Method and device for running application in process

Abstract

An embodiment of the present specification provides a method for running an application in a process, comprising: obtaining a first address space based on a first segment descriptor in a descriptor table, the first address space being a subspace in the address space of the process corresponding to the application; setting the descriptor table to be inaccessible; and running application code of the application stored in the first address space.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of computer technology, and more specifically, to a method and device for running an application in a process. Background Art

[0002] In current computer systems, an application is usually run through a process, and the memory between processes is completely isolated, so as to achieve memory isolation between applications. The process can be specifically implemented as a container, for example. Among them, the container is an operating system virtualization technology used to package applications and their dependencies and run them in an isolated environment. The disadvantage of the above method is: taking the container as an example, if the application is blocked due to reading and writing during operation, the operating system needs to perform task scheduling and switch to run another container, and the overhead of switching containers is relatively large. Summary of the invention

[0003] The embodiments of this specification are intended to provide a more effective solution for running applications in a process, running multiple applications in one process based on a segmentation mechanism and a memory protection key (MPK) mechanism, thereby improving the efficiency of the operating system running multiple applications while ensuring memory isolation between applications.

[0004] To achieve the above-mentioned purpose, one aspect of the present specification provides a method for running an application in a process, comprising: obtaining a first address space based on a first segment descriptor in a descriptor table, the first address space being a subspace in the address space of the process corresponding to the application, wherein other descriptors in the descriptor table correspond to content that the application is prohibited from accessing; setting the descriptor table to be inaccessible; and running the application code of the application stored in the first address space.

[0005] In one embodiment, the method further includes: after setting the descriptor table to be inaccessible, restoring the running scene of the application stored in the first address space.

[0006] In one embodiment, after the descriptor table is set to be inaccessible, restoring the running scene of the application stored in the first address space includes: restoring the running scene of the application stored in the first address space after the descriptor table is set to be inaccessible by running the management code of the application stored in the first address space.

[0007] In one embodiment, the first address space is also used to store data and a stack of the application, the first segment descriptor includes at least a first data segment descriptor and a first stack segment descriptor, and the stack is used to store the execution scene.

[0008] In one embodiment, the method further includes disabling the SMAP function of the processor, setting the descriptor table to be protected by a first protection key, wherein setting the descriptor table to be inaccessible includes: setting permissions corresponding to the first protection key so that the descriptor table is inaccessible.

[0009] In one embodiment, the method further includes, before running the application code of the application stored in the first address space, preventing the application from setting the permission of the first protection key through the execution of hardware or software code.

[0010] In one embodiment, the method further includes: after finishing running the application code of the application, storing the running site of the application, and after setting the permission corresponding to the first protection key to make the descriptor table accessible, jumping to other codes.

[0011] In one embodiment, the method further includes: after an exception occurs in the application, setting the descriptor table to be accessible; based on the first segment descriptor, saving the application running scene to be restored to the first address space; and jumping to the management code running the application.

[0012] Another aspect of the present specification provides a device for running an application in a process, comprising:

[0013] an acquiring unit, configured to acquire a first address space based on a first segment descriptor in a descriptor table, wherein the first address space is a subspace corresponding to the application in the address space of the process, wherein other descriptors in the descriptor table correspond to content that is prohibited for the application to access;

[0014] A setting unit, used for setting the descriptor table to be inaccessible;

[0015] A running unit is used to run the application code of the application stored in the first address space.

[0016] Another aspect of the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, any of the above methods is implemented.

[0017] On the other hand, the present specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute any one of the above methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The embodiments of this specification are described in conjunction with the accompanying drawings to make the embodiments of this specification clearer:

[0019] Figure 1A schematic diagram showing a computing device used in an embodiment of the present application;

[0020] Figure 2 A schematic diagram of isolating application memory based on three mechanisms;

[0021] Figure 3 A schematic diagram of the structure of the application container provided in the embodiment of the present application;

[0022] Figure 4 A flowchart for starting an application container provided in an embodiment of the present application;

[0023] Figure 5 The sub-application processing module provided in the embodiment of the present application includes a flowchart;

[0024] Figure 6 The flowchart of the submodule provided in the embodiment of the present application includes:

[0025] Figure 7 The flowchart of the swap-out submodule provided in the embodiment of the present application includes;

[0026] Figure 8 A structural diagram of a device for running an application in a process provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] The embodiments of the present application will be described below with reference to the accompanying drawings.

[0028] Figure 1 A schematic diagram of a computing device used in an embodiment of the present application is shown. Figure 1 As shown in , the computing device includes a CPU 11 and a memory 12 .

[0029] The CPU 11 is, for example, an Intel X64 processor that supports both 32-bit code and 64-bit code. When the CPU 11 is in IA64 mode, it supports running 32-bit applications in compatibility mode and running 64-bit applications in 64-bit mode; when the current segment descriptor indicates 32-bit code, the CPU 11 enters the compatibility mode, and the application can use all capabilities in the 32-bit mode, such as the segmentation mechanism.

[0030] Among them, the segmentation mechanism is to provide protection for code, data structure, program or application through hardware mechanism. Taking application as an example, CPU11 can allocate corresponding segment descriptors for each application in the descriptor table 121 in the memory 12, and the segment descriptor specifies the segment corresponding to the application (i.e., a continuous logical address in the linear address). Among them, the descriptor table 121 includes a global descriptor table (global descriptor table, GDT) or a local descriptor table (local descriptor table, LDT). The segment descriptor includes, for example, a 32-bit code segment descriptor, a data segment descriptor and a stack segment descriptor. The base addresses of these segment descriptors are all set to the starting address of the linear address segment assigned to the application, and the length is set to the length of the linear address assigned to the application (the length is less than or equal to 4G), so that each application can have an independent logical address space or virtual address space. For example, if a 32-bit application is running in 64-bit mode, the base addresses of the code segment, data segment, and stack segment used by the 32-bit application code may all be set to 7G, and the segment length limit is set to 4G. When the 32-bit application is running, it can only access linear addresses within the interval [7G, 11G). The segment descriptor also limits the read and write permissions of the corresponding segment.

[0031] CPU11 can access the segment through the segment descriptor corresponding to the segment in the memory 12. CPU11 stores the index of the segment descriptor corresponding to the application in the segment register 111, so that it can access the segment descriptor according to the read and write permissions specified by the segment descriptor, obtain the linear address of the segment specified by the segment descriptor, and access the segment corresponding to the application based on the linear address. At the same time, after obtaining the linear address of the segment, CPU11 caches the linear address for the next access to the segment.

[0032] Among them, in the operating system related concepts, the memory address that the application can see is called a virtual address; in the Intel manual, the memory address that the application sees is called a logical address. The memory management unit (MMU) inside the processor CPU11 is responsible for translating the linear address into a physical memory address.

[0033] For 64-bit applications, their logical address and linear address are equal. The logical address is 64 bits, of which the actual effective bits are 48 bits or 52 bits (depending on the specific implementation of the processor). For 32-bit applications, the application's addressing space is limited by the 32-bit mode. The maximum length of a segment is 4G bytes, that is, the application can only use 4G logical addresses. In 32-bit mode, the MMU obtains the linear address used when accessing memory by adding the base address of the segment used when accessing memory (recorded in the segment descriptor) and the logical address when accessing memory. In addition, since the linear address is not equivalent to the physical memory address, the processor's memory management unit (MMU) can achieve different linear addresses mapped to different physical memory addresses (memory complete isolation scenario); or some linear addresses are mapped to the same physical memory address (such as memory compression scenario or memory sharing scenario), while other linear addresses are mapped to different physical memory addresses.

[0034] Normally, by using a segmentation mechanism to assign different linear addresses to different applications, the memory space of the application can be isolated. However, some malicious applications may have built-in instructions for switching segment registers, which switch the index of the segment descriptor in the segment register 111, so that the corresponding segments of other applications can be accessed by reading the segment descriptors of other applications, which brings insecurity. In addition, since the number of bytes of this instruction is small, full code search and replacement of the instructions for switching segment registers will cause a large number of unnecessary replacements, affecting performance.

[0035] To this end, an embodiment of the present application provides a solution for running applications in a process. After a linear address is assigned to each application through a segmentation mechanism, a memory protection key (MPK) mechanism is used to ensure that the descriptor table is inaccessible when the application code is running. Therefore, even if the application code has built-in instructions for switching segment registers, it cannot switch to the segments of other applications by reading the segment descriptors of other applications, thereby providing stricter memory isolation between applications.

[0036] Among them, on Intel X64 compatible processors, the access permission control for memory is controlled by the segmentation mechanism, paging mechanism, and MPK mechanism, among which the segmentation mechanism includes the read and write permissions for the segment and the linear address range corresponding to the segment; the paging mechanism stipulates how the application can access which linear addresses, the addresses accessible in user mode are called user mode addresses, and the corresponding pages are called user mode pages; the MPK mechanism is a supplement to the paging mechanism, through which the page table 122 defines which key each user mode page is protected by, and the protection key register (protectionkeyrightsregister) 112 in the processor defines what access permissions the current processor has to the memory pages protected by each key, that is, when accessing the user mode page, it is also necessary to query the information in the protection key register 112 to determine whether the corresponding access permissions are currently available. Although the application can modify the value in the protection key register 112 by executing the wrpkru instruction, thereby changing the processor's access rights to the memory pages protected by each key, since the wrpkru instruction includes more bytes, the application code and related code (such as code used to support the application) can be scanned and replaced so that the application code and related code do not contain the wrpkru instruction. In addition, the hardware mechanism of the processor can also be used to prevent the application code from changing the protection key register 112. After the MPK mechanism is enabled, generally speaking, the system software will use key0 as the default key.

[0037] Figure 2 The following is a schematic diagram of the process of isolating the application's memory based on the above three mechanisms. Figure 2 On the left Figure 1 The address space allocated to the 64-bit process for running each 32-bit application in the computing device shown is, for example, a linear address space corresponding to the physical address of the memory. The process can be implemented as an application container, which can be used to provide users with services for running applications (or codes). Figure 2Schematically illustrates a 64-bit application container as an example. In the linear address space, 4G of virtual address space (or logical address space) is allocated to 32-bit application 1 and 32-bit application 2 respectively through a segmentation mechanism. In addition, a descriptor table 121 is also stored in the linear address space. The descriptor table 121 includes code segment descriptors, data segment descriptors, and stack segment descriptors corresponding to application 1 and application 2 respectively. Among them, the code segment descriptor of the 32-bit application can be used to access the code of the application, the data segment descriptor can be used to access the data of the application, and the stack segment descriptor can be used to perform stack operations. The descriptor table 121 also includes the code segment descriptor, data segment descriptor, and stack segment descriptor of the 64-bit application container. The 64-bit application container uses a 64-bit code segment, whose base address defined by the segment descriptor is 0, and the length is the maximum value of the linear address space, so that the application container can access the complete 64-bit linear address space.

[0038] Among them, for each 32-bit application, its lower address stores the 32-bit application code, the 32-bit application running support environment code, and the input and output (IO) request response area, and its highest virtual address is used to store the code and data related to the 64-bit application container, such as the scheduling management code and scheduling management data structure.

[0039] like Figure 2 As shown in the page table 122 on the right side, the application container-related code and data of all applications (such as 32-bit scheduling management code and scheduling management data structure) are mapped to the same physical memory page, and are protected by a non-default protection key (in the figure, key1 is used for protection, assuming that the default protection key is key0). In addition, in the page table 122, the descriptor table 121 stored in the user-mode page and available to the application is also protected by key1. It can be understood that although it is shown here that the scheduling management code, scheduling management data structure and descriptor table 121 are protected by the same protection key (i.e. key1), in practice, different protection keys can also be used to protect them separately, for example, using key1 to protect the descriptor table 121, and using key2 to protect the scheduling management code and scheduling management data structure, so that key1 and key2 can be set to correspond to different permissions as needed. In addition, it can be understood that it is not necessarily as Figure 2 As shown in the figure, the code segment descriptor, data segment descriptor and stack segment descriptor of application 1 in the descriptor table 121 are protected using a non-default key (such as key1). For example, since malicious applications may access the data and stacks of other applications, only the data segment descriptor and stack segment descriptor of the application can be protected, while the code segment descriptor can be stored in a kernel mode page or protected with the default key0.

[0040] Thus, before running the application code, the processor's Supervisor-Mode Memory Access Protection (SMAP) function is first disabled, and by disabling the SMAP function, the user-mode memory is allowed to be accessed in the privileged mode. Thus, before running the 32-bit application code, the processor can first read the segment descriptor corresponding to the application code in the privileged mode, and cache the address corresponding to the application code, and then run the application code after the CPU sets key1 in the protection key register 112 to inaccessible permissions, thereby preventing the application from modifying the segment register through the access descriptor table 121 when running the application code, and preventing the application from accessing memory out of bounds.

[0041] Figure 3 This is a schematic diagram of the structure of the application container provided in the embodiment of the present application. Figure 3 As shown, the application container includes an external input processing module for: 1) receiving a request to start a new sub-application; 2) receiving input data of the sub-application. The sub-application is, for example, Figure 2 Application 1 or application 2 shown in . The application container also includes sub-application execution threads, and each sub-application execution thread can provide execution services for one or more sub-applications. Each sub-application is executed by one or more sub-application execution threads. For example, for a multi-threaded sub-application, a sub-application needs to use multiple sub-application execution threads to complete the work. For some sub-applications, such as an ftp server application compiled as X86nativecode, it may need to run in a libraryOS. At this time, the application container provides a sub-application management module for this libraryOS, which contains sub-application scheduling code and sub-application scheduling related data structures. The libraryOS or application container implements the application container adaptation module, and implements the sub-application IO through the IO send and receive buffer. The application container also supports running applications in language virtual machines, sandboxes, etc.

[0042] The application container includes an initialization module, a sub-application request processing module, a scheduling management module and an external input processing module, wherein the scheduling management module includes a swap-out sub-module and a swap-in sub-module. These modules will be described in detail below.

[0043] Figure 4 The startup process of the application container provided in the embodiment of the present application is performed by executing the initialization module after the process corresponding to the application container is started, and includes the following steps.

[0044] First, in step S41, the MPK capability of the processor is enabled and the SMAP feature of the processor is disabled. That is, by enabling MPK and disabling SMAP, the memory isolation of each sub-application can be performed in combination with the segmentation mechanism and the MPK mechanism.

[0045] In step S42, a subspace is set.

[0046] Specifically, the virtual address space of the process is divided into a number of non-overlapping subspaces with a maximum size of 4G, wherein the internal address of each subspace is continuous, and corresponding 32-bit code segment, data segment, and stack segment segment descriptors are created for these subspaces in the descriptor table stored in the user state page, and the segment descriptors that need to be protected of each sub-application in the descriptor table are protected by a predefined protection key (for example, key1) through the MPK mechanism. For example, in the case where the code segment descriptor, data segment descriptor, and stack segment descriptor of each sub-application need to be protected, the following can be done: Figure 2 As shown in , a partial descriptor table including code segment descriptors, data segment descriptors, and stack segment descriptors of each sub-application is protected using key1. In another case, when only the data segment descriptors and stack segment descriptors of each sub-application need to be protected, a partial descriptor table including the data segment descriptors and stack segment descriptors of each sub-application can be protected using key1. By setting key1 to protect the above partial descriptor table, the sub-application code is prevented from switching segment descriptors at will during runtime. After the processor sets the above partial descriptor table to be protected by key1 at this time, key1 can be set in the protection key register 112 to initially correspond to the accessible permissions.

[0047] In step S43, a physical memory page is allocated and a scheduling management module is stored in the physical memory page.

[0048] The scheduling management module is as follows Figure 2 As shown in the figure, it includes 32-bit scheduling management code and scheduling management data structure. After executing each sub-application, the application container can map the virtual addresses of each sub-application corresponding to the scheduling management module to the same physical memory page, so as to coordinate the management of each sub-application.

[0049] In step S44, the external input processing module is started. Specifically, the application container may create an IO service thread to execute the external input processing module to monitor the IO request of the application, wherein the IO request may include, for example, a request to start a new sub-application, or a request to input data to the sub-application, etc.

[0050] In step S45, one or more sub-application execution threads are created to start the sub-application processing module. The sub-application execution threads can access the segment descriptor and wait for a sub-application running request to execute the sub-application.

[0051] Figure 5 A flowchart including a sub-application processing module provided in an embodiment of the present application.

[0052] like Figure 5 As shown, after the application container starts to execute the sub-application processing module, first, step S51 is executed to check whether there is a new sub-application execution request, and if not, step S55 is executed to determine whether there is a sub-application that can be executed.

[0053] If the result of the check in step S51 is that there is a new sub-application execution request, step S52 is executed to allocate a sub-space for the sub-application. Specifically, a linear address space and a segment descriptor that the sub-application can access are allocated to the sub-application, thereby specifying the address space that the sub-application can access.

[0054] Then, step S53 is executed to prepare a sub-application running environment in the sub-space.

[0055] This step may include the following settings:

[0056] (1) loading an application running support environment in the subspace of the sub-application, wherein the application running support environment includes, for example, code supporting application running, such as input and output code, etc.;

[0057] (2) At a predetermined address (e.g., [4G-100M, 4G]) of the subspace corresponding to the sub-application, the code and data (i.e., Figure 2 32-bit scheduling management code and scheduling management data structure in the virtual address space of application 1 or application 2), and set these addresses to be protected by a protection key (e.g., key2) of a non-default protection key (i.e., key0) according to the MPK mechanism, wherein key2 and key1 may be the same key;

[0058] (3) Allocate IO transceiver buffer physical memory for the sub-application and map it to a predetermined address in the sub-space, such as [4G-400M, 4G-100). Figure 2 The IO request response area in the virtual address space of application 1 corresponds to;

[0059] (4) allocating an application field storage area for the sub-application and mapping it to a predetermined address of the subspace (i.e., the application field storage area), such as [4G-400M-4K, 4G-400M), and saving the processor state corresponding to the initial startup of the sub-application in the field storage area. The field storage area is in the form of a stack, for example;

[0060] (5) Load the code and data of the sub-application into the sub-space. The specific loading address is controlled by the sub-application and cannot overlap with the aforementioned address. The storage address and stack corresponding to the code and data of the sub-application are located at Figure 2At "32-bit application 1" in the virtual address space of application 1.

[0061] Afterwards, the sub-application execution thread executes step S54, and after ensuring that the sub-application code cannot modify the protection key register, marks the sub-application as executable.

[0062] In one embodiment, in the case where a sub-application may perform malicious actions by modifying the protection key register by itself, binary code scanning and replacement can be performed to ensure that the executable code of the sub-application does not contain the relevant instructions for modifying the protection key register (i.e., the wrpkru instruction). Since the instruction includes 5 bytes, the scanning and replacement will not cause a large number of unnecessary replacements. In addition, the hardware mechanism of the processor can also be used to prevent malicious code from modifying the protection key register.

[0063] After ensuring that the sub-application code cannot modify the protection key register, the sub-application execution thread marks the sub-application as being in an executable state. Specifically, the sub-application execution thread may record in the scheduling management data structure that the sub-application is in an executable state.

[0064] Afterwards, the sub-application execution thread executes step S55 to check whether there is a sub-application that is currently in an executable state. If there is, it jumps to the swap-in sub-module of the scheduling management module corresponding to the currently executable sub-application to run the sub-application. Similarly, the sub-application execution thread can query the scheduling management data structure to see whether there is a sub-application that is currently executable. If the check result shows that there is no sub-application that is currently executable, the sub-application execution thread jumps to step S51 to determine again whether there is a new sub-application execution request.

[0065] Figure 6 A flowchart including a swap-in submodule provided in an embodiment of the present application.

[0066] like Figure 6 As shown, after the sub-application execution thread jumps to the swap-in sub-module in the execution scheduling management module as described above, it first executes step S61 to switch the segment descriptor of the sub-application. Specifically, the processor 11 stores the indexes of the code segment descriptor, data segment descriptor, and stack segment descriptor of the sub-application in the segment register 111, thereby accessing the code segment descriptor, data segment descriptor, and stack segment descriptor of the sub-application through the indexes, and caching the linear address space of the sub-application corresponding to these segment descriptors.

[0067] The sub-application execution thread then executes step S62, and sets a portion of the descriptor table in the descriptor table to be inaccessible based on the MPK mechanism, wherein the portion of the descriptor table includes, in addition to the segment descriptor of the sub-application, other descriptors corresponding to the content that the sub-application is prohibited from accessing, such as at least one segment descriptor of other sub-applications. Specifically, Figure 1 and Figure 2 As shown, the processor 11 sets the permission corresponding to key1 in the protection key register 112 to be inaccessible, so that Figure 2 In the case where key2 is different from key1, the sub-application execution thread can also set the permission corresponding to key2 to non-writable before executing the application code of the sub-application, thereby preventing the malicious code of the sub-application from changing the scheduling management code.

[0068] Afterwards, the sub-application execution thread executes step S63, restores the sub-application running scene, and executes the sub-application. Specifically, the sub-application execution thread can access the stack top pointer in the linear address space of the sub-application based on the linear address space corresponding to the cached stack segment descriptor, restores the processor's stack top register based on the stack top pointer, thereby accessing the stack, and reading the processor state corresponding to the sub-application just started (i.e., the sub-application running scene) in the stack, restores the sub-application running scene in the processor, and executes the application code of the sub-application based on the sub-application running scene.

[0069] exist Figure 6 In the process shown, before the sub-application execution thread runs the application code of the sub-application, it sets the descriptor table to be non-readable and non-writable through the MPK mechanism, and has ensured in advance that the protection key register 112 cannot be changed in the application code of the sub-application. Therefore, the application code of the sub-application cannot read the description table, and cannot modify the segment register to access the memory of other sub-applications by reading the segment descriptors of other sub-applications. Therefore, the memory isolation between sub-applications is more effectively performed.

[0070] When an application container runs multiple sub-applications, it is necessary to switch between the multiple sub-applications. As described above, the application code of a sub-application cannot read the descriptor table after it starts running, which will make it impossible for the sub-application execution thread that executes one sub-application to switch to execute another sub-application. For this reason, the embodiment of the present application also includes a swap-out sub-module in the scheduling management module, which is used to enable the sub-application execution thread to switch from one sub-application to another sub-application.

[0071] Figure 7 A flowchart including a swap-out submodule provided in an embodiment of the present application.

[0072] like Figure 7As shown, first, the sub-application execution thread executes step S71 to save the current running scene. Specifically, the processor running state of the current sub-application is saved in the sub-application scene saving area in the subspace corresponding to the sub-application. The scene saving area is in the form of a stack, for example. After the saving, the sub-application execution thread also saves the stack top pointer of the stack at a predetermined position. It can be understood that the scene saving area is not limited to the form of a stack, so the stack top pointer is not necessarily required. The sub-application execution thread can save the storage address of the scene saving area at a predetermined position to find the scene saving area.

[0073] In step S72, the above-mentioned partial descriptor table is set to be accessible.

[0074] Specifically, the sub-application execution thread can enable the processor 11 to modify the permission corresponding to key1 in the protection key register 112, so that the processor can access the above-mentioned part of the descriptor table in the descriptor table 121, that is, Figure 2 As shown, the part of the descriptor table 121 protected by key1.

[0075] In addition, the sub-application execution thread can also set key2 so that the processor can write to the scheduling management data structure.

[0076] In step S73, it is determined whether there are other executable sub-applications.

[0077] The sub-application execution thread can read the scheduling management data structure to determine whether there are other sub-applications that can be run. If so, step S74 can be executed to jump to the swap-in sub-module of other sub-applications. If not, step S75 can be executed to jump to Figure 5 In step S51, it is determined whether there is a new sub-application execution request.

[0078] By setting the submodule swap-in and submodule swap-out in the application container, the application container can switch between multiple sub-applications while ensuring the memory isolation of the multiple sub-applications.

[0079] During the execution of the application container, it may also enter the kernel due to an interrupt / exception; after the kernel handles the interrupt / exception, restoring the sub-application running scene also involves implicit privileged mode access to the descriptor table; because the setting of key1 in the protection key register prohibits the processor from accessing the descriptor table at this time, the kernel cannot smoothly restore the sub-application running scene. In this case, when it is necessary to return from the kernel to the user state of the application, perform the following steps: set the descriptor table to accessible through the wrpkru instruction, that is, set the permission corresponding to key1 in the protection key register to accessible access rights; save the sub-application running scene to be restored to the scene save area of ​​the current sub-application; jump to the swap-in sub-module of the sub-application.

[0080] Generally speaking, when a sub-application is running, it needs to interact with the outside world (input data, output data). For this purpose, the application container also includes an external input processing module and an internal output processing module, and the two modules can be executed by, for example, an IO service thread.

[0081] The functions of the internal output processing module include: monitoring the IO transceiver buffer to obtain the output data of the sub-application, and outputting the data in an agreed manner.

[0082] The functions of the external input processing module include: monitoring input data from outside the sub-application, and if the input data is a new sub-application running request, sending the request to the sub-application execution thread, and after receiving the sub-application running request, the sub-application execution thread can execute S52 to run the sub-application. If the input data corresponds to the input data of a sub-application, the input data is written into the IO transceiver buffer corresponding to the sub-application; and the sub-application is marked as being in an executable state in the scheduling management data structure.

[0083] The application container or the sub-application provides a communication adapter module, which is responsible for receiving input data and sending output data through the IO transceiver buffer; those skilled in the art may compare the communication adapter module to a device front-end driver in computer virtualization, and the external input processing module and the internal output processing module to a device back-end driver in computer virtualization.

[0084] Figure 8 A structural diagram of a device for running an application in a process provided in an embodiment of the present application includes:

[0085] An acquiring unit 81 is configured to acquire a first address space based on a first segment descriptor in a descriptor table, wherein the first address space is a subspace corresponding to the application in the address space of the process, and other descriptors in the descriptor table correspond to content that is prohibited for the application to access;

[0086] A setting unit 82, used for setting the descriptor table to be inaccessible;

[0087] The running unit 83 is configured to run the application code of the application stored in the first address space.

[0088] In one embodiment, the device further includes: a recovery unit, configured to restore the running scene of the application stored in the first address space after setting the descriptor table to be inaccessible.

[0089] In one implementation, the recovery unit is further configured to recover the running site of the application stored in the first address space after setting the descriptor table to be inaccessible by running the management code of the application stored in the first address space.

[0090] In one embodiment, the first address space is also used to store data and a stack of the application, the first segment descriptor includes at least a first data segment descriptor and a first stack segment descriptor, and the stack is used to store the execution scene.

[0091] In one implementation, the setting unit is further configured to: disable the SMAP function of the processor, set the descriptor table to be protected by a first protection key, and set permissions corresponding to the first protection key so that the descriptor table is inaccessible.

[0092] In one embodiment, the device further includes an execution unit, which is used to disable the application from setting permissions of the first protection key by executing hardware or software code before running the application code of the application stored in the first address space.

[0093] In one embodiment, the device also includes: a swap-out unit, which is used to: store the running site of the application after finishing running the application code of the application, and jump to other codes after setting the permission corresponding to the first protection key to make the descriptor table accessible.

[0094] In one embodiment, the device also includes: an exception handling unit, which is used to: after an exception occurs in the application, set the descriptor table to be accessible; based on the first segment descriptor, save the application running scene to be restored to the first address space; and jump to the management code running the application.

[0095] Another aspect of the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, any of the above methods is implemented.

[0096] On the other hand, the present specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute any one of the above methods.

[0097] Through the solution for running applications in a process provided by the embodiments of the present application, multiple applications are run in one process based on a segmentation mechanism and a memory protection key (MPK) mechanism, thereby improving the efficiency of the operating system in running multiple applications while ensuring memory isolation between applications.

[0098] It should be understood that the descriptions such as “first” and “second” in this article are only used to distinguish similar concepts for the sake of simplicity of description and do not have any other limiting effect.

[0099] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0100] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0101] Those of ordinary skill in the art should also be further aware that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those of ordinary skill in the art can use different methods to implement the described functions for each specific application, but this implementation should not be considered to be beyond the scope of the present application. Among them, the software module can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0102] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for running an application in a process, comprising: Disable the processor's privileged mode memory access protection SMAP function; Acquire a first address space based on a first segment descriptor in a descriptor table, where the first address space is a subspace corresponding to the application in the address space of the process, and other descriptors in the descriptor table correspond to content that is prohibited for the application to access; Setting the descriptor table to be inaccessible; The application code of the application stored in the first address space is executed.

2. The method according to claim 1, further comprising: After the descriptor table is set to be inaccessible, the running scene of the application stored in the first address space is restored.

3. The method according to claim 2, wherein after setting the descriptor table to be inaccessible, restoring the running scene of the application stored in the first address space comprises: By running the management code of the application stored in the first address space, after setting the descriptor table to be inaccessible, the running scene of the application stored in the first address space is restored.

4. The method according to claim 2, wherein: The first address space is also used to store data and a stack of the application. The first segment descriptor includes at least a first data segment descriptor and a first stack segment descriptor. The stack is used to store the running site of the application.

5. The method according to claim 3, further comprising disabling an SMAP function of a processor, setting the descriptor table to be protected by a first protection key, wherein setting the descriptor table to be inaccessible comprises: The permission corresponding to the first protection key is set so that the descriptor table is inaccessible. 6 . The method according to claim 5 , further comprising, before running the application code of the application stored in the first address space, preventing the application from setting the permission of the first protection key through the execution of hardware or software code.

7. The method according to claim 5, further comprising: After the application code of the application is finished running, the running site of the application is stored, and after the permission corresponding to the first protection key is set to make the descriptor table accessible, jumping to other codes is performed.

8. The method according to claim 3, further comprising: After an exception occurs in the application, setting the descriptor table to be accessible; Based on the first segment descriptor, saving the application running scene to be restored into the first address space; Jump to the management code that runs the application.

9. A device for running an application in a process, comprising: A disabling unit, used to disable the privileged mode memory access protection SMAP function of the processor; an acquiring unit, configured to acquire a first address space based on a first segment descriptor in a descriptor table, wherein the first address space is a subspace corresponding to the application in the address space of the process, wherein other descriptors in the descriptor table correspond to content that is prohibited for the application to access; A setting unit, used for setting the descriptor table to be inaccessible; A running unit is used to run the application code of the application stored in the first address space.

10. A computing device, comprising a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 8 is implemented.

Images