CN116127445A - eBPF memory isolation method and system based on kernel mode memory isolation hardware characteristics - Google Patents

Abstract

The invention provides an eBPF memory isolation method and system based on kernel mode memory isolation hardware characteristics, wherein the method comprises the following steps: step S1: calling an auxiliary function; step S2: the springboard function checks whether the parameters of the auxiliary function call are legal; if the error is not checked, error processing is performed, and the execution of the whole eBPF program is ended; if the inspection is passed, the process proceeds to step S3; step S3: updating PKRS to temporarily exit the sandbox; step S4: synchronizing the shadow object back to the kernel object; step S5: calling a real auxiliary function; step S6: synchronizing the kernel object back to the shadow object; step S7: updating the value of PKRS to reenter the sandbox; step S8: and ending calling the auxiliary function. The PKS isolation sandbox reduces the code quantity of the eBPF checker, can intercept malicious eBPF program access and storage in the running process, and solves the problem of false negative.

Description

eBPF memory isolation method and system based on kernel state memory isolation hardware features

technical field

The present invention relates to the technical field of the kernel state, in particular to an eBPF memory isolation method and system based on the hardware characteristics of the kernel state memory isolation.

Background technique

Intel PKS technology is a new hardware feature developed by Intel Corporation. It can divide the kernel address space into independent memory domains at the granularity of pages, and can check the memory every time the program is running without introducing additional performance overhead. Whether the access operation has access to the corresponding memory domain. PKS uses four reserved bits in the page table entry to mark the memory domain to which a page belongs, and introduces a new special module register PKRS to control the access rights of the current kernel thread to the memory domain. The processor can use the WRMSR instruction to modify the value of PKRS, thereby achieving the purpose of kernel memory isolation.

The eBPF mechanism in the Linux kernel can safely load untrusted programs provided by users into the kernel. The eBPF mechanism provides a simplified RISC instruction set architecture, and users can use the eBPF backend provided by llvm to compile C language code into eBPF bytecode. Before loading bytecode into the kernel for execution, eBPF relies on checkers to ensure the safety of loaded programs. Since the llvm compiler is not in the Trusted Computing Base, the checker will check at the eBPF bytecode level to ensure that eBPF programs will not access kernel sensitive information or cause kernel crashes. eBPF bytecode that successfully passes the checker is compiled to machine code for the target hardware architecture. After the eBPF program is successfully loaded into the kernel, it will be triggered to execute by specific events. For example, there are eBPF trigger points preset by the kernel at the beginning and end of the network driver processing network packets and system calls. When the system executes to these places, the eBPF program mounted there will be executed. In addition, eBPF can also rely on Kprobe technology to insert programs into the kernel where almost any function is located.

There are two key problems in the design of the static security check mechanism in the eBPF mechanism. One is that there are loopholes in the code of the checker itself, which may be exploited by attackers to cause "false negative" problems. In the 5.10 version of the Linux kernel, the code of the eBPF checker is about 12,000 lines, with complex logic and large scale. Since 2020, as many as 14 of the vulnerabilities disclosed in the Linux kernel involve the eBPF checker. According to the vulnerabilities, attackers can carefully craft eBPF programs that can cause the kernel to crash or steal sensitive kernel data, and these programs can pass the checker's inspection; The second is the "false positive" problem caused by the conservative inspection of the checker. On the one hand, in order to prevent the checker from taking up too much CPU execution time, eBPF only supports limited semantics at the beginning of the design, such as a limit on the number of instructions, and does not support dynamic memory allocation, etc.; on the other hand, the simulation used by the checker The executed method lacks the semantics of the relationship between variables, making it difficult to accurately track the value ranges of variables. These factors have brought difficulties to the development of eBPF programs. Developers often need to carefully analyze and even understand the underlying principles of the checker to write efficient code that is accepted by the checker.

In order to solve the above-mentioned "false negative" and "false positive" problems, the existing work often enhances the function of the eBPF system by optimizing the static check. PREVAIL can translate eBPF binary files into a language based on execution flow graphs, which can then be read and analyzed by tools based on abstract interpretation. However, PREVAIL's detection speed is slower than the checker in the Linux kernel, it is not compatible with the current kernel eBPF implementation, and it also relies on the abstract interpretation system Crab, which makes it difficult to integrate into the kernel system. The PRSafe system introduces a non-Turing-complete domain-specific language that ensures that all computations are terminated based on the memory and input properties of primitive recursive functions. But the work is still at a relatively early stage, skipping some key issues, such as it relies on the Z3 SMT solver for security checks, but how to provide the same functionality as the eBPF checker is regarded as future work. The ExoBPF system requires developers to provide proof of the correctness of eBPF programs, so the entire eBPF checker can be moved out of the kernel. ExoBPF plans to support different kinds of checkers, including using SAT solving to analyze large programs. The disadvantage of this scheme is that it brings a large proof burden to developers, because developers need to understand formal proofs to use this mechanism well.

Therefore, a new technical solution needs to be proposed to improve the above technical problems.

Contents of the invention

Aiming at the defects in the prior art, the object of the present invention is to provide an eBPF memory isolation method and system based on the hardware characteristics of kernel state memory isolation.

According to a kind of eBPF memory isolation method based on kernel state memory isolation hardware characteristic provided by the present invention, described method comprises the following steps:

Step S1: call the auxiliary function;

Step S2: The springboard function checks whether the parameters of the auxiliary function call are legal; if the check is not passed, it will perform error handling and end the execution of the entire eBPF program; if it passes the check, go to step S3;

Step S3: update PKRS to temporarily exit the sandbox;

Step S4: Synchronize the shadow object back to the kernel object;

Step S5: call the real helper function;

Step S6: Synchronize the kernel object back to the shadow object;

Step S7: update the value of PKRS and re-enter the sandbox;

Step S8: End calling the auxiliary function.

Preferably, the step S1 proposes a springboard function mechanism to solve the problem of auxiliary function calls; the eBPF program calls the auxiliary function through the springboard function; if the auxiliary function needs to access the kernel data structure outside the sandbox, the springboard function updates the PKRS before calling the auxiliary function The value temporarily exits the sandbox and re-enters the sandbox after being called; the springboard function synchronizes the shadow object to the kernel object before calling the helper function, and passes the kernel object as a parameter to the helper function.

Preferably, said step S2 replaces the call to the auxiliary function with the call to the springboard function when the eBPF program is compiled; the springboard function corresponds to the auxiliary function one by one, and the parameters of the call are checked for correctness, and illegal calls are rejected; After the parameters pass the check, the corresponding helper function is called.

Preferably, said step S3 includes a memory that an eBPF program allows access in a sandbox. When the kernel code execution flow is executed to the eBPF program, the value of the PKRS is updated by the WRMSR instruction to enter the sandbox; when the eBPF program calls outside the sandbox The isolation domain is switched again to allow access to the kernel address space when the auxiliary function is called; when the execution flow returns from the auxiliary function or exits from the eBPF program, the isolation domain is switched again.

Preferably, the shadow object in the step S4 is a copy of the kernel data structure in the sandbox, and the eBPF program accesses the shadow object during operation; the nested structure of the shadow object mechanism maintains the structure in the sandbox pointer relationship between them.

The present invention also provides an eBPF memory isolation system based on the hardware characteristics of kernel state memory isolation, and the system includes the following modules:

Module M1: call auxiliary function;

Module M2: The springboard function checks whether the parameters of the auxiliary function call are legal; if it fails the check, it will perform error handling and end the execution of the entire eBPF program; if it passes the check, it will enter module M3;

Module M3: Update PKRS to temporarily exit the sandbox;

Module M4: Synchronize the shadow object back to the kernel object;

Module M5: call the real helper function;

Module M6: Synchronize the kernel object back to the shadow object;

Module M7: update the value of PKRS and re-enter the sandbox;

Module M8: Finish calling the helper function.

Preferably, the module M1 proposes a springboard function mechanism to solve the problem of auxiliary function calls; the eBPF program calls the auxiliary function through the springboard function; if the auxiliary function needs to access the kernel data structure outside the sandbox, the springboard function updates the PKRS before calling the auxiliary function The value temporarily exits the sandbox and re-enters the sandbox after being called; the springboard function synchronizes the shadow object to the kernel object before calling the helper function, and passes the kernel object as a parameter to the helper function.

Preferably, the module M2 replaces the call to the auxiliary function with the call to the springboard function when the eBPF program is compiled; the springboard function corresponds to the auxiliary function one by one, and checks the correctness of the parameters of the call, and rejects illegal calls; After the parameters pass the check, the corresponding helper function is called.

Preferably, the module M3 includes a memory that an eBPF program allows access in a sandbox. When the kernel code execution flow is executed to the eBPF program, the value of the PKRS is updated by the WRMSR instruction to enter the sandbox; when the eBPF program calls the sandbox outside The isolation domain is switched again to allow access to the kernel address space when the auxiliary function is called; when the execution flow returns from the auxiliary function or exits from the eBPF program, the isolation domain is switched again.

Preferably, the shadow object in the module M4 is a copy of the kernel data structure in the sandbox, and the eBPF program accesses the shadow object during operation; the nested structure of the shadow object mechanism maintains the structure in the sandbox pointer relationship between them.

Compared with the prior art, the present invention has the following beneficial effects:

1. The PKS isolation sandbox proposed by the present invention reduces the code amount of the eBPF checker, and can intercept malicious eBPF program access during operation, solving the "false negative" problem;

2. The present invention moves part of the work of the checker to runtime checking, thus allowing more flexible semantics, reducing the burden on eBPF developers, and providing the eBPF compiler with the possibility of more aggressive optimization, alleviating "false positives" "question.

Description of drawings

Other characteristics, objects and advantages of the present invention will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

Fig. 1 is the schematic diagram of the PKS isolation sandbox of the present invention;

Fig. 2 is a schematic diagram of the processing flow of the context object area of the present invention;

Fig. 3 is a flow chart of the execution process of the springboard function in the present invention.

Detailed ways

The present invention will be described in detail below in conjunction with specific embodiments. The following examples will help those skilled in the art to further understand the present invention, but do not limit the present invention in any form. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

Example 1:

According to a kind of eBPF memory isolation method based on kernel state memory isolation hardware characteristic provided by the present invention, described method comprises the following steps:

Step S1: Call the auxiliary function; propose a springboard function mechanism to solve the problem of auxiliary function calling; eBPF program calls the auxiliary function through the springboard function; if the auxiliary function needs to access the kernel data structure outside the sandbox, the springboard function updates the PKRS before calling the auxiliary function The value temporarily exits the sandbox and re-enters the sandbox after being called; the springboard function synchronizes the shadow object to the kernel object before calling the helper function, and passes the kernel object as a parameter to the helper function.

Step S2: The springboard function checks whether the parameters called by the auxiliary function are legal; if it fails the check, it will perform error handling and end the execution of the entire eBPF program; if it passes the check, enter step S3; when compiling the eBPF program, it will The function call is replaced by a call to the springboard function; the springboard function corresponds to the auxiliary function one by one, and the correctness of the parameters of the call is checked, and illegal calls are rejected; the corresponding auxiliary function is called after the parameters pass the inspection.

Step S3: Update PKRS to temporarily exit the sandbox; a sandbox contains a memory that an eBPF program is allowed to access. When the kernel code execution flow is executed to the eBPF program, update the value of PKRS through the WRMSR instruction to enter the sandbox; when the eBPF program calls When the helper function outside the sandbox, the isolation domain is switched again to allow access to the kernel address space; when the execution flow returns from the helper function or exits from the eBPF program, the isolation domain is switched again.

Step S4: Synchronize the shadow object back to the kernel object; the shadow object is a copy of the kernel data structure in the sandbox, and the eBPF program accesses the shadow object during operation; the nested structure of the shadow object mechanism is maintained in the sandbox Pointer relationship between structures.

Step S5: call the real helper function;

Step S6: Synchronize the kernel object back to the shadow object;

Step S7: update the value of PKRS and re-enter the sandbox;

Step S8: End calling the auxiliary function.

The present invention also provides an eBPF memory isolation system based on the hardware characteristics of kernel-mode memory isolation hardware, the eBPF memory isolation system based on the hardware characteristics of kernel-mode memory isolation can implement the eBPF memory isolation method based on the hardware characteristics of kernel-mode memory isolation The process steps are implemented, that is, those skilled in the art can understand the eBPF memory isolation method based on the kernel-mode memory isolation hardware characteristics as a preferred implementation of the eBPF memory isolation system based on the kernel-mode memory isolation hardware characteristics.

Example 2:

The present invention also provides an eBPF memory isolation system based on the hardware characteristics of kernel state memory isolation, and the system includes the following modules:

Module M1: call auxiliary functions; a springboard function mechanism is proposed to solve the problem of auxiliary function calls; eBPF programs call auxiliary functions through springboard functions; if auxiliary functions need to access kernel data structures outside the sandbox, springboard functions update PKRS before calling auxiliary functions The value temporarily exits the sandbox and re-enters the sandbox after being called; the springboard function synchronizes the shadow object to the kernel object before calling the helper function, and passes the kernel object as a parameter to the helper function.

Module M2: The springboard function checks whether the parameters of the auxiliary function call are legal; if it fails the check, it will perform error handling and end the execution of the entire eBPF program; if it passes the check, it will enter module M3; when compiling the eBPF program, it will The function call is replaced by a call to the springboard function; the springboard function corresponds to the auxiliary function one by one, and the correctness of the parameters of the call is checked, and illegal calls are rejected; the corresponding auxiliary function is called after the parameters pass the inspection.

Module M3: Update PKRS to temporarily exit the sandbox; a sandbox contains a memory that an eBPF program is allowed to access. When the kernel code execution flow is executed to the eBPF program, the value of PKRS is updated through the WRMSR instruction to enter the sandbox; when the eBPF program calls When the helper function outside the sandbox, the isolation domain is switched again to allow access to the kernel address space; when the execution flow returns from the helper function or exits from the eBPF program, the isolation domain is switched again.

Module M4: Synchronize the shadow object back to the kernel object; the shadow object is a copy of the kernel data structure in the sandbox, and the eBPF program accesses the shadow object during operation; the nested structure of the shadow object mechanism is maintained in the sandbox Pointer relationship between structures.

Module M5: call the real helper function;

Module M6: Synchronize the kernel object back to the shadow object;

Module M7: update the value of PKRS and re-enter the sandbox;

Module M8: Finish calling the helper function.

Example 3:

The method proposed by the present invention replaces the static simulation execution checking mechanism in the eBPF checker with a lightweight dynamic checking method. Specifically, the present invention proposes to run the eBPF program in the kernel state sandbox, and the sandbox will dynamically check the memory access of the program to ensure that the program cannot illegally access the kernel memory; in order to efficiently implement a lightweight kernel state sandbox , the present invention utilizes the novel hardware feature PKS to check memory access instructions with zero overhead, and proposes an efficient method for interacting between the kernel and the eBPF program in the sandbox.

The present invention modifies the memory management method of the map data structure in the eBPF mechanism. In order to ensure that the eBPF program in the sandbox can normally access the map, the present invention proposes to place the allocated memory pages in the kernel sandbox when creating the map data structure. Because the PKS mechanism protects the memory area at the granularity of the page, the present invention modifies the memory allocation function of each map type so that the allocated memory is aligned at the granularity of the page. The present invention proposes that the map data structure can be placed in a separate kernel sandbox, and multiple eBPF programs are given access to the sandbox, so as to support the map data structure to be accessed by multiple eBPF programs simultaneously.

The invention modifies the memory management mode of the Linux kernel to the network data packets. The present invention proposes to maintain a buffer for storing data packets in the kernel, and place it in a separate sandbox reserved for network packets when the system is started. At the same time, the present invention proposes to use a light-weight memory management library to manage the buffer memory space, and modify the allocation function of data packets in the kernel to ensure that all data packets are allocated in the buffer.

The present invention proposes a shadow object mechanism to solve the problem of eBPF accessing the context structure. The shadow object is a copy of the kernel data structure in the sandbox, and the eBPF program accesses the shadow object during operation. The nested structure of the shadow object mechanism can maintain the pointer relationship between the structures in the sandbox. The present invention proposes a time-use copy mechanism to only copy domains needed by eBPF programs to solve the problem of waste of resources.

The invention proposes a shadow stack mechanism to solve the problem of eBPF programs accessing the kernel stack. The shadow stack is a memory area located in the kernel sandbox. When the eBPF program is executed, the stack pointer will be switched to the shadow stack, and then switched back to the kernel stack after execution. In order to avoid the performance overhead caused by allocating the shadow stack at runtime, this design pre-allocates the shadow stack array in the sandbox when creating the eBPF sandbox, and directly reads the address of the shadow stack according to the current CPU serial number when the program is executed.

The invention proposes a springboard function mechanism to solve the problem of auxiliary function calling. The eBPF program can only call the auxiliary function through the springboard function proposed by the present invention. If the auxiliary function needs to access the kernel data structure outside the sandbox, the springboard function will update the value of PKRS before calling the auxiliary function to temporarily exit the sandbox, and re-enter the sandbox after the call. In order to prevent the kernel from directly accessing the shadow object, the springboard function will synchronize the shadow object to the kernel object before calling the auxiliary function, and pass the kernel object as a parameter to the auxiliary function.

The invention handles PKS page fault abnormality. When a malicious eBPF program accesses memory outside the kernel sandbox, a PKS page fault exception will be triggered. In order to avoid a kernel crash, the page fault exception handler will terminate the execution of the eBPF program, unload the eBPF program from the kernel, and reset the execution flow to the address returned by the eBPF entry function to continue execution.

Fig. 1 is a schematic diagram of the PKS isolation sandbox in the embodiment. A PKS sandbox contains memory that an eBPF program is allowed to access, such as the stack area, context area, and Map area. Memory that can be shared by multiple eBPF programs is placed in the shared sandbox, such as the packet area. When the kernel code execution flow is executed to the eBPF program, the value of PKRS will be updated through the WRMSR instruction to enter the sandbox. When an eBPF program calls a helper function outside the sandbox, the isolation domain is switched again to allow access to the kernel address space. Similarly, when the execution flow returns from a helper function or exits from an eBPF program, the isolation domain is switched again.

Fig. 2 is a schematic diagram of the processing flow of the context object area in the embodiment. The present invention proposes to construct a shadow object copy for the context object at the entry function, and use the pointer (ctx_iso) pointing to the shadow object to replace the original pointer (ctx) as a parameter and pass it to the eBPF machine code, so the context area can be transparently supported for the eBPF program isolation. After the eBPF function is executed, the value of the shadow object may be modified by the eBPF program, and then copy the value of the shadow object back to the original object. The present invention proposes to create shadow objects (nested shadow objects) for all nested structures when creating a shadow object of a structure containing pointers. At the same time, the pointer in the context shadow object will be updated to point to the nested shadow object. This mechanism can also handle two or more levels of nesting. Only some fields (fields marked with shadows) in the context object need to be synchronized into the shadow object, thus solving the problem of waste of resources.

Fig. 3 is a flowchart of the execution process of the springboard function in the embodiment. The springboard function first checks whether the parameters of the function call are legal, such as comparing whether the address of the shadow object in the parameter is the same as the address in the entry function, judging whether the memory address is allowed to be accessed, etc. . If the check fails, error handling will be performed and the execution of the entire eBPF program will end. If the auxiliary function needs to access the kernel data structure outside the sandbox, the springboard function will update the value of PKRS before calling the auxiliary function to temporarily exit the sandbox, and re-enter the sandbox after the call. If the auxiliary function needs to access the shadow object, the springboard function will synchronize the shadow object to the kernel object before calling the auxiliary function, and pass the kernel object as a parameter to the auxiliary function.

An eBPF memory sandbox isolation mechanism based on PKS technology, which controls the read and write permissions of the memory isolation sandbox through PKS technology, and isolates memory resources between different memory domains.

In the memory sandbox isolation mechanism, each eBPF program corresponds to an isolation sandbox. There are independent stack area, map area and context area in the isolation sandbox.

In the memory sandbox isolation mechanism, the map shared by multiple eBPF programs is placed in a public isolation sandbox, and the eBPF program that has access to the map accesses the sandbox at the same time.

In the memory sandbox isolation mechanism, the network data packet area corresponds to a public isolation sandbox, which can be accessed by all eBPF programs that have access rights to network data packets. The network packet isolation sandbox modifies the mechanism for distributing network packets in the kernel, and distributes all network packets to the space reserved in the sandbox when the system starts.

A shadow object mechanism that supports eBPF programs to access context objects, and maintains a shadow object in the sandbox for each context object. When the eBPF function is called, the context object is copied to the shadow object, and the context object in the parameter of calling the eBPF function is replaced with the shadow object. When the eBPF function call ends, the shadow object is copied into the context object.

In the shadow object mechanism, when a pointer in the shadow object points to another object, a new shadow object is created for the object pointed to by the pointer. This mechanism supports nesting of multi-layer object pointers.

In the shadow object mechanism, when only some fields in the context object are accessed by the eBPF program, only these accessed fields are copied into the shadow object.

A springboard function mechanism that supports eBPF programs to access auxiliary functions, and replaces calls to auxiliary functions with calls to springboard functions when eBPF programs are compiled. The springboard function corresponds to the auxiliary function one by one, and checks the correctness of the parameters of the call, and rejects illegal calls. After the parameters pass the check, the corresponding helper function is called.

In the springboard function mechanism, if the auxiliary function needs to access memory outside the sandbox, it temporarily exits the sandbox by modifying the value of PKRS before calling the auxiliary function, and re-enters the sandbox after calling.

In the springboard function mechanism, if the auxiliary function needs to access the context object, the shadow object is copied to the context object before calling the auxiliary function, and the context object is passed to the auxiliary function as a parameter, and the context object is copied back to the shadow object after the call .

A PKS page fault exception handling mechanism. The PKS page fault exception processing function triggered by the illegal memory access of the eBPF program in the isolation sandbox will terminate the execution of the eBPF program, unload the eBPF program from the kernel, and reset the execution flow to The address returned by the eBPF entry function continues execution.

The method proposed by the present invention is not limited to isolating eBPF programs, and can also use the PKS isolation sandbox to isolate important data structures and submodules such as drivers in the kernel.

PKS: Protection Key for Supervisor;

eBPF: Extended Berkeley Packet Filter;

RISC: Reduced Instruction Set Computing, reduced instruction set.

Those skilled in the art may understand this embodiment as a more specific description of Embodiment 1 and Embodiment 2.

Those skilled in the art know that, in addition to realizing the system provided by the present invention and its various devices, modules, and units in a purely computer-readable program code mode, the system provided by the present invention and its various devices can be completely programmed by logically programming the method steps. , modules, and units implement the same functions in the form of logic gates, switches, ASICs, programmable logic controllers, and embedded microcontrollers. Therefore, the system and its various devices, modules, and units provided by the present invention can be regarded as a hardware component, and the devices, modules, and units included in it for realizing various functions can also be regarded as hardware components. The structure; the devices, modules, and units for realizing various functions can also be regarded as not only the software modules for realizing the method, but also the structures in the hardware components.

Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art may make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. In the case of no conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims (10)

1. an eBPF memory isolation method based on kernel state memory isolation hardware characteristics, is characterized in that, described method comprises the steps: Step S1: call the auxiliary function; Step S2: The springboard function checks whether the parameters of the auxiliary function call are legal; if the check is not passed, it will perform error handling and end the execution of the entire eBPF program; if it passes the check, go to step S3; Step S3: update PKRS to temporarily exit the sandbox; Step S4: Synchronize the shadow object back to the kernel object; Step S5: call the real helper function; Step S6: Synchronize the kernel object back to the shadow object; Step S7: update the value of PKRS and re-enter the sandbox; Step S8: End calling the auxiliary function. 2. the eBPF memory isolation method based on kernel state memory isolation hardware characteristics according to claim 1, is characterized in that, described step S1 proposes springboard function mechanism to solve the problem of auxiliary function call; eBPF program calls auxiliary function by springboard function; If the auxiliary function needs to access the kernel data structure outside the sandbox, the springboard function updates the value of PKRS before calling the auxiliary function to temporarily exit the sandbox and re-enter the sandbox after calling; the springboard function synchronizes the shadow object to kernel object, and pass the kernel object as an argument to the helper function. 3. the eBPF memory isolation method based on kernel mode memory isolation hardware characteristics according to claim 1, is characterized in that, described step S2 is replaced with the calling of springboard function to the calling of auxiliary function when eBPF program is compiled; There is a one-to-one correspondence between the function and the auxiliary function, and the correctness of the parameters of the call is checked, and illegal calls are rejected; the corresponding auxiliary function is called after the parameters pass the inspection. 4. the eBPF memory isolation method based on the kernel state memory isolation hardware characteristic according to claim 1, is characterized in that, described step S3 comprises the memory that an eBPF program allows access in a sandbox, when kernel code execution stream execution When entering the eBPF program, update the value of PKRS through the WRMSR instruction to enter the sandbox; when the eBPF program calls an auxiliary function outside the sandbox, switch the isolation domain again to allow access to the kernel address space; when the execution flow returns from the auxiliary function or from the eBPF program When exiting in , switch the isolation domain again. 5. the eBPF memory isolation method based on the kernel mode memory isolation hardware characteristic according to claim 1, is characterized in that, the shadow object in the described step S4 is a copy of the kernel data structure in the sandbox, and the eBPF program is in Access the shadow object during operation; the structure of the shadow object mechanism is nested, and the pointer relationship between the structures is maintained in the sandbox. 6. A kind of eBPF memory isolation system based on kernel state memory isolation hardware characteristic, it is characterized in that, described system comprises following module: Module M1: call auxiliary function; Module M2: The springboard function checks whether the parameters of the auxiliary function call are legal; if it fails the check, it will perform error handling and end the execution of the entire eBPF program; if it passes the check, it will enter module M3; Module M3: Update PKRS to temporarily exit the sandbox; Module M4: Synchronize the shadow object back to the kernel object; Module M5: call the real helper function; Module M6: Synchronize the kernel object back to the shadow object; Module M7: update the value of PKRS and re-enter the sandbox; Module M8: Finish calling the helper function. 7. the eBPF memory isolation system based on kernel state memory isolation hardware characteristics according to claim 6, is characterized in that, described module M1 proposes springboard function mechanism to solve the problem of auxiliary function call; eBPF program calls auxiliary function by springboard function; If the auxiliary function needs to access the kernel data structure outside the sandbox, the springboard function updates the value of PKRS before calling the auxiliary function to temporarily exit the sandbox and re-enter the sandbox after calling; the springboard function synchronizes the shadow object to kernel object, and pass the kernel object as an argument to the helper function. 8. the eBPF memory isolation system based on the kernel state memory isolation hardware characteristic according to claim 6, is characterized in that, described module M2 will be replaced to the calling of springboard function to the calling of auxiliary function when eBPF program compiling; Springboard There is a one-to-one correspondence between the function and the auxiliary function, and the correctness of the parameters of the call is checked, and illegal calls are rejected; the corresponding auxiliary function is called after the parameters pass the inspection. 9. The eBPF memory isolation system based on kernel state memory isolation hardware characteristics according to claim 6, wherein said module M3 includes a memory that an eBPF program allows access in a sandbox, and when the kernel code execution flow executes When entering the eBPF program, update the value of PKRS through the WRMSR instruction to enter the sandbox; when the eBPF program calls an auxiliary function outside the sandbox, switch the isolation domain again to allow access to the kernel address space; when the execution flow returns from the auxiliary function or from the eBPF program When exiting in , switch the isolation domain again. 10. The eBPF memory isolation system based on the kernel state memory isolation hardware characteristic according to claim 6, wherein the shadow object in the module M4 is a copy of the kernel data structure in the sandbox, and the eBPF program is in Access the shadow object during operation; the structure of the shadow object mechanism is nested, and the pointer relationship between the structures is maintained in the sandbox.

Images