过TEE OS提供安全保护。
此外，TEE OS提供了可信应用(trusted application，TA)的安全执行环境，同时也保护TA的资源和数据的保密性，完整性和访问权限。在TEE中，每个TA是相互独立的，而且不能在未授权的情况下不能互相访问。
以下介绍了本申请实施例提供设计的电子设备、用于这样的电子设备的用户界面、和用于使用这样的电子设备的实施例。在一些实施例中，电子设备可以是还包含其它功能诸如便携式电子设备，诸如手机、平板电脑、具备无线通讯功能的可穿戴电子设备(如智能手表)等。便携式电子设备的示例性实施例包括但不限于搭载
Figure PCTCN2020102032-appb-000001
或者其它操作系统的便携式电子设备。上述便携式电子设备也可以是其它便携式电子设备，诸如膝上型计算机(Laptop)等。还应当理解的是，在其他一些实施例中，上述电子设备也可以不是便携式电子设备，而是台式计算机。在一些实施例中，电子设备可以是智能家电，诸如智能音箱、智能家居设备。在一些实施例中，电子设备可以是车载设备、车辆等等。所述车载设备可以为智能驾驶计算平台或车载数据处理平台等具备处理能力的设备，前述的第一操作系统和第二操作系统运行在智能驾驶计算平台或车载数据处理平台上。所述智能驾驶计算平台或车载数据处理平台可以为移动数据中心(mobile data center，MDC)。
示例性的，图3示出了电子设备300的结构示意图。电子设备300可以包括处理器310，外部存储器接口320，内部存储器323，通用串行总线(universal serial bus，USB)接口330，充电管理模块340，电源管理模块343，电池342，天线1，天线2，移动通信模块350，无线通信模块360，音频模块370，扬声器370A，受话器370B，麦克风370C，耳机接口370D，传感器模块380，按键390，马达393，指示器392，摄像头393，显示屏394，以及用户标识模块(subscriber identification module，SIM)卡接口395等。其中传感器模块380可以包括压力传感器380A，陀螺仪传感器380B，气压传感器380C，磁传感器380D，加速度传感器380E，距离传感器380F，接近光传感器380G，指纹传感器380H，温度传感器380J，触摸传感器380K，环境光传感器380L，骨传导传感器380M等。
可以理解的是，本申请实施例示意的结构并不构成对电子设备300的具体限定。在本申请另一些实施例中，电子设备300可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件或软件和硬件的组合的形式实现。示例性的，当所述电子设备300为智能驾驶计算平台时，所述电子设备300可以不包含传感器模块380、扬声器370A、受话器370B、麦克风370C等部件，而是通过有线或无线的形式与传感器模块380、扬声器370A、受话器370B、麦克风370C进行数据传输。
2、页表。
页表是一种特殊的数据结构，放在操作系统空间的页表区，保存的是虚拟地址到物理地址的映射。其中，逻辑地址指的是中央处理单元(central processing unit，CPU)所生成的地址，具体地CPU产生的逻辑地址被分为页号(p)和页偏移(d)，页号包含每个页在物理内存中的基址，用来作为页表的索引、页偏移与基址相结合，用来确定设备的物理内存地址；物理地址指的是内存单元所看到的地址。逻辑地址空间为2^m，且页大小为2^n，那么逻辑地址的高m－n位表示页号，低n位表示页偏移。实现从页号到物理块号 的地址映射。
逻辑地址转换成物理地址的过程是：用页号p去检索页表，从页表中得到该页的物理块号，把它装入物理地址寄存器中。同时，将页内地址d直接送入物理地址寄存器的块内地址字段中。这样，物理地址寄存器中的内容就是由二者拼接成的实际访问内存的地址，从而完成了从逻辑地址到物理地址的转换。
具体地，用固定大小的页来描述逻辑地址空间，用相同大小的页框来描述物理内存空间，由操作系统实现从逻辑页到物理页框的页面映射，同时负责对所有页的管理和进程运行的控制。
3、转换检测缓冲区(translation lookaside buffer，TLB)。
页表的缓存，TLB中每一行都保存着一个由单个页表项(page table entry，PTE)组成的块，这些块是当前最可能被访问到的页表项。如果页号在TLB中，得到帧号访问内存；否则从内存中的页表中得到帧号，将其存入TLB访问内存。
4、动态度量技术。
对内存中的进程和内核模块完整性进行度量，及时检测针对内存运行进程的恶意攻击。工作原理包括周期性/主动去度量操作系统运行时，内存中不变的部分，计算代表其完整性的哈希(hash)值，将该hash值与基准值做比较，据此判断是否有恶意攻击行为篡改了度量对象的内存映像。基线值可以通过进程首次加载到内存时的内存映像来计算，也可以通过离线的方式，根据应用程序对应的ELF文件来建立相应的基线值。
上文结合图1介绍了本申请实施例提供的第一操作系统访问第二操作系统资源的方法能够应用的场景，并结合图3详细介绍了本申请实施例中涉及的TEE OS和REE OS能够运行的电子设备。下面将结合附图详细介绍本申请实施例提供的第一操作系统访问第二操作系统资源的方法。
此外，为了便于理解本申请实施例，做出以下几点说明。
第一，在本申请中，“用于指示”可以包括用于直接指示和用于间接指示。当描述用于指示A时，可以包括该指示信息直接指示A或间接指示A，而并不代表该指示信息中一定包括有A。
用于指示的信息可以称为待指示信息，则具体实现过程中，对待指示信息进行指示的方式有很多种。例如，可以直接指示待指示信息，如待指示信息本身或者该待指示信息的索引等。也可以通过指示其他信息来间接指示待指示信息，其中该其他信息与待指示信息之间存在关联关系。还可以仅仅指示待指示信息的一部分，而待指示信息的其他部分则是已知的或者提前约定的。例如，还可以借助预先约定(例如协议规定)的各个信息的排列顺序来实现对特定信息的指示，从而在一定程度上降低指示开销。
第二，在本申请中第一、第二以及各种数字编号(例如，“#1”、“#2”)仅为描述方便进行的区分，并不用来限制本申请实施例的范围。例如，区分不同的操作系统等。
第三，在本申请中“保存”，可以是指的保存在一个或者多个存储器中。所述一个或者多个存储器，可以是单独的设置，也可以是集成在编码器、译码器、处理器、或通信装置中。所述一个或者多个存储器，也可以是一部分单独设置，一部分集成在编码器、译码器、处理器、或通信装置中。存储器的类型可以是任意形式的存储介质，本申请并不对此限定。
图4是本申请实施例提供的一种第一操作系统访问第二操作系统资源的方法的示意性流程图。执行主体包括第一操作系统和第二操作系统，从第一操作系统和第二操作系统之间的交互说明第一操作系统访问第二操作系统资源的方法。
本申请提供的第一操作系统访问第二操作系统资源的方法可以应用在图1所述的两个操作系统场景下，其中，第一操作系统和第二操作系统构成两个操作系统场景。可选地，第一操作系统和第二操作系统所属的体系架构一致，例如，第一操作系统和第二操作系统同属于x86体系架构，或者，第一操作系统和第二操作系统同属于ARM体系架构。
该第一操作系统访问第二操作系统资源的方法包括以下步骤中的全部或部分。
S110，第一操作系统初始化。
本申请实施例中第一操作系统初始化包括：
第一操作系统将第一操作系统中的内核页表和用户页表存储在低位地址空间的页表内存中。
应理解，本申请实施例中对于第一操作系统如何获得上述的内核页表和用户页表并不限制，可以参考目前协议的规定，第一操作系统中包括生成上述内核页表和用户页表的模块。
本申请实施例中涉及的内核页表包括存放在主内核页全局目录中的一段内存，硬件并不直接使用，内核页表中的内容为所有进程共享，内核页表由内核维护并更新。本申请实施例中涉及的用户页表包括每个进程各自的页表，放在进程的页目录中。
还应理解，本申请实施例中对于内核页表和用户页表的具体形式并不限制，可以参考目前协议中的描述，本申请实施例主要涉及存储页表的内存配置的寄存器。
第一操作系统将第一操作系统中的内核页表和用户页表存储在低位地址空间的页表内存之后，将低位地址空间的页表内存配置到第一寄存器，所述第一寄存器对应第一地址空间，第一操作系统基于第二操作系统的高位地址空间预留第二地址空间，其中，第一地址空间供用户和内核使用，第一地址空间和第二地址空间相异，第二地址空间为第一操作系统中虚拟地址空间中除已使用的第一地址空间之外的地址空间。
应理解，目前操作系统采用虚拟内存设计，以Linux系统为例，通常32位Linux内存虚拟地址空间划分0～3G为用户空间，3～4G为内核空间。其中，0～3G理解为低位地址空间、3～4G理解为高位地址空间，该高位地址空间供Linux系统内核使用，应用程序不可访问。低位地址空间供用户程序访问。
与目前操作系统不同的是，本申请实施例中的第一操作系统内核空间和用户空间均使用第一地址空间，第一地址空间理解为第一操作系统的内存虚拟地址空间中的低位地址空间，第一寄存器可以理解为低位地址空间对应的寄存器。第一操作系统将第二地址空间预留出来，未被第一操作系统的内核使用，第二地址空间理解为高位地址空间。也就是说第一操作系统在进行初始化的过程中，基于第二操作系统的虚拟地址空间中的高位地址空将第一操作系统的高位地址空间预留出来，例如，第二操作系统为32位Linux系统，则第二操作系统的虚拟地址空间划分0～3G为用户空间，3～4G为内核空间，在此情况下第一操作系统可以将第一操作系统的高位地址空间3～4G预留出来。
应理解，为了使得第一操作系统能够复用第二操作系统的内核页表的寄存器配置来对第一操作系统的改为地址空间对应的第二寄存器进行配置，第一操作系统的地址空间划分 与第二操作系统的地址空间划分应该一致。例如，第一操作系统和第二操的虚拟地址空间划分均为0～3G为低位地址空间，3～4G为高位地址空间，其中，第一操作系统和第二操作系统虚拟地址空间划分均为0～3G为低位地址空间，3～4G为高位地址空间只是举例，对本申请的保护范围并不构成任何限定，其他可能的系统低位地址空间和高位地址空间的划分可以参考现有的划分方式，本申请对此不再赘述。
进一步地，为了提高安全性能，当第一操作系统内核空间和用户空间均使用低位地址空间时，第一操作系统配置内核页表时，在内核页表条目上增加用户不可访问权限控制、第一操作系统配置用户页表时，在用户页表条目上增加不可执行特权(privileged execute never，PXN)防护，该PXN防护的目的是阻止内核执行用户代码。
为了使得第一操作系统能够访问第二操作系统的内核空间的资源，本申请实施例中第一操作系统能够获取第二操作系统的内核页表的寄存器配置信息。
作为一种可能的实现方式，第一操作系统主动获取第二操作系统的内核页表的寄存器配置信息。例如，第一操作系统中部署有获取模块，用于获取第二操作系统的内核页表的寄存器配置信息。
作为另一种可能的实现方式，第一操作系统接收来自第二操作系统的第二操作系统的内核页表的寄存器配置信息。例如，第一操作系统中部署有接收模块，用于接收第二操作系统的内核页表的寄存器配置信息。
进一步地，第一操作系统还可以获取第二操作系统的内核符号表信息，并解析内核符号表信息，得到的第二操作系统高位地址空间转换关系，获取用户进程的用户页表基地址信息，利用转换关系逐级读取用户页表条目内容，访问第二操作系统的用户空间的资源。其中，内核符号表信息包括用户进程内核栈的信息以及结构体偏移(进程的地址空间描述符(例如，代码段、数据段、堆栈、文件系统信息等等)、进程描述符)。根据内核栈的信息以及结构体偏移，获取用代码段或者数据段的地址范围。
可选地，为了使得第一操作系统能够获取第二操作系统的内核页表的寄存器配置信息和/或第二操作系统的内核符号表信息。第二操作系统中可以部署有内核驱动模块，该内核驱动模块用于获取第二操作系统的内核符号表信息、第二操作系统的内核页表的寄存器配置信息。
作为一种可能的实现方式，该内核驱动模块获取到上述的第二操作系统的内核符号表信息、第二操作系统的内核页表的寄存器配置信息之后，可以存储在第二操作系统本地存储模块中，使第一操作系统能够主动获取得到。
作为另一种可能的实现方式，该内核驱动模块获取到上述的第二操作系统的内核符号表信息、第二操作系统的内核页表的寄存器配置信息之后，可以发起主动请求，将获取的第二操作系统的内核符号表信息、第二操作系统的内核页表的寄存器配置信息通知给第一操作系统，则图4所示的方法流程还可以包括：
S120，第二操作系统向该第一操作系统发送请求消息。
该请求消息中携带上述的内核符号表信息和/或第二操作系统的内核页表的寄存器配置信息，该请求消息用于请求第一操作系统修改第一操作系统的寄存器配置。
具体地，由于请求消息中包括上述的第二操作系统的内核符号表信息和/或第二操作系统的内核页表的寄存器配置信息，第一操作系统接收到请求消息之后，可以基于接收到 的第二操作系统的内核页表的寄存器配置信息配置第一操作系统的寄存器配置，使得第一操作系统的高位地址空间对应的寄存器配置与第二操作系统的高位地址空间对应的寄存器配置相同，可以理解为第一操作系统的高位地址空间对应的寄存器配置复用第二操作系统的高位地址空间对应的寄存器配置。即图4所示的方法流程还包括：S130，第一操作系统配置寄存器。
作为一种可能的实现方式，在接收到上述的请求消息之前第一操作系统中部署客户端用户程序(client application，CA)，该CA基于接收到的第二操作系统的内核页表的寄存器配置信息配置第一操作系统的高位地址空间对应的寄存器配置；
作为另一种可能的实现方式，在接收到上述的请求消息之后第一操作系统中部署上述的CA，该CA基于接收到的第二操作系统的内核页表的寄存器配置信息配置第一操作系统的高位地址空间对应的寄存器配置；
作为又一种可能的实现方式，在接收到上述的请求消息时第一操作系统中部署上述的CA，该CA基于接收到的第二操作系统的内核页表的寄存器配置信息配置第一操作系统的高位地址空间对应的寄存器配置。
应理解，本申请实施例中对于第一操作系统何时部署上述的CA并不限制。
其中，第二操作系统的内核页表的寄存器配置包括地址翻译控制器、内存属性控制器、高位空间页表基地址寄存器等配置。当第一操作系统完成第一操作系统的高位地址空间对应的寄存器配置之后，第一操作系统与第二操作系统具有相同的高位空间页表基地址寄存器配置。
可选地，第一操作系统接收到请求消息之后，可以获取第二操作系统的内核符号表信息，第一操作系统可以存储上述的第二操作系统的内核符号表信息。
具体地，当第一操作系统根据第二操作系统的内核页表的寄存器配置信息配置第一操作系统的高位地址空间对应的第二寄存器的情况下，第一操作系统启用高位地址空间之后，第一操作系统拥有直接访问第二操作系统内核空间的资源的权限，可以访问和第二操作系统同样的高位地址空间。
当第一操作系统接收到上述的内核符号表信息之后，能够得到的第二操作系统高位地址空间转换关系，获取用户进程的用户页表基地址信息，利用转换关系逐级读取用户页表条目内容，访问第二操作系统的用户空间的资源。
为了便于直观地理解，结合图5详细说明上述的S110-S130所示的流程。图5是本申请实施例提供的一种第一操作系统访问第二操作系统资源的示意性框图。
可选地，以第一操作系统为ARM 64位体系的操作系统，第二操作系统为Linux OS为例，进一步说明上述的第一操作系统如何实现复用第二操作系统的寄存器配置。Linux OS通常将64位地址空间中0x0000-0000-0000-0000～0x0000-7fff-ffff-f000的128T地址用于用户空间，0xffff-8000～0000-0000为系统内核空间地址。
第一操作系统初始化时，将内核页表和用户页表存储在同一块连续内存中，将内存基址配置到TTBR0_EL1(低位空间页表基地址寄存器)中，内核空间和用户空间全部使用低位地址空间。具体地，第一操作系统配置内核页表时，增加用户态不可访问权限控制、配置用户页表，增加PXN防护；并且需要保证第一操作系统的高位地址空间范围与第二操作系统的内核地址空间保持一致(例如，保证第一操作系统的64位地址空间中 0xffff-8000～0000-0000为高位地址空间)。
进一步地，部署内核驱动模块到Linux OS中，用于获取Linux OS的内核符号表信息以及一些关键系统寄存器配置(内核页表相关的寄存器配置信息，例如，TCR_EL1(地址翻译控制器配置)，TTBR1_EL1(低位空间页表基地址寄存器)，MAIR_EL1(内存属性寄存器)等寄存器配置)，并将获取到的内核符号表信息以及一些关键系统寄存器配置发送给第一操作系统，使得第一操作系统复用第二操作系统的高位地址空间配置，因此第一操作系统可以访问第二操作系统高位地址空间范围数据。
X86体系的操作系统架构也类似，寄存器配置也需要保证本端操作系统(第一操作系统)高位地址空间范围需要与对端操作系统(第二操作系统)的内核地址空间范围保持一致。寄存器名字可能和ARM体系的操作系统架构存在差别，但是原理是一样的，本申请对此不再赘述。
进一步地，第一操作系统可以以软件(软件关系：Table_Entry[(VA>>(39-Level*9))&0x1FF]，Level为页表级别)的形式访问第二操作系统用户页表资源，即图4所示的方法流程还包括S140：第一操作系统访问第二操作系统用户页表资源。
具体地，第一操作系统以遍历的方式访问第二操作系统用户页表资源。下面以一个具体的例子说明第一操作系统访问第二操作系统用户页表资源的具体流程。如图6所示，图6是本申请实施例提供的一种用户页表访问的流程示意图。假设第二操作系统是四级分页机制：PGD包含若干PUD的地址、PUD包含若干PMD的地址、PMD包含若干PTE的地址，每一个PTE指向一个页框。第一操作系统需要访问某个VA对应的物理页框内容。具体访问流程如下：
首先，第一操作系统利用已有的高位地址转换关系(无需像前文中所示的拷贝第二操作系统的页表资源)，获取到第二操作系统中的用户进程PGD对应的VA，根据进该VA的偏移以及利用PGD[(VA>>(39-3*9))&0x1FF]读取一级页表条目的条目内容，确定该条目内容对应的包含该VA在内的二级页表条目(PUD条目物理地址)。其次，判断该二级页表条目是否是有效条目，如果是有效条目则，利用PUD[(VA>>(39-2*9))&0x1FF]，获取到该二级页表条目物理地址，逐级最后可以获取进程代码段对应的真实页框。最后，利用第二操作系统高位地址线性关系对PTE页框做虚实转换，第一操作系统就可以访问第二操作系统虚拟地址的内容；整体只需要4步简单线性转换，就可以快速获取到第二操作系统具体的物理页框上资源。即用户页表资源访问，第一操作系统可以通过软件快速索引方式快速访问。
第一操作系统通过地址总线可以访问连接在地址总线上的所有外设，包括物理内存、IO设备等等，但从第一操作系统发出的访问地址并非是这些外设在地址总线上的物理地址，而是一个虚拟地址，由MMU将虚拟地址转换成物理地址再从地址总线上发出，MMU上的这种虚拟地址和物理地址的转换关系是需要创建的，当没有创建一个虚拟地址到物理地址的映射或者程序设计不当导致访问了非法地址，MMU将会通知第一操作系统产生一个缺页异常。
本申请实施例中当第一操作系统访问所述第二操作系统的资源异常时，所述第一操作系统将所述异常相关信息发送给所述第二操作系统，具体地第一操作系统中部署有远端程序调录(remote procedure call，RPC)服务，该RPC服务将所述异常相关信息发送给所述 第二操作系统。
例如，当第一操作系统访问第二操作系统用户进程，软件快速索引用户页框时，访问到空条目，第一操作系统无法正常读取第二操作系统应用程序内容。此时第一操作系统需要额外设计缺页处理机制。如图7所示，图7是本申请实施例提供的一种缺页异常处理流程示意图。
第一操作系统中部署有RPC服务，第一操作系统中的CA程序借助RPC服务将缺页异常RPC请求透传回第二操作系统，并主动传递缺页进程号，及缺页对应的虚拟地址；第二操作系统收到来自第一操作系统的RPC请求后，利用第二操作系统缺页处理程序，设置相关的内存页后，并将内存页锁住在内存中，回复第一操作系统的RPC请求。第一操作系统中的CA根据第二操作系统返回的结果，进行后续相应处理，如果第二操作系统返回结果成功，那么第二操作系统就可以正常访问该用户进程资源，否则拒绝访问。
还例如，第一操作系统访问某地址出现数据终止异常(data abort exception)时，第一操作系统需要设计异常处理机制。如图8所示，图8是本申请实施例提供的一种异常处理流程示意图。第一操作系统进行异常处理，首先需要分析地址来源，如果是第一操作系统地址访问错误，则进入第一操作系统异常处理程序中处理，否则借助RPC服务，路由回第二操作系统中处理，交由第二操作系统处理。
作为一种可能的实现方式，图4所示的方法可以用用在图1所示的异操作系统中，具体地图1所示的异操作系统对应的软件操作系统如图9所示，图9是本申请实施例提供的一种操作系统软件示意性框图。其中，符号起始的块(block started by symbol，BSS)段：通常是指用来存放程序中未初始化的全局变量的一块内存区域。BSS段属于静态内存分配。
数据段(data segment)：通常是指用来存放程序中已初始化的全局变量的一块内存区域。数据段属于静态内存分配。
代码段(code segment/text segment)：通常是指用来存放程序执行代码的一块内存区域。这部分区域的大小在程序运行前就已经确定，并且内存区域通常属于只读某些架构也允许代码段为可写，即允许修改程序。在代码段中，也有可能包含一些只读的常数变量，例如字符串常量等。
堆栈：用户存放程序临时创建的局部变量，可以把堆栈看成一个寄存、交换临时数据的内存区，由操作系统分配的，内存的申请与回收都由系统管理。
BIN文件是原始二进制(raw binary)文件，这种文件只包含机器码。ELF文件除了机器码外，还包含其它额外的信息，如段的加载地址，运行地址，重定位表，符号表等。本申请中对于操作系统软件具体划分并不限定，可以参考目前两个操作系统的软件划分。
上述操作系统软件分为两个域：安全域和非安全域，其中，安全域对应安全隔离操作系统，非安全域对应主流操作系统。安全隔离操作系统中可以部署动态度量(dynamic integrity measurement，DIM)模块，本申请实施例中安全隔离操作系统可以称为本端操作系统，也可以称为第一操作系统、主流操作系统可以称为对端操作系统，也可以称为第二操作系统。也就是说本申请中的第一操作系统中可以部署有动态度量模块，为第二操作系统提供安全防护。本申请提供的第一操作系统访问第二操作系统资源的方法可以应用在自动驾驶领域，例如，第二操作系统和用户进行交互，软件安全服务访问部署在第一操作系 统中。
应理解，上述方法实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
上面结合图4-图9详细介绍了本申请实施例提供的第一操作系统访问第二操作系统资源的方法，下面结合图10-图13详细介绍本申请实施例提供的第一操作系统访问第二操作系统资源的装置。
参见图10，图10是本申请提出的第一操作系统访问第二操作系统资源的装置10的示意图。如图10所示，装置10包括处理单元110和接收单元120。
处理单元110，用于在所述第一操作系统的第一地址空间配置所述第一操作系统的内核空间和用户空间，为所述第二操作系统预留第二地址空间，其中，所述第一操作系统的内存虚拟地址空间包括所述第一地址空间和所述第二地址空间；
接收单元120，用于获取所述第二操作系统的内核页表的寄存器配置信息；
所述处理单元110，还用于根据所述第二操作系统的内核页表的寄存器配置信息配置所述第一操作系统的第二寄存器，所述第二寄存器对应所述第一操作系统的所述第二地址空间；
所述处理单元110，还用于使用所述第二地址空间访问所述第二操作系统的内核空间的资源。
装置10和方法实施例中的第一操作系统完全对应，装置10可以是方法实施例中的第一操作系统，或者方法实施例中的第一操作系统内部的芯片或功能模块。装置10的相应单元用于执行图4所示的方法实施例中由第一操作系统执行的相应步骤。
其中，装置10中的处理单元110执行方法实施例中第一操作系统内部实现或处理的步骤。例如，执行图4中初始化的步骤S110、还用于执行图4中配置寄存器的步骤S130。
接收单元120执行方法实施例中第一操作系统接收的步骤。例如，执行图4中接收来自第二操作系统的请求消息的步骤S120。
装置10还可以包括发送单元，用于执行第一操作系统发送的步骤，例如，向其他设备发送信息。发送单元和接收单元120可以组成收发单元，同时具有接收和发送的功能。其中，处理单元110可以是处理器。发送单元可以是发射器，接收单元120可以是接收器。接收器和发射器可以集成在一起组成收发器。
参见图11，图11是适用于本申请实施例的第一操作系统的结构示意图。该第一操作系统可应用于图1所示出的两个操作系统中。为了便于说明，图11仅示出了第一操作系统的主要部件。如图11所示，第一操作系统包括处理器1110(对应于图10中所示的处理单元110)、存储器1120、收发器1130(对应于图10中所示的接收单元120)。处理器用于控制收发器收发信息，存储器用于存储计算机程序，处理器用于从存储器中调用并运行该计算机程序，以执行本申请提出的第一操作系统访问第二操作系统资源的方法中由第一操作系统执行的相应流程和/或操作。此处不再赘述。
本领域技术人员可以理解，为了便于说明，图11仅示出了一个存储器和处理器。在实际的第一操作系统中，可以存在多个处理器和存储器。存储器也可以称为存储介质或者存储设备等，本申请实施例对此不做限制。
参见图12，图12是本申请提出的第一操作系统访问第二操作系统资源的装置20的示意图。如图12所示，装置20包括处理单元210和发送单元220。
处理单元210，用于获取所述第二操作系统的内核页表的寄存器配置信息；
发送单元220，用于向所述第一操作系统发送所述第二操作系统的内核页表的寄存器配置信息。
装置20和方法实施例中的第二操作系统完全对应，装置20可以是方法实施例中的第二操作系统，或者方法实施例中的第二操作系统内部的芯片或功能模块。装置20的相应单元用于执行图4所示的方法实施例中由第二操作系统执行的相应步骤。
其中，装置20中的发送单元220执行方法实施例中第二操作系统发送的步骤。例如，执行图4中向第一操作系统发送请求消息的步骤S120。
装置20中的处理单元210执行方法实施例中第二操作系统内部实现或处理的步骤。
装置20还可以包括接收单元，用于执行第二操作系统接收的步骤，例如，接收其他设备发送的信息。接收单元和发送单元210可以组成收发单元，同时具有接收和发送的功能。其中，处理单元110可以是处理器。发送单元210可以是发射器。接收单元可以是接收器。接收器和发射器可以集成在一起组成收发器。
参见图13，图13是适用于本申请实施例的第二操作系统的结构示意图。该第二操作系统可应用于图1所示出的两个操作系统中。为了便于说明，图13仅示出了第二操作系统的主要部件。如图13所示，第一操作系统包括处理器1310(对应于图12中所示的处理单元210)、存储器1320、收发器1330(对应于图12中所示的发送单元220)。处理器用于控制收发器收发信息，存储器用于存储计算机程序，处理器用于从存储器中调用并运行该计算机程序，以执行本申请提出的第一操作系统访问第二操作系统资源的方法中由第一操作系统执行的相应流程和/或操作。此处不再赘述。
本申请实施例还提供一种电子设备，其包括前述的第一操作系统和第二操作系统。该电子设备还可以包括其他外设如图3所示，其中第一操作系统和第二操作系统均可以设置于处理器310中。
本申请还提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当该指令在计算机上运行时，使得计算机执行上述如图4所示的方法中第一操作系统执行的各个步骤。
本申请还提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当该指令在计算机上运行时，使得计算机执行上述如图4所示的方法中第二操作系统执行的各个步骤。
本申请还提供了一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行如图4所示的方法中第一操作系统执行的各个步骤。
本申请还提供了一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行如图4所示的方法中第二操作系统执行的各个步骤。
本申请还提供一种芯片，包括处理器。该处理器用于读取并运行存储器中存储的计算机程序，以执行本申请提供的第一操作系统访问第二操作系统资源的方法中由第一操作系统执行的相应操作和/或流程。可选地，该芯片还包括存储器，该存储器与该处理器通过电路或电线与存储器连接，处理器用于读取并执行该存储器中的计算机程序。进一步可选 地，该芯片还包括通信接口，处理器与该通信接口连接。通信接口用于接收需要处理的数据和/或信息，处理器从该通信接口获取该数据和/或信息，并对该数据和/或信息进行处理。该通信接口可以是该芯片上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。所述处理器也可以体现为处理电路或逻辑电路。
本申请还提供一种芯片，包括处理器。该处理器用于读取并运行存储器中存储的计算机程序，以执行本申请提供的第一操作系统访问第二操作系统资源的方法中由第二操作系统执行的相应操作和/或流程。可选地，该芯片还包括存储器，该存储器与该处理器通过电路或电线与存储器连接，处理器用于读取并执行该存储器中的计算机程序。进一步可选地，该芯片还包括通信接口，处理器与该通信接口连接。通信接口用于接收需要处理的数据和/或信息，处理器从该通信接口获取该数据和/或信息，并对该数据和/或信息进行处理。该通信接口可以是该芯片上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。所述处理器也可以体现为处理电路或逻辑电路。
应理解，上述的芯片也可以替换为芯片系统，这里不再赘述。
本申请中的术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计 算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
另外，本申请中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系；本申请中术语“至少一个”，可以表示“一个”和“两个或两个以上”，例如，A、B和C中至少一个，可以表示：单独存在A，单独存在B，单独存在C、同时存在A和B，同时存在A和C，同时存在C和B，同时存在A和B和C，这七种情况。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (31)

  1. 一种第一操作系统访问第二操作系统资源的方法，其特征在于，包括：
    在所述第一操作系统的第一地址空间配置所述第一操作系统的内核空间和用户空间，为所述第二操作系统预留第二地址空间，其中，所述第一操作系统的内存虚拟地址空间包括所述第一地址空间和所述第二地址空间；
    所述第一操作系统获取所述第二操作系统的内核页表的寄存器配置信息；
    所述第一操作系统根据所述第二操作系统的内核页表的寄存器配置信息配置所述第一操作系统的第二寄存器，所述第二寄存器对应所述第一操作系统的所述第二地址空间；
    所述第一操作系统使用所述第二地址空间访问所述第二操作系统的内核空间的资源。
  2. 根据权利要求1所述的方法，其特征在于，
    所述第一地址空间为高位地址空间；所述第二地址空间为低位地址空间，所述第一操作系统的高位地址空间与所述第二操作系统的内核地址空间范围一致。
  3. 根据权利要求1或2所述的方法，其特征在于，所述方法还包括：
    所述第一操作系统接收所述第二操作系统发送的内核符号表信息；
    所述第一操作系统解析所述内核符号表信息，得到的所述第二操作系统高位地址空间转换关系，获取用户进程的用户页表基地址信息，利用所述转换关系逐级读取用户页表条目内容，访问第二操作系统的用户空间的资源。
  4. 根据权利要求1-3中任一项所述的方法，其特征在于，在所述第一操作系统的第一地址空间配置所述第一操作系统的内核空间和用户空间包括：
    所述第一操作系统将所述第一操作系统中的内核页表和用户页表存储在所述第一地址空间的页表内存中；
    所述第一操作系统将所述第一地址空间的页表内存配置到所述第一操作系统的第一寄存器。
  5. 根据权利要求1-4中任一项所述的方法，其特征在于，为所述第二操作系统预留第二地址空间包括：所述第一操作系统基于所述第二操作系统的高位地址空间预留所述第二地址空间。
  6. 根据权利要求1-5中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一操作系统接收所述第二操作系统发送的请求消息，所述请求消息中携带内核符号表信息和所述第二操作系统的内核页表的寄存器配置信息。
  7. 根据权利要求1-6中任一项所述的方法，其特征在于，所述第一操作系统中部署客户端应用程序CA；
    所述第一操作为所述第二操作系统预留第二地址空间包括：
    所述CA初始化过程中，基于所述第二操作系统的内核页表的寄存器配置信息修改所述第一操作系统的寄存器的配置。
  8. 根据权利要求4所述的方法，其特征在于，所述第一操作系统将所述第一操作系统中的内核页表和用户页表存储在所述第一地址空间的页表内存中之前，所述方法还包括：
    所述第一操作系统在所述内核页表上增加用户不可访问权限控制；
    所述第一操作系统在所述用户页表上增加不可执行特权PXN防护。
  9. 根据权利要求1-8中任一项所述的方法，其特征在于，所述第二操作系统的内核页表的寄存器配置信息包括：
    地址翻译控制器配置信息、内存属性控制器配置信息和内核空间页表基地址寄存器配置信息。
  10. 根据权利要求1-9中任一项所述的方法，其特征在于，所述第一操作系统中部署有动态度量模块，所述动态度量模块用于为所述第二操作系统提供安全服务。
  11. 根据权利要求1-10中任一项所述的方法，其特征在于，当所述第一操作系统访问所述第二操作系统的内核空间的资源异常时，所述第一操作系统将所述异常相关信息发送给所述第二操作系统。
  12. 根据权利要求11所述的方法，其特征在于，所述第一操作系统中部署有远端程序调录RPC服务；
    所述第一操作系统将所述异常相关信息发送给所述第二操作系统包括：
    所述RPC服务将所述异常相关信息发送给所述第二操作系统。
  13. 一种第一操作系统访问第二操作系统资源的方法，其特征在于，包括：
    所述第二操作系统获取所述第二操作系统的内核页表的寄存器配置信息；
    所述第二操作系统向所述第一操作系统发送所述第二操作系统的内核页表的寄存器配置信息。
  14. 根据权利要求13所述的方法，其特征在于，所述方法还包括：
    所述第二操作系统获取所述第二操作系统的内核符号表信息；
    所述第二操作系统向所述第一操作系统发送所述内核符号表信息。
  15. 根据权利要求13或14所述的方法，其特征在于，所述第二操作系统中部署内核驱动模块；
    所述第二操作系统获取所述内核符号表信息和/或所述第二操作系统的内核页表的寄存器配置信息包括：
    所述内核驱动模块获取所述内核符号表信息和/或所述第二操作系统的内核页表的寄存器配置信息。
  16. 一种第一操作系统访问第二操作系统资源的装置，其特征在于，包括：
    处理单元，用于在所述第一操作系统的第一地址空间配置所述第一操作系统的内核空间和用户空间，为所述第二操作系统预留第二地址空间，其中，所述第一操作系统的内存虚拟地址空间包括所述第一地址空间和所述第二地址空间；
    接收单元，用于获取所述第二操作系统的内核页表的寄存器配置信息；
    所述处理单元，还用于根据所述第二操作系统的内核页表的寄存器配置信息配置所述第一操作系统的第二寄存器，所述第二寄存器对应所述第一操作系统的所述第二地址空间；
    所述处理单元，还用于使用所述第二地址空间访问所述第二操作系统的内核空间的资源。
  17. 根据权利要求16所述的装置，其特征在于，所述接收单元，还用于接收所述第 二操作系统发送的内核符号表信息；
    所述处理单元，还用于解析所述内核符号表信息，得到的所述第二操作系统高位地址空间转换关系，获取用户进程的用户页表基地址信息，利用所述转换关系逐级读取用户页表条目内容，访问第二操作系统的用户空间的资源。
  18. 根据权利要求16或17所述的装置，其特征在于，所述处理单元在所述第一操作系统的第一地址空间配置所述第一操作系统的内核空间和用户空间包括：
    所述处理单元，用于将所述第一操作系统中的内核页表和用户页表存储在所述第一地址空间的页表内存中。
  19. 根据权利要求16-18中任一项所述的装置，其特征在于，所述处理单元为所述第二操作系统预留第二地址空间包括：所述处理单元基于所述第二操作系统的高位地址空间预留所述第二地址空间。
  20. 根据权利要求16-19中任一项所述的装置，其特征在于，所述装置还包括：
    接收单元，用于接收所述第二操作系统发送的请求消息，所述请求消息中携带内核符号表信息和所述第二操作系统的内核页表的寄存器配置信息。
  21. 根据权利要求16-20中任一项所述的装置，其特征在于，所述装置中部署客户端应用程序CA；
    所述处理单元为所述第二操作系统预留第二地址空间包括：
    所述CA初始化过程中，所述处理单元基于所述第二操作系统的内核页表的寄存器配置信息修改所述第一操作系统的寄存器的配置。
  22. 根据权利要求21所述的装置，其特征在于，所述处理单元将所述第一操作系统中的内核页表和用户页表存储在所述第一地址空间的页表内存中之前，所述处理单元，还用于在所述内核页表上增加用户不可访问权限控制以及在所述用户页表上增加不可执行特权PXN防护。
  23. 根据权利要求16-22中任一项所述的装置，其特征在于，所述装置中部署有动态度量模块，所述动态度量模块用于为所述第二操作系统提供安全服务。
  24. 根据权利要求16-23中任一项所述的装置，其特征在于，当所述处理单元访问所述第二操作系统的资源异常时，所述装置还包括：
    发送单元，用于将所述异常相关信息发送给所述第二操作系统。
  25. 根据权利要求24所述的装置，其特征在于，所述装置中部署有远端程序调录RPC服务；
    所述发送单元将所述异常相关信息发送给所述第二操作系统包括：
    所述RPC服务将所述异常相关信息发送给所述第二操作系统。
  26. 一种第一操作系统访问第二操作系统资源的装置，其特征在于，包括：
    处理单元，用于获取所述第二操作系统的内核页表的寄存器配置信息；
    发送单元，用于向所述第一操作系统发送所述第二操作系统的内核页表的寄存器配置信息。
  27. 根据权利要求26所述的装置，其特征在于，所述处理单元，还用于获取所述第二操作系统的内核符号表信息；
    所述发送单元，还用于向所述第一操作系统发送所述内核符号表信息。
  28. 根据权利要求26或27所述的装置，其特征在于，所述装置中部署内核驱动模块；
    所述处理单元获取所述内核符号表信息和/或所述第二操作系统的内核页表的寄存器配置信息：
    所述内核驱动模块获取所述内核符号表信息和/或所述第二操作系统的内核页表的寄存器配置信息。
  29. 一种电子设备，其特征在于，包括如16-25中任一项所述的装置以及如26-28中任一项所述的装置。
  30. 一种计算机可读存储介质，其特征在于，包括：所述计算机可读介质存储有计算机程序；所述计算机程序在计算机上运行时，使得计算机执行权利要求1-15中任一项所述的方法。
  31. 一种芯片，其特征在于，包括通信接口、存储器和处理器，所述存储器用于存储计算机程序，所述处理器用于读取并执行所述存储器中存储器的所述计算机程序，使得所述芯片实现如权利要求1-15中任一项所述的方法。
PCT/CN2020/102032 2019-11-22 2020-07-15 第一操作系统访问第二操作系统资源的方法和装置 WO2021098244A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
JP2022529685A JP7443519B2 (ja) 2019-11-22 2020-07-15 第１のオペレーティングシステムが第２のオペレーティングシステムのリソースにアクセスするための方法及び装置
EP20890467.2A EP4053700A4 (en) 2019-11-22 2020-07-15 METHOD AND DEVICE FOR ENABLING A FIRST OPERATING SYSTEM TO ACCESS RESOURCES OF A SECOND OPERATING SYSTEM
KR1020227020341A KR20220093379A (ko) 2019-11-22 2020-07-15 제1 운영 체제가 제2 운영 체제의 리소스에 액세스하기 위한 방법 및 장치
US17/749,627 US12007906B2 (en) 2019-11-22 2022-05-20 Method and apparatus for first operating system to access resource of second operating system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911156149.8A CN111124664B (zh) 2019-11-22 2019-11-22 第一操作系统访问第二操作系统资源的方法和装置
CN201911156149.8 2019-11-22

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/749,627 Continuation US12007906B2 (en) 2019-11-22 2022-05-20 Method and apparatus for first operating system to access resource of second operating system

Publications (1)

Publication Number Publication Date
WO2021098244A1 true WO2021098244A1 (zh) 2021-05-27

Family

ID=70498040

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/102032 WO2021098244A1 (zh) 2019-11-22 2020-07-15 第一操作系统访问第二操作系统资源的方法和装置

Country Status (6)

Country Link
US (1) US12007906B2 (zh)
EP (1) EP4053700A4 (zh)
JP (1) JP7443519B2 (zh)
KR (1) KR20220093379A (zh)
CN (1) CN111124664B (zh)
WO (1) WO2021098244A1 (zh)

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111124664B (zh) 2019-11-22 2023-12-08 华为技术有限公司 第一操作系统访问第二操作系统资源的方法和装置
CN114091110A (zh) * 2020-08-04 2022-02-25 华为技术有限公司 一种完整性度量方法和完整性度量装置
CN112231124B (zh) * 2020-12-14 2021-03-19 支付宝(杭州)信息技术有限公司 基于隐私保护的应用间通信方法及装置
CN114691532A (zh) * 2020-12-30 2022-07-01 华为技术有限公司 内存访问方法、内存地址分配方法及装置
CN115437717A (zh) * 2021-06-01 2022-12-06 北京小米移动软件有限公司 跨操作系统的调用方法、装置及电子设备
CN113538207B (zh) * 2021-09-17 2022-03-01 北京鲸鲮信息系统技术有限公司 跨进程调用的图形渲染方法、装置、电子设备与存储介质
CN114090096B (zh) * 2022-01-21 2022-04-15 成都云祺科技有限公司 一种网络虚拟文件系统实现方法、系统及存储介质
CN115658560B (zh) * 2022-12-28 2023-03-14 北京紫光芯能科技有限公司 一种数据共享管理方法、装置、系统、电子设备及存储介质
CN115858251B (zh) * 2023-01-18 2023-05-16 苏州浪潮智能科技有限公司 一种基板控制单元控制方法、装置及电子设备和存储介质
CN116185902B (zh) * 2023-04-13 2023-08-01 阿里云计算有限公司 一种表切分方法、系统、电子设备及可读介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080065856A1 (en) * 2004-03-23 2008-03-13 Nec Corporation Multi-processor system and memory accessing method
CN102968342A (zh) * 2012-11-12 2013-03-13 华中科技大学 嵌入式平台下半虚拟化的快速切换客户操作系统的方法
CN105068859A (zh) * 2015-07-29 2015-11-18 上海谐桐信息技术有限公司 一种跨虚拟机的多服务调用方法及系统
CN110245001A (zh) * 2019-05-05 2019-09-17 阿里巴巴集团控股有限公司 数据隔离方法及装置、电子设备
CN111124664A (zh) * 2019-11-22 2020-05-08 华为技术有限公司 第一操作系统访问第二操作系统资源的方法和装置

Family Cites Families (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6697070B1 (en) * 1985-09-13 2004-02-24 Renesas Technology Corporation Graphic processing system
US6772419B1 (en) * 1997-09-12 2004-08-03 Hitachi, Ltd. Multi OS configuration system having an interrupt process program executes independently of operation of the multi OS
US7035963B2 (en) 2000-12-27 2006-04-25 Intel Corporation Method for resolving address space conflicts between a virtual machine monitor and a guest operating system
GB0226874D0 (en) * 2002-11-18 2002-12-24 Advanced Risc Mach Ltd Switching between secure and non-secure processing modes
JP2007507779A (ja) * 2003-10-01 2007-03-29 ジャルナ エスアー オペレーティングシステム
WO2006103687A1 (en) * 2005-03-31 2006-10-05 Hewlett-Packard Development Company L.P. Partitioned resource reallocation system and method
JP2014089644A (ja) 2012-10-31 2014-05-15 Toshiba Corp プロセッサ、プロセッサ制御方法及び情報処理装置
JP6129702B2 (ja) * 2013-09-24 2017-05-17 株式会社東芝 情報処理装置、情報処理システム、プログラム
WO2015176046A1 (en) * 2014-05-15 2015-11-19 Lynx Software Technologies, Inc. Systems and methods involving features of hardware virtualization, hypervisor, apis of interest, and/or other features
JP6181004B2 (ja) 2014-06-20 2017-08-16 株式会社東芝 メモリ管理装置、プログラム、及び方法
JP6130612B1 (ja) 2015-08-25 2017-05-17 株式会社Ｓｅｌｔｅｃｈ ハイパーバイザーを有するシステム
US10387681B2 (en) * 2017-03-20 2019-08-20 Huawei Technologies Co., Ltd. Methods and apparatus for controlling access to secure computing resources
US10438019B2 (en) * 2017-05-04 2019-10-08 Microsoft Technology Licensing, Llc Cross container user model
US11074114B1 (en) * 2017-12-29 2021-07-27 Virtuozzo International Gmbh System and method for executing applications in a non-native environment
US10599835B2 (en) * 2018-02-06 2020-03-24 Vmware, Inc. 32-bit address space containment to secure processes from speculative rogue cache loads
CN110348252B (zh) 2018-04-02 2021-09-03 华为技术有限公司 基于信任区的操作系统和方法
CN110874478B (zh) * 2018-08-29 2023-05-02 阿里巴巴集团控股有限公司 密钥处理方法及装置、存储介质和处理器

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080065856A1 (en) * 2004-03-23 2008-03-13 Nec Corporation Multi-processor system and memory accessing method
CN102968342A (zh) * 2012-11-12 2013-03-13 华中科技大学 嵌入式平台下半虚拟化的快速切换客户操作系统的方法
CN105068859A (zh) * 2015-07-29 2015-11-18 上海谐桐信息技术有限公司 一种跨虚拟机的多服务调用方法及系统
CN110245001A (zh) * 2019-05-05 2019-09-17 阿里巴巴集团控股有限公司 数据隔离方法及装置、电子设备
CN111124664A (zh) * 2019-11-22 2020-05-08 华为技术有限公司 第一操作系统访问第二操作系统资源的方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4053700A4

Also Published As

Publication number Publication date
CN111124664A (zh) 2020-05-08
US20220276968A1 (en) 2022-09-01
CN111124664B (zh) 2023-12-08
KR20220093379A (ko) 2022-07-05
US12007906B2 (en) 2024-06-11
JP7443519B2 (ja) 2024-03-05
EP4053700A1 (en) 2022-09-07
EP4053700A4 (en) 2022-11-23
JP2023503110A (ja) 2023-01-26

Similar Documents

Publication Publication Date Title
WO2021098244A1 (zh) 第一操作系统访问第二操作系统资源的方法和装置
EP3629540B1 (en) Apparatus and method for secure memory access using trust domains
US12019562B2 (en) Cryptographic computing including enhanced cryptographic addresses
US11748146B2 (en) Scalable virtual machine operation inside trust domains within the trust domain architecture
JP2019522298A (ja) コンピューティングデバイスのメモリ内のページに対するアクセス制御
US10705976B2 (en) Scalable processor-assisted guest physical address translation
US10140139B1 (en) Ensuring the privacy and integrity of a hypervisor
US20210026543A1 (en) Secure address translation services permission table for trust domain extensions
US9158690B2 (en) Performing zero-copy sends in a networked file system with cryptographic signing
CN109656886B (zh) 基于键值对的文件系统实现方法、装置、设备和存储介质
US11494523B2 (en) Direct memory access mechanism
EP4202702A1 (en) Method and apparatus to set guest physical address mapping attributes for trusted domain
US20230098288A1 (en) Apparatus and method for role-based register protection for tdx-io
US10705983B1 (en) Transparent conversion of common virtual storage
US20240202315A1 (en) Maintaining data confidentiality in shared computing environments

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20890467

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2022529685

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2020890467

Country of ref document: EP

Effective date: 20220601

ENP Entry into the national phase

Ref document number: 20227020341

Country of ref document: KR

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE