155 results about "Linux kernel" patented technology

The invention discloses a compatible operation method for an Android camera HAL in a container based on memory access virtualization, and the method comprises the steps: taking a DMA-Buf memory heap of a Linux kernel host system as a target memory heap, taking an ION memory heap of an Android container system as a source memory heap, building a process exclusive memory management context, an FD cache table and a synchronous fence pool, and carrying out the execution of the process exclusive memory management context, the FD cache table and the synchronous fence pool; kernel registration and node binding of virtual ION equipment, pre-allocation of a first memory pool and access hook registration of kernel layer equipment are completed, and when an ION file descriptor is obtained in an HAL process, legality of a container process is verified, and context binding is initialized to the file descriptor; intercepting a memory allocation request of the HAL process, analyzing and adapting parameters, and preferentially multiplexing first memory pool resources to obtain an ION handle; when a data sharing request is processed, matching an FD cache or generating a new FD through an ION handle; when the HAL process releases the memory, resources are recycled according to a memory source, and when the HAL process exits, the context is cached or destroyed, so that cross-system memory operation compatibility is realized.

The invention discloses an eBPF-based kernel optimization method, system, equipment and medium, belongs to the technical field of Linux kernel network optimization, and aims to solve the technical problem of how to improve the transmission performance for a specific data stream and specify the data stream to carry out a special routing and transmission process so as to provide services for a special network adapter and improve the transmission performance of the specific data stream. According to the technical scheme, the method comprises the steps that data packet interception is carried out on a plurality of kernel eBPF loading points and program interception points selected by a user through an eBPF kernel hook program, routing query is carried out with a routing kernel module, and selection of an operation function and routing parameters is completed; the routing kernel module completes a routing decision based on various complex routing requirements, configuration conditions, data packet conditions and environment conditions, and returns a query result to the eBPF kernel hook program, and the query result is executed by the eBPF kernel hook program. The system comprises an eBPF user mode management program module, a user mode control tool, an eBPF kernel hook program module and a routing kernel module.

The invention provides a dual-storage system starting method and device. An architecture in which a master control chip SOC works cooperatively with an external memory DDR, a nonvolatile memory SPI NOR and an SD card is adopted. After the SOC is powered on, a BootROM guide code is executed, a system is initialized, ID Blocks containing a DDR initialization program and an SPL secondary loading program are sequentially obtained and verified from multiple storage media, the DDR initialization program is loaded, DDR is initialized, and the SPL secondary loading program is loaded to the DDR to run. The method comprises the following steps of: firstly, loading an SD (Secure Digital) card, then loading U-Boot firmware, completing initialization of residual hardware and security mirror verification, then detecting and verifying a kernel mirror format and Header information in the SD card, then loading a Linux kernel, an equipment tree and a ramdisk, mounting rootfs to an RAM (Random Access Memory) space, and mounting the SD card as a user data storage space. According to the method, high reliability of system guiding is ensured through the SPI NOR, large-capacity storage and flexible upgrading are achieved through the SD card, and the comprehensive performance of the embedded system in the aspects of reliability, storage expansibility and cost effectiveness is remarkably improved.

The invention discloses a kernel probe generation method and device, computer equipment and a storage medium, and relates to the technical field of operating system kernel monitoring, and the kernel probe generation method comprises the steps of obtaining a target metadata file corresponding to a current operating system kernel in response to a kernel probe generation request; determining a target declarative strategy file; and determining a target program logic file corresponding to the target declarative strategy file, and generating a probe code according to the target program logic file and the target metadata file to obtain a kernel probe program. The probe program source code adaptive to the current kernel version can be dynamically generated in combination with the target metadata file and the target declarative strategy file, kernel probe development logic and underlying kernel knowledge can be decoupled through the source code generation function, and developers do not need to deeply understand kernel internal data structures and version differences; the development threshold is lower, a specific operating system or probe type is supported, and a universal Linux kernel and multiple probe types are also supported.

According to the kernel indirect control flow transfer dynamic verification method based on the eBPF, an eBPF attachment point of an indirect call instruction is positioned, a verification program is dynamically attached, a source address and a target address are captured to generate a compound key, and the legality of a control flow is verified in a pre-constructed BPF hash table; and meanwhile, three indirect addressing modes of a differential strategy adaptive register, an immediate operand and a memory are adopted. Based on an eBPF technology, an EV program can be dynamically loaded into a running kernel as required during running, and the characteristic of dynamic expansion of a modern kernel can be perfectly adapted; all the capabilities are constructed on a universal software mechanism of a Linux kernel and do not depend on any hardware extension; while powerful security defense is provided, extremely low overhead during operation is realized. Benefited from an innovative hybrid verification strategy and an efficient CFG storage scheme, control flow hijacking attacks in the real world can be effectively defended with extremely low performance loss.

The invention discloses a file hiding method and system based on an ext4 file system, and the method comprises the steps: obtaining a target file and metadata information of a directory where the target file is located according to a target file path needing to be hidden, and distributing a new mapping item in an internal mapping table of the ext4 file system for recording; creating a new hard link in a directory where the target file is located, and associating the new hard link with an inode node for storing metadata information of the target file; reopening the ext4 file system, and deleting the directory entry of the target file, so that the target file cannot be found in the ext4 file system; and re-mounting the ext4 file system, refreshing the Linux kernel cache, and recording the new hard link, the original name of the target file, the inode node number of the target file and the file type into a new mapping item. According to the invention, data security can be ensured, and efficient hidden storage of files is realized.

The invention discloses a method for ensuring hard real-time in a Linux user mode based on a multi-core CPU, and belongs to the technical field of embedded systems. According to the method, a Linux kernel is configured to be in a completely preemptable mode, user threads with the number equal to that of CPU kernels are created and bound to different kernels, a real-time scheduling kernel is selected, the thread scheduling strategy of the real-time scheduling kernel is set to be SCHEDFIFO, the priority of the real-time scheduling kernel is equal to that of the lowest-priority soft interrupt, the thread stack space is locked, the real-time kernel is isolated through kernel parameters isolcplus and nohzfull, and the cost of tick is avoided. Finally, the real-time core is exclusively used for executing the real-time task. According to the scheme, the problem that the real-time performance of the Linux user state task is poor due to the fact that a kernel cannot be preempted, scheduling delay, memory page changing, system interference and the like is effectively solved, and extremely low delay and high certainty of user state task response are ensured through multi-level collaborative optimization.

The invention discloses a system call hijacking method and device compatible with multiple versions of Linux kernels, a first hijacking channel and a second hijacking channel are deployed in parallel in a target version of Linux kernel in advance, the first hijacking channel is adapted to a Linux kernel version executing system call through a system call table, and the second hijacking channel is adapted to a second hijacking channel which is adapted to a Linux kernel version executing system call through a system call table. The second hijacking channel is adapted to a Linux kernel version which executes system calling through a system calling distribution function, and the method comprises the following steps: in response to a system calling request, hijacking the system calling request to a pre-defined target address through a target hijacking channel which actually takes effect in a Linux kernel of a target version, determining a corresponding target function based on the target address; sorting system call parameters carried in the system call request into a data format required by a preset hook entry function through a target function, and sending the data subjected to format sorting to the hook entry function; and determining a security processing strategy for the system call request through a hook entry function on the basis of the formatted data.

The invention provides a monitoring method and system for a high-frequency transaction scene based on an eBPF. The monitoring method comprises the steps that a pre-compiled eBPF byte code program is loaded into a Linux kernel; an eBPF probe is deployed at an event trigger point of each layer of the network protocol stack; establishing a data storage and processing mechanism in a kernel space by using an eBPF Map, acquiring real-time data through a probe, and performing preliminary analysis; further processing is carried out based on the analysis result, and if abnormity is detected, an alarm is given and information is recorded. The technical problem that microsecond-level continuous monitoring and accurate acquisition of abnormal events cannot be realized in high-frequency transactions is solved.

The invention discloses a kernel-level heterogeneous collaborative AI reasoning method and device, equipment and a storage medium, and relates to the field of AI reasoning acceleration. When the KDS receives a reasoning request submitted by a user space, generating a cross-device plan list according to a global system resource state and issuing the cross-device plan list to the HCEE; the HCEE drives the corresponding target execution equipment according to the task execution sequence, reads the data information from the UCMP, or restores intermediate / result data reasoned and output by the target execution equipment; after reasoning of the plan list is completed, the kernel space triggers an event notification mechanism, and a user process of the user space is awakened; and the user process directly reads the reasoning result from the UCMP. According to the scheme, deep collaboration of task scheduling, memory management and equipment execution is realized on a Linux kernel level, the problems of high overhead, resource islands, memory redundant copy, extensive scheduling granularity and the like of a user mode reasoning framework system are solved, and end-to-end low-delay, high-throughput and high-energy-efficiency AI reasoning acceleration is realized.

The invention relates to a container design technology of embedded gateway equipment, discloses a gateway-based multi-container stacking method, and solves the problems of high repeated space occupation and long container creation time when multiple containers are created by adopting a traditional LXC technology in gateway equipment. According to the scheme, the method comprises the steps that S1, a base container file system mirror image is manufactured, specifically, a minimum LXC container suitable for gateway equipment is created, a rootfs catalogue of the container is extracted and packaged, and a squashfs read-only file system format is adopted to construct the base container mirror image; s2, integration and mounting of a base container file system: splitting a framework partition from an existing partition of gateway equipment firmware, and writing a base container mirror image into a specified offset address of the partition; after the gateway system is started, mounting the framework partition to a preset directory, so that the rootfs directory of the base container can be accessed; and S3, creating an application container based on a stacking technology: starting an OverlayFS function of a Linux kernel of the gateway, rewriting container creation logic of the LXC, and configuring a hierarchical storage path of the OverlayFS when the application container is created.

The invention discloses a task difference-oriented congestion control scheduling method and system based on deep reinforcement learning. The method comprises the following steps: carrying out network topology configuration; generating an application layer task flow; performing network protocol stack operation configuration; a customized congestion control module is realized; carrying out data acquisition; performing reward construction; reinforcement learning training is carried out; an action space is designed according to the scheduling strategy difference of different task flows, and the congestion window is adjusted and mapped into an action set according to the focus of attention of each task on the performance index, so that the intelligent agent can output the corresponding scheduling strategy according to the task flow difference, and the task difference-oriented adaptive congestion control is realized. The method has high configurability and real mappability, and the designed modules can truly correspond to related network functions in a Linux kernel. A data structure and processing logic collected in the system are also realized based on a real operating system kernel, so that the method has relatively strong practical feasibility.

The invention relates to the technical field of computer security, in particular to a desktop environment-oriented interactive management and control method for Linux sandbox lightweight process auditing. Comprising the following steps: constructing a dynamic hierarchical sandbox environment based on a namespace and a control group of a Linux kernel, and carrying out bidirectional binding on a specified directory of a host machine and a virtual directory in a sandbox through a preset environment variable mapping rule to realize isolation and dynamic adaptation of a process running environment; loading an intelligent file filter driver with context sensing capability, and performing multi-dimensional monitoring on file operation behaviors of processes in the sandbox in combination with a dynamic probe technology of a kernel mode; constructing a real-time auditing model based on the behavior feature vector, performing security level evaluation on the process operation behavior through the model, and triggering a corresponding management and control strategy according to an evaluation result; according to the method and the device, accurate auditing and dynamic management and control of process behaviors can be realized, so that the safety and the flexibility of the sandbox are improved.

The invention relates to a high-concurrency request processing method for reducing Linux kernel resource loss. The high-concurrency request processing method comprises the following steps: receiving a user request and extracting a routing key; the requests are distributed to one fragment in the fixed N fragments through a fragment event executor, each fragment is bound with a single thread and a bounded queue, and the same routing key requests are executed in the same fragment in a strongly sequenced mode according to the enqueue sequence; calling a coprogram state machine to push a business process in the fragment execution thread, and returning a state result of migrating to a next state, keeping a current state or terminating the process through a state processing function; dynamically triggering self-adaptive back pressure based on queue depth or waiting time delay, and adjusting a request submission strategy according to a queue filling rate and exponentially weighted moving average waiting time delay; and submitting the long blocking task to an asynchronous task subsystem, and performing isolated execution through an independent bounded queue and a small concurrent thread pool. The same-key sequence is guaranteed through fragmentation single-thread execution, and thread switching and lock contention are remarkably reduced.

The invention provides a heterogeneous task lock scheduling system and a control method thereof.The heterogeneous task lock scheduling system comprises a task lock scheduling module, the task lock scheduling module calculates a lock weight actual value corresponding to a current task, compares the lock weight actual value with a lock weight threshold value, and sends the lock weight actual value to the current task; according to the task type and the comparison result, a task lock type matched with the current task is allocated to the current task; the core domain module comprises an RTOS core domain and a Linux core domain which communicate with each other, and can dynamically adjust a core domain type bound with a current task according to a processing stage; an emergency response channel through which an emergency stop signal can be sent into the RTOS core domain; the real lock weight value corresponding to the current task is calculated through the task lock scheduling module, the real lock weight value is compared with the lock weight threshold value, and therefore the task lock type matched with the current task is allocated to the current task according to the task type and the comparison result, and the problem of real-time performance instability caused by task lock competition of the CNC system under the AMP architecture is solved.

The application relates to a multifunctional controller based on an SPI bus, which comprises a core control module for packaging an SPI communication protocol frame and a register read-write instruction based on a Linux kernel subsystem; a device class registration module for registering a special device class to manage corresponding special functions through the device class registration module; a first docking module for docking standard functions with the Linux kernel subsystem to drive the standard functions based on an SPI interface and the register read-write instruction; and a second docking module for abstracting non-standard functions into virtual SPI devices and docking the virtual SPI devices with an application layer. Through an innovative modular architecture and a unified management mechanism, the application effectively solves technical problems such as complex development of a multifunctional controller driver, lack of out-of-band management, difficulty in application layer development, and chaotic driver management, and provides an efficient, flexible and easily-extended solution for the development and management of multifunctional SPI peripherals.

The application discloses a printer configuration webpage access method based on a USB-to-network port and a printer device, and the method comprises the following steps: controlling a LINUX kernel to load a USB virtual network card driver, allocating an IP address and a subnet mask for a USB port, and generating a virtual network port according to the USB port; performing domain name system configuration processing on the virtual network port, and allocating a slave IP address for a terminal device connected to the USB port according to the IP address and the subnet mask, wherein, the USB port of the printer is simulated into a virtual network port through the USB virtual network card driver, so that the terminal device can obtain the slave IP address allocated by the virtual network port by connecting the USB port, access the network of the printer device through the slave IP address, and access the configuration webpage of the printer device, thereby simply and effectively realizing the printer configuration webpage access, not needing additional hardware devices, and further simplifying the configuration webpage access process and improving the use experience of users.

The invention relates to an SPI (Serial Peripheral Interface) data acquisition method and device. The method is applied to a system-on-chip integrated with a multi-core CPU (Central Processing Unit), and comprises the following steps of: binding a high-precision timer and an SPI (Serial Peripheral Interface) data acquisition task to a special CPU core; the high-precision timer is configured into an absolute time trigger mode based on a hardware clock source, and the frequency corresponding to a trigger period is higher than a target sampling frequency; the special CPU core is configured to exclusively run the high-precision timer, process interruption generated by the high-precision timer and execute an SPI data acquisition task; in response to the interruption generated by the high-precision timer, starting SPI data acquisition by utilizing an interruption processing function, and storing the acquired data into an annular buffer area; and reading the data stored in the annular buffer area, and correcting the read data to obtain SPI data meeting the sampling requirement. By adopting the method, the problem of sampling time sequence jitter caused by Linux kernel scheduling in a high-frequency and high-precision scene of the existing SPI data acquisition method can be solved.

This application provides a process monitoring method, electronic device, storage medium, and computer program product. The method includes: acquiring file access events of a target directory; responding to the file access events, reading a process file system to obtain first runtime information of multiple Linux processes, wherein the process file system is used to provide runtime information of all Linux processes under non-privileged user privileges, and the non-privileged user privileges do not have control permissions in the Linux kernel mode; and generating a process activity log based on the first runtime information of the multiple Linux processes. This application's solution allows for more comprehensive monitoring of process activities in a Linux system.

This invention discloses a hardware topology detection method for kernel instrumentation, comprising: obtaining and extracting key structure definitions from the current Linux kernel through the BTF infrastructure, and copying the structure definitions into the kernel module source code; reading the kernel symbol table, selecting the instrumented function from it, and filling the kernel module source code; obtaining the kernel header file of the target machine, compiling and loading the kernel module in conjunction with the modified kernel module source code, and specifying the storage path of the output file; obtaining the number of on-chip systems in the current system according to the sysfs interface, performing a counting operation on the performance monitoring units on each on-chip system, triggering the instrumented function, and obtaining the pointer to the key structure of the kernel driver; using the pointer to the key structure of the kernel driver to calculate the coordinates of the XP node and its connected device type information, obtaining the data through MMI / O access and outputting it in a structured format. This invention also discloses a detection system for implementing the above detection method, which has a wide range of application scenarios.

The application relates to a novel LinuxBoot starting and booting method and system based on a RISC-V server CPU, which comprises the following steps: firstly, ZSBL is executed, and FSBL is loaded and jumped to. Then, the FSBL loads a DTB, OpenSBI and LinuxBoot into a memory; the OpenSBI firstly executes underlying initialization, then executes platform early initialization, related hardware device initialization and platform final initialization, and finally executes secondary boot to jump to a LinuxBoot kernel; the LinuxBoot kernel loads u-root as initramfs; the LinuxBoot kernel loads a real Linux kernel image and a device tree, and sets hardware configuration and parameters, so that the Linux kernel is started. The application improves the efficiency and flexibility of system starting; and realizes fast, reliable and flexible starting of a server system.

The application discloses a kind of based on Linux kernel's cryptographic device master-standby cluster load balancing method, it is related to information security and high-availability cluster technical field, including the following steps: step one, at least one main cryptographic device node is configured with at least one backup cryptographic device node, and cryptographic service program is deployed on all nodes to initialize cluster configuration, Keepalived service module is deployed in main cryptographic device node and backup cryptographic device node, periodically send heartbeat message by groupcast mode, and real-time perception node state;Step two, set up health detection module, and adopt dual detection mechanism of node survival detection and cryptographic service availability detection;It can realize that cryptographic device master-standby automatically switches quickly, load intelligent distribution, security context real-time synchronization, comprehensively improve the availability of cryptographic service, reliability, efficiency and security, meet the high-level security needs of critical information system.

The invention relates to an external display screen driving method and system based on an Android system, an external display screen is connected with Android equipment through a low-speed serial interface, and the method comprises the steps that S1, a Native layer initialization function is called through a JNI interface on an Android application layer; s2, an LVGL graphic library is loaded on a Native layer; s3, registering and adapting external display screen hardware of the low-speed serial interface through a display driving interface of the LVGL graphics library; s4, executing a color space conversion algorithm on the Native layer, and converting color graphic data output by the LVGL graphic library into color format data suitable for the target external display screen; and S5, transmitting the converted display data to an external display screen through a device driving interface of the Linux kernel. According to the method, the lightweight LVGL graphics library is integrated into the Android application through the JNI technology, and the display screen connected through the low-speed serial interface is directly driven in the user space, so that the efficient and flexible display driving is realized under the condition that the source code of the Android system is not modified, and the multi-screen different display function is supported.

The invention discloses a PXE dual-system parallel installation method and device, equipment and a storage medium, and relates to the technical field of operating systems, and the method comprises the steps: loading a to-be-deployed Linux kernel and a corresponding system mirror image file in a PXE environment of target equipment, and determining dynamic partition matrixes of a Linux operating system and a Windows operating system based on hardware disk data of the target equipment; creating an LVM volume group based on the dynamic partition matrix, starting installation of the Linux operating system according to the to-be-deployed Linux kernel and the system mirror image file, and meanwhile, installing the Windows operating system to a second partition corresponding to the Windows operating system in the LVM volume group by utilizing a preset virtual machine; and mounting the read-only SquashFS mirror image to a Linux operating system and a Windows operating system so as to realize parallel installation of the PXE dual systems. In this way, parallel installation of the PXE dual systems can be achieved.

The invention provides a bypass decryption method for TLS protocol traffic, electronic equipment and a storage medium, and belongs to the technical field of data processing. The method comprises the steps that when a target process executes a specified function and completes TLS negotiation, an eBPF program is executed through a Linux kernel, and the eBPF program is used for obtaining a master key generated by TLS negotiation from a runtime context of the target process; the decryption program is used for transmitting the master key from a kernel mode to a user mode; and deriving a symmetric key for decryption from the master key through the decryption program so as to decrypt the TLS protocol flow collected by the bypass. According to the method and the device, reliable bypass decryption of TLS 1.3 and earlier version protocol traffic can be realized on the premise of not depending on a server private key and not changing a network topology.

This invention provides a method for improving the real-time performance of Linux operating system applications based on a multi-core CPU. The method includes, during system startup, modifying Linux kernel startup parameters to reallocate tasks across the cores of the multi-core CPU, concentrating basic Linux system tasks on the zeroth core; when the target application creates a task, it sets task affinity based on the task's real-time requirements by calling system functions; non-real-time critical tasks are assigned to the first core; real-time critical tasks are assigned to the second core; and sub-real-time critical tasks are assigned to the third core. This invention effectively reduces the response latency of specific interrupts with strict real-time requirements in the Linux system by utilizing different cores of a multi-core CPU to allocate different tasks, improving device real-time performance and meeting the real-time requirements of fields such as power distribution automation.

This invention relates to a method for cross-version binary compatibility of Linux kernel modules, belonging to the field of computer operating system kernels. It includes the following steps: During the compilation phase, the compiler identifies specific keywords (__kabi_reloc_member, __kabi_check_member, __kabi_sizeof) and records instruction offsets, type identifiers, member variable name offsets, and relocation types, generating a .kabi_relocs segment. During the loading phase, the loader parses the .kabi_relocs segment, combines it with module BTF and kernel BTF information, and dynamically repairs instructions based on the relocation type. This invention achieves "compile once, run anywhere" binary compatibility for kernel modules, with the repair operation completed at load time, having no impact on runtime performance.

The invention relates to a secure and trusted computing system based on real-time virtualization of an aneuhua OS (Operating System). The secure and trusted computing system comprises three program modules and a virtual machine manager, wherein the virtual machine manager provides a high-efficiency virtualization technology, adopts a Type1 type virtualization architecture, realizes a lightweight virtual machine manager at a bottom layer, and runs on a hardware platform; the trusted computing core is specially responsible for running an embedded operating system and is used for executing a secure and sensitive trusted computing task; the Linux core is used for operating user service processing and providing user experience and service support; the security isolation and monitoring module is used for realizing security isolation between the two trusted computing cores and the Linux core; the security authentication and authorization module is used for performing identity authentication and authorization on the user and the application program; the problems that real-time guarantee of tasks is difficult to realize and application requirements in the technical field cannot be met in a current system security extension technology are solved, and a secure and credible operation environment during multi-core heterogeneous hybrid deployment and credible computing is realized.

The application relates to a service processing method, system, device and medium based on a dual real-time kernel. A real-time Linux kernel and a real-time virtual machine monitor kernel are constructed, and a message sharing channel is established between the real-time Linux kernel and the real-time virtual machine monitor kernel; according to a preset multidimensional task scheduling strategy and a preset resource allocation and isolation strategy, the real-time Linux kernel is responsible for system service process scheduling and resource allocation at an operating system level, and the real-time virtual machine monitor kernel is responsible for scheduling, device simulation and resource allocation of a virtual machine service. Through the dual real-time kernel, task scheduling is separated, and the efficiency of task scheduling can be effectively improved. Through the optimized multidimensional task scheduling strategy and the resource allocation and isolation strategy, task scheduling is controlled, and the scheduling delay and jitter of real-time tasks in system services and / or virtual machine services are improved in combination with hardware optimization. The system device and the medium based on the method provided by the application can also achieve the above effects.

The invention provides a detection method and device for an industrial personal computer in a distributed control system and electronic equipment. The detection method comprises the following steps: pre-determining a plurality of detection items of a to-be-detected industrial personal computer of an operating system carrying a Linux kernel, and a preset detection strategy corresponding to each detection item; and detecting the corresponding detection item on the to-be-detected industrial personal computer by adopting a preset detection strategy to obtain a corresponding target detection result. Detecting corresponding detection items on a to-be-detected industrial personal computer of an operating system carrying a Linux kernel through a preset detection strategy; the to-be-detected industrial personal computer carrying the operating system with the Linux kernel can be accurately and comprehensively detected, so that the reliability and the stability of the to-be-detected industrial personal computer carrying the operating system with the Linux kernel can be remarkably improved.