Method for calling kernel function of operating system and computer device

Abstract

An embodiment of the present application discloses a method for calling kernel functions of an operating system and a computer device, belonging to the field of computer technology. In this method, each API function in the API layer of the operating system corresponds to a kernel function in the kernel layer, and the parameters of the API function and the kernel function with the corresponding relationship are the same. Since the target API function and the target kernel function have this corresponding relationship, the parameters of the target API function and the target kernel function are the same. In this way, when calling the target kernel function through the target API function, it is not necessary to pass the parameters of the target API function to the target kernel function. After directly modifying the running permission of the target user task from the user state to the privileged state in the kernel layer, the target kernel function can be directly called, and the operation is relatively simple, thereby improving the calling efficiency of the kernel function.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technologies, and in particular, to a method for calling kernel functions of an operating system and a computer device. Background Art

[0002] The automotive open system architecture (Autosar) operating system (OS) includes an application programming interface (API) layer and a kernel layer. The API layer includes multiple API functions, and the kernel layer includes multiple kernel functions. Moreover, the running space of the Autosar operating system is divided into a user space and a kernel space. The API functions are functions that can be directly used by user tasks in the user space, and the API functions are the entry points for user tasks in the user space to call kernel functions, that is, the entry points for user tasks in the user space to enter the kernel space. Among them, user tasks can also be referred to as user processes.

[0003] The Autosar operating system supports trusted operating system applications (OSAs) and untrusted OSAs. The trusted OSA runs in the kernel space, and the untrusted OSA runs in the user space. It can also be understood that the trusted OSA runs in the privileged state, and the untrusted OSA runs in the user state. When any user task needs to call a kernel function through an API function, the API layer determines whether the user task is a task of the trusted OSA or an untrusted OSA by accessing kernel data. If the user task is a task of the trusted OSA, then the user task can directly call the corresponding kernel function. If the user task is a task of the untrusted OSA, then the user task needs to send a request to the kernel layer through the syscall assembly instruction to enter the kernel space. The request carries the function identifier of the kernel function that needs to be called currently and the parameters of the API function. After receiving the request, the exception vector table module (trap) in the kernel layer determines the corresponding kernel function according to the function identifier carried in the request through the syscall_handler function, and then calls the kernel function according to the parameters carried in the request to process the request. After the processing is completed, the trap module returns the processing result to the user task.

[0004] However, since the above method is implemented by calling a kernel function in the trap module, this process requires passing the parameters of the API function to the kernel function, and the operation is relatively complex, thus reducing the calling efficiency of the kernel function. Summary of the Invention

[0005] The embodiments of the present application provide a method for calling kernel functions of an operating system and a computer device, which can solve the problems of complex operations and low calling efficiency of kernel functions in the related art. The technical solutions are as follows:

[0006] In a first aspect, a method for calling kernel functions of an operating system is provided. The operating system includes an application programming interface (API) layer and a kernel layer. The API layer includes multiple API functions, and the kernel layer includes multiple kernel functions. Each API function in the API layer corresponds to a kernel function in the kernel layer, and the API function and the kernel function with a corresponding relationship have the same parameters. The method includes: The processor determines whether the target user task is a task of a trusted operating system application (OSA) or a non-trusted OSA. The target user task refers to the user task that currently calls the target kernel function through the target API function. The target API function is one of the multiple API functions, and the target kernel function is one of the multiple kernel functions, and the target API function and the target kernel function have a corresponding relationship; If the target user task is a task of a non-trusted OSA, the processor modifies the running privilege of the target user task from the user state to the privileged state through the kernel layer; The processor calls the target kernel function through the kernel layer when the running privilege of the target user task is in the privileged state.

[0007] In the embodiments of the present application, since the target API function and the target kernel function have a corresponding relationship, the target API function and the target kernel function have the same parameters. In this way, when calling the target kernel function through the target API function, it is not necessary to pass the parameters of the target API function to the target kernel function. After only modifying the running privilege of the target user task from the user state to the privileged state in the kernel layer, the target kernel function can be directly called, and the operation is relatively simple, thereby improving the calling efficiency of the kernel function.

[0008] Optionally, the processor modifies the running privilege of the target user task from the user state to the privileged state through the kernel layer, including: The processor stores the context information of the target kernel function, and the context information of the target kernel function includes the running privilege of the target user task; The processor modifies the running privilege of the target user task in the context information of the target kernel function from the user state to the privileged state through the exception vector table module included in the kernel layer. In this way, the processor calls the target kernel function through the kernel layer when the running privilege of the target user task is in the privileged state, including: The processor calls the target kernel function through the kernel layer when the running privilege of the target user task in the context information of the target kernel function is in the privileged state.

[0009] It should be noted that the exception vector table module can be referred to as the trap module. The trap module includes multiple exception handling functions, and each exception handling function corresponds to a type of exception. In the embodiment of the present application, since the running privilege of the target user task is in the user mode and the kernel function cannot be directly called, this type of exception can be referred to as a memory protection exception. The exception handling function corresponding to the memory protection exception can be referred to as the memory protection exception handling function. Therefore, the exception vector table module can modify the running privilege of the target user task in the context information of the target kernel function from the user mode to the privileged mode through the memory protection exception handling function.

[0010] Optionally, the processor modifies the running privilege of the target user task in the context information of the target kernel function from the user mode to the privileged mode through the exception vector table module included in the kernel layer, including: the processor determines whether the call of the target kernel function comes from the API layer through the exception vector table module; if the call of the target kernel function comes from the API layer, the processor modifies the running privilege of the target user task in the context information of the target kernel function from the user mode to the privileged mode through the exception vector table module.

[0011] Since the embodiment of the present application calls the kernel function through the API function, thus avoiding calling the kernel function through the syscall assembly instruction, before the exception vector table module modifies the running privilege of the target user task in the context information of the target kernel function from the user mode to the privileged mode, it is also necessary to determine whether the call of the target kernel function comes from the API layer. If the call of the target kernel function comes from the API layer, it indicates that the current call to the target kernel function is legal, and the exception vector table module modifies the running privilege of the target user task in the context information of the target kernel function from the user mode to the privileged mode. If the call of the target kernel function does not come from the API layer, it indicates that the current call to the target kernel function is illegal, and the exception vector table module will handle it according to the exception protection process.

[0012] Optionally, the processor determines whether the call of the target kernel function comes from the API layer through the exception vector table module, including: the processor obtains the start address and the end address of the API layer through the exception vector table module; if the return address of the target kernel function is between the start address and the end address, it is determined that the call of the target kernel function comes from the API layer.

[0013] In an embodiment of the present application, by determining the start address and end address of the API layer, it is possible to quickly determine whether the call of the target kernel function comes from the API layer according to the return address of the target kernel function, thereby improving the call efficiency of the kernel function.

[0014] Optionally, after the processor calls the target kernel function through the kernel layer when the running privilege of the target user task is in the privileged state, it further includes: when the processor determines that the call of the target kernel function is completed, the running privilege of the target user task is restored to the user state.

[0015] Since during the process of the processor running the target user task, it is determined that the target user task needs to call the target kernel function through the target API function, at this time, the processor will store the context information of the target API function. However, after the call of the target kernel function is completed, in order to continue running the subsequent code, the processor can restore the running privilege of the target user task to the state before calling the target kernel function, that is, the user state.

[0016] Optionally, the processor determines whether the target user task is a task of a trusted OSA or a non-trusted OSA, including: the processor determines whether the target user task is a task of a trusted OSA or a non-trusted OSA through the memory protection unit MPU.

[0017] In an embodiment of the present application, the MPU in the hardware layer is used to determine whether the target user task is a task of a trusted OSA or a non-trusted OSA, without the need to determine by accessing kernel data, which simplifies the operation and improves the performance of the computer device.

[0018] In a second aspect, a computer device is provided, and the computer device has a function of implementing the behavior of the method for calling the kernel function of the operating system in the first aspect above. The computer device includes at least one module, and the at least one module is used to implement the method for calling the kernel function of the operating system provided in the first aspect above.

[0019] In a third aspect, a computer device is provided, and the computer device includes a processor and a memory. The memory is used to store a program for executing the method provided in the first aspect above, and store data related to implementing the method provided in the first aspect above. The processor is configured to execute the program stored in the memory. The operating device of the storage device may further include a communication bus, and the communication bus is used to establish a connection between the processor and the memory.

[0020] In a fourth aspect, a computer-readable storage medium is provided, and instructions are stored in the computer-readable storage medium. When the instructions are run on a computer, the computer is caused to execute the method described in the first aspect above.

[0021] In a fifth aspect, a computer program product including instructions is provided. When it runs on a computer, the computer is caused to execute the method described in the first aspect above.

[0022] The technical effects obtained in the second, third, fourth, and fifth aspects above are similar to those obtained by the corresponding technical means in the first aspect, and will not be elaborated here.

[0023] The technical solutions provided in the embodiments of the present application at least bring the following beneficial effects:

[0024] Since the target API function and the target kernel function have a corresponding relationship, the parameters of the target API function and the target kernel function are the same. In this way, when calling the target kernel function through the target API function, it is not necessary to pass the parameters of the target API function to the target kernel function. After directly modifying the running permission of the target user task from the user state to the privileged state at the kernel layer, the target kernel function can be directly called, and the operation is relatively simple, thereby improving the calling efficiency of the kernel function. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 is a schematic structural diagram of a computer device provided by an embodiment of the present application;

[0026] Figure 2 is a schematic diagram of the corresponding relationship between an API function and a kernel function provided by an embodiment of the present application;

[0027] Figure 3 is a schematic structural diagram of a hardware layer included in a computer device provided by an embodiment of the present application;

[0028] Figure 4 is a flowchart of a method for calling a kernel function of an operating system provided by an embodiment of the present application;

[0029] Figure 5 is a schematic diagram of the process of a non-trusted OSA task calling a target kernel function provided by an embodiment of the present application;

[0030] Figure 6 is a schematic diagram of the process of a trusted OSA task calling a target kernel function provided by an embodiment of the present application;

[0031] Figure 7 is a schematic structural diagram of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0032] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the following will further describe the embodiments of the present application in detail with reference to the accompanying drawings.

[0033] Please refer to Figure 1 , Figure 1 which is a schematic structural diagram of a computer device shown according to an embodiment of the present application. The computer device includes an application layer, an API layer, a kernel layer, a driver layer, and a hardware layer.

[0034] The application layer is used to run various application programs, including a trusted OSA and an untrusted OSA.

[0035] The API layer, the kernel layer, and the driver layer constitute the operating system of the computer device, and the operating system can be an Autosar operating system.

[0036] The API layer includes multiple API functions, and the multiple API functions can also be referred to as system call interfaces. The multiple API functions can be directly used by user tasks in the user space, that is, the multiple API functions can be directly used by user tasks in the user state. The kernel layer includes multiple kernel functions, and the multiple kernel functions cannot be called by user tasks in the user space, but can be called by user tasks in the kernel space, that is, the multiple kernel functions cannot be called by user tasks in the user state, but can be called by user tasks in the privileged state.

[0037] Each API function in the API layer corresponds to a kernel function in the kernel layer, and the parameters of the corresponding API function and kernel function are the same. Moreover, in the embodiment of the present application, the API function can directly call the corresponding kernel function.

[0038] In some embodiments, for the corresponding API function and kernel function, the naming of the kernel function can be obtained by adding a prefix before the naming of the API function. For example, as Figure 2 shown, the API layer includes three API functions, namely Activate Task (start task), Terminate Task (terminate task), and API. The corresponding kernel functions of these three API functions are xx_Activate Task, xx_Terminate Task, and xx_API respectively, and the API function can directly call the corresponding kernel function. That is, call xx_Activate Task means to call the start task function with the prefix xx_, call xx_Terminate Task means to call the terminate task function with the prefix xx_, and call xx_API means to call the API function with the prefix xx_.

[0039] The hardware layer includes an MPU. Through the MPU, it is possible to determine whether a user task is a task of a trusted OSA or a task of a non-trusted OSA, so as to determine whether the target user task has the permission to call the target kernel function. In some embodiments, the computer device is an Electronic Control Unit (ECU). At this time, the hardware layer includes the relevant hardware included in the ECU.

[0040] In some embodiments, please refer to Figure 3 , the hardware layer further includes at least one processor 301, a communication bus 302, a memory 303, and at least one communication interface 304.

[0041] The processor 301 is a general-purpose central processing unit (CPU), a network processor (NP), a microprocessor, or one or more integrated circuits for implementing the solution of the present application. For example, an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The above PLD is a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0042] The communication bus 302 is used to transfer information between the above components. The communication bus 302 is divided into an address bus, a data bus, a control bus, etc. For the sake of simplicity, only a thick line is shown in the figure, but it does not mean that there is only one bus or one type of bus.

[0043] The memory 303 is a read-only memory (ROM), or a random access memory (RAM), or an electrically erasable programmable read-only memory (EEPROM), an optical disc (including a compact disc read-only memory (CD-ROM), a compressed optical disc, a laser disc, a digital versatile disc, a Blu-ray disc, etc.), a magnetic disk storage medium, or any other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 303 can exist independently and be connected to the processor 301 through the communication bus 303. The memory 303 can also be integrated with the processor 301.

[0044] The communication interface 304 uses any device such as a transceiver for communicating with other devices or communication networks. The communication interface 304 includes a wired communication interface and also includes a wireless communication interface. Among them, the wired communication interface is, for example, an Ethernet interface. The Ethernet interface is an optical interface, an electrical interface, or a combination thereof. The wireless communication interface is a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof, etc.

[0045] In a specific implementation, as an embodiment, the processor 301 includes one or more CPUs, such as Figure 3 CPU0 and CPU1 shown in

[0046] In a specific implementation, as an embodiment, the hardware layer includes multiple processors, such as Figure 3 the processor 301 and the processor 305 shown in

[0047] In a specific implementation, as an embodiment, the hardware layer further includes an output device 306 and an input device 307. The output device 306 communicates with the processor 301 to display information in various ways. For example, the output device 306 is a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, a projector, or the like. The input device 307 communicates with the processor 301 to receive user input in various ways. For example, the input device 307 can be a mouse, a keyboard, a touch screen device, a sensing device, or the like.

[0048] In some embodiments, the memory 303 is used to store the program code 210 for executing the solution of this application, and the processor 301 can execute the program code 310 stored in the memory 303. The computer device can implement the method provided in the following Figure 4 embodiment through the program code 210 in the processor 201 and the memory 203.

[0049] Figure 4 is a flowchart of a method for calling kernel functions of an operating system provided by an embodiment of this application. This method is applied to a computer device. The operating system of the computer device includes an API layer and a kernel layer. The API layer includes multiple API functions, and the kernel layer includes multiple kernel functions. Each API function in the API layer corresponds to a kernel function in the kernel layer, and the parameters of the corresponding API function and kernel function are the same. Please refer to Figure 4 and the method includes the following steps.

[0050] Step 401: The processor determines whether the target user task is a task of a trusted OSA or a task of a non-trusted OSA. The target user task refers to the user task that currently calls the target kernel function through the target API function. The target API function is one of the multiple API functions included in the API layer, and the target kernel function is one of the multiple kernel functions included in the kernel layer, and the target API function and the target kernel function have a corresponding relationship.

[0051] Since a kernel function can be called by a user task in the privileged state but cannot be called by a user task in the user state, when the processor determines that the user task currently calls the target kernel function through the target API function, the processor needs to determine whether the target user task is a task of a trusted OSA or a task of a non-trusted OSA, so as to determine whether the target user task has the permission to call the target kernel function.

[0052] In the embodiments of the present application, the processor is used to run the code in the API layer and the code in the kernel layer, and the API function can directly call the corresponding kernel function. Therefore, from the perspective of the API layer and the kernel layer, the API layer can directly send a call request to the kernel layer, and the call request carries the identifier of the target user task. Since the kernel function needs to be called in the privileged state, after the kernel layer receives the call request, the MPU is used to determine whether the target user task is a task of the trusted OSA or a task of the untrusted OSA, that is, the MPU is used to determine whether the target user task has the permission to call the target kernel function.

[0053] In some embodiments, the MPU stores the correspondence between the identifier of each user task and the range of the executable code segment. In this way, when the kernel layer determines whether the target user task is a task of the trusted OSA or a task of the untrusted OSA through the MPU, it can determine whether the range of the executable code segment corresponding to the target user task includes the code segment of the kernel layer through the identifier of the target user task. If the range of the executable code segment corresponding to the target user task includes the code segment of the kernel layer, then it is determined that the target user task is a task of the trusted OSA. If the range of the executable code segment corresponding to the target user task does not include the code segment of the kernel layer, then it is determined that the target user task is a task of the untrusted OSA.

[0054] In the embodiments of the present application, the API function directly calls the corresponding kernel function, and there is no need to pass the identifier of the kernel function to be called to the kernel layer, which simplifies the operation. In addition, in the embodiments of the present application, the MPU in the hardware layer is used to determine whether the target user task is a task of the trusted OSA or a task of the untrusted OSA, without determining by accessing the kernel data, which simplifies the operation and improves the performance of the computer device.

[0055] Step 402: If the target user task is a task of the untrusted OSA, the processor modifies the running permission of the target user task from the user state to the privileged state through the kernel layer.

[0056] In some embodiments, the processor modifies the running permission of the target user task from the user state to the privileged state through the following steps (1)-(2).

[0057] (1) The processor stores the context information of the target kernel function, and the context information of the target kernel function includes the running permission of the target user task.

[0058] In some embodiments, the context information of the target kernel function includes the values of multiple registers at the current moment. The multiple registers refer to the registers included in the computer device and are used to temporarily store information such as instructions, data, and addresses during the operation of the computer device. Therefore, the processor backs up and stores the values of the multiple registers at the current moment.

[0059] Among them, the multiple registers include a Program Status Word (PSW) register, and the PSW register is used to store the running privilege of the target user task.

[0060] It should be noted that in the case where the target user task is a task of a non-trusted OSA, it indicates that the running privilege of the target user task is the user mode. Therefore, when calling the target kernel function through the target API function, the running privilege of the target user task stored in the PSW register is the user mode.

[0061] (2) The processor modifies the running privilege of the target user task in the context information of the target kernel function from the user mode to the privileged mode through the exception vector table module included in the kernel layer.

[0062] Since the target user task is a task of a non-trusted OSA, when the target user task calls the target kernel function through the target API function, an exception will be triggered in the kernel layer. And the exception vector table model included in the kernel layer is used to specifically handle the process after the exception. Therefore, the processor will modify the running privilege of the target user task in the context information of the target kernel function from the user mode to the privileged mode through the exception vector table module included in the kernel layer.

[0063] Since the embodiment of the present application calls the kernel function through the API function, thereby avoiding calling the kernel function through the syscall assembly instruction, before the exception vector table module modifies the running privilege of the target user task in the context information of the target kernel function from the user mode to the privileged mode, it is also necessary to determine whether the call of the target kernel function comes from the API layer. If the call of the target kernel function comes from the API layer, it indicates that the current call to the target kernel function is legal, and the exception vector table module will modify the running privilege of the target user task in the context information of the target kernel function from the user mode to the privileged mode. If the call of the target kernel function does not come from the API layer, it indicates that the current call to the target kernel function is illegal, and the exception vector table module will process it according to the exception protection process.

[0064] In the embodiment of the present application, the API layer corresponds to a starting address and an ending address, and the return address of the target kernel function is the address of the caller of the target kernel function. In this way, when determining whether the call of the target kernel function comes from the API layer, the exception vector table module can obtain the starting address and the ending address of the API layer. If the return address of the target kernel function is between the starting address and the ending address, it is determined that the call of the target kernel function comes from the API layer. Otherwise, it is determined that the call of the target kernel function does not come from the API layer.

[0065] It should be noted that the exception vector table module can be called the trap module. The trap module includes multiple exception handling functions, and each exception handling function corresponds to a type of exception. In the embodiments of the present application, since the running privilege of the target user task is in the user mode and the kernel function cannot be directly called, this type of exception can be called a memory protection exception. The exception handling function corresponding to the memory protection exception can be called a memory protection exception handling function. For example, the memory protection trap handler function. Therefore, the exception vector table module can modify the running privilege of the target user task in the context information of the target kernel function from the user mode to the privileged mode through the memory protection exception handling function.

[0066] Under normal circumstances, the context information is stored in a specific piece of memory and stored in the form of a linked list. Only modules or processors in the privileged mode can perform read and write operations on it. In the embodiments of the present application, the exception vector table module itself runs in the privileged mode. Therefore, the context information of the target kernel function can be modified through the exception vector table module.

[0067] Step 403: The processor calls the target kernel function through the kernel layer when the running privilege of the target user task is in the privileged mode.

[0068] After the exception vector table module modifies the running privilege of the target user task in the context information of the target kernel function from the user mode to the privileged mode, as the result of the exception vector table module is returned, the processor will restore the values of the above multiple registers to the data stored in the context information of the target kernel function. At this time, for the PSW register, the running privilege of the target user task stored in this register will be modified to the privileged mode. Since in the current situation, the running privilege of the target user task stored in the PSW register is in the privileged mode, then the processor can continue to run the kernel layer code, and thus can directly call the target kernel function. That is, the processor calls the target kernel function through the kernel layer when the running privilege of the target user task in the context information of the target kernel function is in the privileged mode.

[0069] Based on the descriptions of step 402 and step 403 above, when the processor determines that the target user task is a non-trusted OSA task, it indicates that the running privilege of the target user task is in the user mode. And a target user task in the user mode cannot call kernel functions. At this time, the kernel layer will trigger an exception. In this case, to handle the exception, the processor will store the context information of the target kernel function. However, for the exception vector table module in the kernel layer, the exception vector table module will determine whether the call of the target kernel function comes from the API layer. If the call of the target kernel function comes from the API layer, it will determine that the call of the target kernel function is a legal call, and thus will modify the running privilege of the target user task in the context information of the target kernel function from the user mode to the privileged mode. It can also be understood as elevating the running privilege of the target user task. In this way, with the return of the exception vector table module, the processor determines that the exception situation has been handled, and the processor will return to the call process of the target kernel function again and re-determine the running privilege of the target user task. At this time, the processor determines that the running privilege of the target user task is in the privileged mode. Therefore, the processor will continue to run the kernel layer code and thus call the target kernel function.

[0070] In addition, the above step 402 and step 403 are the processes of calling the target kernel function when the target user task is a non-trusted OSA task. When the target user task is a trusted OSA task, it indicates that the target user task is in the privileged mode. At this time, the processor can directly call the target kernel function without triggering an exception in the kernel layer.

[0071] Step 404: When the processor determines that the call of the target kernel function is completed, it restores the running privilege of the target user task to the user mode.

[0072] After the processor runs until the target user task returns from the target kernel function, it determines that the target kernel function has been called. At this time, in order to continue running the subsequent code, the processor needs to restore the running privilege of the target user task to the user mode.

[0073] Since the embodiment of the present application directly calls the kernel function through the API function, when the target API function calls the target kernel function, the processor will store the context information of the target API function. The context information of the target API function includes the values of multiple registers. Moreover, in the case where the target user task is a non-trusted OSA task, the running privilege of the target user task stored in the context information of the target API function is in the user mode. Therefore, after the processor determines that the call of the target kernel function is completed, it can restore the running privilege of the target user task stored in the PSW register to the user mode according to the context information of the target API function.

[0074] Next, through Figure 5 andFigure 6 , illustrate the call situations of the tasks of the trusted OSA and the tasks of the untrusted OSA to the target kernel function.

[0075] For the tasks of the untrusted OSA, such as Figure 5 shown, in step ①, the target user task belonging to the untrusted OSA calls the target kernel function through the target API function. At this time, the running privilege of the target user task stored in the PSW register is the user state, and the API layer will store the running privilege of the target user task stored in the PSW register as the context information of the target API function.

[0076] In step ②, the processor determines that the target user task is a task of the untrusted OSA. At this time, the running privilege of the target user task stored in the PSW register is still the user state, and the processor will store the running privilege of the target user task stored in the PSW register as the context information of the target kernel function. Next, a kernel layer exception is triggered.

[0077] In step ③, the processor modifies the running privilege of the target user task from the user state to the privileged state through the trap module. Specifically, the trap module determines whether the call of the target kernel function comes from the API layer through the return address of the target kernel function. If so, it determines that the call of the target kernel function is a legal call, and modifies the running privilege of the target user task in the context information of the target kernel function from the user state to the privileged state. Otherwise, it determines that the call of the target kernel function is an illegal call and directly proceeds with the subsequent exception handling process.

[0078] In step ④, with the result return of the trap module, the processor determines that the running privilege of the target user task stored in the PSW register is the privileged state. At this time, the target kernel function will be called.

[0079] In step ⑤, after calling the target kernel function, the processor restores the running privilege of the target user task stored in the PSW register to the state before the target kernel function was called through the context information of the target API function, that is, restores the running privilege of the target user task stored in the PSW register to the user state.

[0080] For the tasks of the trusted OSA, such as Figure 6 shown, in step ①, the target user task belonging to the trusted OSA calls the target kernel function through the target API function. At this time, the running privilege of the target user task stored in the PSW register is the privileged state, and the processor will store the running privilege of the target user task stored in the PSW register as the context information of the target API function.

[0081] In step ②, the processor determines that the target user task is a task of the trusted OSA. At this time, the running privilege of the target user task stored in the PSW register is still in the privileged state, and the processor will directly call the target kernel function.

[0082] In step ③, after calling the target kernel function, the processor restores the running privilege of the target user task stored in the PSW register to the state before the target kernel function was called through the context information of the target API function. Since the target user task belonging to the trusted OSA itself runs in the kernel space, the running privilege of the target user task stored in the PSW register is still in the privileged state.

[0083] In summary, since the target API function and the target kernel function have a corresponding relationship, the parameters of the target API function and the target kernel function are the same. In this way, when calling the target kernel function through the target API function, it is not necessary to pass the parameters of the target API function to the target kernel function. After simply modifying the running privilege of the target user task from the user state to the privileged state, the target kernel function can be directly called, which is relatively simple and thus improves the calling efficiency of the kernel function. In addition, for the tasks of the trusted OSA and the non-trusted OSA, a set of API functions is shared, reducing the code volume and further reducing the code maintenance workload. Moreover, since the running efficiency of calling the kernel function through the API function is generally higher than that through the syscall assembly instruction, and in the embodiment of the present application, the running privilege of the target user task is enhanced through the exception vector table module, the operation is simple and the efficiency is also improved a lot.

[0084] Figure 7 It is a schematic structural diagram of a computer device provided by an embodiment of the present application. The operating system of the computer device includes an API layer and a kernel layer. The API layer includes multiple API functions, and the kernel layer includes multiple kernel functions. Each API function in the API layer corresponds to a kernel function in the kernel layer, and the parameters of the API function and the kernel function with a corresponding relationship are the same. Please refer to Figure 7 , the computer device includes:

[0085] A determination module 701, configured to determine whether the target user task is a task of the trusted OSA or a task of the non-trusted OSA. The target user task refers to the user task that currently calls the target kernel function through the target API function. The target API function is one of the multiple API functions, and the target kernel function is one of the multiple kernel functions, and the target API function and the target kernel function have a corresponding relationship;

[0086] The permission modification module 702 is used to, if the target user task is a task of a non-trusted OSA, modify the running permission of the target user task from the user state to the privileged state through the kernel layer;

[0087] The calling module 703 is used to call the target kernel function through the kernel layer when the running permission of the target user task is in the privileged state.

[0088] Optionally, the permission modification module 702 includes:

[0089] The storage sub-module is used to store the context information of the target kernel function, and the context information of the target kernel function includes the running permission of the target user task;

[0090] The permission modification sub-module is used to modify the running permission of the target user task in the context information of the target kernel function from the user state to the privileged state through the exception vector table module included in the kernel layer;

[0091] The calling module includes:

[0092] The calling sub-module is used to call the target kernel function through the kernel layer when the running permission of the target user task in the context information of the target kernel function is in the privileged state.

[0093] Optionally, the permission modification sub-module includes:

[0094] The judgment unit is used to determine whether the call of the target kernel function comes from the API layer through the exception vector table module;

[0095] The permission modification unit is used to, if the call of the target kernel function comes from the API layer, modify the running permission of the target user task in the context information of the target kernel function from the user state to the privileged state through the exception vector table module.

[0096] Optionally, the judgment unit is used for:

[0097] Obtain the start address and end address of the API layer through the exception vector table module;

[0098] If the return address of the target kernel function is between the start address and the end address, it is determined that the call of the target kernel function comes from the API layer.

[0099] Optionally, the computer device further includes:

[0100] The permission recovery module is used to restore the running permission of the target user task to the user state when it is determined that the call of the target kernel function is completed.

[0101] Optionally, the determination module is specifically used for:

[0102] Determine whether the target user task is a task of the trusted OSA or a task of the untrusted OSA through the memory protection unit MPU.

[0103] Since the target API function and the target kernel function have a corresponding relationship, the parameters of the target API function and the target kernel function are the same. In this way, when calling the target kernel function through the target API function, it is not necessary to pass the parameters of the target API function to the target kernel function. After only modifying the running permission of the target user task from the user state to the privileged state, the target kernel function can be directly called, and the operation is relatively simple, thereby improving the calling efficiency of the kernel function. In addition, for the tasks of the trusted OSA and the untrusted OSA, a set of API functions is shared, reducing the amount of code and further reducing the workload of code maintenance. Moreover, since the running efficiency of calling the kernel function through the API function is usually higher than that of calling the kernel function through the syscall assembly instruction, and in the embodiment of the present application, the running permission of the target user task is improved through the exception vector table module, the operation is simple and the efficiency is also improved a lot.

[0104] It should be noted that when the computer device provided in the above embodiment calls the kernel function of the operating system, only the above-mentioned division of each functional module is used for illustration. In practical applications, the above functions can be allocated to different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the computer device provided in the above embodiment and the embodiment of the method for calling the kernel function of the operating system belong to the same concept, and the specific implementation process can be seen in the method embodiment, which will not be elaborated here.

[0105] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from a website, computer, server, or data center to another website, computer, server, or data center by wire (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wirelessly (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer, or a data storage device such as a server or data center that includes one or more integrated available media. The available media can be magnetic media (e.g., floppy disk, hard disk, magnetic tape), optical media (e.g., digital versatile disc (DVD)), or semiconductor media (e.g., solid state disk (SSD)), etc. It should be noted that the computer-readable storage medium mentioned in the embodiments of the present application can be a non-volatile storage medium, in other words, a non-transitory storage medium.

[0106] It should be understood that the "plurality" mentioned herein refers to two or more. In the description of the embodiments of the present application, unless otherwise specified, " / " means "or". For example, A / B can mean A or B. The "and / or" herein is merely a description of the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, terms such as "first" and "second" are used to distinguish the same items or similar items with basically the same functions and roles. Those skilled in the art can understand that the terms "first", "second", etc. do not limit the quantity and execution order, and the terms "first", "second", etc. do not necessarily mean different.

[0107] The above are the embodiments provided by the present application, which are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for kernel function call of an operating system, characterized in that The operating system includes an Application Programming Interface (API) layer and a kernel layer. The API layer includes multiple API functions, and the kernel layer includes multiple kernel functions. Each API function in the API layer corresponds to a kernel function in the kernel layer, and the parameters of the corresponding API function and kernel function are the same. The method includes: The processor determines whether the target user task is a task of a trusted operating system application (OSA) or a non-trusted OSA. The target user task refers to the user task that currently calls the target kernel function through the target API function. The target API function is one of the multiple API functions, and the target kernel function is one of the multiple kernel functions, and the target API function and the target kernel function have a corresponding relationship; If the target user task is a task of a non-trusted OSA, the processor stores the context information of the target kernel function, and the context information of the target kernel function includes the running privilege of the target user task; The processor modifies the running privilege of the target user task in the context information of the target kernel function from the user mode to the privileged mode through the exception vector table module included in the kernel layer; The processor calls the target kernel function through the kernel layer when the running privilege of the target user task in the context information of the target kernel function is in the privileged mode; 2. The method according to claim 1, wherein The processor modifies the running privilege of the target user task in the context information of the target kernel function from the user mode to the privileged mode through the exception vector table module included in the kernel layer, including: The processor determines whether the call of the target kernel function comes from the API layer through the exception vector table module; If the call of the target kernel function comes from the API layer, the processor modifies the running privilege of the target user task in the context information of the target kernel function from the user mode to the privileged mode through the exception vector table module; 3. The method according to claim 2, wherein The processor determines whether the call of the target kernel function comes from the API layer through the exception vector table module, including: The processor obtains the start address and the end address of the API layer through the exception vector table module; If the return address of the target kernel function is between the start address and the end address, it is determined that the call of the target kernel function comes from the API layer; 4. The method according to any one of claims 1-3, characterized in that, After the processor calls the target kernel function through the kernel layer when the running privilege of the target user task in the context information of the target kernel function is in the privileged mode, it further includes: When the processor determines that the call of the target kernel function is completed, it restores the running privilege of the target user task to the user mode; 5. The method according to any one of claims 1-3, characterized in that The processor determines whether the target user task is a task of a trusted OSA or a non-trusted OSA, including: The processor determines whether the target user task is a task of a trusted OSA or a non-trusted OSA through the Memory Protection Unit (MPU).

6. A computer device, characterized in that, The operating system of the computer device includes an Application Programming Interface (API) layer and a kernel layer. The API layer includes multiple API functions, and the kernel layer includes multiple kernel functions. Each API function in the API layer corresponds to a kernel function in the kernel layer, and the parameters of the corresponding API function and kernel function are the same. The computer device includes: A determination module, configured to determine whether the target user task is a task of a trusted operating system application (OSA) or a task of a non-trusted OSA. The target user task refers to the user task that currently calls the target kernel function through the target API function. The target API function is one of the multiple API functions, and the target kernel function is one of the multiple kernel functions, and the target API function and the target kernel function have a corresponding relationship; A permission modification module, configured to, if the target user task is a task of a non-trusted OSA, modify the running permission of the target user task from the user mode to the privileged mode through the kernel layer; A call module, configured to call the target kernel function through the kernel layer when the running permission of the target user task is in the privileged mode; Wherein, the permission modification module includes: A storage sub-module, configured to store the context information of the target kernel function, and the context information of the target kernel function includes the running permission of the target user task; A permission modification sub-module, configured to modify the running permission of the target user task in the context information of the target kernel function from the user mode to the privileged mode through the exception vector table module included in the kernel layer; The call module includes: A call sub-module, configured to call the target kernel function through the kernel layer when the running permission of the target user task in the context information of the target kernel function is in the privileged mode.

7. The computer device according to claim 6, wherein The permission modification sub-module includes: A judgment unit, configured to determine whether the call of the target kernel function comes from the API layer through the exception vector table module; A permission modification unit, configured to, if the call of the target kernel function comes from the API layer, modify the running permission of the target user task in the context information of the target kernel function from the user mode to the privileged mode through the exception vector table module.

8. The computer device according to claim 7, characterized in that, The judgment unit is specifically configured to: Obtain the start address and end address of the API layer through the exception vector table module; If the return address of the target kernel function is between the start address and the end address, determine that the call of the target kernel function comes from the API layer.

9. The computer device according to any one of claims 6-8, characterized in that, The computer device further includes: A permission recovery module, configured to restore the running permission of the target user task to the user mode when the call of the target kernel function is completed.

10. The computer device according to any one of claims 6-8, characterized in that, The determination module is specifically configured to: Determine whether the target user task is a task of a trusted OSA or a task of a non-trusted OSA through a Memory Protection Unit (MPU).

11. A computer-readable storage medium, characterized in that, Instructions are stored in the storage medium, and when the instructions are run on a computer, the computer is caused to execute the steps of the method according to any one of claims 1-5.

12. A computer program product comprising instructions, characterized in that, When the instructions are run on a computer, the computer is caused to execute the steps of the method according to any one of claims 1-5.

Images