Hardware-assisted isolation execution method and device for eBPF program

Abstract

The invention provides a hardware-assisted isolation execution method for an eBPF program, which comprises the following steps: acquiring a to-be-executed eBPF program, setting access data pages in the eBPF program as non-privileged pages, and transmitting all memory access instructions in the eBPF program as non-privileged access instructions through instant JIT compiling to obtain a to-be-executed program; running the to-be-executed program in a kernel mode EL1 of a server operating system to obtain a running result; in the process of running the to-be-executed program, a non-access instruction in the to-be-executed program runs at a kernel mode EL1 privilege level, and in the running process, an access instruction in the to-be-executed program is a non-privilege access instruction, and the non-privilege access instruction runs at a user mode EL0 non-privilege level. By setting the memory of the eBPF program as a non-privileged page, the eBPF program still runs at a privileged level, but is transmitted to use a non-privileged memory access instruction. The internal memory of the kernel is set as a privileged page, so that the eBPF program cannot access the privileged page, and the internal memory security of the kernel is ensured.

Description

Technical Field

[0001] The present invention relates to the field of operating system security technology in computer technology, and in particular to a hardware-assisted isolation execution method and device for an eBPF program. Background Art

[0002] The operating system is the core software in the computer system, which supports the operation of various services and application software. After more than 60 years of development, the industry has gradually formed an overall architecture for operating system security. In recent years, the Linux kernel has proposed a new extended kernel technology eBPF (extended Berkeley Packet Filter) based on the existing Berkeley Packet Filter (BPF), allowing users to run custom code in the kernel space and generate eBPF programs without modifying the kernel source code or loading kernel modules. This application has been widely used in the kernel and is used to extend kernel functions in various ways. When the eBPF program is loaded, the kernel will perform static verification on it to ensure the security of the kernel.

[0003] The eBPF Verifier is used to ensure that the eBPF program does not harm the kernel's main security mechanism. The Verifier is responsible for checking whether the program to be loaded will harm the operating system kernel. However, it has been found that there are some bugs in the verification logic of the Verifier, which allows the problematic program to pass the verification, which will harm the kernel. Figure 1 The workflow of the verifier is given. It consists of three consecutive stages, and its verification logic becomes more complex as the stages progress. In the preprocessing stage, all relocation items in the eBPF program are relocated by linear scanning. During this process, the legality of the instruction format in the program is also checked, such as whether there are illegal opcodes (such as indirect calls). The control flow graph checking stage traverses the control flow graph of the eBPF program through a depth-first search method, and prohibits all out-of-bounds jumps and unreachable code. However, due to the complexity of its design and implementation, it exposes a large number of security vulnerabilities. According to statistics, since 2014, more than 60% of the vulnerabilities in the eBPF subsystem come from the failure of the verifier to detect that the eBPF program has security vulnerabilities, which makes it an important source of risk in the kernel.

[0004] The academic community has tried to enhance the execution environment of eBPF programs in the kernel, for example, using hardware to isolate eBPF programs, or building this execution environment based on software error isolation methods. However, on the one hand, due to the lack of complete memory partitioning and fine-grained protection of kernel objects, their methods cannot solve the memory security problem of the kernel; on the other hand, in addition to memory safety, information leakage and kernel availability are also security attributes that need to be considered, which are not yet considered in related work. Therefore, there is an urgent need to provide a secure, low-overhead isolated execution environment for eBPF. In order to protect the security of the kernel, the present invention proposes a secure eBPF program execution environment to ensure the integrity, confidentiality and availability of the kernel. Summary of the invention

[0005] The purpose of the present invention is to use hardware to dynamically isolate the eBPF program, so that the security attributes of static analysis can be equivalent, and the security problem of the eBPF program can be solved. In addition, static analysis faces the problem of state explosion, which makes it impossible for legal programs to pass verification, which is also an important obstacle to the development of eBPF programs. After the present invention replaces static analysis, this obstacle no longer exists. The state is related to the complexity of the program code. For example, for a simple program, such as the helloworld program, there is only one execution path, so it has only one state. And complex programs, such as programs containing if-else, will contain two execution paths, so its state is two. When the if statement becomes more, the state of the program will increase accordingly. Generally speaking, if n branches are included, there will be 2 to the power of n states. If the program has a loop statement, there will be more states, because each loop will create a new state. Static verification needs to ensure that there will be no problems with each state of the program, so it needs to enumerate all states, and when the state reaches a certain number, it will take a lot of time and memory, and static analysis will be difficult to continue, that is, state explosion. This results in static analysis being unable to handle programs containing loops or a large number of branches.

[0006] The design of the present invention is based on AArch64 (the 64-bit instruction set architecture of the ARM architecture), particularly driven by the increasing popularity of ARM-based processors in the mobile market, personal computer and server market, but is also applicable to other instruction set architectures (ISA), such as the x86 instruction set.

[0007] Specifically, Fig.12 As shown, the present invention proposes a hardware-assisted isolation execution method for an eBPF program, which includes:

[0008] Step S1, obtaining an eBPF program to be executed, setting all access data pages in the eBPF program as non-privileged pages, and emitting all memory access instructions in the eBPF program as non-privileged access instructions through just-in-time compilation to obtain a program to be executed;

[0009] Step S2, running the program to be executed in the kernel state EL1 of the server operating system to obtain the running result; and in the process of running the program to be executed, the non-memory access instructions in the program to be executed are run at the kernel state EL1 privilege level, and the memory access instructions in the program to be executed during the running process are non-privileged access instructions, and the non-privileged access instructions are run at the user state EL0 non-privileged level.

[0010] The hardware-assisted isolation execution method of the eBPF program, wherein the just-in-time compilation process of step 1 includes: creating a mapping of the eBPF data of the eBPF program in the kernel state EL1 application, mapping the eBPF data to an independent address space, obtaining eBPF shadow data, and setting the eBPF shadow data as a privileged page;

[0011] Step 2 includes: the program to be executed directly accesses the eBPF shadow data by calling a helper function provided by the server operating system kernel.

[0012] The hardware-assisted isolated execution method of the eBPF program, wherein accessible data and inaccessible data in the eBPF data are decoupled by allocating a dedicated stack space to each eBPF function in the eBPF program; when the server operating system loads the program to be executed, a dedicated memory area is allocated to the program to be executed as the stack space, and a register is set in the program code to be executed generated by just-in-time compilation to point to the stack space.

[0013] The described hardware-assisted isolation execution method of the eBPF program, wherein a timetable is maintained for the program to be executed when it is running, so as to record the time that each program to be executed has been executed, and whether the program has been executed for too long is checked according to the timetable, and the program to be executed that has timed out is forcibly unloaded; and when the program to be executed is running, whether an exception occurs is monitored through the exception handling function in the server operating system kernel, and if so, the program to be executed that has timed out is forcibly unloaded.

[0014] The hardware-assisted isolation execution method of the eBPF program, wherein step 2 includes: running the program to be executed in the kernel state EL1 of the server operating system, and using non-privileged access isolation hardware to create a two-way isolation between the user state application in the server operating system and the program to be executed, and / or using the non-privileged access isolation hardware to create a multi-domain isolated execution environment for the program to be executed loaded by multiple users.

[0015] The hardware-assisted isolation execution method of the eBPF program, wherein step 1 includes: preventing non-privileged access instructions in the program to be executed from accessing illegal memory through a hardware patch of the processor in the server operating system.

[0016] The present invention also proposes a hardware-assisted isolation execution device for an eBPF program, comprising:

[0017] Module 1 is used to obtain the eBPF program to be executed, set all access data pages in the eBPF program as non-privileged pages, and then emit all memory access instructions in the eBPF program as non-privileged access instructions through just-in-time compilation to obtain the program to be executed;

[0018] Module 2 is used to run the program to be executed in the kernel state EL1 of the server operating system to obtain the running result; and in the process of running the program to be executed, the non-memory access instructions in the program to be executed are run at the kernel state EL1 privilege level, and the memory access instructions in the program to be executed during the running process are non-privileged access instructions, and the non-privileged access instructions are run at the user state EL0 non-privileged level.

[0019] The hardware-assisted isolation execution device of the eBPF program, wherein the just-in-time compilation process of the module 1 is specifically as follows: by creating a mapping of the eBPF data of the eBPF program in the kernel state EL1 application, mapping the eBPF data to an independent address space, obtaining eBPF shadow data, and setting the eBPF shadow data as a privileged page;

[0020] The module 2 is used for: the program to be executed directly accesses the eBPF shadow data by calling the helper function provided by the server operating system kernel;

[0021] By allocating a dedicated stack space for each eBPF function in the eBPF program, accessible data and inaccessible data in the eBPF data are decoupled; when the server operating system loads the program to be executed, a dedicated memory area is allocated for the program to be executed as the stack space, and a register is set in the program code to be executed generated by just-in-time compilation to point to the stack space;

[0022] When the program to be executed is run, a timetable is maintained for it to record the time each program to be executed has been executed, and the program to be executed that has timed out is checked according to the timetable, and the program to be executed that has timed out is forcibly uninstalled; and when the program to be executed is run, whether an exception occurs is monitored through the exception handling function in the server operating system kernel, and if an exception occurs, the program to be executed that has timed out is forcibly uninstalled;

[0023] The module 2 is used to: run the program to be executed in the kernel state EL1 of the server operating system, and use the non-privileged access isolation hardware to create a two-way isolation between the user state application in the server operating system and the program to be executed, and / or use the non-privileged access isolation hardware to create a multi-domain isolated execution environment for the program to be executed loaded by multiple users;

[0024] The module 1 is used to prevent non-privileged access instructions in the program to be executed from accessing illegal memory through a hardware patch of a processor in a server operating system.

[0025] The present invention also proposes an electronic device, which includes a hardware-assisted isolation execution device for an eBPF program. The electronic device may be connected to an information display device, and the information display device is used to display the evaluation results using display parameters and attributes set by a user or through an artificial intelligence model.

[0026] The present invention also proposes a storage medium for storing a computer program for executing the hardware-assisted isolation execution method of the eBPF program.

[0027] It can be seen from the above scheme that the advantages of the present invention are:

[0028] The present invention proposes an eBPF demotion and isolation technology based on non-privileged memory access isolation. The present invention sets the memory of the eBPF program to an unprivileged page (U-page). The eBPF program still runs at the privileged level, but is emitted to use non-privileged memory access instructions (unprivileged load / store, LSU). Since the kernel memory is set to privileged pages, the eBPF program cannot access them, thereby ensuring the memory security of the kernel. In addition, the present invention also uses non-privileged access isolation hardware (Preventing EL0 access to halves of address maps, E0PD) to create a two-way isolation between user-mode applications and eBPF programs, and creates a multi-domain isolated execution environment for eBPF programs loaded by multiple users.

[0029] The present invention proposes an eBPF pointer de-informatization technology based on an independent address space. The present invention maps the eBPF memory to an independent address space (called the eBPF space), so that the pointer pointing to the space does not contain any kernel layout information, so that the eBPF memory originally belonging to the privileged page is mapped to a non-privileged page. Even if these pointers are leaked, the attacker cannot infer the layout of the kernel. For side channel attacks, the present invention uses non-privileged access to convert the Spectre attack of the same privilege level into a cross-privilege Meltdown attack, and uses hardware patches to prevent it, such as using the hardware patch of CSV3 in the processor to prevent Meltdown attacks. Among them, the Spectre attack is also called a ghost attack. Its principle is to use the speculative execution of the processor to access illegal memory. Specifically, the eBPF program can only access eBPF data and specific domains of specific kernel objects. All other memory pairs are illegal memory. At the same time, the present invention proposes a descriptor table to solve the pointer leakage and Spectre problems of pointers of special kernel objects in a targeted manner.

[0030] The present invention proposes a system availability assurance method that combines active and passive methods. The eBPF program does not have any monitoring mechanism during execution, so once the eBPF program crashes, the entire kernel will also crash. In addition, since the kernel will turn off preemption when the eBPF program is executed, once the program cannot be terminated or the execution time is too long, the kernel will not be able to respond to other service requests, making the kernel unavailable. Existing static analysis controls the possible execution time of the program in disguise by controlling the number of instructions analyzed, and prevents the eBPF program from crashing by predicting all execution states. Finally, the present invention captures exceptions and monitors the execution time of the eBPF program. Once the eBPF program triggers an exception or times out, it will roll back the state and uninstall the eBPF program, thereby ensuring the availability of the kernel.

[0031] Through the above design, the present invention is based on hardware isolation. Regardless of whether the program is legal or not, the program will actually run. However, when the program performs illegal operations, it is captured by hardware means. In this way, it can be completely equivalent to the security properties of static analysis, thereby providing a low-overhead isolated execution environment to solve the security issues of eBPF programs. In addition, static analysis faces the problem of state explosion, which makes it impossible for legal programs to pass verification. This is also an important obstacle to the development of eBPF programs. After the present invention replaces static analysis, this obstacle no longer exists. The present invention can support the running of kernel modules in the form of eBPF programs, and can also safely run the system call intensive logic of user-mode applications into the kernel to improve the performance of the application, further proving the practical value of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 The workflow diagram for the validator;

[0033] Figure 2 This is a schematic diagram of the operation principle of the present invention;

[0034] Figure 3a , Figure 3b and Figure 3c This is a schematic diagram of the eBPF program structure;

[0035] Figure 4a Schematic diagram of the code generated by the compiler;

[0036] Figure 4b and Figure 4c These are schematic diagrams of the decoupled eBPF stack and kernel stack;

[0037] Figure 5 This is a schematic diagram of the eBPF memory access isolation process;

[0038] Figure 6 Schematic diagram of user-mode application execution;

[0039] Figure 7 This is the eBPF memory map of the present invention;

[0040] Figure 8 This is the EL1 system register structure diagram;

[0041] Fig. 9 It is a schematic diagram of the space from low address to high address;

[0042] Fig.10a and Fig.10b They are respectively the prologe and pilog code instance diagrams of the eBPF program;

[0043] Fig.11a and Fig.11b They are respectively a diagram of the eBPF program execution time monitoring program and a diagram of the register structure of the present invention;

[0044] Fig.12 is a flow chart of the method of the present invention;

[0045] Fig.13 It is a module diagram of the device of the present invention;

[0046] Fig.14 This is a schematic diagram of the structure of a first electronic device of the present invention;

[0047] Fig.15 This is a schematic diagram of the application environment structure of the first electronic device of the present invention;

[0048] Fig.16 It is a schematic diagram of the structure of a second electronic device of the present invention.

[0049] Reference numerals:

[0050] A-First electronic device;

[0051] B-Hardware-assisted isolated execution device for eBPF programs;

[0052] C-data acquisition equipment;

[0053] D-information display device;

[0054] 1000 - second electronic device;

[0055] Ⅰ-computational unit;

[0056] II-ROM;

[0057] III-RAM;

[0058] IV-bus;

[0059] V-interface;

[0060] VI - input unit;

[0061] VII-output unit;

[0062] VIII- Storage medium;

[0063] Ⅸ-Communication unit. DETAILED DESCRIPTION

[0064] It should be noted that, in this application, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0065] Without more constraints, an element defined by the phrase "comprising a..." does not exclude the existence of other identical elements in the process, method, article or apparatus comprising the element.

[0066] The processor described in the present invention is the control center of the electronic device, which can be a processor or a general term for multiple processing elements. For example, it can be one or more central processing units (CPUs), or application specific integrated circuits (ASICs), or one or more integrated circuits configured to implement the embodiments of the present invention, such as one or more microprocessors (digital signal processors, DSPs), or one or more field programmable gate arrays (FPGAs).

[0067] Optionally, the processor can perform various functions of the electronic device by running or executing a software program stored in the memory, and calling data stored in the memory.

[0068] In a specific implementation, as an embodiment, the processor may include one or more CPUs. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions). Electronic devices may include: servers, desktop computers, laptops, smart phones, tablet computers, embedded computers, etc., wherein the embedded computers include vehicles and robots, etc.

[0069] The memory is used to store the software program for executing the solution of the present invention, and the execution is controlled by the processor. The specific implementation method can refer to the above method embodiment and will not be repeated here.

[0070] It should be noted that the structure of the electronic device shown in the drawings of the present invention does not constitute a limitation thereto, and the actual knowledge structure recognition device may include more or fewer components than shown in the drawings, or a combination of certain components, or a different arrangement of components.

[0071] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0072] It should also be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0073] In the present invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0074] It should also be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0075] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0076] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0077] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0078] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0079] In order to make the above features and effects of the present invention more clearly and understandably described, embodiments are given below and described in detail with reference to the accompanying drawings. This specification discloses one or more embodiments that include the features of the present invention. The disclosed embodiments are only for illustration. The scope of protection of the present invention is not limited to the disclosed embodiments, and the present invention is defined by the attached claims.

[0080] The present invention believes that from the perspective of user-defined code, eBPF programs cannot be simply regarded as kernel extensions. Corresponding to user-mode applications, user-mode applications request kernel services through system calls, while eBPF programs request kernel services through helper function calls. Like eBPF programs, user-mode applications also need to be isolated to ensure the memory security of the kernel, and they use static verification methods that are not pure software, but hardware-based dynamic inspection methods. In the ARM architecture, the EL-based memory isolation mechanism prohibits user-mode applications running on EL0 from accessing the kernel's memory, because the kernel memory page is set as a privileged page. Therefore, if a similar hardware-assisted method can be used to create an isolated execution environment for the eBPF program, some heavy inspection tasks in static verification can be replaced by hardware-assisted dynamic inspection, which is also the core idea of ​​the present invention.

[0081] Specifically, if Figure 2 As shown, the present invention first sets all data pages accessible to the eBPF program as unprivileged pages (UnprivilegedPages, U-page). Subsequently, during JIT compilation, the present invention emits all memory access instructions in the eBPF program as unprivileged access instructions LSU. Since the eBPF program runs in kernel mode (EL1), according to the hardware characteristics of LSU in AArch64, these LSU instructions are regarded as being executed in user mode (EL0). Therefore, the eBPF program can access the eBPF data on the U-page, but cannot access other kernel memories, because the original memory of the kernel is still privileged pages (Privileged Pages, P-page). It is worth mentioning that because the code of the eBPF program is not readable and writable to itself, the page where its code is located is still a P-page. Non-memory access instructions (such as function calls, etc.) in the eBPF program are not affected and still run at the EL1 privilege level. The present invention refers to the execution difference of this instruction granularity brought by LSU as an instruction-level memory isolation technology. This technology enables the eBPF program to interact with the kernel without switching the privileged state, thereby avoiding the overhead caused by domain switching.

[0082] In addition to directly accessing eBPF data, the eBPF program also calls the helper function provided by the kernel and passes in a pointer to the eBPF data as a parameter. However, the existence of the privileged access prohibition (PAN) mechanism under AArch64 makes these helper functions unable to access eBPF data, because the helper function is the code of the kernel, and the memory access instructions therein are still ordinary LS instructions. And because the helper function also accesses kernel data, it is impossible to convert the memory access instructions in the helper function into LSU instructions like the eBPF program. In order to solve this problem, the present invention creates an additional mapping for the eBPF data, which the present invention refers to as eBPF shadow data. These pages are all set to P-page, so the helper function can directly access them. Before the eBPF program calls the helper function, the corresponding parameter pointer is relocated to point to the shadow data area. Among them, the eBPF data is declared in the eBPF program and is also the data to be accessed by the eBPF program.

[0083] eBPF memory decoupling

[0084] In eBPF, since all eBPF objects are discontinuous, the size of each object may be different, and only the data area but not the metadata area can be accessed inside the object, the existing static security check can only use more precise subtypes to determine whether each pointer is out of bounds. This fragmented accessible memory poses a challenge to privileged level-based memory isolation. The present invention proposes to decouple the accessible data from the inaccessible memory in the eBPF data object, so that these accessible data are checked using a unified data type, thereby matching the capabilities of exception-level-based memory isolation. The following takes the eBPF stack frame as an example to introduce a specific decoupling method.

[0085] eBPF programs use the eBPF stack frame at the top of the current kernel stack to store local variables. The eBPF stack pointer register (R10) is mapped to a physical general-purpose register (such as the x25 register on AArch64), and all local variables are accessed through this register or its derived pointers. In addition, the return address and callee-saved registers are also stored in the stack frame, but these contents can only be accessed through the physical stack pointer register (sp register on AArch64).

[0086] like Figure 3a As shown in the figure, suppose an eBPF program contains two functions, bar() and foo(). After the program is loaded into the kernel, the run() function in the kernel calls the program's entry function bar(), and then the bar() function calls the foo() function internally. Figure 3bAs shown in the figure, for each function in the eBPF program, the code generated by the JIT compiler consists of three parts: prolog, function body, and epilog. The first part of the prolog mainly includes three steps: 1) Save the callee-saved register on the kernel stack (line 2), which is required by the calling convention (CallingConversion); 2) Initialize the eBPF stack register (line 3), that is, assign a value to the eBPF stack register x25 through the current kernel stack pointer register sp. After the assignment, both registers point to the kernel stack; 3) Expand the eBPF stack (line 4), by subtracting the required memory size (size) from the kernel stack, the need to allocate space for the eBPF stack is completed. The second part of the function body is translated from the bytecode in the eBPF function. The eBPF bytecode is relatively simple and mostly corresponds to the local instructions one by one. Finally, the epilog of the function is responsible for reclaiming the stack space (line 11), whose size corresponds to the size allocated in the prolog, and then restoring the callee-saved register to ensure the stack balance. Finally there is a return instruction, which is responsible for popping the return address on the stack and returning control flow to the caller function.

[0087] superior Figure 3c The kernel call stack layout when the foo() function is executed is shown. The local variables of the run() function in the kernel are at the top. When it calls the bar() function, the calling convention pushes the return address onto the stack. Then, when the bar() function is executed, the callee-saved register is saved first, then the eBPF stack frame register x25 is initialized, and then the stack is expanded to save the local variables of the bar() function. The process of the bar() function calling the foo() function is similar, saving the return address and caller-saved registers, and setting the stack registers. Finally, the sp register in the kernel points to the top of the kernel stack, and the eBPF stack register x25 points to the bottom of the eBPF stack.

[0088] From the existing layout, the local variables of the eBPF program are coupled with other data on the kernel stack. Static verification ensures that the memory access on the stack is inside the local variables of the eBPF stack by tracking the range of the stack pointer and its derived pointers. Without static verification, the security of other data on the stack (such as the return address) cannot be guaranteed by using only the LSU mechanism, so the eBPF stack must be decoupled from the kernel stack.

[0089] The present invention notices that in the code generated by JIT, only the function body is controllable by the eBPF function, while the instructions in the prolog and epilog are not controllable by the eBPF function. At the same time, all local variables in the function body are generated from the x25 register, which is also controlled by the instructions in the prolog. Based on the above observations, the present invention adopts a safe stack - putting safe data (i.e. return address and callee-saved registers) on the original kernel stack, and isolating unsafe data (i.e. local variables of the application) to a new stack.

[0090] To achieve this, when the application is loaded, the present invention allocates a dedicated memory area as the eBPF stack (one for each CPU core) and sets the x25 register in the prolog code generated by the JIT to point to this space. Since there is no static verification, the present invention cannot determine the size of the stack frame in each function, so the present invention uses the upper limit of the eBPF stack size allowed in eBPF (512 bytes) as the fixed size of each stack frame. The size of the entire eBPF stack is set to 8MB by default. When the application is loaded, the present invention only allocates memory for the two memory pages at the bottom of the stack, and the remaining pages are allocated by delaying the page fault exception.

[0091] As above Figure 4a As shown in the figure, for each eBPF function, in the prolog of the code generated by the JIT compiler, the eBPF stack register x25 is no longer set through the sp register, but is set to the stack address dedicated to this function (line 3). Since the eBPF program does not allow recursion, there is no need to consider the case where the same function appears twice on the call stack. At the same time, since the eBPF stack has been allocated, the original stack allocation instructions (lines 4 and 9) can be optimized away. In addition, other codes generated by the JIT are not affected, and the code inside the eBPF program does not need to be adjusted.

[0092] superior Figure 4b and Figure 4cThe decoupled eBPF stack and kernel stack are shown separately, and each eBPF function has its own dedicated stack space. It is worth noting that the metadata generated by the calling convention is inaccessible to the eBPF program, and they can only be accessed through the push / pop instructions generated by the JIT (just-in-time) compiler in the prolog and epilog, so they are retained on the kernel stack. In addition, another advantage of this design is that there is no need to switch stacks when calling helper functions, that is, the kernel's helper function still uses the kernel stack. At the same time, the control flow security of the eBPF program ensures that these instructions cannot be abused by attackers. Finally, in order to prevent attackers from causing kernel stack overflow through continuous function calls, the present invention places an unmapped protection page at the lowest position of the kernel stack. The exception triggered after the overflow will be captured by the present invention, thereby unloading the eBPF program.

[0093] eBPF memory access isolation

[0094] After decoupling, the memory associated with the eBPF data object pointer has been completely decoupled from its metadata ( Figure 5 middle ). Then, the present invention sets these memories as U-pages and aggregates them together (maximum 1TB), storing them in the order of eBPF stack, map value (maps are created in the order they were created), and network data packet-specific slabs ( Figure 5 middle ). For the eBPF program, the present invention modifies the eBPF JIT compiler to emit all memory access instructions in the eBPF program as LSU instructions during JIT.

[0095] by Figure 5 middle Taking the code shown as an example, it contains an 8-byte local variable time, which is initialized by calling the helper function bpf_get_time(). The eBPF bytecode corresponding to this program is as follows Figure 5 middle As shown, the R10 register is the stack register in the eBPF instruction set, so R1 is initialized to a pointer to the time variable. After calling the bpf_get_time() function, according to the calling convention, the return value is in the R0 register, and then the content of the register is written to the memory pointed to by R1, that is, the time variable.

[0096] The code generated by the untuned JIT compiler is as follows Figure 5 middle As shown in the figure, the eBPF R0, R1, and R10 registers correspond to the x7, x0, and x25 registers in AArch64 respectively. After the helper function returns, the code uses the str instruction to write the return value register x7 to the memory offset 0 pointed to by the x0 register. The code generated by the adjusted JIT compiler is as follows: Figure 5 As shown. After the helper function returns, the memory is accessed through the non-privileged access instruction sttr provided by the LSU hardware feature, and other instructions inside the function body remain unchanged. If an attacker maliciously modifies the x0 register to point to the kernel's memory, the program will trigger a crash because the non-privileged access instruction cannot access the privileged page, and will be further captured and uninstalled by the present invention. In this way, the eBPF data object pointer no longer requires an object-level range check, but only utilizes a memory isolation mechanism based on the exception level. It is worth noting that an attacker can modify x0 to point to any non-privileged page, such as pointing the pointer that originally pointed to the stack to the value of the map, but since these memories are originally accessible to the program at will, they will not cause any security issues.

[0097] In addition, this demotion method introduces a new attack surface: since the eBPF memory is demoted to the user privilege level, the eBPF program cannot be isolated from the user-mode application, that is, the eBPF code and the user code can access the eBPF memory and the user-mode memory at the same time. To solve this problem, the present invention uses the E0PD hardware function to establish a bidirectional isolation between the eBPF memory and the user-mode memory.

[0098] like Figure 6 As shown, when the user-mode application is executed, due to the isolation caused by different exception levels, the user-mode code cannot access the P-page in the kernel, but can access the eBPF memory because they are U-pages. The present invention sets the E0PD0 bit in the TCR_EL1 register to 0 and the E0PD1 bit to 1, indicating that the low address space (ie, user space) can be accessed, but the high address space (ie, kernel space) cannot be accessed. Therefore, the user-mode application can be executed normally and cannot access the eBPF-related memory.

[0099] On the contrary, when the CPU switches to kernel mode execution, the present invention enables E0PD0 and disables E0PD1 by setting the TCR_EL1 register, thereby only allowing access to the high address space (i.e., kernel space). Since all memories except the eBPF memory in the kernel are P-pages, the non-privileged access instructions in the eBPF program can only access the eBPF memory but cannot access the user space. It is worth noting that the push / pop instructions in the prolog / epilog of the eBPF program normally access the kernel stack (P-page), but these accesses are safe because they are not controlled by the eBPF program but generated by the JIT compiler. All settings related to E0PD only require one instruction to change the corresponding bit in the TCR_EL1 register. Compared with the time of the entire context switch, this overhead is negligible.

[0100] Helper function memory isolation

[0101] In addition to direct memory access, the eBPF data object pointer can also be passed as a parameter to the helper function. In order to avoid confusion proxy attacks, static verification performs an out-of-bounds check on the corresponding parameters when encountering a helper function call during the process of checking the eBPF program. Therefore, the present invention also needs to provide equivalent security guarantees.

[0102] In addition, since the eBPF data object pointers used in the eBPF program all point to U-page, even if the eBPF program passes the correct pointer, it cannot be used inside the helper function. This is because the memory access instructions in the helper function are regular LS instructions, and since the PAN mechanism is enabled by default in the kernel, the LS instructions in the kernel cannot access the eBPF memory with U-Page attributes. Although temporarily disabling PAN when calling the helper function can solve this problem, it will reduce the security of the kernel and increase the performance overhead of the eBPF program.

[0103] To solve this problem, Figure 7As shown, the present invention double maps the eBPF memory of the aggregated U-page attribute to P-page, and places the area in the range of up to 1TB of the kernel space. Based on this design, before the helper function is called, the present invention will traverse the parameter list of the called function. If there is a parameter of the eBPF data object pointer, an orrxn,xn,0xffffff0000000000 instruction will be inserted before the function call instruction. When the eBPF program is running, the instruction sets the high 24 bits of the parameter register to 1, and the low 40 bits remain unchanged, so the offset of the pointer relative to the eBPF memory is retained (the eBPF memory is set to 1TB size), and the pointer is pointed to the corresponding position of the eBPF shadow memory. In this way, the helper function in the kernel can access the eBPF memory in disguise. At the same time, the logic or instruction is also responsible for controlling the pointer out of bounds. Even if the pointer is tampered with by an attacker to an arbitrary pointer, after the instruction is adjusted, the actual pointer will always point to the shadow memory area, and the area does not contain any other kernel memory except the memory accessible by the eBPF program.

[0104] Multi-domain isolation:

[0105]

[0106] Since different eBPF programs may be loaded by multiple users, isolation is also required between these applications. In order to provide a multi-domain isolated execution environment, the present invention audited all available hardware features in AArch64 to find a suitable solution. As shown in the above table, the present invention summarizes all available hardware features and their available domains and domain switching overhead. Among them, the LSU used in the present invention can create two isolation domains to isolate the eBPF program from the kernel, and combined with E0PD, it can further create two-way isolation between user-mode applications and eBPF programs. Among the remaining available hardware, HPD or E1PD can only provide two domains, which is difficult to meet the requirements, and E1PD conflicts with the LSU usage method in the present invention and cannot be used. TxSz can adjust the size of the kernel space to make some of its contents inaccessible, but this adjustment is one-way and cannot meet the flexible isolation requirements. The Watchpoint mechanism uses debug registers to monitor the reading and writing of specific content, and adjusts the monitoring range by modifying the value of the debug register, thereby switching different isolation domains. However, since there are only four debug registers in AArch64, only four efficient isolation domains can be created. That is, domain switching only requires modifying the debug register once (42 cycles). Although up to 16 domains can be combined by overlapping the monitoring ranges of different debug registers, the overhead of domain switching will increase.

[0107] Based on the above analysis, the present invention utilizes switching kernel page tables to switch to different eBPF program executions. On the one hand, the mechanism has no limit on the number of isolation domains and is compatible with the present invention's usage of LSU and E0PD. On the other hand, the domains created by the mechanism have the lowest overhead when switching. Specifically, the present invention creates a kernel page table for each eBPF program, which share the same kernel memory but only contain the memory of the eBPF program itself. When the eBPF program is executed, the present invention switches the corresponding page table by setting the TTBR1_EL1 system register.

[0108] like Figure 8 As shown, the TTBR1_EL1 system register is divided into two parts, the upper 16 bits are the address space identifier (ASID), and the lower 48 bits are the specific page table base address (BADDR). In order to avoid frequent TLB shootdowns, the present invention assigns an ASID to each eBPF program, and switches the corresponding ASID at the same time when switching page tables. Finally, in order to avoid unnecessary page table switching, the present invention merges eBPF programs of the same type and capabilities from the same user into one page table, and only switches page tables when different eBPF programs switch execution.

[0109] Independent address space

[0110] In order to solve the problem of pointer leakage of eBPF data objects, the present invention creates an independent address space for each eBPF program, which stores the eBPF data objects decoupled from the kernel, including the eBPF stack frame, all map values, and dedicated slab memory. Fig. 9 As shown, from low address to high address are user space (256TB), memory reservation area (non-linear addressing space), kernel space (254TB), BPF space (1TB) and BPF shadow space (1TB).

[0111] Specifically, when the operating system starts, the present invention adjusts the randomization process of the kernel to exclude the space up to 2TB from the randomization process of the kernel address space, so that the BPF space is completely decoupled from the kernel space. During the loading process of the eBPF program, the pointers of all eBPF data objects are relocated to point to the BPF space when they are generated. In this way, the eBPF program can arbitrarily leak the pointers of the eBPF data objects, because even if they are leaked, the attacker cannot infer any kernel layout information from the values ​​of these pointers.

[0112] The memory layout inside the BPF space is also fixed, from low to high, they are the eBPF stack frame, map value (different maps are stored in the order declared inside the eBPF program), and the slab memory map dedicated to network packets. Therefore, even if the attacker does not run the target eBPF program, the specific memory address can be inferred.

[0113] In addition, the present invention initializes all memory allocated in the BPF space when the eBPF program is loaded. Each time the eBPF program is executed, the BPF stack frame of the current core is reused without reinitialization. Therefore, if the eBPF program does not initialize the eBPF stack frame during a certain execution, the content read will be the content of the last execution, and will not cause kernel memory leaks.

[0114] Finally, eBPF relies on static verification to identify code that may be executed speculatively to dynamically prevent Spectre v1 and v4 attacks. Note that Spectre v2 attacks do not exist in eBPF programs because they cannot contain indirect call instructions. The key to both Spectre v1 and v4 attacks is transient access to sensitive data (such as kernel data) and using the accessed value to encode and access legitimate memory addresses that cause cache state changes.

[0115] The present invention converts the memory access instructions in the eBPF program into non-privileged memory access forms, so speculative access to kernel space will trigger a permission error, so the Spectre attack is converted into a Meltdown attack. On this basis, the present invention uses a hardware patch called CSV3 in ARM commercial processing. If a speculative execution triggers a permission error, the patch prohibits the data accessed by this speculative execution from being used as the target address of subsequent memory access instructions, thereby preventing Meltdown attacks. Therefore, through the transformation of LSU instructions and the CSV3 patch, the present invention can block Spectre attacks from the hardware level without modifying the kernel or eBPF program code at the software level.

[0116] Fighting Denial of Service Attacks

[0117] eBPF programs may bring two types of denial of service attacks: triggering exceptions and executing without termination. For the former case, the present invention passively captures all triggered exceptions, determines that they are illegal exceptions, uninstalls the eBPF program, and rolls back the kernel's execution state to the program's entry point; for the latter case, the present invention checks all eBPF execution times every time an interrupt arrives, and uninstalls the eBPF program and rolls back the state when the execution time reaches a certain threshold.

[0118] The method of catching exceptions is relatively intuitive. The present invention can be done by hooking the exception handling functions in the kernel (such as handle_page_fault() function and die_kernel() function, etc.). For the rollback state, the eBPF program will change the system state in the following four aspects:

[0119] eBPF data in the BPF space, including map values ​​and eBPF stack frames, while dedicated slabs do not need to be considered because these memories are read-only for eBPF programs;

[0120] eBPF-related management structures in the kernel, including map metadata, kernel stack, etc. The former is generated before the eBPF program is created and destroyed after the eBPF program is uninstalled, and the latter changes with the function calls inside the eBPF program;

[0121] Kernel objects accessible to eBPF programs, such as context objects. Most of the fields of such objects are not accessible to eBPF programs, and most of the open fields are read-only.

[0122] eBPF-related registers, including registers corresponding to the eBPF instruction set and reserved registers used in the JIT compiler. Before entering the eBPF code, the prolog (JIT compiler control) of the eBPF program will save these registers on the kernel stack. When the eBPF program exits, its epilog will restore these registers from the kernel stack.

[0123] Among the above four types of data, changes to the first two types of data will not affect the state of the kernel, and for the third type of data, the fields open to the eBPF program for modification will not affect the execution of the kernel even if they are modified. After all, legal programs can modify these fields at will. Therefore, the present invention only needs to uninstall the eBPF program to clear these data. Finally, in order to restore the register, the present invention needs to additionally record the kernel stack pointer sp register at the entrance of the eBPF program and save it to a reserved register x28 (not visible to eBPF). After the eBPF program triggers an exception, the kernel stack pointer sp register is restored to the x28 register at the exception site, and jumps to the prolog of the eBPF program, thereby completing the rollback of the register state.

[0124] As shown in Figure 10, the prolog of the eBPF program will save the callee-saved registers involved in eBPF on the kernel stack, of which the x23 register, the x24 register and the x28 register are introduced by the present invention. Other registers (such as parameter registers x0-x4, etc.) do not need to be considered, because either these registers do not need to be saved or the kernel will save them. After that, the present invention adds an instruction to save the stack pointer sp register to the x28 register (line 7). Since the register is invisible to the eBPF program, the eBPF program cannot be modified. At the same time, the register is a callee-saved register, so the helper function call will not change the register. Once the eBPF program is maliciously triggered to crash during execution, the present invention parses the x28 register at the crash site to locate the stack position at the entry of the eBPF program, and then jumps to the epilog code of the eBPF program, thereby restoring the values ​​of the registers one by one, and finally returning to the kernel code through a ret instruction.

[0125] The present invention maintains a timetable for the eBPF programs already loaded in the kernel to record how long each eBPF program has been executed, and inserts additional logic in the kernel's schedule() function, which is called at the end of each interrupt processing logic to check whether the eBPF program has been executed for too long. First, check whether there is an eBPF program executing on any core. If found, obtain the current execution time of the corresponding eBPF program by searching the timetable, and check whether the execution time exceeds the preset upper limit (the default is the execution time of 1 million instructions). For programs that have timed out, they will be forced to uninstall; for programs that do not time out, the present invention will use the current time to update their timetable.

[0126] The present invention designs a two-level execution configuration for eBPF programs based on program type and time level. First, each type of eBPF program is allowed to execute for a different length of time, and these times are configured by the system administrator. Second, for the same program type, different programs can also have different execution times. Fig.11a and Fig.11b As shown, at the entry of the eBPF program, the present invention uses the tpidrro_el0 register to record the type and time level of the current program, and queries the corresponding execution time limit through this register during the inspection. Note that each core has one register, and the register will not be used in the kernel, so it only needs to be cleared before the eBPF program exits.

[0127] The duration calculation above is accurate because the execution of eBPF programs is non-preemptive. The advantage of this approach is that the execution time also includes the execution time of the helper function, thus avoiding the denial of service problem caused by estimating only the execution time of the eBPF program.

[0128] The following is a system embodiment corresponding to the above method embodiment. This embodiment can be implemented in conjunction with the above embodiment. The relevant technical details mentioned in the above embodiment are still valid in this embodiment. In order to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied in the above embodiment.

[0129] like Fig.13 As shown, the present invention also proposes a hardware-assisted isolation execution device for an eBPF program, which includes:

[0130] Module M1 is used to obtain the eBPF program to be executed, set all access data pages in the eBPF program as non-privileged pages, and then emit all memory access instructions in the eBPF program as non-privileged access instructions through just-in-time compilation to obtain the program to be executed;

[0131] Module M2 is used to run the program to be executed in the kernel state EL1 of the server operating system to obtain the running result; and in the process of running the program to be executed, the non-memory access instructions in the program to be executed are run at the kernel state EL1 privilege level, and the memory access instructions in the program to be executed during the running process are non-privileged access instructions, and the non-privileged access instructions are run at the user state EL0 non-privileged level.

[0132] The hardware-assisted isolation execution device of the eBPF program, wherein the just-in-time compilation process of the module 1 is specifically as follows: by creating a mapping of the eBPF data of the eBPF program in the kernel state EL1 application, mapping the eBPF data to an independent address space, obtaining eBPF shadow data, and setting the eBPF shadow data as a privileged page;

[0133] The module M2 is used for: the program to be executed directly accesses the eBPF shadow data by calling the helper function provided by the server operating system kernel;

[0134] By allocating a dedicated stack space for each eBPF function in the eBPF program, accessible data and inaccessible data in the eBPF data are decoupled; when the server operating system loads the program to be executed, a dedicated memory area is allocated for the program to be executed as the stack space, and a register is set in the program code to be executed generated by just-in-time compilation to point to the stack space;

[0135] When the program to be executed is run, a timetable is maintained for it to record the time each program to be executed has been executed, and the program to be executed that has timed out is checked according to the timetable, and the program to be executed that has timed out is forcibly uninstalled; and when the program to be executed is run, whether an exception occurs is monitored through the exception handling function in the server operating system kernel, and if an exception occurs, the program to be executed that has timed out is forcibly uninstalled;

[0136] The module M2 is used to: run the program to be executed in the kernel state EL1 of the server operating system, and use the non-privileged access isolation hardware to create a two-way isolation between the user state application in the server operating system and the program to be executed, and / or use the non-privileged access isolation hardware to create a multi-domain isolated execution environment for the program to be executed loaded by multiple users;

[0137] The module M1 is used to prevent non-privileged access instructions in the program to be executed from accessing illegal memory through a hardware patch of a processor in a server operating system.

[0138] like Fig.14 As shown, the present invention further proposes a first electronic device A in another embodiment, comprising a hardware-assisted isolation execution device B of the eBPF program.

[0139] like Fig.15 As shown, the first electronic device A can also be connected to the data acquisition device C and the information display device D through a wired or wireless information transmission scheme, the data acquisition device C is used to acquire the eBPF program, and the information display device D is used to display the program running results obtained by running the present invention.

[0140] The information display device D can sort and process the data output by the first electronic device A based on the information display mechanism to improve the readability of the data output by the first electronic device A. The information display mechanism can be manually preset, for example, the data output by the first electronic device A is visually displayed, which can be based on the display parameters and / or attributes set by the user. The display parameters can be, for example, the display data range, and the display attributes can be, for example, the display font, color, whether to scroll and play, etc. The user is presented with the key information specified by the user, such as the running status of the program, etc. The user can understand this information more promptly without having to access the secondary page or scroll the page, saving the user's operation. Or the information display mechanism can be an artificial intelligence AI display model, which can learn the user's key information based on the user's previous usage habits, such as viewing time, number of clicks, number of edits, etc., and then automatically present rich and necessary key information to the user.

[0141] The present invention also proposes a storage medium VIII in another embodiment for storing a computer program for executing the hardware-assisted isolation execution method of the eBPF program. It should be understood that the storage medium in the embodiment of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus random access memory (DR RAM).

[0142] Fig.16 A schematic block diagram of a second electronic device 1000 that can be used to implement an embodiment of the present invention is shown. The second electronic device 1000 electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The second electronic device 1000 can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples, and are not intended to limit the implementation of the present invention described and / or required herein. The second electronic device 1000 may be the same or different from the first electronic device A.

[0143] The second electronic device 1000 includes a computing unit I, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory II (ROM) or a computer program loaded from a storage medium VIII into a random access memory (RAM) III. In RAM III, various programs and data required for the operation of the device 1000 can also be stored. The computing unit I, ROM II, and RAM III are connected to each other via a bus IV. An input / output (I / O) interface V is also connected to the bus IV.

[0144] A plurality of components in the second electronic device 1000 are connected to the I / O interface V, including: an input unit VI, such as a keyboard, a mouse, etc.; an output unit VII, such as various types of displays, speakers, etc.; a storage medium VIII, such as a disk, an optical disk, etc.; and a communication unit IX, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit IX allows the second electronic device 1000 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0145] The computing unit I may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of computing unit I include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit I performs the various methods and processes described above, such as method steps S1-S2. For example, in some embodiments, the method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage medium VIII. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 1000 via ROM II and / or a communication unit IX. When the computer program is loaded into RAM III and executed by the computing unit I, one or more steps of the method described above may be performed. Alternatively, in other embodiments, the computing unit I may be configured to execute the method in any other appropriate manner (e.g., by means of firmware).

[0146] Although the embodiments of the present invention have been disclosed as above, they are not limited to the applications listed in the specification and the implementation modes, and they can be fully applied to various fields suitable for the present invention. For those familiar with the art, additional modifications can be easily implemented. Therefore, without departing from the general concept defined by the claims and the scope of equivalents, the present invention is not limited to the specific details and the illustrations shown and described herein.

Claims

1. A method for hardware-assisted isolated execution of eBPF programs, It is characterized in that include: Step 1: Get the eBPF program to be executed, set all access data pages in the eBPF program to non-privileged pages, and then emit all memory access instructions in the eBPF program as non-privileged access instructions through just-in-time compilation to obtain the program to be executed; Step 2: Run the program to be executed in the kernel state EL1 of the server operating system to obtain the running result; and in the process of running the program to be executed, the non-memory access instructions in the program to be executed are run at the kernel state EL1 privilege level, and the memory access instructions in the program to be executed during the running process are non-privileged access instructions, and the non-privileged access instructions are run at the user state EL0 non-privileged level.

2. The method for hardware-assisted isolated execution of an eBPF program according to claim 1, It is characterized in that The just-in-time compilation process of step 1 includes: creating a mapping of the eBPF data of the eBPF program in the kernel state EL1 application, mapping the eBPF data to an independent address space, obtaining eBPF shadow data, and setting the eBPF shadow data as a privileged page; Step 2 includes: the program to be executed directly accesses the eBPF shadow data by calling a helper function provided by the server operating system kernel.

3. The method for hardware-assisted isolation execution of an eBPF program as claimed in claim 2, It is characterized in that By allocating dedicated stack space for each eBPF function in the eBPF program, accessible data in the eBPF data is decoupled from inaccessible data; When the server operating system loads the program to be executed, a dedicated memory area is allocated for the program to be executed as the stack space, and a register is set in the program code to be executed generated by just-in-time compilation to point to the stack space.

4. The method for hardware-assisted isolated execution of an eBPF program as claimed in claim 2, It is characterized in that When the program to be executed is run, a timetable is maintained for it to record the execution time of each program to be executed. According to the timetable, it is checked whether the execution time of the program is too long, and the program to be executed that has timed out is forcibly uninstalled. When the program to be executed is run, the exception handling function in the server operating system kernel is used to monitor whether an exception occurs. If an exception occurs, the program to be executed that has timed out is forcibly uninstalled.

5. The method for hardware-assisted isolation execution of an eBPF program according to claim 1, It is characterized in that Step 2 includes: running the program to be executed in the kernel state EL1 of the server operating system, and using non-privileged access isolation hardware to create a two-way isolation between the user state application in the server operating system and the program to be executed, and / or using the non-privileged access isolation hardware to create a multi-domain isolated execution environment for the program to be executed loaded by multiple users.

6. The method for hardware-assisted isolation execution of an eBPF program according to claim 1, It is characterized in that The step 1 includes: preventing non-privileged access instructions in the program to be executed from accessing illegal memory through a hardware patch of a processor in a server operating system.

7. A hardware-assisted isolated execution device for eBPF programs, It is characterized in that include: Module 1 is used to obtain the eBPF program to be executed, set all access data pages in the eBPF program as non-privileged pages, and then emit all memory access instructions in the eBPF program as non-privileged access instructions through just-in-time compilation to obtain the program to be executed; Module 2 is used to run the program to be executed in the kernel state EL1 of the server operating system to obtain the running result; and in the process of running the program to be executed, the non-memory access instructions in the program to be executed are run at the kernel state EL1 privilege level, and the memory access instructions in the program to be executed during the running process are non-privileged access instructions, and the non-privileged access instructions are run at the user state EL0 non-privileged level.

8. The hardware-assisted isolation execution device of the eBPF program according to claim 7, It is characterized in that The just-in-time compilation process of the module 1 is specifically as follows: by creating a mapping of the eBPF data of the eBPF program in the kernel state EL1 application, mapping the eBPF data to an independent address space, obtaining eBPF shadow data, and setting the eBPF shadow data as a privileged page; The module 2 is used for: the program to be executed directly accesses the eBPF shadow data by calling the helper function provided by the server operating system kernel; By allocating dedicated stack space for each eBPF function in the eBPF program, accessible data in the eBPF data is decoupled from inaccessible data; When the server operating system loads the program to be executed, a dedicated memory area is allocated for the program to be executed as the stack space, and a register is set in the program code to be executed generated by the just-in-time compilation to point to the stack space; When the program to be executed is run, a timetable is maintained for it to record the time each program to be executed has been executed, and the program to be executed that has timed out is checked according to the timetable, and the program to be executed that has timed out is forcibly uninstalled; and when the program to be executed is run, whether an exception occurs is monitored through the exception handling function in the server operating system kernel, and if an exception occurs, the program to be executed that has timed out is forcibly uninstalled; The module 2 is used to: run the program to be executed in the kernel state EL1 of the server operating system, and use the non-privileged access isolation hardware to create a two-way isolation between the user state application in the server operating system and the program to be executed, and / or use the non-privileged access isolation hardware to create a multi-domain isolated execution environment for the program to be executed loaded by multiple users; The module 1 is used to prevent the non-privileged access instruction in the to-be-executed program from accessing illegal memory through a hardware patch of a processor in a server operating system.

9. An electronic device, It is characterized in that A hardware-assisted isolation execution device for an eBPF program as described in claim 7 or 8, wherein the electronic device is connected to an information display device, and the information display device is used to display the evaluation result with display parameters and attributes set by the user or through an artificial intelligence model.

10. A storage medium for storing a computer program for executing the hardware-assisted isolation execution method of the eBPF program described in claims 1-6.

Images