Method, device and equipment for optimizing process operation based on process kernel stack and storage medium

Abstract

The invention discloses a method, device and equipment for optimizing process running based on a process kernel stack and a storage medium, and belongs to the technical field of software engineering. The method comprises the following steps: placing custom data of a process in a stack top of a process kernel stack; and when the custom data of the process needs to be accessed, finding the address of the process custom data at the stack top of the process kernel stack, finding the custom data through the address, and after the execution of the process is finished, releasing the process kernel stack at the stack top. According to the method, for some drive program or security module development scenes, on the premise that kernel source codes are not modified, custom data of a process is stored through an extended process descriptor taskstruct structure. By using the method, a source code of the kernel does not need to be modified, the influence of a traditional mode on the kernel performance does not need to be considered, and the method can be widely applied to various development scenes such as drive development and kernel security modules.

Description

Technical Field

[0001] The present invention belongs to the technical field of software engineering, and in particular relates to a method, device, equipment and storage medium for optimizing process operation based on a process kernel stack. Background Art

[0002] The Linux system is a free operating system with excellent performance, open source code and wide application. Due to its advantages such as stability, reliability, scalability, high running speed and good network performance, it is widely used in various fields of information systems. In the field of personal computers, the Linux system can be used as an alternative to the Windows operating system to provide a stable, secure and free solution. In the serverless field, the Linux system has a high degree of stability and reliability and is widely used in web servers, database servers and mail servers. In the embedded field, the Linux system can run on various embedded platforms, such as smart phones, TVs, routers, various smart home appliances, etc.

[0003] At the same time, the Linux system is also a free and open source operating system. Both individual users and corporate users can carry out secondary development based on the Linux system according to their own needs, and use its powerful functions and flexible customization to meet their own needs. In order to facilitate Linux driver developers, as well as enterprises and individual users who carry out secondary development based on the Linux system, the Linux system introduces kernel modules. The kernel module is a separately compiled piece of kernel code that can be dynamically loaded into the kernel when needed, thereby dynamically increasing kernel functions. When not needed, it can be dynamically unloaded. It is not possible to load or unload kernel modules without restarting the system.

[0004] The kernel module of the Linux system provides a flexible and convenient development framework for driver developers and secondary development users, but there are some obstacles for some specific scenarios. For example, developers need to develop a set of security modules based on the Linux system's security framework LSM to control the access rights of the process, or to perform trusted dynamic measurement on the memory data of the process, etc., and often need to bind some custom data associated with the process in the process descriptor task_struct, such as access control policy, baseline value, etc. The simplest way is to modify the kernel source code of the Linux system and add a pointer type member variable in the structure definition of task_struct to store the address of the custom data. This requires modifying the kernel source code. After the kernel source code is modified, all drivers and applications running on the kernel need to be re-adapted, otherwise the operating system will have great uncertainty in terms of stability and reliability. Therefore, the method of modifying the kernel source code is generally not adopted in actual business. The more common way for developers is to cache the custom data of the process in the memory and establish a one-to-one mapping relationship between the process and the custom data of the process in a certain way, such as establishing a mapping relationship through a hash table. When the custom data of the process needs to be accessed, the hash table needs to be searched. However, when the number of processes is large, the efficiency of table lookup will be very low, which will seriously affect the kernel performance of the Linux system. Therefore, this method is not a very friendly solution. Summary of the invention

[0005] The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and provide a method, device, equipment and storage medium for optimizing process operation based on process kernel stack, so as to solve the problem in the prior art that when searching for custom data of a process in the task_struct structure, the kernel source code of the Linux system needs to be modified.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions: The method for optimizing process operation based on process kernel stack includes the following steps: S1, stores the process's custom data address at the top of the process kernel stack; S2, when it is necessary to access the process's custom data, find the address of the process's custom data at the top of the process kernel stack; S3, finding the custom data of the process through the address; S4, execution process; S5, after the execution process is finished, the custom data of the process is released, and the address of the custom data stored at the top of the stack is cleared.

[0007] A further improvement of the present invention is: Preferably, when the extension mode of the process kernel stack in the task_struc structure is unknown, the top position of the process kernel stack is determined by the end_of_stack() function.

[0008] Preferably, in a 64-bit system, the address occupies the top 4 bytes of the process kernel stack.

[0009] Preferably, in a 32-bit system, the address occupies the top 2 bytes of the process kernel stack.

[0010] Preferably, the stack top is located at a high address or a low address.

[0011] Preferably, if the process kernel stack expands from a low address to a high address, the address of the custom data is located at the high address of the process kernel stack; if the process kernel stack expands from a high address to a low address, the address of the custom data is located at the high address of the process kernel stack.

[0012] Preferably, when the process kernel stack at the end is released, the custom data of the process is found through the address.

[0013] A device for optimizing process operation based on process kernel stack, comprising: The allocation module is used to store the custom data address of the process at the top of the process kernel stack; An extension module, used for setting a pointer for a process kernel stack of the end; The calling module finds the custom data of the process through the address; Metrics module, used to execute processes; The release module is used to release the custom data of the process after the execution of the process ends, and clean up the address of the custom data stored at the top of the stack.

[0014] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, any one of the above methods for optimizing process operation based on a process kernel stack is implemented.

[0015] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for optimizing process operation based on a process kernel stack as described in any one of the above items is implemented.

[0016] Compared with the prior art, the present invention has the following beneficial effects: The invention discloses a method for optimizing process operation based on a process kernel stack. The method is aimed at some driver or security module development scenarios. Developers store the process's custom data by extending the process descriptor task_struct structure without modifying the kernel source code. The specific process of the method includes: using the process kernel stack space to store the address of the process custom data structure, and storing the address of the process custom data structure at the top of the process kernel stack. The present invention only occupies a pointer-sized space at the end of the stack. A pointer space of a 64-bit system is 4 bytes. Since only the available space of the process kernel stack is reduced by 4 bytes, it generally does not affect the process itself, but the free 4-byte space can be used to extend the process descriptor task_struct to store the process's custom data. The method effectively solves the problem of extending the process descriptor task_struct encountered by driver developers or kernel security module developers during the development process. Developers do not need to modify the kernel source code or consider the impact of traditional methods on kernel performance when using the method, and can be widely used in various driver development, kernel security module and other development scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a schematic diagram of the task_struct structure in the Linux system; Figure 2 It is a flowchart of a method for executing a process based on task_struct; Figure 3 The task_struct structure diagram with custom data addresses added to the Linux system; DETAILED DESCRIPTION It should be noted that the terms "first", "second", etc. in the specification and drawings of the present invention are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0018] First, the English abbreviations or terms involved in the present invention are uniformly defined below.

[0019] Linux system, usually referring to GNU / Linux, is a multi-user network operating system with stable performance.

[0020] Windows operating system is an operating system developed based on the graphical user interface.

[0021] LSM, short for Linux Security Modules, is a lightweight general access control framework in the Linux system kernel.

[0022] The task_struct structure is a process descriptor in the Linux system, which is used to record characteristic information such as process PID and process status throughout the life cycle of the process.

[0023] Each process in the Linux operating system corresponds to a task_struct structure. Linux allocates a process kernel stack for each process. The size of the process kernel stack is 8K in a 32-bit system and 16K in a 64-bit system. When the Linux process kernel stack creates a process, the task_struct structure will also create a corresponding process kernel stack for the process; the task_struct structure of the process has a member variable void*stack, which points to the top of the process kernel stack structure.

[0024] See also Figure 1 This is a schematic diagram of the task_struct structure in the Linux system. Figure 1 The background area of ​​the middle grid is the available area of ​​the process kernel stack, where H points to the beginning and L points to the end. The process kernel stack expands from high address to low address during use, that is, from H to L in the above figure. When it reaches the L point, it indicates that the process kernel stack of the current process has been exhausted. When it reaches the L point, if it continues to expand, it will overwrite the storage space of thread_info, and a stack overflow will occur, causing the process to crash. Therefore, in actual application, the process kernel stack at the end is usually not filled and expanded.

[0025] How to associate the process's custom data structure struct task_private_data with the process descriptor task_struct, that is, how to quickly find the process's custom data structure through task_struct, becomes the key to the problem. A common way is to create a linked list in memory to establish an association relationship, and query the process's custom data structure by looking up the table. However, table lookup will seriously affect efficiency, causing the entire operating system to run more slowly. The application of the present invention can solve this problem well. Based on the above, see Figure 2The first aspect of the present invention discloses a method for optimizing process operation based on process kernel stack, which method does not need to modify kernel source code or establish a mapping relationship between process and process custom data in memory.

[0026] See also Figure 2 The core idea of ​​the present invention is to use the process kernel stack space of the process to expand the process descriptor task_struct structure, and store the address of the process's custom data structure at the end of the process kernel stack. Depending on the system, the process kernel stack of the process is generally 8K or 16K, and the process kernel stack is expanded from one end to the other. The present invention occupies a pointer-sized space at the end of the process kernel stack extension. Based on this, the method of optimizing process operation based on the process kernel stack of the present invention includes the following steps: S1, stores the process's custom data address at the top of the process kernel stack; S2, when it is necessary to access the process's custom data, find the address of the process's custom data at the top of the process kernel stack; S3, finding the custom data of the process through the address; S4, execution process; S5, after the execution process is finished, the custom data of the process is released, and the address of the custom data stored at the top of the stack is cleared.

[0027] The present invention is based on the above-mentioned characteristics of the Linux operating system process kernel stack to expand the process descriptor task_struct structure for storing the address of the self-defined data associated with the process, and uses the process kernel stack space to store the address of the process self-defined data structure, and stores the address of the process self-defined data structure at the end of the process kernel stack. Through the above method, when it is necessary to access the self-defined data of the process, it is only necessary to read the pointer address at the end of the process kernel stack, and the pointer address points to the self-defined data structure associated with the process. On the one hand, it avoids the modification of the kernel source code, and on the other hand, it is not necessary to frequently query the mapping table in the internal memory, which will neither affect the stability and reliability of the Linux system kernel, nor cause the performance of the Linux system kernel to be seriously reduced due to frequent table lookups.

[0028] It should be understood that custom data is private data added to a process, and has different contents depending on the process.

[0029] It should be understood that if Figure 1 As shown, according to the different extension methods of the process kernel stack in the Linux system, the process kernel stack at the end for storing custom data can be located at the head end or at the end. Based on this, there are the following three situations: In some implementation schemes of the present invention, when the expansion mode of the process kernel stack in the task_struc structure is from the head end to the end end, the custom data is placed in the process kernel stack at the end end.

[0030] In some implementation modes of the present invention, when the expansion mode of the process kernel stack in the task_struc structure is from the end to the head end, the custom data is placed in the process kernel stack at the head end.

[0031] In some implementation schemes of the present invention, when the extension mode of the process kernel stack in the task_struc structure is unknown, the position of the process kernel stack at the end is determined by the end_of_stack() function.

[0032] Through the configuration of the above implementation scheme, when the struct task is used normally, the kernel stack of the process at the end will not affect the expansion of the necessary data of the process placed in the struct task.

[0033] In some implementation schemes of the present invention, a pointer occupies 4 bytes in a 64-bit system, and the process descriptor task_struct is extended by using the free 4-byte space at the end to store the custom data of the process.

[0034] The available space of the process kernel stack is reduced by 4 bytes, so it generally does not affect the process itself.

[0035] In some implementations of the present invention, the process's custom data structure is defined as struct task_private_data, the process descriptor task_struct's extended address is defined as void *external, and the process descriptor task_struct of the current process is current. Then the three have the following corresponding relationship: void*external=current->stack±sizeof(struct thread_info)=(structtask_private_data *)process customized data address.

[0036] The present invention stores the address of the process self-defined data structure at the end of the process kernel stack. The process kernel stack of the process is generally 8K or 16K, and the expansion mode of the process kernel stack is to expand from the head end to the end. The present invention only occupies a space of the size of a pointer at the end of the stack. The space of a pointer of a 64-bit system is 4 bytes, which only reduces the available space of the process kernel stack by 4 bytes, so generally the process itself will not be affected. In this way, it is very convenient to establish the association relationship between the process descriptor task_struct and the process self-defined data struct task_private_data. In this way, it is not necessary to look up the table in the memory when finding the corresponding struct task_private_data through the process task_struct. It is only necessary to obtain the memory address where the self-defined data structure struct task_private_data of the process is located through current->stack ± sizeof (struct thread_info), and read the content of the process self-defined data through the address. Doing so avoids the modification of the kernel source code on the one hand, and does not need to frequently query the mapping table in the memory on the other hand, which neither affects the stability and reliability of the Linux kernel, nor causes the performance of the Linux kernel to be seriously reduced due to frequent table lookups.

[0037] The following is further described in conjunction with specific embodiments.

[0038] Example 1 The technical solution is set to be applied to implement an application scenario in which a trusted dynamic measurement is performed on the code segments of all processes in the system.

[0039] Dynamic measurement of the code segment of a process includes at least the following three custom data: 1. Baseline value information: First, you need to collect the baseline value of the process code segment, recalculate the measurement value of the code segment when performing dynamic measurement, and compare it with the baseline value to determine whether the code segment of the process has been tampered with.

[0040] 2. Measurement conditions: Measurement conditions are a set of rules configured by the user, which stipulate under what conditions the process triggers trusted dynamic measurement.

[0041] 3. Control method: The control method is also a set of rules configured by the user, which specifies the specific actions of the process after the measurement fails, including terminating the process, sending an alarm, and resuming the process.

[0042] Based on the above scenarios, custom data including benchmark information, measurement conditions, control methods and other private information are stored in the process's custom data structure struct task_private_data. The complete steps to solve this problem using this technical solution are as follows: Step 1: After the process starts, allocate a memory space of the size of a struct task_private_data structure, and store the process's baseline value, measurement conditions, control method and other private information in the struct task_private_data structure; at the same time, assign the address of the struct task_private_data structure to the extended address void *external.

[0043] Step 2: When performing trusted dynamic measurement on the current process current, you need to first find the custom data structure struct task_private_data corresponding to the current process. To find struct task_private_data, you only need to find the extended address void *external, because the extended address void *external points to the custom data structure struct task_private_data. It is very convenient to find the extended address void *external of the current process. Some system process kernel stacks are extended from high addresses to low addresses, and some are extended from low addresses to high addresses.

[0044] If it is expanding from high to low, the way to get the extended address of the current process is as follows: external = current->stack + sizeof(struct thread_info).

[0045] If it expands from low to high, then external = current->stack - sizeof(structthread_info).

[0046] If you are not sure how the kernel stack of the current system process is extended, the kernel also provides the end_of_stack() function to get the bottom address of the stack: external = end_of_stack(current).

[0047] Step 3: After the process exits, use the same method as step 2 to find the extended address of the process void *external, release the memory space pointed to by external, and assign external to empty.

[0048] A second aspect of the present invention discloses a device for optimizing process operation based on a process kernel stack, comprising: An allocation module, used for placing the custom data of the process in a process kernel stack at one end, wherein the process kernel stack at the end is a process kernel stack at any one end of the task_struc structure of the Linux system; An extension module, used for setting a pointer for a process kernel stack of the end; A calling module is used to find the process kernel stack position at the end through the pointer when executing the process, and call the custom data of the process; Metrics module, used to execute processes; The release module is used to release the process kernel stack at the end after the execution process ends.

[0049] A third aspect of the present invention discloses a computer device, which includes a processor and a memory, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, and is specifically suitable for loading and executing one or more instructions to implement corresponding method flows or corresponding functions; the processor described in this embodiment can be used to implement a method for executing a process based on a task_struct structure, comprising the following steps: placing the custom data of the process in a process kernel stack at one end, the process kernel stack at the end being the process kernel stack at any one of the two ends in the task_struc structure of the Linux system; setting a pointer for the process kernel stack at the end; when executing the process, finding the position of the process kernel stack at the end through the pointer, calling the custom data of the process; executing the process; after the execution of the process ends, releasing the process kernel stack at the end.

[0050] The fourth aspect of the present invention discloses a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a terminal device for storing programs and data. It can be understood that the computer-readable storage medium here can include both the built-in storage medium in the terminal device and the extended storage medium supported by the terminal device. The computer-readable storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and these instructions can be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here can be a high-speed RAM memory or a non-volatile memory (non-volatile memory), such as at least one disk memory. A processor can load and execute one or more instructions stored in a computer-readable storage medium to implement a method for executing a process based on a task_struct structure in the above embodiment, comprising the following steps: placing the custom data of the process in a process kernel stack at one end, the process kernel stack at the end being the process kernel stack at any one of the two ends of the task_struc structure of the Linux system; setting a pointer for the process kernel stack at the end; when executing the process, finding the position of the process kernel stack at the end through the pointer and calling the custom data of the process; executing the process; and releasing the process kernel stack at the end after the execution of the process ends.

[0051] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for optimizing process operation based on process kernel stack, characterized in that: The following steps are involved: S1, stores the process's custom data address at the top of the process kernel stack; S2, when it is necessary to access the process's custom data, find the address of the process's custom data at the top of the process kernel stack; S3, finding the custom data of the process through the address; S4, execution process; S5, after the execution process is finished, the custom data of the process is released, and the address of the custom data stored at the top of the stack is cleared.

2. The method for optimizing process operation based on process kernel stack according to claim 1, characterized in that: When the extension method of the process kernel stack in the task_struc structure is unknown, the top position of the process kernel stack is determined by the end_of_stack() function.

3. The method for optimizing process operation based on process kernel stack according to claim 1, characterized in that: On a 64-bit system, this address occupies the top 4 bytes of the process kernel stack.

4. The method for optimizing process operation based on process kernel stack according to claim 1, characterized in that: On a 32-bit system, this address occupies the top 2 bytes of the process kernel stack.

5. The method for optimizing process operation based on process kernel stack according to claim 1, characterized in that: The stack top is located at a high address or a low address.

6. The method for optimizing process operation based on process kernel stack according to claim 5, characterized in that: If the process kernel stack expands from a low address to a high address, the address of the custom data is located at the high address of the process kernel stack; if the process kernel stack expands from a high address to a low address, the address of the custom data is located at the high address of the process kernel stack.

7. The method for optimizing process operation based on process kernel stack according to claim 1, characterized in that: When the process kernel stack at the end is released, the custom data of the process is found through the address.

8. A device for optimizing process operation based on process kernel stack, characterized in that: include: The allocation module is used to store the custom data address of the process at the top of the process kernel stack; An extension module, used for setting a pointer for a process kernel stack of the end; The calling module finds the custom data of the process through the address; Metrics module, used to execute processes; The release module is used to release the custom data of the process after the execution of the process ends, and clean up the address of the custom data stored at the top of the stack.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method for optimizing process operation based on the process kernel stack as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for optimizing process operation based on the process kernel stack as claimed in any one of claims 1 to 7 is implemented.

Images