WO2023098536A1 - 一种运行进程的方法及装置 - Google Patents

一种运行进程的方法及装置 Download PDF

Info

Publication number
WO2023098536A1
WO2023098536A1 PCT/CN2022/133714 CN2022133714W WO2023098536A1 WO 2023098536 A1 WO2023098536 A1 WO 2023098536A1 CN 2022133714 W CN2022133714 W CN 2022133714W WO 2023098536 A1 WO2023098536 A1 WO 2023098536A1
Authority
WO
WIPO (PCT)
Prior art keywords
memory
kernel
page table
functional safety
partition
Prior art date
Application number
PCT/CN2022/133714
Other languages
English (en)
French (fr)
Inventor
陶喆
周海锋
代超
谭中平
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023098536A1 publication Critical patent/WO2023098536A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/08—Error detection or correction by redundancy in data representation, e.g. by using checking codes
    • G06F11/10—Adding special bits or symbols to the coded information, e.g. parity check, casting out 9's or 11's
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/08—Error detection or correction by redundancy in data representation, e.g. by using checking codes
    • G06F11/10—Adding special bits or symbols to the coded information, e.g. parity check, casting out 9's or 11's
    • G06F11/1004—Adding special bits or symbols to the coded information, e.g. parity check, casting out 9's or 11's to protect a block of data words, e.g. CRC or checksum
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/02—Addressing or allocation; Relocation
    • G06F12/08—Addressing or allocation; Relocation in hierarchically structured memory systems, e.g. virtual memory systems
    • G06F12/10—Address translation
    • G06F12/1009—Address translation using page tables, e.g. page table structures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G06F9/5061—Partitioning or combining of resources
    • G06F9/5077—Logical partitioning of resources; Management or configuration of virtualized resources
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • G06F9/544—Buffers; Shared memory; Pipes

Definitions

  • the present application relates to the field of computer technology, in particular to a method and device for running a process.
  • Embedded operating systems are inseparable from the Internet of Things, automotive electronics, industrial automation, military and aerospace fields that have strict requirements on real-time and reliability.
  • the existing architecture includes a secure computing base, a security system, a high-function security domain proxy, a Linux kernel, and a low-function security domain proxy Proxy.
  • the secure computing base runs on EL2 to provide security virtualization and isolation support, and supports some underlying resource sharing, and the high-function security domain ecological proxy Platform provides system call and page fault proxy capabilities after the system is running, and cooperates with the low-function security domain proxy Proxy provides the reuse of the existing Linux ecosystem for CORE-side data plane applications.
  • the secure computing base provides partition isolation for the upper two planes (control plane and data plane); the secure computing base and the high-function security domain ecological agent Platform jointly provide high performance for applications running in the data plane on the CORE side
  • QM environment the interactive pollution of the kernel-side environment
  • ASIL-D environment functional safety partition
  • the present application provides a method for running a process, the method is applied to a computer system in a smart car, the computer system includes a kernel and a functional safety partition, and the functional safety partition and the kernel are located at the same privilege Layer, the method includes: the kernel acquires the operation function data of the target process, the operation function data includes page table information, and the page table information indicates the mapping relationship between the virtual address and the physical address of the target process; The kernel migrates the running function data to the functional safety partition; the functional safety partition performs page table information reconstruction on the page table memory according to the page table information, wherein the page table memory is allocated to the The functional security partition is a physical space that cannot be accessed by the kernel; the functional security partition runs the target process in the functional security partition based on page table information in the page table memory.
  • the functional safety partition can reconstruct the page table information of the page table memory according to the page table information, and the page table memory is allocated to the functional safety partition and cannot be The physical space accessed by the kernel. That is to say, for the security process, the functional safety partition (ASIL-D environment) and the kernel (QM environment) can each save a copy of the same page table information, but the kernel (QM environment) cannot read and write the functional safety partition (ASIL-D environment). D environment), and the functional safety partition (ASIL-D environment) can read and write the page table information of the kernel (QM environment).
  • the page table information is stored on the kernel side, and the kernel side has the ability to access and modify the page table information, which causes the environment on the kernel side (QM environment) to functional safety partition (ASIL-D environment) cross-contamination.
  • QM environment environment on the kernel side
  • ASIL-D environment functional safety partition
  • the functional safety partition may verify the page table information, and pass the verification based on the page table information, and perform page table information on the page table memory according to the page table information refactor.
  • the verification includes at least one of the following: authorization verification, reliability verification, integrity verification, and data security verification.
  • functional security partitions can perform end-to-end information verification, and the verification process includes but is not limited to hash verification integrity, data information security verification, etc. If the verification fails, the functional safety partition will save the information to the log and report the abnormal scene, and the upper layer architecture will make a specific exception handling decision; if the verification is successful, the functional safety partition will be based on the initialization in the SEE environment of the high-function safety partition Reserve page table memory to reconstruct thread page table.
  • the SEE Stub after the SEE Stub receives a notification from the kernel (such as an interrupt), it can trigger the interrupt callback process of the migration event, start to check the data of the proxy channel, and check the page table information and process content information of the proxy channel and
  • the hash information preset in the high-function security domain SEE performs end-to-end integrity verification, and further performs legal reliability verification. If the verification fails, record the abnormal scene and report it to the upper layer architecture for exception handling decisions; if The verification is successful.
  • the reserved page table memory initialized by SEE Stub is used to reconstruct the page table of the security process in the high-function security domain environment.
  • the reserved page table memory can be managed through the bitmap data structure.
  • the functional security partition can reconstruct the page table information of the page table memory according to the page table information, and demap the stage2 mapping of the QM side to the secure process memory through the PEK interface that provides EL2 layer virtualization support relationship, to obtain memory function security protection on both physical and virtual memory levels.
  • the functional safety partition can ensure that the functional safety level of the ASIL-D environment is not compromised by QM, etc.
  • the cross-pollution of the system environment improves the security of the system.
  • the execution environment of the functional safety partition meets the safety level of Automotive Safety Integrity Level D (ASIL-D).
  • ASIL-D Automotive Safety Integrity Level D
  • shared memory (such as the proxy channel described in the above embodiments) needs to be used in the process of running functional data migration.
  • the running function data may be migrated to the functional safety partition through a shared memory, where the shared memory is memory shared by the kernel and the functional safety partition.
  • the kernel may store the running function data in the shared memory, and notify the functional safety partition, and then the functional safety partition may obtain the running function data from the shared memory.
  • operation information when the kernel performs read and write operations on the shared memory may be obtained, and a security status judgment is performed on the operation information.
  • SEE Skeleton can call the security registration interface provided by PEK to register the memory as a proxy channel, and record the read and write behavior of the channel by the QM environment, thereby providing protection for the cross-domain proxy channel structure, thereby improving System security.
  • operation information when the kernel performs read and write operations on the shared memory may be obtained, and a security status judgment is performed on the operation information.
  • SEE Skeleton can call the security registration interface provided by PEK to register the memory as a proxy channel, and record the read and write behavior of the channel by the QM environment, thereby providing protection for the cross-domain proxy channel structure, thereby improving System security.
  • the physical address of the target process is an address in the first memory in the computer system
  • the first memory is used to store data related to the functional safety process
  • the target process During execution of , the first memory is not accessible by the kernel.
  • a virtual address is allocated to the target process from the virtual address space, a physical address is allocated to the target process from the storage resources of the kernel, and then the target process is established.
  • a mapping relationship between a virtual address and a physical address (the mapping relationship may be referred to as page table information of the target process).
  • both the safety function process and the non-safety function process are stored in the same piece of memory on the kernel side.
  • the kernel still has the ability to access and modify the data related to the non-safety function process. The permissions cannot meet the security requirements of the security function partition.
  • the computer system may include a first memory and a second memory, the first memory is used to store data related to functional safety processes, and the second memory is used to store data related to non-functional safety processes Process-related data is isolated between the first memory and the second memory, and the first memory cannot be accessed by the kernel during the running of the target process.
  • the kernel when allocating the physical address for the target process, can allocate the physical address for the target process from the first memory, that is to say, the physical address of the target process is the first memory in the computer system address in, after the physical address is assigned to the target process, the first memory cannot be accessed by the kernel during the operation of the target process, that is, the kernel cannot access and modify the information in the first memory, However, only the second memory can be accessed and modified, thereby achieving isolation between the first memory and the second memory.
  • the loading of the safety function process uses physical memory isolation.
  • the memory is through the memory reserved and isolated based on the function safety memory node. Allocation to ensure the deployment of multi-functional security partitions.
  • the first memory is a first non-uniform memory access NUMA node
  • the second memory is a second NUMA node
  • the functional safety partition (such as SEE Stub) can combine the proxy channel (that is, the shared memory in the embodiment of this application) and the kernel (such as SEE Skeleton) to provide SEE data plane applications with high functional security ecological proxy capabilities.
  • the basic functions of the functional safety partition run in a complete ASIL-D self-contained environment.
  • the functional safety partition will trigger the agent pedestal capability of the initialized SEE Stub module, put the ecological requirements such as system calls, page faults, and maintenance and debugging exceptions on the agent channel, and notify the peer SEE Skeleton through the interrupt combined with the shadow thread to complete Peer proxy behavior, and SEE Skeleton puts the proxy results in the proxy channel, and SEE Stub will perform end-to-end verification on the returned proxy results.
  • the verification process includes but is not limited to basic authority verification, parameter verification, hashing It is hoped that the complete verification and data information security verification, etc., will be used in the follow-up according to the security mode of copying, verification and use.
  • the functional safety partition may be based on the fact that the target process needs to execute a target function during runtime, and the target function is configured to be executed by the kernel, and the information of the target function is passed to The kernel; the kernel invokes a shadow thread to execute the target function according to the information of the target function to obtain a processing result; the kernel transmits the processing result to the functional safety partition.
  • the target function is a system call
  • information about the target function is a context of the system call instruction.
  • the functional safety partition runs the target process and needs to call a system call instruction of the functional safety partition.
  • the functional safety partition can store the context of the system call instruction in the shared memory.
  • a functional safety partition can send a notification to the kernel indicating that a system call has occurred.
  • the kernel can read the context of the system call instruction from the shared memory; the kernel can call the system call instruction of the kernel to perform the system call according to the context of the system call instruction, and obtain the return value of the system call; the kernel can put the return value into the shared memory; the function is safe
  • the partition can read the return value of the system call from the shared memory, and use the return value to complete the system call process of the functional safety partition.
  • This embodiment can pass the context of the system call instruction between the functional safety partition and the kernel by sharing the memory. ecological compatibility.
  • the target function is a page fault exception
  • the information of the target function is a context of the page fault exception
  • a page fault occurs while the functional safety partition is running the target process.
  • Functional security partitions can store the context of page fault exceptions in shared memory.
  • the functional safety partition can send a notification to the kernel indicating that a page fault occurred.
  • the kernel can read the context of page fault exceptions from shared memory.
  • the kernel can call the page fault exception handling function in the kernel according to the context of the page fault exception, and handle the page fault exception according to the page fault exception handling function to obtain the processing result.
  • the kernel can write processing results to shared memory.
  • the functional safety partition reads the processing result of the page fault exception from the shared memory, and uses the processing result to complete the processing process of the page fault exception of the functional safety partition.
  • the context of the page fault exception can be transferred between the functional safety partition and the kernel, so that the page fault exception in the functional safety partition can be realized through the page fault exception handling process of the kernel, thereby This ensures the ecological compatibility of the functional safety partition and the kernel.
  • the functional safety partition verifies the processing result, passes the verification based on the processing result, and continues to execute the target process according to the processing result, thereby improving system security.
  • the kernel is specifically a secure execution environment framework (SEE skeleton); the functional safety partition is specifically a secure execution environment base (SEE stub).
  • SEE skeleton secure execution environment framework
  • SEE stub secure execution environment base
  • the present application provides a device for running a process.
  • the device is applied to a computer system in a smart car.
  • the computer system includes a kernel and a functional safety partition, and the functional safety partition and the kernel are located at the same privilege layers, the kernel includes:
  • An acquisition module configured to acquire operational function data of the target process, where the operational function data includes page table information, and the page table information indicates a mapping relationship between a virtual address and a physical address of the target process;
  • a first migration module configured to migrate the operational function data to the functional safety partition
  • the functional safety partition includes:
  • a page table reconstruction module configured to perform page table information reconstruction on the page table memory according to the page table information, wherein the page table memory is allocated to the functional safety partition and cannot be accessed by the kernel physical space;
  • a process running module configured to run the target process in the functional safety partition based on the page table information in the page table memory.
  • the device further includes: a verification module, configured to:
  • the page table information is verified, and the verification is passed based on the page table information, and the page table information is reconstructed for the page table memory according to the page table information.
  • the verification includes at least one of the following:
  • the execution environment of the functional safety partition meets the safety level of Automotive Safety Integrity Level D (ASIL-D).
  • ASIL-D Automotive Safety Integrity Level D
  • the first migration module is specifically configured to:
  • Migrating the running function data to the functional safety partition through a shared memory where the shared memory is memory shared by the kernel and the functional safety partition.
  • the acquisition module is also used to:
  • the physical address of the target process is an address in the first memory in the computer system
  • the first memory is used to store data related to the functional safety process
  • the target process During execution of , the first memory is not accessible by the kernel.
  • the computer system further includes a second memory, the second memory is used to store data related to non-functional safety processes, and the first memory is isolated from the second memory .
  • the first memory is a first non-uniform memory access NUMA node
  • the second memory is a second NUMA node
  • the functional safety partition further includes:
  • a second migration module configured to transfer information of the target function to the kernel based on the target process needing to execute a target function when running, the target function being configured to be executed by the kernel;
  • the kernel also includes:
  • a shadow thread module configured to call a shadow thread to execute the target function according to the information of the target function, so as to obtain a processing result
  • the first migration module is further configured to transfer the processing result to the functional safety partition.
  • the target function is a system call
  • the information of the target function is the context of the system call instruction
  • the target function is a page fault exception, and the information of the target function is the context of the page fault exception.
  • the verification module is also used to:
  • Verifying the processing result passing the verification based on the processing result, and continuing to execute the target process according to the processing result.
  • the kernel is specifically a secure execution environment framework (SEE skeleton); the functional safety partition is specifically a secure execution environment base (SEE stub).
  • SEE skeleton secure execution environment framework
  • SEE stub secure execution environment base
  • the present application provides a computer system, the computer system includes a memory and a processor, the memory is used to store computer-readable instructions (or called computer programs), and the processor is used to read the Computer-readable instructions to implement the method provided by any of the foregoing implementation manners.
  • the present application provides a computer storage medium, and the computer storage medium may be non-volatile.
  • Computer-readable instructions are stored in the computer storage medium, and when the computer-readable instructions are executed by a processor, the method provided by any of the foregoing implementation manners is implemented.
  • the present application provides a computer program product, the computer program product includes computer readable instructions, and when the computer readable instructions are executed by a processor, the method provided by any of the foregoing implementation manners is implemented.
  • An embodiment of the present application provides a method for running a process, the method is applied to a computer system in a smart car, the computer system includes a kernel and a functional safety partition, the functional safety partition and the kernel are located at the same privileged layer,
  • the method includes: the kernel acquires the operation function data of the target process, the operation function data includes page table information, and the page table information indicates the mapping relationship between the virtual address and the physical address of the target process;
  • the running function data is migrated to the functional safety partition;
  • the functional safety partition performs page table information reconstruction on the page table memory according to the page table information, wherein the page table memory is allocated to the function A security partition and a physical space that cannot be accessed by the kernel;
  • the functional security partition runs the target process in the functional security partition based on page table information in the page table memory.
  • the page table information is stored on the kernel side, and the kernel side has the ability to access and modify the page table information, which causes the environment on the kernel side (QM environment) to functional safety partition (ASIL-D environment) cross-contamination.
  • QM environment environment on the kernel side
  • ASIL-D environment functional safety partition
  • FIG. 1 is a schematic diagram of a system architecture of a terminal device provided by an embodiment of the present application
  • Fig. 2 is a schematic diagram of the structure of the automatic driving device provided by the embodiment of the present application.
  • Fig. 3 is a schematic diagram of the application framework provided by the embodiment of the present application.
  • Fig. 4 is a schematic diagram of an embodiment of a method for running a process provided by an embodiment of the present application
  • Fig. 5 is a schematic diagram of another embodiment of the method for running a process provided by the embodiment of the present application.
  • Fig. 6 is a schematic diagram of another embodiment of the method for running a process provided by the embodiment of the present application.
  • Fig. 7 is a schematic diagram of another embodiment of the method for running a process provided by the embodiment of the present application.
  • Fig. 8 is a schematic diagram of the software architecture provided by the embodiment of the present application.
  • Fig. 9 is a schematic diagram of an embodiment of a device for running a process provided by an embodiment of the present application.
  • Fig. 10 is a schematic structural diagram of a computer device provided by an embodiment of the present application.
  • FIG. 11 is another schematic structural diagram of a computer device provided by an embodiment of the present application.
  • plural means two or more.
  • the term “and/or” or the character “/” in this application is just an association relationship describing associated objects, indicating that there may be three relationships, for example, A and/or B, or A/B, which may indicate: A alone exists, both A and B exist, and B exists alone.
  • Executable file is a static concept. It is a file of some pre-compiled instructions and data sets. Executable file includes file header and binary execution code. Each process has a corresponding executable file. Executable file The script can include the ID of the process.
  • a process is a dynamic concept.
  • a process is an operation of a program in a computer on a certain data set, and is the basic unit for resource allocation and scheduling by the system.
  • the kernel is the most fundamental part of an operating system, the part of the software that provides many applications with secure access to computer hardware.
  • the kernel can be a Linux kernel.
  • the functional safety partition is also called the data plane environment (DPE).
  • DPE data plane environment
  • the functional safety partition is configured at the kernel layer and is located at the same privileged layer as the kernel.
  • the functional safety partition can be used to run processes of all applications, and can also be used to run processes of functional safety applications.
  • Functional safety applications refer to applications that have strict requirements on real-time and reliability (such as: automatic driving), usually based on data-driven applications or applications triggered by frequent events.
  • the running function data refers to the data supporting the running of the process, including the virtual address of the process, the mapping relationship between the virtual address and the physical address, and the context of the process.
  • a virtual address is also called a logical address, and is usually represented by an offset. If the logical space shared by all processes in the operating system is described as the entire virtual address space, then the entire virtual address space will have a starting value. Use this The starting value and the offset can determine the virtual address space that the target process can use.
  • the physical address is the address corresponding to the storage resource, and the physical address can also be represented by an offset.
  • the context of the process includes at least one of a data segment (data segment), a heap (heap), a stack (stack) and a register context of the process.
  • Register context refers to the values that a process writes to registers at runtime.
  • the task structure (task_struct) is a structure used to store the context of the process, which can be in the form of a table or in other forms.
  • System call The main function of the operating system is to manage hardware resources and provide a good environment for application developers to make applications more compatible.
  • the kernel provides a series of predetermined functions
  • the multi-kernel functions of are presented to the user through a set of interfaces called system calls.
  • the system call passes the request of the application program to the kernel, calls the corresponding kernel function to complete the required processing, and returns the processing result to the application program.
  • a page fault exception refers to an exception caused by a page fault.
  • the consistency check method may be a cyclic redundancy check (cyclic redundancy check, CRC).
  • CRC cyclic redundancy check
  • CRC is a commonly used verification method with error detection and error correction capabilities.
  • Vehicle operating system a collection of system programs running in the vehicle to manage hardware resources, hide internal logic, provide a software platform, provide user programs and system interaction interfaces, and provide basic services for upper-layer applications.
  • Electronic and electrical architecture organically integrate all hardware, software, sensors, actuators, and electronic and electrical distribution systems on the vehicle through system integration tools to realize software facilities, hardware facilities and efficient power and signal distribution systems.
  • Hypervisor An intermediate software layer that runs between the underlying physical server and the operating system, allowing multiple operating systems and applications to share hardware, also known as a virtual machine monitor.
  • Information Security Protecting the confidentiality, integrity, and availability of information, and protecting information systems from unauthorized access, use, disclosure, destruction, modification, inspection, recording, and destruction.
  • Trusted Computing Base Realize trusted functions including virtualization, provide features such as isolation, integrity, privacy, protection, and resilient recovery, and support a trusted underlying architecture built with different hardware capabilities.
  • Non-uniform memory access The access to physical memory in a multiprocessor system depends on the relative position between the processor and the memory, where the memory relatively close to the processor is called a local memory node; the memory relatively far away from the processor Known as a non-local memory node.
  • Integrity verification use hash algorithm and key to process the data to obtain the hash value protected by the secret key, and then send the hash value and data to the peer end. After the peer end receives the data, it checks the data Use the same hash algorithm and key to process the hash value. If the hash value obtained is the same as the sent one, it means that the data has not been tampered with.
  • a method for running a process provided by an embodiment of the present application can be applied to a terminal device or a computer system of a terminal device.
  • the terminal device also referred to as user equipment (UE)
  • UE user equipment
  • the equipment can be deployed on land, including indoor or outdoor, hand-held or vehicle-mounted; it can also be deployed on water (such as ships, etc.); it can also be deployed in the air (such as aircraft, balloons and satellites, etc.).
  • the terminal can be mobile phone (mobile phone), tablet computer (pad), computer with wireless transceiver function, virtual reality (virtual reality, VR) terminal, augmented reality (augmented reality, AR) terminal, industrial control (industrial control) Wireless terminals, wireless terminals in self driving, automatic driving devices, wireless terminals in remote medical, wireless terminals in smart grid, wireless in transportation safety Terminals, wireless terminals in smart cities, wireless terminals in smart homes, etc.
  • virtual reality virtual reality, VR
  • augmented reality augmented reality, AR
  • industrial control industrial control
  • Wireless terminals wireless terminals in self driving, automatic driving devices, wireless terminals in remote medical, wireless terminals in smart grid, wireless in transportation safety Terminals, wireless terminals in smart cities, wireless terminals in smart homes, etc.
  • the terminal device can be understood by referring to the system architecture shown in FIG. 1 .
  • the terminal device includes a user layer, a kernel layer, a management layer and a hardware layer.
  • applications there may be multiple applications (applications, APPs) in the user layer, and the multiple applications may include functional safety applications and ordinary applications, and ordinary applications are relative to functional safety applications. Applications other than functional safety applications may be referred to as normal applications.
  • the kernel layer includes the kernel and the functional safety partition. Common application processes run in the kernel, and functional safety application processes run in the functional safety partition. In order to ensure that the functional safety partition is compatible with the kernel's ecology, interaction between the functional safety partition and the kernel is possible. The operation of some functional safety applications is assisted by the kernel.
  • the management layer may include a virtual machine manager.
  • the virtual machine manager has higher privileges than the kernel layer and the user layer, and can manage the kernel layer, for example, configure the running function data of the process of the functional safety application to the functional safety partition.
  • the names of the user layer, kernel layer, and management layer may be slightly different.
  • EL0 is usually used to represent the user layer
  • EL1 is used to represent the kernel layer
  • EL2 is used to represent a higher privilege layer.
  • Ring3 is usually used to represent the user layer
  • Ring2 is used to represent the kernel layer
  • Ring1 is used to represent a higher privilege layer.
  • the hardware layer includes resources such as computing units, memory, and communication interfaces.
  • the hardware layer is used to provide hardware resources for the normal work of the user layer, kernel layer, and management layer.
  • the hardware layer may also include hardware such as radar and camera. Since more functional safety applications are involved in the field of automatic driving, the application of the present application in the automatic driving device 100 will be described below with reference to FIG. 2 .
  • the automatic driving device 100 includes a computer system 101, a display 109, an input device 117, a multimedia tray (media tray) 121, a transceiver 123 (which can send and/or receive radio communication signals), a sensor 153 and a camera 155 .
  • the computer system 101 includes a processor 103 , and the processor 103 is coupled to a system bus 105 .
  • the processor 103 may be one or more processors, where each processor may include one or more processor cores.
  • a display adapter (video adapter) 107, the display adapter 107 can drive a display 109, and the display 109 is coupled to the system bus 105.
  • the system bus 105 is coupled to an input-output (I/O) bus 113 through a bus bridge 111 .
  • the I/O interface 115 is coupled to the I/O bus.
  • the I/O interface 115 communicates with various I/O devices, such as an input device 117 (eg, keyboard, mouse, touch screen, etc.), a multimedia disk 121, such as a CD-ROM, and a multimedia interface.
  • Transceiver 123 as well as camera 155 (capable of capturing landscape and dynamic digital video images) and external USB port 125.
  • the interface connected to the I/O interface 115 may be a USB interface.
  • the processor 103 may be any conventional processor, including a Reduced Instruction Set Computing (“RISC”) processor, a Complex Instruction Set Computing (“CISC”) processor, or a combination thereof.
  • the processor may be a special purpose device such as an application specific integrated circuit (“ASIC").
  • the processor 103 may be a neural network processor (neural-network processing unit, NPU) or a combination of a neural network processor and the above traditional processors.
  • the processor 103 is mounted with a neural network processor.
  • Computer system 101 can communicate with software deployment server 149 through network interface 129 .
  • the network interface 129 is a hardware network interface, such as a network card.
  • the network 127 can be an external network, such as the Internet, or an internal network, such as Ethernet or a virtual private network (VPN).
  • the network 127 may also be a wireless network, such as a WiFi network, a cellular network, and the like.
  • a hard disk drive interface is coupled to the system bus 105 .
  • the hardware drive interface is connected with the hard disk drive.
  • System memory 135 is coupled to system bus 105 .
  • Data running in system memory 135 may include operating system 137 and application programs 143 .
  • the operating system 137 includes a functional security partition (DPE) 139 and a kernel (kernel) 141 .
  • DPE functional security partition
  • kernel kernel
  • Kernel 141 consists of those parts of the operating system that manage memory, files, peripherals, and system resources. Directly interacting with hardware, the operating system kernel usually runs processes and provides communication between processes, providing CPU time slice management, interrupts, memory management, IO management, and so on.
  • the application program 143 includes an automatic driving-related program 147, such as a positioning program, a planning program, and a perception program, etc., and the applications corresponding to these programs are all functional safety applications.
  • Application program 143 also exists on the system of software deployment server (deploying server) 149.
  • the computer system 101 can download the application program 143 from the software deployment server 149 when the application program 143 needs to be executed.
  • Sensor 153 is associated with computer system 101 .
  • Sensors 153 are used to detect the environment around computer system 101 .
  • the sensor 153 can detect animals, automobiles, obstacles and crosswalks, etc., and further sensors can also detect the surrounding environment of objects such as the above-mentioned animals, automobiles, obstacles and crosswalks, such as: the environment around the animals, for example, around the animals other animals, weather conditions, the brightness of the surrounding environment, etc.
  • the sensor may be a camera, an infrared sensor, a chemical detector, a microphone, and the like.
  • the sensor 153 senses information at preset intervals when activated and provides the sensed information to the computer system 101 in real time or near real time.
  • the computer system 101 is configured to determine the driving state of the automatic driving device according to the sensor data collected by the sensor 153, determine the driving operation required for automatic driving transposition according to the driving state and the current driving task, and send the driving operation to the control system Control commands corresponding to driving operations.
  • the driving state of the automatic driving device may include the driving conditions of the automatic driving device itself, such as the direction of the vehicle head, speed, position, acceleration, etc., as well as the state of the surrounding environment of the automatic driving device, such as the position of obstacles, the position and speed of other vehicles, and pedestrian crossings. location, traffic lights, etc.
  • Computer system 101 may include a task abstraction network and a shared policy network implemented by processor 103 .
  • the processor 103 determines the current automatic driving task; the processor 103 inputs at least one set of historical paths of the automatic driving task to the task abstraction network for feature extraction, and obtains a task feature vector representing the characteristics of the automatic driving task; processing The processor 103 determines the state vector representing the current driving state of the automatic driving device according to the sensor data collected by the sensor 153; the processor 103 inputs the task feature vector and the state vector to the shared strategy network for processing, and obtains the current driving state of the automatic driving device.
  • the autonomous driving device 100 may be a car, truck, motorcycle, bus, boat, airplane, helicopter, lawn mower, recreational vehicle, amusement park autonomous device, construction equipment, tram, golf cart, train, cart, etc. , the embodiments of the present application are not particularly limited.
  • the kernel layer of the operating system will include the above-mentioned functional safety partition.
  • the distributed electrical/electronic architecture (EEA) adopted by traditional automobiles cannot meet the needs of automobile development at the present stage due to insufficient computing power, insufficient communication bandwidth, and inconvenient software upgrades.
  • the upgrade of the EEA architecture based on component-defined vehicles has become the key to the development of intelligent networked vehicles.
  • the operating system is the soul of the development of the car ecosystem.
  • Highly changing requirements, on-board hardware, continuous evolution, and increased complexity of software systems pose severe challenges to the performance, ecology, usability, and reliability of the operating system.
  • the operation basis of the operating system in the vehicle environment is a heterogeneous distributed computing platform, which not only has the functions and characteristics of a safe operating system, but also provides high-performance, high-reliability sensors, distributed communication, and a general framework for autonomous driving to support multi-ecological modules. To support the common realization of autonomous driving perception, planning, decision-making, control and execution.
  • the existing architecture includes secure computing base PEK, security system CORE, high-function security domain proxy Platform, Linux Kernel and low-function security domain proxy Proxy, hardware modules: single-board V8A-cores, memory.
  • the secure computing base PEK runs on EL2 to provide secure virtualization and isolation support. It abstracts hardware resources such as CPU cores and memory and provides them to Linux Kernel and CORE systems according to allocation, and supports sharing of some underlying resources and high-function security domain ecological agents.
  • the Platform After the system is running, the Platform provides system call and page fault proxy capabilities, and cooperates with the low-function security domain proxy to provide multiplexing of the existing Linux ecosystem for CORE-side data plane applications.
  • partition isolation is provided for the upper two planes (control plane and data plane); PEK and Platform jointly provide a high-performance GuestEL1 operating environment for applications running in the data plane on the CORE side; Platform and Proxy jointly provide data plane
  • the application provides Linux proxy capabilities, making data plane applications compatible with the Linux ecosystem; PEK and Platform jointly provide data plane applications with security isolation at the same layer, solving performance, ecology, and underlying virtualization security issues, but there are still the following deficiencies: process page table Functional safety issues, the functional safety process page table is saved by the QM-level Linux Kernel, which does not meet functional safety; memory isolation problem, the physical memory of the functional safety process is not isolated from the normal process on the Linux side in the proxy process; migration and proxy security issues, not provided Security assurance for end-to-end verification of each process in the migration and proxy process.
  • FIG. 3 is an application architecture of an embodiment of the present application.
  • the architecture shown in FIG. 3 may include hardware foundations related to the embodiment of the present application: CPU (V8A-cores), memory.
  • the architecture shown in Figure 3 may include software modules related to the embodiment of the present application, and the functions of each module are as follows: NUMA memory structure and strategy divide the memory into reserved functional safety memory node1 and QM environment use memory node0;
  • a new secure execution environment (Secure Execution Environment, SEE) Skeleton module is added to the Kernel on the QM plane to provide proxy response capabilities on the QM side; a new SEE Stub is added to the SEE environment on the ASIL-D side for ASIL-D side proxy requests; the SEE Stub is reserved for functional safety applications Page table memory; SEE Stub performs end-to-end verification of the QM data passed through the proxy channel such as the SEE Skeleton agent execution results; SEE Stub uses the page table memory reserved for functional safety applications to reconstruct the functional safety application memory page table; PEK provides cross- Domain proxy channel structure protection, recording SEE Skeleton's read and write behavior on the channel, and end-to-end integrity and reliability verification by the high functional safety (ASIL-D) system domain to ensure the control information boundary.
  • SEE Secure Execution Environment
  • the embodiment of the present application provides a method for running a process executed by a device for running a process.
  • the device for running a process may be a computer system in a smart car, and the computer system includes a kernel and a functional safety partition.
  • the functional safety partition and the kernel are located at the same privileged layer.
  • the method for running a process provided by the embodiment of the present application includes:
  • the kernel acquires running function data of a target process, where the running function data includes page table information, and the page table information indicates a mapping relationship between a virtual address and a physical address of the target process.
  • the execution environment of the functional safety partition meets the safety level of Automotive Safety Integrity Level D (ASIL-D).
  • the kernel may specifically be a secure execution environment framework (SEE skeleton); the functional safety partition may specifically be a secure execution environment base (SEE stub).
  • the PEK underlying trusted computing base can be activated to provide secure virtualization.
  • the PEK can read the boot device tree binary file (device tree binary, DTB) to obtain hardware resource allocation, including but not limited to CPU core resources, memory resources, interrupts, and serial port information. These resources can be abstracted and consolidated by PEK and provide secure virtualization and isolation.
  • PEK pulls up SEE Skeleton according to resource allocation.
  • PEK can pull up the SEE Skeleton module with the obtained resource allocation, and the SEE Skeleton module is used as the QM surface component of the proxy process to initialize the proxy preparation at this time.
  • the PEK can pull up the functional safety partition (such as a high functional safety ASIL-D domain environment), or the SEE Skeleton module can pull up the functional safety partition.
  • PEK can pull up the SEE Stub module according to the obtained resource allocation.
  • the SEE Stub completes the initialization of the communication channel security structure, internal control structure, interrupt and reserved page table memory of the agent base, it pulls up the SEE high-function security module.
  • ASIL-D domain environment, and SEE completes subsequent initialization of high functional safety ASIL-D domain.
  • the kernel may receive a process start request, where the process start request is used to instruct to start a target process.
  • the process start request may be a request triggered when the system is started, or a request triggered when a user uses an application.
  • the kernel may execute the executable file of the target process in the kernel according to the process start request, and obtain the running function data supporting the running of the target process in the kernel.
  • the process start request may carry the identifier of the target process or the identifier of the application corresponding to the target process, so that the corresponding executable file can be found through the identifier of the process or the identifier of the corresponding application.
  • An executable file includes a file header and a binary execution code, and each process has a corresponding executable file, and the script of the executable file may include a process identifier.
  • the executable file executing the target process in the kernel refers to the binary execution code that executes the executable file in the environment of the kernel.
  • the header of the executable file may contain tag information, and the tag information may be a piece of special tag data, a character string, or a value.
  • the running function data may include the virtual address of the target process, the mapping relationship between the virtual address and the physical address, and the context of the target process, where the physical address is the physical address allocated by the target process in the storage resources of the kernel. address.
  • the executable file of the target process may be loaded according to the identifier of the target process and the identifier of the process included in the script of the executable file.
  • the executable file of the target process can be loaded into the memory corresponding to the kernel.
  • a task structure may be created in the kernel.
  • the task structure is used to store the context of the target process.
  • the task structure (task_struct) is a structure used to store the context of the target process in the kernel, which can be in the form of a table or in other forms. If the header of the executable file contains flag information, the device running the process adds an indication value to the task structure according to the flag information, and the indication value is used to indicate that the target process is a process of a functional safety application.
  • the indication value can be added to the identification bit of the functional safety application (DPE APP) of the task structure, and the indication value can be "1" or other values.
  • DPE APP functional safety application
  • the specific selection of the indication value The value is not limited in this application.
  • a virtual address is allocated to the target process from the virtual address space, a physical address is allocated to the target process from the storage resources of the kernel, and then the target process is established.
  • a mapping relationship between a virtual address and a physical address (the mapping relationship may be referred to as page table information of the target process).
  • both the safety function process and the non-safety function process are stored in the same piece of memory on the kernel side.
  • the kernel still has the ability to access and modify the data related to the non-safety function process. The permissions cannot meet the security requirements of the security function partition.
  • the computer system may include a first memory and a second memory, the first memory is used to store data related to functional safety processes, and the second memory is used to store data related to non-functional safety processes Process-related data is isolated between the first memory and the second memory, and the first memory cannot be accessed by the kernel during the running of the target process.
  • the kernel when allocating the physical address for the target process, can allocate the physical address for the target process from the first memory, that is to say, the physical address of the target process is the first memory in the computer system address in, after the physical address is assigned to the target process, the first memory cannot be accessed by the kernel during the operation of the target process, that is, the kernel cannot access and modify the information in the first memory, However, only the second memory can be accessed and modified, thereby achieving isolation between the first memory and the second memory.
  • the loading of the safety function process uses physical memory isolation.
  • the memory is through the memory reserved and isolated based on the function safety memory node. Allocation to ensure the deployment of multi-functional security partitions.
  • a memory (the first memory) is allocated for the functional safety partition separately.
  • the kernel does not occupy the memory and can monitor the high-function domain memory nodes. When an access attempt or abnormality occurs, the information is recorded and reported. A timely intrusion or failure response can be obtained, which improves the safety when the functional safety partition executes the target process.
  • the first memory is a first non-uniform memory access NUMA node (such as Node 1 in the embodiment of this application), and the second memory is a second NUMA node (such as the implementation of this application Node 0 in the example).
  • the SEE Skeleton module can load the preset NUMA memory allocation strategy on the code level based on the NUMA memory model, and perform integrity verification and reliability verification on the NUMA memory allocation strategy. After confirming the security of the strategy, SEE Skeleton The module will apply related policies as memory allocation for subsequent high-function security domain applications.
  • the NUMA-related configuration in DTB can be modified based on PEK pulling up QM, and a new memory node Node 1 is added, and the default configuration of the QM environment uses Memory Node 0.
  • the NUMA model of the memory is applied when the SEE Skeleton module is initialized, and its main data structure is mempolicy.
  • the structure example is as follows:
  • structmempolicypolicy_node1 (structmempolicy)
  • SEE Skeleton can register a proxy channel (the proxy channel can be a shared memory between SEE Skeleton and SEE stub).
  • SEE Skeleton can call the security registration interface provided by PEK to register the memory as a proxy channel, and record the read and write behavior of the channel by the QM environment to provide protection for the cross-domain proxy channel structure.
  • the sending and receiving of agent process information is end-to-end, and the security authority for sending and receiving information is defined according to the functional security level of the system domain.
  • the high-function security domain is trusted for the low-function security domain, and vice versa requires higher
  • the functional safety domain performs end-to-end verification.
  • the kernel migrates the running function data to the functional safety partition.
  • shared memory (such as the proxy channel described in the above-mentioned embodiments) needs to be used during the process of running functional data migration.
  • the running function data may be migrated to the functional safety partition through a shared memory, where the shared memory is memory shared by the kernel and the functional safety partition.
  • the kernel may store the running function data in the shared memory, and notify the functional safety partition, and then the functional safety partition may obtain the running function data from the shared memory.
  • operation information when the kernel performs read and write operations on the shared memory may be obtained, and a security status judgment is performed on the operation information.
  • SEE Skeleton can call the security registration interface provided by PEK to register the memory as a proxy channel, and record the read and write behavior of the channel by the QM environment, thereby providing protection for the cross-domain proxy channel structure, thereby improving System security.
  • the management program in the kernel can pull up the security process, reserve shadow threads in the QM environment, and allocate the stack segment memory of the shadow threads. Then SEE Skeleton preprocesses the page table information of the security process and puts it in the proxy channel. The shadow thread can be used as the response end of the proxy process.
  • the functional safety partition reconstructs the page table information on the page table memory according to the page table information, wherein the page table memory is a physical physical memory allocated to the functional safety partition and cannot be accessed by the kernel space.
  • the functional safety partition may perform an end-to-end verification on the running function data.
  • the functional safety partition may verify the page table information, and pass the verification based on the page table information, and perform page table information on the page table memory according to the page table information refactor.
  • the verification includes at least one of the following: authorization verification, reliability verification, integrity verification, and data security verification.
  • functional security partitions can perform end-to-end information verification, and the verification process includes but is not limited to hash verification integrity, data information security verification, etc. If the verification fails, the functional safety partition will save the information to the log and report the abnormal scene, and the upper layer architecture will make a specific exception handling decision; if the verification is successful, the functional safety partition will be based on the initialization in the SEE environment of the high-function safety partition Reserve page table memory to reconstruct thread page table.
  • the SEE Stub after the SEE Stub receives a notification from the kernel (such as an interrupt), it can trigger the interrupt callback process of the migration event, start to check the data of the proxy channel, and check the page table information and process content information of the proxy channel and
  • the hash information preset in the high-function security domain SEE performs end-to-end integrity verification, and further performs legal reliability verification. If the verification fails, record the abnormal scene and report it to the upper layer architecture for exception handling decisions; if The verification is successful.
  • the reserved page table memory initialized by SEE Stub is used to reconstruct the page table of the security process in the high-function security domain environment.
  • the reserved page table memory can be managed through the bitmap data structure.
  • the functional safety partition can reconstruct the page table information of the page table memory according to the page table information, and demap the QM side to the security process through the PEK interface that provides EL2 layer virtualization support.
  • the stage2 mapping relationship of the memory obtains memory function security protection at two levels of physical memory and virtual memory.
  • the functional safety partition can ensure that the functional safety level of the ASIL-D environment is not compromised by QM, etc.
  • the cross-pollution of the system environment improves the security of the system.
  • the functional safety partition can reconstruct the page table information of the page table memory according to the page table information, and the page table memory is allocated to the functional safety partition and cannot be The physical space accessed by the kernel. That is to say, for the security process, the functional safety partition (ASIL-D environment) and the kernel (QM environment) can each save a copy of the same page table information, but the kernel (QM environment) cannot read and write the functional safety partition (ASIL-D environment). D environment), and the functional safety partition (ASIL-D environment) can read and write the page table information of the kernel (QM environment).
  • the page table information is stored on the kernel side, and the kernel side has the ability to access and modify the page table information, which causes the environment on the kernel side (QM environment) to functional safety partition (ASIL-D environment) cross-contamination.
  • QM environment environment on the kernel side
  • ASIL-D environment functional safety partition
  • the page table structure of the security-related process is migrated from the QM environment to the ASIL-D environment (QM has a copy used by the proxy, but it does not have the ability to read and write to ASIL-D) and provides a complete Performance verification and reliability verification, which strengthens the application's virtual memory functional security capabilities, obtains ecological proxy capabilities and ASIL-D safe operation capabilities through QM copy page table information, and ensures the runtime virtual memory functional safety of security-related processes .
  • the functional safety partition runs the target process in the functional safety partition based on the page table information in the page table memory.
  • the functional safety partition (such as SEE Stub) can combine the proxy channel (that is, the shared memory in the embodiment of this application) and the kernel (such as SEE Skeleton) to provide SEE data plane applications with high functional security ecological proxy capabilities.
  • the basic functions of the functional safety partition run in a complete ASIL-D self-contained environment.
  • the functional safety partition will trigger the proxy base capability of the initialized SEE Stub module, put the ecological requirements such as system calls, page faults, and maintenance and debugging exceptions on the proxy channel, and notify the peer SEE Skeleton through the interrupt Combined with the shadow thread to complete the peer proxy behavior, and SEE Skeleton puts the proxy result in the proxy channel, SEE Stub will perform end-to-end verification on the returned proxy result.
  • the verification process includes but is not limited to basic authority verification, parameter Verification, hash integrity verification and data information security verification, etc., and will be used later in accordance with the security mode used for replication, verification and use.
  • the functional safety partition may be based on the fact that the target process needs to execute a target function during runtime, and the target function is configured to be executed by the kernel, and the information of the target function is passed to The kernel; the kernel invokes a shadow thread to execute the target function according to the information of the target function to obtain a processing result; the kernel transmits the processing result to the functional safety partition.
  • the target function is a system call
  • information about the target function is a context of the system call instruction.
  • the functional safety partition runs the target process and needs to call a system call instruction of the functional safety partition.
  • the functional safety partition can store the context of the system call instruction in the shared memory.
  • a functional safety partition can send a notification to the kernel indicating that a system call has occurred.
  • the kernel can read the context of the system call instruction from the shared memory; the kernel can call the system call instruction of the kernel to perform the system call according to the context of the system call instruction, and obtain the return value of the system call; the kernel can put the return value into the shared memory; the function is safe
  • the partition can read the return value of the system call from the shared memory, and use the return value to complete the system call process of the functional safety partition.
  • This embodiment can pass the context of the system call instruction between the functional safety partition and the kernel by sharing the memory. ecological compatibility.
  • the target function is a page fault exception
  • the information of the target function is a context of the page fault exception
  • a page fault occurs while the functional safety partition is running the target process.
  • Functional security partitions can store the context of page fault exceptions in shared memory.
  • the functional safety partition can send a notification to the kernel indicating that a page fault occurred.
  • the kernel can read the context of page fault exceptions from shared memory.
  • the kernel can call the page fault exception processing function in the kernel according to the context of the page fault exception, and perform page fault exception processing according to the page fault exception processing function to obtain the processing result.
  • the kernel can write processing results to shared memory.
  • the functional safety partition reads the processing result of the page fault exception from the shared memory, and uses the processing result to complete the processing process of the page fault exception of the functional safety partition.
  • the context of the page fault exception can be transferred between the functional safety partition and the kernel, so that the page fault exception in the functional safety partition can be realized through the page fault exception handling process of the kernel, thereby This ensures the ecological compatibility of the functional safety partition and the kernel.
  • the functional safety partition verifies the processing result, passes the verification based on the processing result, and continues to execute the target process according to the processing result, thereby improving system security.
  • An embodiment of the present application provides a method for running a process, the method is applied to a computer system in a smart car, the computer system includes a kernel and a functional safety partition, the functional safety partition and the kernel are located at the same privileged layer,
  • the method includes: the kernel acquires the operation function data of the target process, the operation function data includes page table information, and the page table information indicates the mapping relationship between the virtual address and the physical address of the target process;
  • the running function data is migrated to the functional safety partition;
  • the functional safety partition performs page table information reconstruction on the page table memory according to the page table information, wherein the page table memory is allocated to the function A security partition and a physical space that cannot be accessed by the kernel;
  • the functional security partition runs the target process in the functional security partition based on page table information in the page table memory.
  • the functional safety partition can reconstruct the page table information of the page table memory according to the page table information, and the page table memory is allocated to the functional safety partition and cannot be The physical space accessed by the kernel. That is to say, for the security process, the functional safety partition (ASIL-D environment) and the kernel (QM environment) can each save a copy of the same page table information, but the kernel (QM environment) cannot read and write the functional safety partition (ASIL-D environment). D environment), and the functional safety partition (ASIL-D environment) can read and write the page table information of the kernel (QM environment).
  • the page table information is stored on the kernel side, and the kernel side has the ability to access and modify the page table information, which causes the environment on the kernel side (QM environment) to functional safety partition (ASIL-D environment) cross-contamination.
  • QM environment environment on the kernel side
  • ASIL-D environment functional safety partition
  • the product implementation forms of the embodiments of the present application may be program codes included in the security virtualization architecture and multi-security level system software, and deployed on the hardware of the vehicle environment.
  • the program code of the embodiment of the present application exists in the PEK module of the runtime security virtualization architecture of the platform software, the SEE Skeleton module in the QM Kernel, the agent channel module and the SEE of the ASIL-D system. Inside a stub module, and outside an existing module. During operation, the program code of the embodiment of the present application runs on the hardware of the vehicle environment.
  • Figure 8 shows the implementation form of the present invention to deploy the security virtualization architecture and multi-security level system software on the vehicle environment hardware, where the part shown in the dotted line box is the newly added module based on the existing technology platform software in the embodiment of the present application Ability to achieve.
  • the embodiment of the present application designs the SEE Skeleton module (4012) under the QM system environment, and its internal NUMA model (4023) based on memory (4021) provides physical Memory isolation (4015) and data hashing and encryption (4016) capabilities; inside the proxy channel (4013), the present invention designs page table migration and ecological proxy (4017); in the ASIL-D environment SEE system domain, the present invention designs SEE Stub (4014), which internally provides data verification (4018) and reserved page table memory and page table reconstruction (4019) capabilities.
  • FIG. 9 it is a schematic structural diagram of a device for running a process provided by an embodiment of the present application.
  • the device 900 can be applied to a computer system in a smart car, and the computer system includes a kernel and a functional safety partition.
  • the functional safety partition Located at the same privilege level as the kernel, the kernel includes:
  • An acquiring module 901 configured to acquire operating function data of a target process, where the operating function data includes page table information, and the page table information indicates a mapping relationship between a virtual address and a physical address of the target process;
  • the first migration module 902 is configured to migrate the running function data to the functional safety partition
  • the functional safety partition includes:
  • the page table reconstruction module 903 is configured to reconstruct the page table information of the page table memory according to the page table information, wherein the page table memory is allocated to the functional safety partition and cannot be accessed by the kernel physical space;
  • a process running module 904 configured to run the target process in the functional safety partition based on the page table information in the page table memory.
  • the device further includes: a verification module, configured to:
  • the page table information is verified, and the verification is passed based on the page table information, and the page table information is reconstructed for the page table memory according to the page table information.
  • the verification includes at least one of the following:
  • the execution environment of the functional safety partition meets the safety level of Automotive Safety Integrity Level D (ASIL-D).
  • ASIL-D Automotive Safety Integrity Level D
  • the first migration module is specifically configured to:
  • Migrating the running function data to the functional safety partition through a shared memory where the shared memory is memory shared by the kernel and the functional safety partition.
  • the acquisition module is also used to:
  • the physical address of the target process is an address in the first memory in the computer system
  • the first memory is used to store data related to the functional safety process
  • the target process During execution of , the first memory is not accessible by the kernel.
  • the computer system further includes a second memory, the second memory is used to store data related to non-functional safety processes, and the first memory is isolated from the second memory .
  • the first memory is a first non-uniform memory access NUMA node
  • the second memory is a second NUMA node
  • the functional safety partition further includes:
  • a second migration module configured to transfer information of the target function to the kernel based on the target process needing to execute a target function when running, the target function being configured to be executed by the kernel;
  • the kernel also includes:
  • a shadow thread module configured to call a shadow thread to execute the target function according to the information of the target function, so as to obtain a processing result
  • the first migration module is further configured to transfer the processing result to the functional safety partition.
  • the target function is a system call
  • the information of the target function is the context of the system call instruction
  • the target function is a page fault exception, and the information of the target function is the context of the page fault exception.
  • the verification module is also used to:
  • Verifying the processing result passing the verification based on the processing result, and continuing to execute the target process according to the processing result.
  • the kernel is specifically a secure execution environment framework (SEE skeleton); the functional safety partition is specifically a secure execution environment base (SEE stub).
  • SEE skeleton secure execution environment framework
  • SEE stub secure execution environment base
  • FIG. 10 is a schematic diagram of a possible logical structure of a computer device 90 provided by an embodiment of the present application.
  • the computer device may be the terminal device described in the foregoing embodiments.
  • the computer device 90 includes: a processor system 901 , a communication interface 902 , a memory 903 and a bus 904 .
  • the processor system 901 may include a first processor and a second processor, the first processor corresponds to a core, and the second processor corresponds to a functional security partition. If the processor system is a processor, then the first processor is a processor core.
  • the second processor is another processor core.
  • the memory 903 may include a first memory and a second memory, the first memory corresponds to a kernel, and the second memory corresponds to a functional security partition.
  • the processor system 901 , the communication interface 902 and the memory 903 are connected to each other through the bus 904 .
  • the processor system 901 is used to control and manage the actions of the computer device 90 , for example, the processor system 901 is used to execute steps 401 to 404 in FIG. 4 .
  • the communication interface 902 is used to support the computer device 90 to communicate.
  • the memory 903 is used for storing program codes and data of the computer device 90 .
  • the processor system 901 may be a central processor system unit, a general processor system, a digital signal processor system, an application specific integrated circuit, a field programmable gate array or other programmable logic devices, transistor logic devices, hardware components or any of them combination. It can implement or execute the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor system can also be a combination of computing functions, for example, a combination of one or more microprocessor systems, a combination of a digital signal processor system and a microprocessor system, and the like.
  • the bus 904 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (Extended Industry Standard Architecture, EISA) bus or the like.
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the computer device 1000 includes: a hardware layer 1001 and a virtual machine (virtual machine, VM) layer 1002, where the VM layer may include one or more VMs.
  • the hardware layer 1001 provides hardware resources for the VM to support the running of the VM.
  • the functions of the VM and the processes related to the present application can be understood by referring to the corresponding descriptions in FIGS. 1 to 8 above.
  • the hardware layer 1001 includes hardware resources such as a processor, a communication interface, and a memory.
  • a computer-readable storage medium is also provided, and computer-executable instructions are stored in the computer-readable storage medium.
  • the device executes the above diagram. 1 to the method for running a process described in some embodiments in FIG. 8 .
  • a computer program product in another embodiment, includes computer-executable instructions, and the computer-executable instructions are stored in a computer-readable storage medium; Reading the storage medium reads the computer-executable instructions, and at least one processor executes the computer-executable instructions so that the device executes the method for running a process described in some embodiments in FIGS. 1 to 8 above.
  • a system-on-a-chip in another embodiment of the present application, includes a processor, and is configured to support an apparatus for running a process to implement the method for running a process described in some embodiments in FIGS. 1 to 8 above.
  • the system-on-a-chip may further include a memory, which is used to store necessary program instructions and data for the device running the process.
  • the system-on-a-chip may consist of chips, or may include chips and other discrete devices.
  • the disclosed system, device and method can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or integrated. to another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.
  • the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or part of the contribution to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to enable a computer device (which may be a personal computer, a server, or other network equipment, etc.) to execute all or part of the steps of the method described in the embodiment of FIG. 5 of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

Abstract

本申请实施例公开了一种运行进程的方法，方法包括：内核获取目标进程的运行功能数据，运行功能数据包括页表信息，页表信息指示目标进程的虚拟地址和物理地址的映射关系；内核将运行功能数据迁移到功能安全分区；功能安全分区根据页表信息对页表内存进行页表信息的重构，页表内存为被分配至功能安全分区且不可被内核访问的物理空间；功能安全分区基于页表内存中的页表信息，在功能安全分区运行目标进程。本申请针对安全进程，通过将进程的页表信息由内核侧传递至功能安全分区侧，且内核无法读写功能安全分区的页表信息，保障了功能安全分区的功能安全等级不被内核的交互污染，提高了系统的安全性。

Description

一种运行进程的方法及装置
本申请要求于2021年11月30日提交中国专利局、申请号为202111453393.8、发明名称为“一种运行进程的方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，具体涉及一种运行进程的方法及装置。
背景技术
随着信息技术的发展与芯片制造工艺的不断提高，嵌入式操作系统得到了广泛的发展与应用。对实时性和可靠性有严格要求的物联网、汽车电子、工业自动化、军事与航空航天等领域，都离不开嵌入式操作系统。
对实时性和可靠性有严格要求的应用(如：自动驾驶)通常是基于数据驱动的应用或频繁发生事件触发的应用。这些应用通常可以称为功能安全应用。无论是功能安全应用还是非功能安全应用，通常依赖宏内核(monolithic kernel)的嵌入式操作系统。
在现有的架构中，包括安全计算基座、安全系统和高功能安全域代理、Linux内核和低功能安全域代理Proxy。安全计算基座运行在EL2提供安全虚拟化和隔离支持，并支持部分底层资源共享，和高功能安全域生态代理Platform在系统运行后提供系统调用、缺页的代理能力，配合低功能安全域代理Proxy提供给CORE侧数据面应用Linux现有生态的复用。
现有技术中基于安全计算基座为上层两个平面(控制面和数据面)提供分区隔离；安全计算基座和高功能安全域生态代理Platform共同为CORE侧数据面中运行的应用提供高性能的Guest EL1运行环境；高功能安全域生态代理Platform和低功能安全域代理Proxy共同为数据面应用提供Linux代理能力，使得数据面应用能够兼容linux生态；安全计算基座和高功能安全域生态代理Platform共同为数据面应用提供同层安全隔离，解决性能、生态和底层虚拟化安全性问题，然而仍然存在如下不足：在现有的实现中，页表信息保存于内核侧，且内核侧针对于页表信息具备访问和修改的能力，造成了内核侧的环境(QM环境)对功能安全分区(ASIL-D环境)的交互污染，导致了系统的安全性较差。
发明内容
第一方面，本申请提供了一种运行进程的方法，所述方法应用于智能车中的计算机系统，所述计算机系统包括内核和功能安全分区，所述功能安全分区和所述内核位于同一特权层，所述方法包括：所述内核获取目标进程的运行功能数据，所述运行功能数据包括页表信息，所述页表信息指示所述目标进程的虚拟地址和物理地址的映射关系；所述内核将所述运行功能数据迁移到所述功能安全分区；所述功能安全分区根据所述页表信息对页表内存进行页表信息的重构，其中，所述页表内存为被分配至所述功能安全分区且不可被所述内核访问的物理空间；所述功能安全分区基于所述页表内存中的页表信息，在所述功能安全分区运行所述目标进程。
在一种可能的实现中，所述功能安全分区可以根据所述页表信息对页表内存进行页表信息的重构，且所述页表内存为被分配至所述功能安全分区且不可被所述内核访问的物理空间。也就是说，针对安全进程，功能安全分区(ASIL-D环境)和内核(QM环境)可以各自都保存一份相同的页表信息，而内核(QM环境)无法读写功能安全分区(ASIL-D环境)的页表信息，而且功能安全分区(ASIL-D环境)可读写内核(QM环境)的页表信息。
在现有的实现中，页表信息保存于内核侧，且内核侧针对于页表信息具备访问和修改的能力，造成了内核侧的环境(QM环境)对功能安全分区(ASIL-D环境)的交互污染。本申请实施例中，针对安全进程，通过将进程的页表信息由内核侧传递至功能安全分区侧，且内核(QM环境)无法读写功能安全分区(ASIL-D环境)的页表信息，保障了功能安全分区(ASIL-D环境)的功能安全等级不被内核(QM环境)的交互污染，提高了系统的安全性。
在一种可能的实现中，功能安全分区可以对所述页表信息进行校验，并基于所述页表信息通过所述校验，根据所述页表信息对页表内存进行页表信息的重构。
在一种可能的实现中，所述校验包括如下的至少一种：权限校验、可靠性校验、完整性校验和数据安全校验。
具体的，功能安全分区(例如SEE Stub)可以进行端到端的信息校验，校验流程包括但不限于哈希校验完整性，数据信息安全校验等。若校验失败，功能安全分区会保存信息到日志并进行异常场景上报，由更上层架构进行具体的异常处理决策；若校验成功，功能安全分区会在高功能安全分区SEE环境下基于初始化的预留页表内存重构线程页表。
在一种可能的实现中，SEE Stub收到来自内核的通知(例如中断)后，可以触发迁移事件的中断回调流程，开始检查代理信道的数据，对代理信道的页表信息和进程内容信息和高功能安全域SEE预置的哈希信息进行端到端的完整性校验，并进一步进行合法可靠性校验，若校验失败，则记录此次异常场景并上报上层架构进行异常处理决策；若校验成功，根据代理信道的数据，在高功能安全域环境下使用SEE Stub初始化的预留页表内存进行安全进程的页表重构，此预留页表内存可以通过bitmap数据结构进行管理。
在校验通过后，功能安全分区可以根据所述页表信息对页表内存进行页表信息的重构，并通过提供EL2层虚拟化支持的PEK接口解映射QM侧对安全进程内存的stage2映射关系，获得物理和虚拟内存两个层面上的内存功能安全保护。
本申请实施例中，功能安全分区可以通过对信息的端到端校验在多功能安全等级系统环境和协同场景下的诸多代理和交互流程中保障ASIL-D环境功能安全等级不被和QM等系统环境的交互污染，提高了系统的安全性。
在一种可能的实现中，所述功能安全分区的执行环境满足汽车安全完整性D等级(ASIL-D)的安全等级。
在一种可能的实现中，因为内核与功能安全分区的物理资源是隔离的，在运行功能数 据迁移的过程中需要用到共享内存(例如上述实施例所描述的代理通道)。
具体的，可以将所述运行功能数据通过共享内存迁移到所述功能安全分区，所述共享内存为所述内核和所述功能安全分区共享的内存。例如，内核可以将运行功能数据存储至所述共享内存，并通知功能安全分区，进而功能安全分区可以从共享内存中获取所述运行功能数据。
在一种可能的实现中，可以获取在所述内核对所述共享内存进行读写操作时的操作信息，并对所述操作信息进行安全状态判断。示例性的，在本步骤中，SEE Skeleton可以调用PEK提供的安全注册接口将内存注册为代理信道，并记录QM环境对信道的读写行为，从而提供跨域代理信道结构的保护，进而提高了系统的安全性。
在一种可能的实现中，可以获取在所述内核对所述共享内存进行读写操作时的操作信息，并对所述操作信息进行安全状态判断。示例性的，在本步骤中，SEE Skeleton可以调用PEK提供的安全注册接口将内存注册为代理信道，并记录QM环境对信道的读写行为，从而提供跨域代理信道结构的保护，进而提高了系统的安全性。
在一种可能的实现中，所述目标进程的物理地址为所述计算机系统中第一内存中的地址，所述第一内存用于存储和功能安全进程相关的数据，且在所述目标进程的运行中，所述第一内存不可被所述内核访问。
在一种可能的实现中，在执行该目标进程的可执行文件过程中，还会从虚拟地址空间为目标进程分配虚拟地址，从内核的存储资源上为该目标进程分配物理地址，然后建立该虚拟地址和物理地址的映射关系(该映射关系可以称之为目标进程的页表信息)。
在现有的实现中，无论是安全功能进程还是非安全功能进程均存储在内核侧的同一片内存中，在目标进程在安全功能分区运行时，内核仍然具备访问和修改非安全功能进程相关数据的权限，并不能满足安全功能分区的安全性要求。
在一种可能的实现中，所述计算机系统可以包括第一内存和第二内存，所述第一内存用于存储和功能安全进程相关的数据，所述第二内存用于存储和非功能安全进程相关的数据，所述第一内存和所述第二内存之间隔离，在所述目标进程的运行中，所述第一内存不可被所述内核访问。
在一种可能的实现中，在为目标进程分配物理地址时，内核可以从第一内存中为目标进程分配物理地址，也就是说所述目标进程的物理地址为所述计算机系统中第一内存中的地址，在为目标进程分配了物理地址之后，在所述目标进程的运行中，所述第一内存不可被所述内核访问，也就是内核不可以访问以及修改第一内存中的信息，而仅可以访问和修改第二内存，进而实现了所述第一内存和所述第二内存之间的隔离。
本申请实施例中，安全功能进程的加载使用物理内存隔离，在加载功能安全相关进程(包括启动加载、缺页以及文件映射)时内存都通过基于功能安全内存结点预留且隔离的内存里分配，保障多功能安全分区部署存在运行时高功能安全应用的物理内存隔离，提高 了系统的安全性。
在一种可能的实现中，所述第一内存为第一非一致性内存访问NUMA节点，所述第二内存为第二NUMA节点。
在一种可能的实现中，功能安全分区(例如SEE Stub)可以结合代理信道(即本申请实施例中的共享内存)和内核(例如SEE Skeleton)提供SEE数据面应用高功能安全生态代理能力。
在一种可能的实现中，功能安全分区基本功能运行在完整的ASIL-D自包含环境中，当涉及到生态相关的需求(需要在内核一侧执行的需求，该需求无需很高的安全要求)时，功能安全分区会触发初始化的SEE Stub模块的代理基座能力，将系统调用、缺页和维测调试异常等生态需求置于代理信道，并由中断通知对端SEE Skeleton结合影子线程完成对端代理行为，并由SEE Skeleton将代理结果置于代理信道，SEE Stub会将返回的代理结果进行端到端的校验，校验流程包括但不限于基本的权限校验、参数校验、哈希完整校验和数据信息安全校验等，并按照复制、校验和使用的安全模式在后续进行使用。
在一种可能的实现中，所述功能安全分区可以基于所述目标进程在运行时需要执行目标功能，所述目标功能被配置为需要被所述内核执行，将所述目标功能的信息传递至所述内核；所述内核根据所述目标功能的信息，调用影子线程执行所述目标功能，以得到处理结果；所述内核将所述处理结果传递给所述功能安全分区。
在一种可能的实现中，所述目标功能为系统调用，所述目标功能的信息为所述系统调用指令的上下文。
在一种可能的实现中，功能安全分区运行目标进程，需要调用功能安全分区的系统调用指令。功能安全分区可以将系统调用指令的上下文存入共享内存。功能安全分区可以向内核发送通知，该通知用于指示发生系统调用。内核可以从共享内存读取系统调用指令的上下文；内核可以根据系统调用指令的上下文调用内核的系统调用指令进行系统调用，得到系统调用的返回值；内核可以将返回值放入共享内存；功能安全分区可以从共享内存将系统调用的返回值读取，并使用该返回值完成功能安全分区的系统调用过程。
该实施例通过共享内存，可以在功能安全分区与内核之间传递系统调用指令的上下文，这样，在功能安全分区的系统调用可以通过内核的系统调用过程来实现，从而确保了功能安全分区与内核的生态兼容。
在一种可能的实现中，所述目标功能为缺页异常，所述目标功能的信息为所述缺页异常的上下文。
在一种可能的实现中，功能安全分区运行目标进程时发生缺页异常。功能安全分区可以将缺页异常的上下文存入共享内存。功能安全分区可以向内核发送通知，该通知用于指示发生缺页异常。内核可以从共享内存读取缺页异常的上下文。内核可以根据缺页异常的上下文调用内核中缺页异常处理函数，以及根据缺页异常处理函数进行缺页异常处理，以 得到处理结果。内核可以将处理结果写入共享内存。功能安全分区从共享内存读取缺页异常的处理结果，并使用该处理结果完成功能安全分区的缺页异常得处理过程。
该实施例在发生缺页异常时，可以在功能安全分区与内核之间传递系缺页异常的上下文，这样，在功能安全分区的缺页异常可以通过内核的缺页异常处理过程来实现，从而确保了功能安全分区与内核的生态兼容。
在一种可能的实现中，所述功能安全分区对所述处理结果进行校验，并基于所述处理结果通过所述校验，根据所述处理结果继续执行所述目标进程，进而提高了系统的安全性。
在一种可能的实现中，所述内核具体为安全执行环境框架(SEE skeleton)；所述功能安全分区具体为安全执行环境基座(SEE stub)。
第二方面，本申请提供了一种运行进程的装置，所述装置应用于智能车中的计算机系统，所述计算机系统包括内核和功能安全分区，所述功能安全分区和所述内核位于同一特权层，所述内核包括：
获取模块，用于获取目标进程的运行功能数据，所述运行功能数据包括页表信息，所述页表信息指示所述目标进程的虚拟地址和物理地址的映射关系；
第一迁移模块，用于将所述运行功能数据迁移到所述功能安全分区；
所述功能安全分区包括：
页表重构模块，用于根据所述页表信息对页表内存进行页表信息的重构，其中，所述页表内存为被分配至所述功能安全分区且不可被所述内核访问的物理空间；
进程运行模块，用于基于所述页表内存中的页表信息，在所述功能安全分区运行所述目标进程。
在一种可能的实现中，所述装置还包括：校验模块，用于：
对所述页表信息进行校验，并基于所述页表信息通过所述校验，根据所述页表信息对页表内存进行页表信息的重构。
在一种可能的实现中，所述校验包括如下的至少一种：
权限校验、可靠性校验、完整性校验和数据安全校验。
在一种可能的实现中，所述功能安全分区的执行环境满足汽车安全完整性D等级(ASIL-D)的安全等级。
在一种可能的实现中，所述第一迁移模块，具体用于：
将所述运行功能数据通过共享内存迁移到所述功能安全分区，所述共享内存为所述内核和所述功能安全分区共享的内存。
在一种可能的实现中，所述获取模块，还用于：
获取在所述内核对所述共享内存进行读写操作时的操作信息，并对所述操作信息进行安全状态判断。
在一种可能的实现中，所述目标进程的物理地址为所述计算机系统中第一内存中的地址，所述第一内存用于存储和功能安全进程相关的数据，且在所述目标进程的运行中，所述第一内存不可被所述内核访问。
在一种可能的实现中，所述计算机系统还包括第二内存，所述第二内存用于存储和非功能安全进程相关的数据，且所述第一内存和所述第二内存之间隔离。
在一种可能的实现中，所述第一内存为第一非一致性内存访问NUMA节点，所述第二内存为第二NUMA节点。
在一种可能的实现中，所述功能安全分区还包括：
第二迁移模块，用于基于所述目标进程在运行时需要执行目标功能，所述目标功能被配置为需要被所述内核执行，将所述目标功能的信息传递至所述内核；
所述内核还包括：
影子线程模块，用于根据所述目标功能的信息，调用影子线程执行所述目标功能，以得到处理结果；
所述第一迁移模块，还用于将所述处理结果传递给所述功能安全分区。
在一种可能的实现中，所述目标功能为系统调用，所述目标功能的信息为所述系统调用指令的上下文；或者，
所述目标功能为缺页异常，所述目标功能的信息为所述缺页异常的上下文。
在一种可能的实现中，所述校验模块，还用于：
对所述处理结果进行校验，并基于所述处理结果通过所述校验，根据所述处理结果继续执行所述目标进程。
在一种可能的实现中，所述内核具体为安全执行环境框架(SEE skeleton)；所述功能安全分区具体为安全执行环境基座(SEE stub)。
第三方面，本申请提供一种计算机系统，所述计算机系统包括存储器和处理器，所述存储器用于存储计算机可读指令(或者称之为计算机程序)，所述处理器用于读取所述计算机可读指令以实现前述任意实现方式提供的方法。
第四方面，本申请提供一种计算机存储介质，该计算机存储介质可以是非易失性的。该计算机存储介质中存储有计算机可读指令，当该计算机可读指令被处理器执行时实现前述任意实现方式提供的方法。
第五方面，本申请提供一种计算机程序产品，该计算机程序产品中包含计算机可读指令，当该计算机可读指令被处理器执行时实现前述任意实现方式提供的方法。
本申请实施例提供了一种运行进程的方法，所述方法应用于智能车中的计算机系统，所述计算机系统包括内核和功能安全分区，所述功能安全分区和所述内核位于同一特权层，所述方法包括：所述内核获取目标进程的运行功能数据，所述运行功能数据包括页表信息，所述页表信息指示所述目标进程的虚拟地址和物理地址的映射关系；所述内核将所述运行功能数据迁移到所述功能安全分区；所述功能安全分区根据所述页表信息对页表内存进行页表信息的重构，其中，所述页表内存为被分配至所述功能安全分区且不可被所述内核访问的物理空间；所述功能安全分区基于所述页表内存中的页表信息，在所述功能安全分区运行所述目标进程。在现有的实现中，页表信息保存于内核侧，且内核侧针对于页表信息具备访问和修改的能力，造成了内核侧的环境(QM环境)对功能安全分区(ASIL-D环境)的交互污染。本申请实施例中，针对安全进程，通过将进程的页表信息由内核侧传递至功能安全分区侧，且内核(QM环境)无法读写功能安全分区(ASIL-D环境)的页表信息，保障了功能安全分区(ASIL-D环境)的功能安全等级不被内核(QM环境)的交互污染，提高了系统的安全性。
附图说明
图1是本申请实施例提供的终端设备的一系统架构示意图；
图2是本申请实施例提供的自动驾驶装置的一架构示意图；
图3是本申请实施例提供的应用架构的一示意图；
图4是本申请实施例提供的运行进程的方法的一实施例示意图；
图5是本申请实施例提供的运行进程的方法的另一实施例示意图；
图6是本申请实施例提供的运行进程的方法的另一实施例示意图；
图7是本申请实施例提供的运行进程的方法的另一实施例示意图；
图8是本申请实施例提供的软件架构的一示意图；
图9是本申请实施例提供的运行进程的装置的一实施例示意图；
图10是本申请实施例提供的计算机设备的一结构示意图；
图11是本申请实施例提供的计算机设备的另一结构示意图。
具体实施方式
下面结合附图，对本申请的实施例进行描述，显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。本领域普通技术人员可知，随着技术的发展和新场 景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或模块的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或模块，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或模块。在本申请中出现的对步骤进行的命名或者编号，并不意味着必须按照命名或者编号所指示的时间/逻辑先后顺序执行方法流程中的步骤，已经命名或者编号的流程步骤可以根据要实现的技术目的变更执行次序，只要能达到相同或者相类似的技术效果即可。
另外，在本发明的描述中，除非另有说明，“多个”的含义是两个或两个以上。本申请中的术语“和/或”或字符“/”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，或A/B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。
为了便于理解本申请实施例，下面对本申请实施例中涉及到的一些词语进行介绍。
可执行文件是一个静态的概念，它是一些预先编译好的指令和数据集合的一个文件，可执行文件包括文件头和二进制执行代码，每个进程都有相应的可执行文件，可执行文件的脚本中可以包括进程的标识。
进程则是一个动态的概念，进程是计算机中的程序关于某数据集合上的一次运行活动，是系统进行资源分配和调度的基本单位。
内核是操作系统最基本的部分，它是为众多应用程序提供对计算机硬件的安全访问的一部分软件。该内核可以为Linux内核。
功能安全分区也称为数据面环境(data plane evironment，DPE)，功能安全分区配置在内核层，与内核位于同一特权层。功能安全分区可以用于运行所有应用的进程，也可以用于运行功能安全应用的进程。
功能安全应用指的是对实时性和可靠性有严格要求的应用(如：自动驾驶)，通常是基于数据驱动的应用或频繁发生事件触发的应用。
运行功能数据指的是支持进程运行的数据，包括进程的虚拟地址、虚拟地址与物理地址的映射关系，以及该进程的上下文。
虚拟地址也称为逻辑地址，通常用偏移量来表示，如果将操作系统中所有进程所共用的逻辑空间描述为整个虚拟地址空间，那么该整个虚拟地址空间会有一个起始值，使用该起始值和偏移量就可以确定出该目标进程所能使用的虚拟地址空间。
物理地址是对应存储资源的地址，物理地址也可以通过偏移量来表示。
进程的上下文包括进程的数据段(data segment)、堆(heap)、栈(stack)和寄存器上下文中的至少一个。
寄存器上下文指的是进程在运行时写入到寄存器中的值。
任务结构体(task_struct)是用于存放进程的上下文的结构，可以是表的形式，也可以是其他形式。
系统调用(system call)：操作系统的主要功能是为管理硬件资源和为应用程序开发人员提供良好的环境来使应用程序具有更好的兼容性，为了达到这个目的，内核提供一系列具备预定功能的多内核函数，通过一组称为系统调用的接口呈现给用户。系统调用把应用程序的请求传给内核，调用相应的内核函数完成所需的处理，将处理结果返回给应用程序。
缺页异常指的是因缺页而引起的异常。
一致性校验的方法可以为循环冗余校验(cyclic redundancy check，CRC)。CRC是一种常用的、具有检错、纠错能力的校验方法。
车用操作系统：运行于车内的系统程序集合，以实现管理硬件资源、隐藏内部逻辑提供软件平台、提供用户程序与系统交互接口、为上层应用提供基础服务等功能。
电子电气架构：通过系统集成化工具有机地整合车上所有的硬件、软件、传感器、执行机构、电子电气分配系统到一起，实现软件设施、硬件设施和高效的动力和信号分配系统。
虚拟机管理程序：一种运行在基础物理服务器和操作系统之间的中间软件层，可允许多个操作系统和应用共享硬件，也被称为虚拟机监视器。
信息安全：保护信息的机密性、完整性、可用性，以及保护信息系统免受未经授权的进入、使用、披露、破坏、修改、检视、记录及销毁。
可信计算底座：实现包括虚拟化在内的可信功能，提供隔离性、完整性、私密性、保护、韧性恢复等特性，并且支持不同的硬件能力构建的可信底层架构。
非一致性内存访问：多处理器系统中物理内存的访问依赖于处理器和内存之间的相对位置的，其中和处理器相对近的内存被称作本地内存节点；和处理器相对远的内存被称为非本地内存节点。通过提供给程序不同的策略定义可以使用的内存，在一个节点上面分配地内存不会被移动到其他节点，提供较底层的内存预留和隔离。
完整性校验：使用哈希算法和密钥等对数据进行处理获得受秘钥保护的哈希值，然后将该哈希值和数据一块发送给对端，对端收到数据之后，对数据使用相同的哈希算法和密钥进行处理得到哈希值，如果得到的哈希值和发过来的相同，那么就说明数据没有经过篡改。
本申请实施例提供的一种运行进程的方法，可以应用于终端设备或终端设备的计算机系统中，该终端设备(也可以称为用户设备(user equipment，UE))是一种具有无线收发功能的设备，可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。终端可以是手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、自动驾驶装置、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。
该终端设备可以参阅图1所示的系统架构进行理解。如图1所示，该终端设备包括用户层、内核层、管理层和硬件层。
其中，用户层中可以有多个应用(application，APP)，多个应用中可以包括功能安全应用和普通应用，普通应用是相对于功能安全应用来说的。可以将除功能安全应用之外的应用称为普通应用。
内核层包括内核和功能安全分区，普通应用的进程在内核运行，功能安全应用的进程在功能安全分区运行，为了确保功能安全分区兼容内核的生态，可以在功能安全分区和内核之间进行交互，由内核辅助完成一些功能安全应用的操作。
管理层可以包括虚拟机管理器，该虚拟机管理器的特权高于内核层和用户层，可以对内核层进行管理，例如：将功能安全应用的进程的运行功能数据配置到功能安全分区。
在不同架构下，用户层、内核层和管理层的名称可能略有不同，例如：在ARM架构中通常用EL0来表示用户层，用EL1来表示内核层，用EL2来表示更高特权层。在X86架构中，通常用Ring3来表示用户层，用Ring2来表示内核层，用Ring1来表示更高特权层。
硬件层包括计算单元、存储器和通信接口等资源，硬件层用于为用户层、内核层和管理层正常工作提供硬件资源。
若该终端设备是自动驾驶装置，硬件层还可以包括雷达和摄像头等硬件。因为在自动驾驶领域会较多的涉及到功能安全应用，下面结合图2对本申请应用在自动驾驶装置100中的形态进行描述。
如图2所示，自动驾驶装置100包括计算机系统101、显示器109、输入设备117、多媒体盘(media tray)121、收发器123(可以发送和/或接受无线电通信信号)、传感器153和摄像头155。其中，计算机系统101包括处理器103，处理器103和系统总线105耦合。处理器103可以是一个或者多个处理器，其中，每个处理器都可以包括一个或多个处理器核。显示适配器(video adapter)107，显示适配器107可以驱动显示器109，显示器109和系统总线105耦合。系统总线105通过总线桥111和输入输出(I/O)总线113耦合。I/O接口115和I/O总线耦合。I/O接口115和多种I/O设备进行通信，比如输入设备117(如：键盘，鼠标，触摸屏等)，多媒体盘121，例如CD-ROM，多媒体接口等。收发器123以及摄像头155(可以捕捉景田和动态数字视频图像)和外部USB端口125。可选的，和I/O接口115相连接的接口可以是USB接口。
其中，处理器103可以是任何传统处理器，包括精简指令集计算(“RISC”)处理器、复杂指令集计算(“CISC”)处理器或上述的组合。可选的，处理器可以是诸如专用集成电路(“ASIC”)的专用装置。可选的，处理器103可以是神经网络处理器(neural-network processing unit，NPU)或者是神经网络处理器和上述传统处理器的组合。可选的,处理器103挂载有一个神经网络处理器。
计算机系统101可以通过网络接口129和软件部署服务器149通信。网络接口129是硬件网络接口，比如，网卡。网络127可以是外部网络，比如因特网，也可以是内部网络，比如以太网或者虚拟私人网络(VPN)。可选的，网络127还可以是无线网络，比如WiFi网络，蜂窝网络等。
硬盘驱动接口和系统总线105耦合。硬件驱动接口和硬盘驱动器相连接。系统内存135和系统总线105耦合。运行在系统内存135的数据可以包括操作系统137和应用程序143。
操作系统137包括功能安全分区(DPE)139和内核(kernel)141。
内核141由操作系统中用于管理存储器、文件、外设和系统资源的那些部分组成。直接与硬件交互，操作系统内核通常运行进程，并提供进程间的通信，提供CPU时间片管理、中断、内存管理、IO管理等等。
应用程序143包括自动驾驶相关程序147，比如，定位的程序，规划的程序和感知的程序等，这些程序对应的应用都是功能安全应用。应用程序143也存在于软件部署服务器(deploying server)149的系统上。在一个实施例中，在需要执行应用程序143时，计算机系统101可以从软件部署服务器149下载应用程序143。
传感器153和计算机系统101关联。传感器153用于探测计算机系统101周围的环境。举例来说，传感器153可以探测动物，汽车，障碍物和人行横道等，进一步传感器还可以探测上述动物，汽车，障碍物和人行横道等物体周围的环境，比如：动物周围的环境，例如，动物周围出现的其他动物，天气条件，周围环境的光亮度等。可选的，如果计算机系统101位于自动驾驶装置上，传感器可以是摄像头，红外线感应器，化学检测器，麦克风等。传感器153在激活时按照预设间隔感测信息并实时或接近实时地将所感测的信息提供给计算机系统101。
计算机系统101，用于根据传感器153采集的传感器数据，确定自动驾驶装置的行驶状态，以及根据该行驶状态和当前的驾驶任务确定自动驾驶转置所需执行的驾驶操作，并向控制系统发送该驾驶操作对应的控制指令。自动驾驶装置行驶状态可以包括自动驾驶装置自身的行驶状况，例如车头方向、速度、位置、加速度等，也包括自动驾驶装置周边环境的状态，例如障碍物的位置、其他车辆的位置和速度、人行横道的位置、交通灯的信号等。计算机系统101可以包括由处理器103实现的任务抽象网络和共享策略网络。具体的，处理器103确定当前的自动驾驶任务；处理器103将该自动驾驶任务的至少一组历史路径输入到任务抽象网络做特征提取，得到表征该自动驾驶任务的特征的任务特征向量；处理器103根据传感器153采集的传感器数据，确定表征自动驾驶装置的当前行驶状态的状态向量；处理器103将该任务特征向量和该状态向量输入到共享策略网络做处理，得到该自动驾驶装置当前所需执行的驾驶操作；处理器103通过控制系统执行该驾驶操作；处理器103重复之前确定和执行驾驶操作的步骤，直到完成该自动驾驶任务。
自动驾驶装置100可以为轿车、卡车、摩托车、公共汽车、船、飞机、直升飞机、割草机、娱乐车、游乐场自动驾驶装置、施工设备、电车、高尔夫球车、火车和手推车等，本申请实施例不做特别的限定。
无论上述终端设备是自动驾驶装置，还是其他设备，操作系统的内核层都会包括上述功能安全分区。
传统汽车采用的分布式电子电气架构(electrical/electronic architecture，EEA)因计算能力不足、通讯带宽不足、不便于软件升级等瓶颈，不能满足现阶段汽车发展的需求，在智能网联汽车产业大变革下，基于件定义汽车的EEA架构升级已成为智能网联汽车发展的关键。软件定义汽车和自动驾驶的背景下，操作系统是汽车生态发展的灵魂。高度变化的需求、车载硬件、持续演进和软件系统复杂程度的提升对操作系统的性能、生态、易用性以及可靠性等提出了严峻的挑战。车载环境下操作系统运行基础是异构分布式计算平台，既 具有安全操作系统的功能和特点，还能够提供高性能、高可靠的传感器、分布式通信、自动驾驶通用框架等支持多生态的模块以支持自动驾驶感知、规划、决策、控制与执行的共性实现。
相比于传统操作系统，车载域和自动驾驶域操作系统需要更加注重确定性、低延时和安全性。为了满足以上的部分需求，业界已经存在一些相对成熟的技术，如下部分“与本发明相关的现有技术”。由于大部分车型仍未形成自动驾驶域，操作系统发展仍较早期，目前更多是考虑生态和高实时性，大多基于现有的质量管理(quality management，QM)安全等级的通用/实时操作系统开发。但是在实际应用和投产场景下，车载环境对系统的安全存在较高的要求和规范，其中车载环境的信息安全和功能安全能力是现有系统的核心需求和痛点。
基于ISO26262功能安全规范与生态开发和功能的考虑，现有DPE架构存在多个协同工作的不同功能安全等级的系统环境。但是协同场景下的诸多代理和交互流程会导致汽车安全完整性D等级(automotive safety integration level D，ASIL-D)环境功能安全等级被QM等系统环境污染，且不同安全等级的功能与应用存在干扰和影响，现有场景和架构存在以下挑战：多功能安全等级的系统环境上的跨系统流程的功能安全；保障安全相关进程的运行时虚拟内存功能安全；保障安全相关进程的运行时物理内存功能安全；实现跨功能安全系统域的控制信息和信道边界安全。
在现有的架构中，包括安全计算基座PEK、安全系统CORE和高功能安全域代理Platform、Linux Kernel和低功能安全域代理Proxy，硬件模块：单板V8A-cores、内存。安全计算基座PEK运行在EL2提供安全虚拟化和隔离支持，将CPU cores、内存等硬件资源抽象后根据分配提供给Linux Kernel和CORE系统，并支持部分底层资源共享，和高功能安全域生态代理Platform在系统运行后提供系统调用、缺页的代理能力，配合低功能安全域代理Proxy提供给CORE侧数据面应用Linux现有生态的复用。
现有技术中基于PEK为上层两个平面(控制面和数据面)提供分区隔离；PEK和Platform共同为CORE侧数据面中运行的应用提供高性能的GuestEL1运行环境；Platform和Proxy共同为数据面应用提供Linux代理能力，使得数据面应用能够兼容linux生态；PEK和Platform共同为数据面应用提供同层安全隔离，解决性能、生态和底层虚拟化安全性问题，然而仍然存在如下不足：进程页表功能安全问题，功能安全进程页表由QM等级的Linux Kernel保存不满足功能安全；内存隔离问题，代理流程存在功能安全进程的物理内存未与Linux侧普通进程隔离；迁移和代理安全问题，未提供迁移和代理流程中各流程端到端校验的安全保障。
参照图3，图3为本申请实施例的一个应用架构。
参照图3，图3所示的架构可以包括与本申请实施例相关的硬件基础：CPU(V8A-cores)、内存。
图3所示的架构可以包括与本申请实施例相关的软件模块，各模块功能如下：NUMA内存结构和策略将内存划分为预留功能安全内存node1和QM环境使用内存node0；
QM面Kernel新增安全执行环境(Secure Execution Environment，SEE)Skeleton模块提供QM侧代理响应能力；ASIL-D面SEE环境新增SEE Stub进行ASIL-D侧代理请求；SEE  Stub预留功能安全应用的页表内存；SEE Stub将SEE Skeleton代理执行结果等经过代理信道的QM数据进行端到端校验；SEE Stub使用预留功能安全应用的页表内存重构功能安全应用内存页表；PEK提供跨域代理信道结构的保护，记录SEE Skeleton对信道的读写行为，并由高功能安全(ASIL-D)系统域进行端到端的完整性和可靠性校验保障控制信息边界。
下面，结合附图介绍本申请实施例提供运行进程的装置所执行的运行进程的方法，该运行进程的装置可以是智能车中的计算机系统，所述计算机系统包括内核和功能安全分区，所述功能安全分区和所述内核位于同一特权层，参照图4，本申请实施例提供的运行进程的方法，包括：
401、所述内核获取目标进程的运行功能数据，所述运行功能数据包括页表信息，所述页表信息指示所述目标进程的虚拟地址和物理地址的映射关系。
在一种可能的实现中，所述功能安全分区的执行环境满足汽车安全完整性D等级(ASIL-D)的安全等级。例如所述内核具体可以为安全执行环境框架(SEE skeleton)；所述功能安全分区具体可以为安全执行环境基座(SEE stub)。
接下来介绍拉起SEE skeleton以及SEE stub的过程：
在一种可能的实现中，可以启动PEK底层可信计算基座提供安全虚拟化。在本步骤中，PEK可以读取启动设备树二进制文件(device tree binary，DTB)，获取硬件资源分配情况，包括但不限于CPU core资源、内存资源、中断和串口信息等。这些资源可以由PEK进行抽象整合并提供安全虚拟化和隔离。
在一种可能的实现中，PEK根据资源分配拉起SEE Skeleton。在本步骤中，PEK可以以获取的资源分配拉起SEE Skeleton模块，SEE Skeleton模块作为代理流程的QM面组件此时进行代理准备的初始化。
在一种可能的实现中，PEK可以拉起功能安全分区(例如高功能安全ASIL-D域环境)，或者由SEE Skeleton模块来拉起功能安全分区。在本步骤中，PEK可以根据获取的资源分配拉起SEE Stub模块，SEE Stub完成代理基座的通信信道安全结构、内部控制结构、中断和预留页表内存初始化后，拉起SEE高功能安全ASIL-D域环境，并由SEE完成后续的高功能安全ASIL-D域初始化。
在一种可能的实现中，内核可以接收进程启动请求，该进程启动请求用于指示启动目标进程。该进程启动请求可以是系统启动时触发的请求，也可以使用户使用应用时触发的请求。
在一种可能的实现中，内核可以根据进程启动请求，在内核执行目标进程的可执行文件，得到支持目标进程在内核运行的运行功能数据。该进程启动请求中可以携带目标进程的标识，也可以携带与该目标进程对应的应用的标识，这样，通过该进程的标识或对应的应用的标识就可以查找到相应的可执行文件。可执行文件包括文件头和二进制执行代码，每个进程都有相应的可执行文件，可执行文件的脚本中可以包括进程的标识。在内核执行目标进程的可执行文件指的是在内核的环境中执行可执行文件的二进制执行代码。
在一种可能的实现中，可执行文件的文件头中可以包含标记信息，标记信息可以是一段特殊标记数据，可以是一个字符串，也可以是一个数值。
在一种可能的实现中，运行功能数据可以包括目标进程的虚拟地址，虚拟地址和物理地址的映射关系，以及目标进程的上下文，其中物理地址是目标进程在内核的存储资源中被分配的物理地址。
具体的，在操作系统启动时，或者目标进程对应的目标应用被触发时，可以根据该目标进程的标识以及可执行文件的脚本中包含的进程的标识，加载该目标进程的可执行文件。该目标进程的可执行文件可以加载到内核对应的内存中。
在一种可能的实现中，在执行该目标进程的可执行文件过程中，可以会在内核中创建任务结构体(task_struct)。任务结构体用于存放目标进程的上下文。任务结构体(task_struct)是内核中用于存放目标进程的上下文的结构，可以是表的形式，也可以是其他形式。若可执行文件的文件头中包含标记信息，则运行进程的装置在根据标记信息，在任务结构体中添加指示值，指示值用于指示目标进程为功能安全应用的进程。
在一种可能的实现中，该指示值可以添加在任务结构体的功能安全应用(DPE APP)的标识位上，该指示值可以为“1”，也可以为其他数值，指示值的具体取值，本申请中不做限定。
在一种可能的实现中，在执行该目标进程的可执行文件过程中，还会从虚拟地址空间为目标进程分配虚拟地址，从内核的存储资源上为该目标进程分配物理地址，然后建立该虚拟地址和物理地址的映射关系(该映射关系可以称之为目标进程的页表信息)。
在现有的实现中，无论是安全功能进程还是非安全功能进程均存储在内核侧的同一片内存中，在目标进程在安全功能分区运行时，内核仍然具备访问和修改非安全功能进程相关数据的权限，并不能满足安全功能分区的安全性要求。
在一种可能的实现中，所述计算机系统可以包括第一内存和第二内存，所述第一内存用于存储和功能安全进程相关的数据，所述第二内存用于存储和非功能安全进程相关的数据，所述第一内存和所述第二内存之间隔离，在所述目标进程的运行中，所述第一内存不可被所述内核访问。
在一种可能的实现中，在为目标进程分配物理地址时，内核可以从第一内存中为目标进程分配物理地址，也就是说所述目标进程的物理地址为所述计算机系统中第一内存中的地址，在为目标进程分配了物理地址之后，在所述目标进程的运行中，所述第一内存不可被所述内核访问，也就是内核不可以访问以及修改第一内存中的信息，而仅可以访问和修改第二内存，进而实现了所述第一内存和所述第二内存之间的隔离。
本申请实施例中，安全功能进程的加载使用物理内存隔离，在加载功能安全相关进程(包括启动加载、缺页以及文件映射)时内存都通过基于功能安全内存结点预留且隔离的内存里分配，保障多功能安全分区部署存在运行时高功能安全应用的物理内存隔离，提高了系统的安全性。
本申请实施例中，单独为功能安全分区分配了一个内存(第一内存)，内核不占用该内存并可以监控高功能域内存节点，当被试图访问或异常时，将该信息记录并上报，能获得及时的入侵或故障响应，提高了功能安全分区执行目标进程时的安全性。
在一种可能的实现中，所述第一内存为第一非一致性内存访问NUMA节点(例如本申 请实施例中的Node 1)，所述第二内存为第二NUMA节点(例如本申请实施例中的Node 0)。
接下来以内核中的SEE Skeleton为例，介绍SEE Skeleton加载NUMA的内存策略。在本步骤中，SEE Skeleton模块可以基于NUMA内存模型加载代码层面上预置的NUMA内存分配策略并对NUMA内存分配策略进行完整性校验和可靠可信校验，在确认策略安全后，SEE Skeleton模块会应用相关策略作为后续高功能安全域应用的内存分配。
具体的，参照图5，在本步骤中，可以基于PEK拉起QM时加载DTB中NUMA相关配置修改，新增内存节点Node 1，且QM环境默认配置全部使用Memory Node 0节点。QM拉起后，SEE Skeleton模块初始化时应用内存的NUMA模型，其主要数据结构为mempolicy，结构示例的如下：
structmempolicypolicy_node1＝(structmempolicy)
{.refcnt＝ATOMIC_INIT(1),
.mode＝MPOL_PREFERRED,
.flags＝MPOL_F_MOF|MPOL_F_MORON,
.v＝{.preferred_node＝1,},}；
在初始化时进行启动默认NUMA策略修改，执行NUMA内存策略的检查，配置SEE环境使用Node 1内存，执行NUMA内存策略的完整性和安全性检查，确认合法后SEE Skeleton应用相应的NUMA内存策略。
在一种可能的实现中，SEE Skeleton可以注册代理信道(代理通道可以为SEE Skeleton和SEE stub之间的共享内存)。在本步骤中，SEE Skeleton可以调用PEK提供的安全注册接口将内存注册为代理信道，并记录QM环境对信道的读写行为，提供跨域代理信道结构的保护。其中，对于代理流程信息发送与接收信息是端到端的，根据系统域功能安全等级定义发送与接收信息操作安全权限，高功能安全域对于低功能安全域是可信的，而反之则需要更高功能安全域进行端到端校验。
402、所述内核将所述运行功能数据迁移到所述功能安全分区。
在一种可能的实现中，因为内核与功能安全分区的物理资源是隔离的，在运行功能数据迁移的过程中需要用到共享内存(例如上述实施例所描述的代理通道)。
具体的，可以将所述运行功能数据通过共享内存迁移到所述功能安全分区，所述共享内存为所述内核和所述功能安全分区共享的内存。例如，内核可以将运行功能数据存储至所述共享内存，并通知功能安全分区，进而功能安全分区可以从共享内存中获取所述运行功能数据。
在一种可能的实现中，可以获取在所述内核对所述共享内存进行读写操作时的操作信息，并对所述操作信息进行安全状态判断。示例性的，在本步骤中，SEE Skeleton可以调用PEK提供的安全注册接口将内存注册为代理信道，并记录QM环境对信道的读写行为，从而提供跨域代理信道结构的保护，进而提高了系统的安全性。
在一种可能的实现中，内核中的管理程序可以拉起安全进程，在QM环境下预留影子线程，分配影子线程的栈堆段内存。然后SEE Skeleton预处理安全进程的页表信息置于代理信道。该影子线程可以作为代理流程的响应端。
403、所述功能安全分区根据所述页表信息对页表内存进行页表信息的重构，其中，所述页表内存为被分配至所述功能安全分区且不可被所述内核访问的物理空间。
在一种可能的实现中，功能安全分区在接收到运行功能数据之后，可以对运行功能数据进行端到端校验。
在一种可能的实现中，功能安全分区可以对所述页表信息进行校验，并基于所述页表信息通过所述校验，根据所述页表信息对页表内存进行页表信息的重构。
在一种可能的实现中，所述校验包括如下的至少一种：权限校验、可靠性校验、完整性校验和数据安全校验。
具体的，功能安全分区(例如SEE Stub)可以进行端到端的信息校验，校验流程包括但不限于哈希校验完整性，数据信息安全校验等。若校验失败，功能安全分区会保存信息到日志并进行异常场景上报，由更上层架构进行具体的异常处理决策；若校验成功，功能安全分区会在高功能安全分区SEE环境下基于初始化的预留页表内存重构线程页表。
在一种可能的实现中，SEE Stub收到来自内核的通知(例如中断)后，可以触发迁移事件的中断回调流程，开始检查代理信道的数据，对代理信道的页表信息和进程内容信息和高功能安全域SEE预置的哈希信息进行端到端的完整性校验，并进一步进行合法可靠性校验，若校验失败，则记录此次异常场景并上报上层架构进行异常处理决策；若校验成功，根据代理信道的数据，在高功能安全域环境下使用SEE Stub初始化的预留页表内存进行安全进程的页表重构，此预留页表内存可以通过bitmap数据结构进行管理。
参照图6，在校验通过后，功能安全分区可以根据所述页表信息对页表内存进行页表信息的重构，并通过提供EL2层虚拟化支持的PEK接口解映射QM侧对安全进程内存的stage2映射关系，获得物理和虚拟内存两个层面上的内存功能安全保护。
本申请实施例中，功能安全分区可以通过对信息的端到端校验在多功能安全等级系统环境和协同场景下的诸多代理和交互流程中保障ASIL-D环境功能安全等级不被和QM等系统环境的交互污染，提高了系统的安全性。
在一种可能的实现中，所述功能安全分区可以根据所述页表信息对页表内存进行页表信息的重构，且所述页表内存为被分配至所述功能安全分区且不可被所述内核访问的物理空间。也就是说，针对安全进程，功能安全分区(ASIL-D环境)和内核(QM环境)可以各自都保存一份相同的页表信息，而内核(QM环境)无法读写功能安全分区(ASIL-D环境)的页表信息，而且功能安全分区(ASIL-D环境)可读写内核(QM环境)的页表信息。
在现有的实现中，页表信息保存于内核侧，且内核侧针对于页表信息具备访问和修改的能力，造成了内核侧的环境(QM环境)对功能安全分区(ASIL-D环境)的交互污染。本申请实施例中，针对安全进程，通过将进程的页表信息由内核侧传递至功能安全分区侧，且内核(QM环境)无法读写功能安全分区(ASIL-D环境)的页表信息，保障了功能安全分区(ASIL-D环境)的功能安全等级不被内核(QM环境)的交互污染，提高了系统的安全性。
本申请实施例中，从QM环境迁移安全相关进程的页表结构到ASIL-D环境(QM存有代理时使用的副本，但不具备对ASIL-D的读写能力)并提供迁移流程中完整性校验和可靠性 校验，加固了应用的虚拟内存功能安全能力，通过QM副本页表信息获得生态代理能力和ASIL-D获得安全运行能力，保障安全相关进程的运行时虚拟内存功能安全。
404、所述功能安全分区基于所述页表内存中的页表信息，在所述功能安全分区运行所述目标进程。
在一种可能的实现中，功能安全分区(例如SEE Stub)可以结合代理信道(即本申请实施例中的共享内存)和内核(例如SEE Skeleton)提供SEE数据面应用高功能安全生态代理能力。
在一种可能的实现中，参照图7，功能安全分区基本功能运行在完整的ASIL-D自包含环境中，当涉及到生态相关的需求(需要在内核一侧执行的需求，该需求无需很高的安全要求)时，功能安全分区会触发初始化的SEE Stub模块的代理基座能力，将系统调用、缺页和维测调试异常等生态需求置于代理信道，并由中断通知对端SEE Skeleton结合影子线程完成对端代理行为，并由SEE Skeleton将代理结果置于代理信道，SEE Stub会将返回的代理结果进行端到端的校验，校验流程包括但不限于基本的权限校验、参数校验、哈希完整校验和数据信息安全校验等，并按照复制、校验和使用的安全模式在后续进行使用。
在一种可能的实现中，所述功能安全分区可以基于所述目标进程在运行时需要执行目标功能，所述目标功能被配置为需要被所述内核执行，将所述目标功能的信息传递至所述内核；所述内核根据所述目标功能的信息，调用影子线程执行所述目标功能，以得到处理结果；所述内核将所述处理结果传递给所述功能安全分区。
在一种可能的实现中，所述目标功能为系统调用，所述目标功能的信息为所述系统调用指令的上下文。
在一种可能的实现中，功能安全分区运行目标进程，需要调用功能安全分区的系统调用指令。功能安全分区可以将系统调用指令的上下文存入共享内存。功能安全分区可以向内核发送通知，该通知用于指示发生系统调用。内核可以从共享内存读取系统调用指令的上下文；内核可以根据系统调用指令的上下文调用内核的系统调用指令进行系统调用，得到系统调用的返回值；内核可以将返回值放入共享内存；功能安全分区可以从共享内存将系统调用的返回值读取，并使用该返回值完成功能安全分区的系统调用过程。
该实施例通过共享内存，可以在功能安全分区与内核之间传递系统调用指令的上下文，这样，在功能安全分区的系统调用可以通过内核的系统调用过程来实现，从而确保了功能安全分区与内核的生态兼容。
在一种可能的实现中，所述目标功能为缺页异常，所述目标功能的信息为所述缺页异常的上下文。
在一种可能的实现中，功能安全分区运行目标进程时发生缺页异常。功能安全分区可以将缺页异常的上下文存入共享内存。功能安全分区可以向内核发送通知，该通知用于指示发生缺页异常。内核可以从共享内存读取缺页异常的上下文。内核可以根据缺页异常的上下文调用内核中缺页异常处理函数，以及根据缺页异常处理函数进行缺页异常处理，以得到处理结果。内核可以将处理结果写入共享内存。功能安全分区从共享内存读取缺页异常的处理结果，并使用该处理结果完成功能安全分区的缺页异常得处理过程。
该实施例在发生缺页异常时，可以在功能安全分区与内核之间传递系缺页异常的上下文，这样，在功能安全分区的缺页异常可以通过内核的缺页异常处理过程来实现，从而确保了功能安全分区与内核的生态兼容。
在一种可能的实现中，所述功能安全分区对所述处理结果进行校验，并基于所述处理结果通过所述校验，根据所述处理结果继续执行所述目标进程，进而提高了系统的安全性。
本申请实施例提供了一种运行进程的方法，所述方法应用于智能车中的计算机系统，所述计算机系统包括内核和功能安全分区，所述功能安全分区和所述内核位于同一特权层，所述方法包括：所述内核获取目标进程的运行功能数据，所述运行功能数据包括页表信息，所述页表信息指示所述目标进程的虚拟地址和物理地址的映射关系；所述内核将所述运行功能数据迁移到所述功能安全分区；所述功能安全分区根据所述页表信息对页表内存进行页表信息的重构，其中，所述页表内存为被分配至所述功能安全分区且不可被所述内核访问的物理空间；所述功能安全分区基于所述页表内存中的页表信息，在所述功能安全分区运行所述目标进程。
在一种可能的实现中，所述功能安全分区可以根据所述页表信息对页表内存进行页表信息的重构，且所述页表内存为被分配至所述功能安全分区且不可被所述内核访问的物理空间。也就是说，针对安全进程，功能安全分区(ASIL-D环境)和内核(QM环境)可以各自都保存一份相同的页表信息，而内核(QM环境)无法读写功能安全分区(ASIL-D环境)的页表信息，而且功能安全分区(ASIL-D环境)可读写内核(QM环境)的页表信息。
在现有的实现中，页表信息保存于内核侧，且内核侧针对于页表信息具备访问和修改的能力，造成了内核侧的环境(QM环境)对功能安全分区(ASIL-D环境)的交互污染。本申请实施例中，针对安全进程，通过将进程的页表信息由内核侧传递至功能安全分区侧，且内核(QM环境)无法读写功能安全分区(ASIL-D环境)的页表信息，保障了功能安全分区(ASIL-D环境)的功能安全等级不被内核(QM环境)的交互污染，提高了系统的安全性。
接下来介绍本申请实施例的一个软件结构示意。
本申请实施例的产品实现形态，可以是包含在安全虚拟化架构和多安全等级系统软件中，并部署在车载环境硬件上的程序代码。以图8所示的应用场景为例，本申请实施例的程序代码存在于平台软件的运行时安全虚拟化架构PEK模块、QM Kernel内的SEE Skeleton模块、代理信道模块和ASIL-D系统的SEE Stub模块内部，以及现有模块外部。运行时，本申请实施例的程序代码运行于车载环境硬件。图8给出了本发明部署安全虚拟化架构和多安全等级系统软件在车载环境硬件上的实现形态，其中虚线框所示部分为本申请实施例在现有技术平台软件基础上新增模块的能力实现。基于运行时安全虚拟化架构PEK(4011)底层安全虚拟化支持，本申请实施例设计了QM系统环境下的SEE Skeleton模块(4012)，其内部基于内存(4021)的NUMA模型(4023)提供物理内存隔离(4015)和数据哈希和加密(4016)能力；在代理信道(4013)内部，本发明设计了页表迁移和生态代理(4017)；在ASIL-D环境SEE系统域内本发明设计了SEE Stub(4014)，其内部提供数据校验(4018)和预留页表内存和页表重构(4019)能力。
以上描述了本申请实施例提供的运行进程的方法，下面结合附图介绍本申请实施例提供的运行进程的装置。
参照图9为本申请实施例提供的一种运行进程的装置的结构示意，所述装置900可以应用于智能车中的计算机系统，所述计算机系统包括内核和功能安全分区，所述功能安全分区和所述内核位于同一特权层，所述内核包括：
获取模块901，用于获取目标进程的运行功能数据，所述运行功能数据包括页表信息，所述页表信息指示所述目标进程的虚拟地址和物理地址的映射关系；
第一迁移模块902，用于将所述运行功能数据迁移到所述功能安全分区；
所述功能安全分区包括：
页表重构模块903，用于根据所述页表信息对页表内存进行页表信息的重构，其中，所述页表内存为被分配至所述功能安全分区且不可被所述内核访问的物理空间；
进程运行模块904，用于基于所述页表内存中的页表信息，在所述功能安全分区运行所述目标进程。
在一种可能的实现中，所述装置还包括：校验模块，用于：
对所述页表信息进行校验，并基于所述页表信息通过所述校验，根据所述页表信息对页表内存进行页表信息的重构。
在一种可能的实现中，所述校验包括如下的至少一种：
权限校验、可靠性校验、完整性校验和数据安全校验。
在一种可能的实现中，所述功能安全分区的执行环境满足汽车安全完整性D等级(ASIL-D)的安全等级。
在一种可能的实现中，所述第一迁移模块，具体用于：
将所述运行功能数据通过共享内存迁移到所述功能安全分区，所述共享内存为所述内核和所述功能安全分区共享的内存。
在一种可能的实现中，所述获取模块，还用于：
获取在所述内核对所述共享内存进行读写操作时的操作信息，并对所述操作信息进行安全状态判断。
在一种可能的实现中，所述目标进程的物理地址为所述计算机系统中第一内存中的地址，所述第一内存用于存储和功能安全进程相关的数据，且在所述目标进程的运行中，所述第一内存不可被所述内核访问。
在一种可能的实现中，所述计算机系统还包括第二内存，所述第二内存用于存储和非功能安全进程相关的数据，且所述第一内存和所述第二内存之间隔离。
在一种可能的实现中，所述第一内存为第一非一致性内存访问NUMA节点，所述第二内存为第二NUMA节点。
在一种可能的实现中，所述功能安全分区还包括：
第二迁移模块，用于基于所述目标进程在运行时需要执行目标功能，所述目标功能被配置为需要被所述内核执行，将所述目标功能的信息传递至所述内核；
所述内核还包括：
影子线程模块，用于根据所述目标功能的信息，调用影子线程执行所述目标功能，以得到处理结果；
所述第一迁移模块，还用于将所述处理结果传递给所述功能安全分区。
在一种可能的实现中，所述目标功能为系统调用，所述目标功能的信息为所述系统调用指令的上下文；或者，
所述目标功能为缺页异常，所述目标功能的信息为所述缺页异常的上下文。
在一种可能的实现中，所述校验模块，还用于：
对所述处理结果进行校验，并基于所述处理结果通过所述校验，根据所述处理结果继续执行所述目标进程。
在一种可能的实现中，所述内核具体为安全执行环境框架(SEE skeleton)；所述功能安全分区具体为安全执行环境基座(SEE stub)。
图10所示，为本申请的实施例提供的计算机设备90的一种可能的逻辑结构示意图。该计算机设备可以是前述实施例所描述的终端设备。计算机设备90包括：处理器系统901、通信接口902、存储器903以及总线904。该处理器系统901可以包括第一处理器和第二处理器，该第一处理器对应内核，第二处理器对应功能安全分区。若该处理器系统是一个处理器，那么该第一处理器为一个处理器核。第二处理器为另一个处理器核。存储器903中可以包括第一内存和第二内存，该第一内存对应内核，第二内存对应功能安全分区。处理器系统901、通信接口902以及存储器903通过总线904相互连接。在本申请的实施例中，处理器系统901用于对计算机设备90的动作进行控制管理，例如，处理器系统901用于执行图4中的步骤401至404。通信接口902用于支持计算机设备90进行通信。存储器903，用于存储计算机设备90的程序代码和数据。
其中，处理器系统901可以是中央处理器系统单元，通用处理器系统，数字信号处理器系统，专用集成电路，现场可编程门阵列或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器系统也可以是实现计算功能的组合，例如包含一个或多个微处理器系统组合，数字信号处理器系统和微处理器系统的组合等等。总线904可以是外设部件互连标准(Peripheral Component Interconnect，PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，图10中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
如图11所示，本申请实施例提供的计算机设备1000的一种可能的逻辑结构示意图。该计算机设备可以是前述实施例所描述的终端设备。该计算机设备1000包括：硬件层1001和虚拟机(virtual machine，VM)层1002，该VM层可以包括一个或多个VM。该硬件层1001为VM提供硬件资源，支撑VM运行，该VM的功能和与本申请相关的过程可以参阅上述图1至图8中的相应描述进行理解。该硬件层1001包括处理器、通信接口以及存储器等硬件资源。
在本申请的另一实施例中，还提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机执行指令，当设备的至少一个处理器执行该计算机执行指令时，设备执行上述图1至图8部分实施例所描述的运行进程的方法。
在本申请的另一实施例中，还提供一种计算机程序产品，该计算机程序产品包括计算机执行指令，该计算机执行指令存储在计算机可读存储介质中；设备的至少一个处理器可以从计算机可读存储介质读取该计算机执行指令，至少一个处理器执行该计算机执行指令使得设备执行上述图1至图8部分实施例所描述的运行进程的方法。
在本申请的另一实施例中，还提供一种芯片系统，该芯片系统包括处理器，用于支持运行进程的装置实现上述图1至图8部分实施例所描述的运行进程的方法。在一种可能的设计中，芯片系统还可以包括存储器，存储器，用于保存运行进程的装置必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者其他网络设备等)执行本申请图5实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (29)

  1. 一种运行进程的方法，其特征在于，所述方法应用于智能车中的计算机系统，所述计算机系统包括内核和功能安全分区，所述功能安全分区和所述内核位于同一特权层，所述方法包括：
    所述内核获取目标进程的运行功能数据，所述运行功能数据包括页表信息，所述页表信息指示所述目标进程的虚拟地址和物理地址的映射关系；
    所述内核将所述运行功能数据迁移到所述功能安全分区；
    所述功能安全分区根据所述页表信息对页表内存进行页表信息的重构，其中，所述页表内存为被分配至所述功能安全分区且不可被所述内核访问的物理空间；
    所述功能安全分区基于所述页表内存中的页表信息，在所述功能安全分区运行所述目标进程。
  2. 根据权利要求1所述的方法，其特征在于，所述根据所述页表信息对页表内存进行页表信息的重构，包括：
    对所述页表信息进行校验，并基于所述页表信息通过所述校验，根据所述页表信息对页表内存进行页表信息的重构。
  3. 根据权利要求1或2所述的方法，其特征在于，所述校验包括如下的至少一种：
    权限校验、可靠性校验、完整性校验和数据安全校验。
  4. 根据权利要求1至3任一所述的方法，其特征在于，所述功能安全分区的执行环境满足汽车安全完整性D等级(ASIL-D)的安全等级。
  5. 根据权利要求1至4任一所述的方法，其特征在于，所述将所述运行功能数据迁移到所述功能安全分区，包括：
    将所述运行功能数据通过共享内存迁移到所述功能安全分区，所述共享内存为所述内核和所述功能安全分区共享的内存。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    获取在所述内核对所述共享内存进行读写操作时的操作信息，并对所述操作信息进行安全状态判断。
  7. 根据权利要求1至6任一所述的方法，其特征在于，所述目标进程的物理地址为所述计算机系统中第一内存中的地址，所述第一内存用于存储和功能安全进程相关的数据，且在所述目标进程的运行中，所述第一内存不可被所述内核访问。
  8. 根据权利要求1至7任一所述的方法，其特征在于，所述计算机系统还包括第二内存， 所述第二内存用于存储和非功能安全进程相关的数据，且所述第一内存和所述第二内存之间隔离。
  9. 根据权利要求8所述的方法，其特征在于，所述第一内存为第一非一致性内存访问NUMA节点，所述第二内存为第二NUMA节点。
  10. 根据权利要求1至9任一所述的方法，其特征在于，所述方法还包括：
    基于所述目标进程在运行时需要执行目标功能，所述目标功能被配置为需要被所述内核执行，所述功能安全分区将所述目标功能的信息传递至所述内核；
    所述内核根据所述目标功能的信息，调用影子线程执行所述目标功能，以得到处理结果；
    所述内核将所述处理结果传递给所述功能安全分区。
  11. 根据权利要求10所述的方法，其特征在于，
    所述目标功能为系统调用，所述目标功能的信息为所述系统调用指令的上下文；或者，
    所述目标功能为缺页异常，所述目标功能的信息为所述缺页异常的上下文。
  12. 根据权利要求10或11所述的方法，其特征在于，所述方法还包括：
    所述功能安全分区对所述处理结果进行校验，并基于所述处理结果通过所述校验，根据所述处理结果继续执行所述目标进程。
  13. 根据权利要求1至12任一所述的方法，其特征在于，所述内核具体为安全执行环境框架(SEE skeleton)；所述功能安全分区具体为安全执行环境基座(SEE stub)。
  14. 一种运行进程的装置，其特征在于，所述装置应用于智能车中的计算机系统，所述计算机系统包括内核和功能安全分区，所述功能安全分区和所述内核位于同一特权层，所述内核包括：
    获取模块，用于获取目标进程的运行功能数据，所述运行功能数据包括页表信息，所述页表信息指示所述目标进程的虚拟地址和物理地址的映射关系；
    第一迁移模块，用于将所述运行功能数据迁移到所述功能安全分区；
    所述功能安全分区包括：
    页表重构模块，用于根据所述页表信息对页表内存进行页表信息的重构，其中，所述页表内存为被分配至所述功能安全分区且不可被所述内核访问的物理空间；
    进程运行模块，用于基于所述页表内存中的页表信息，在所述功能安全分区运行所述目标进程。
  15. 根据权利要求14所述的装置，其特征在于，所述装置还包括：校验模块，用于：
    对所述页表信息进行校验，并基于所述页表信息通过所述校验，根据所述页表信息对页表内存进行页表信息的重构。
  16. 根据权利要求14或15所述的装置，其特征在于，所述校验包括如下的至少一种：
    权限校验、可靠性校验、完整性校验和数据安全校验。
  17. 根据权利要求14至16任一所述的装置，其特征在于，所述功能安全分区的执行环境满足汽车安全完整性D等级(ASIL-D)的安全等级。
  18. 根据权利要求14至17任一所述的装置，其特征在于，所述第一迁移模块，具体用于：
    将所述运行功能数据通过共享内存迁移到所述功能安全分区，所述共享内存为所述内核和所述功能安全分区共享的内存。
  19. 根据权利要求18所述的装置，其特征在于，所述获取模块，还用于：
    获取在所述内核对所述共享内存进行读写操作时的操作信息，并对所述操作信息进行安全状态判断。
  20. 根据权利要求14至19任一所述的装置，其特征在于，所述目标进程的物理地址为所述计算机系统中第一内存中的地址，所述第一内存用于存储和功能安全进程相关的数据，且在所述目标进程的运行中，所述第一内存不可被所述内核访问。
  21. 根据权利要求14至20任一所述的装置，其特征在于，所述计算机系统还包括第二内存，所述第二内存用于存储和非功能安全进程相关的数据，且所述第一内存和所述第二内存之间隔离。
  22. 根据权利要求21所述的装置，其特征在于，所述第一内存为第一非一致性内存访问NUMA节点，所述第二内存为第二NUMA节点。
  23. 根据权利要求14至22任一所述的装置，其特征在于，所述功能安全分区还包括：
    第二迁移模块，用于基于所述目标进程在运行时需要执行目标功能，所述目标功能被配置为需要被所述内核执行，将所述目标功能的信息传递至所述内核；
    所述内核还包括：
    影子线程模块，用于根据所述目标功能的信息，调用影子线程执行所述目标功能，以得到处理结果；
    所述第一迁移模块，还用于将所述处理结果传递给所述功能安全分区。
  24. 根据权利要求23所述的装置，其特征在于，
    所述目标功能为系统调用，所述目标功能的信息为所述系统调用指令的上下文；或者，
    所述目标功能为缺页异常，所述目标功能的信息为所述缺页异常的上下文。
  25. 根据权利要求23或24所述的装置，其特征在于，所述校验模块，还用于：
    对所述处理结果进行校验，并基于所述处理结果通过所述校验，根据所述处理结果继续执行所述目标进程。
  26. 根据权利要求14至25任一所述的装置，其特征在于，所述内核具体为安全执行环境框架(SEE skeleton)；所述功能安全分区具体为安全执行环境基座(SEE stub)。
  27. 一种计算设备，其特征在于，包括处理器和存储有计算机程序的计算机可读存储介质；
    所述处理器与所述计算机可读存储介质耦合，所述计算机程序被所述处理器执行时实现如权利要求1-13任一项所述的方法。
  28. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现如权利要求1-13任一项所述的方法。
  29. 一种芯片系统，其特征在于，包括处理器，所述处理器被调用用于执行如权利要求1-13任一项所述的方法。
PCT/CN2022/133714 2021-11-30 2022-11-23 一种运行进程的方法及装置 WO2023098536A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111453393.8A CN116204458A (zh) 2021-11-30 2021-11-30 一种运行进程的方法及装置
CN202111453393.8 2021-11-30

Publications (1)

Publication Number Publication Date
WO2023098536A1 true WO2023098536A1 (zh) 2023-06-08

Family

ID=86508229

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/133714 WO2023098536A1 (zh) 2021-11-30 2022-11-23 一种运行进程的方法及装置

Country Status (2)

Country Link
CN (1) CN116204458A (zh)
WO (1) WO2023098536A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117573419A (zh) * 2024-01-16 2024-02-20 上海芯联芯智能科技有限公司 一种页面异常处理方法及装置
CN117786668A (zh) * 2023-12-28 2024-03-29 北京长扬软件有限公司 一种应用程序动态完整性度量方法和系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107077428A (zh) * 2014-09-30 2017-08-18 微软技术许可有限责任公司 保护应用秘密免受操作系统攻击
CN109002706A (zh) * 2018-06-08 2018-12-14 中国科学院计算技术研究所 一种基于用户级页表的进程内数据隔离保护方法和系统
US10191861B1 (en) * 2016-09-06 2019-01-29 Fireeye, Inc. Technique for implementing memory views using a layered virtualization architecture
CN110058921A (zh) * 2019-03-13 2019-07-26 上海交通大学 客户虚拟机内存动态隔离和监控方法及系统
CN113867828A (zh) * 2020-06-30 2021-12-31 华为技术有限公司 一种运行进程的方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107077428A (zh) * 2014-09-30 2017-08-18 微软技术许可有限责任公司 保护应用秘密免受操作系统攻击
US10191861B1 (en) * 2016-09-06 2019-01-29 Fireeye, Inc. Technique for implementing memory views using a layered virtualization architecture
CN109002706A (zh) * 2018-06-08 2018-12-14 中国科学院计算技术研究所 一种基于用户级页表的进程内数据隔离保护方法和系统
CN110058921A (zh) * 2019-03-13 2019-07-26 上海交通大学 客户虚拟机内存动态隔离和监控方法及系统
CN113867828A (zh) * 2020-06-30 2021-12-31 华为技术有限公司 一种运行进程的方法及装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117786668A (zh) * 2023-12-28 2024-03-29 北京长扬软件有限公司 一种应用程序动态完整性度量方法和系统
CN117573419A (zh) * 2024-01-16 2024-02-20 上海芯联芯智能科技有限公司 一种页面异常处理方法及装置
CN117573419B (zh) * 2024-01-16 2024-04-26 上海芯联芯智能科技有限公司 一种页面异常处理方法及装置

Also Published As

Publication number Publication date
CN116204458A (zh) 2023-06-02

Similar Documents

Publication Publication Date Title
WO2023098536A1 (zh) 一种运行进程的方法及装置
CN110520847B (zh) 控制和状态信号的虚拟化
US10963268B1 (en) Interception of identifier indicative of client configurable hardware logic and configuration data
EP4199450A1 (en) Digital twin framework for next generation networks
WO2022001506A1 (zh) 一种运行进程的方法及装置
US20080065854A1 (en) Method and apparatus for accessing physical memory belonging to virtual machines from a user level monitor
CN109791536A (zh) 可配置逻辑平台
CN112035272A (zh) 进程间通信的方法、装置以及计算机设备
CN108959916A (zh) 用于访问安全世界的方法、装置和系统
US10795742B1 (en) Isolating unresponsive customer logic from a bus
EP4155949A1 (en) Method and apparatus for isolating kernel from task
US20220014947A1 (en) Dynamic slice reconfiguration during fault-attack-failure-outage (fafo) events
US20220012042A1 (en) Mechanism for secure and resilient configuration upgrades
CN114253658A (zh) 边缘计算的持续测试、集成和部署管理
CN113010265A (zh) Pod的调度方法、调度器、存储插件及系统
CN114787806A (zh) 用于运行计算装置的方法和设备
US20220012149A1 (en) Stable transformations of networked systems with automation
CN102799480B (zh) 虚拟化系统中关闭中断的方法和装置
US11526358B2 (en) Deterministic execution replay for multicore systems
US10956226B2 (en) Basic runtime environment
WO2023020069A1 (zh) 虚拟机管理方法及相关系统、存储介质
US20220222077A1 (en) Tag checking procedure calls
JP2022085863A (ja) 電子制御装置、ソフトウェア更新方法、ソフトウェア更新プログラム、及び電子制御システム
JP2022085862A (ja) 電子制御装置、ソフトウェア更新方法、ソフトウェア更新プログラム、及び電子制御システム
CN117492730A (zh) 一种车辆控制的软件架构系统及软件开发方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22900341

Country of ref document: EP

Kind code of ref document: A1