Operating system compatibility layer
The technology provides efficient and secure virtualized execution of software compiled for a first (guest) operating system to run on a second (host) operating system. This includes delineating a kernel space and a separate user space, the kernel space including a handle table and kernel of a host operating system. In the user space, a restricted space is separate from an unrestricted space. The restricted space corresponds to a restricted mode and the unrestricted space corresponding to an unrestricted mode. A hyperprocess is implemented and a hyperprocess handle table is created in the unrestricted space. A set of child processes is loaded into separate memory address spaces in the restricted space, wherein the set of child processes is associated with a guest operating system. The hyperprocess handle table is shared among the child processes and includes a file descriptor tables each associated with a specific child process.
1 . A computer-implemented method executable by one or more processors of a processing system, the method comprising:
in an assigned address space, delineating a kernel space and a separate user space, the kernel space including a handle table and kernel of a host operating system;
in the user space, delineating a restricted space separate from an unrestricted space, the restricted space corresponding to a restricted mode and the unrestricted space corresponding to an unrestricted mode, wherein the unrestricted mode allows access to both a private address space of a given address space and a shared address space of the given address space, and wherein the restricted mode allows access to the private address space and not the shared address space;
implementing a hyperprocess in the unrestricted space as a translation layer of the user space and creating a hyperprocess handle table in the unrestricted space; and
loading a set of child processes into separate memory address spaces of the restricted space, wherein the set of child processes are associated with a guest operating system;
wherein the hyperprocess handle table is shared among the set of child processes and includes a set of file descriptor tables, each file descriptor table being associated with a specific child process of the set of child processes.
2 . The method of claim 1 , wherein the implementing is performed by a runner of the host operating system.
3 . The method of claim 1 , further comprising loading a host process into the restricted space in a location distinct from the memory address spaces of the child processes.
4 . The method of claim 1 , wherein delineating the restricted space separate from the unrestricted space includes splitting the user space into two partitions.
5 . The method of claim 4 , wherein the two partitions evenly split the user space.
6 . The method of claim 4 , wherein the two partitions are split along a page table boundary.
7 . The method of claim 1 , wherein the set of child processes has an N:1 mapping with hyperprocess handle table, and each thread of a given child process has an N:1 mapping with the given child process, and an N:1 mapping with the memory address spaces in the restricted space.
8 . The method of claim 1 , wherein the memory address spaces in the restricted space has a tree of virtual memory access regions associated with the set of child processes.
9 . The method of claim 1 , wherein upon entering the restricted mode via a system call, the method includes returning any traps and exceptions back to the unrestricted mode via an in-process vector table.
10 . The method of claim 1 , further comprising the kernel saving restricted state information upon transitioning to the unrestricted mode.
11 . The method of claim 1 , wherein a thread of a given child of the set of child processes is permitted to access different memory regions depending on which process it is a member of, and which mode it is operating in.
12 . The method of claim 1 , wherein implementing the hyperprocess and creating the hyperprocess handle table in the unrestricted space includes implementing a set of distinct hyperprocesses each having its own hyperprocess handle table, in which the set of child processes for a given one of the set of hyperprocesses does not interact with the set of child processes for any other of the set of hyperprocesses.
13 . A processing system, comprising:
memory having a set of address spaces; and
one or more processors operatively coupled to the memory, the one or more processors being configured to:
in an assigned address space, delineate a kernel space and a separate user space, the kernel space including a handle table and kernel of a host operating system;
in the user space, delineate a restricted space separate from an unrestricted space, the restricted space corresponding to a restricted mode and the unrestricted space corresponding to an unrestricted mode, wherein the unrestricted mode allows access to both a private address space of a given address space and a shared address space of the given address space, and wherein the restricted mode allows access to the private address space and not the shared address space;
implement a hyperprocess in the unrestricted space as a translation layer of the user space and create a hyperprocess handle table in the unrestricted space; and
load a set of child processes into separate memory address spaces of the restricted space, wherein the set of child processes are associated with a guest operating system;
wherein the hyperprocess handle table is shared among the set of child processes and includes a set of file descriptor tables, each file descriptor table being associated with a specific child process of the set of child processes.
14 . The processing system of claim 13 , wherein the processing system is configured to load a host process into the restricted space in a location distinct from the memory address spaces of the child processes.
15 . The processing system of claim 13 , wherein delineation of the restricted space separate from the unrestricted space includes splitting the user space into two partitions.
16 . The processing system of claim 13 , wherein the set of child processes has an N:1 mapping with hyperprocess handle table, and each thread of a given child process has an N:1 mapping with the given child process, and an N:1 mapping with the memory address spaces in the restricted space.
17 . The processing system of claim 13 , wherein the memory address spaces in the restricted space has a tree of virtual memory access regions associated with the set of child processes.
18 . The processing system of claim 13 , wherein upon entering the restricted mode via a system call, the processing system supports returns of any traps and exceptions back to the unrestricted mode via an in-process vector table.
19 . The processing system of claim 13 , wherein a thread of a given child of the set of child processes is permitted to access different memory regions depending on which process it is a member of, and which mode it is operating in.
20 . The processing system of claim 13 , wherein implementation of the hyperprocess and creation of the hyperprocess handle table in the unrestricted space includes implementing a set of distinct hyperprocesses each having its own hyperprocess handle table, in which the set of child processes for a given one of the set of hyperprocesses does not interact with the set of child processes for any other of the set of hyperprocesses.