Hypercall method and device for kernel mode program of enhanced packet filter

Abstract

The embodiment of the invention provides a hypercall method and device for a kernel mode program of an enhanced packet filter. The method is applied to a virtual machine monitor, and comprises the following steps: in response to a virtualization missing page triggered by a kernel mode program, obtaining a memory address for triggering the virtualization missing page; judging whether the memory address of the virtualization missing page is consistent with the memory address corresponding to the missing page key in the mapping table or not; wherein the mapping table records the mapping relation between the key value pairs, the missing page keys are keys jointly determined by the kernel mode program and the virtual machine monitor in the mapping table, and each key in the mapping table uniquely corresponds to one memory address; if the memory address of the virtualization missing page is consistent with the memory address corresponding to the missing page key, reading a missing page value mapped by the missing page key from the mapping table; wherein the missing page value comprises the function type of the hyper-call written by the kernel mode program before triggering the virtualized missing page; and executing the hyper call of the function type based on the function type indicated by the missing page value.

Description

technical field [0001] The embodiments of the present specification relate to the field of computer technology, and in particular, to a method and apparatus for hypercalling a kernel-mode program of an enhanced packet filter. Background technique [0002] Extended Berkeley Packet Filter (eBPF) is a general-purpose execution engine. Enhanced packet filters are commonly used by developers because they can run special programs (such as sandboxed programs) in the operating system kernel (such as the Linux kernel) without changing the kernel source code or loading kernel modules. [0003] The architecture of the enhanced packet filter may include at least two parts: user mode program (or user space program) and kernel mode program (or kernel program). Among them, the user-mode program is used to load the instruction code (such as BPF bytecode) into the kernel, and can also read the information or events returned by the kernel; and the kernel-mode program is used to convert the i...

AI Technical Summary

Problems solved by technology

[0005] However, if the enhanced packet filter running in a virtualized environment wants to obtain higher operating authority, it needs to switch from the kernel state program to the underlying virtual machine monitor (Hypervisor, or virtual machine monitor, VMM) in the virtual machine. ); while the kernel state program of the existing enhanced packet filter cannot call the Hypercall, so it cannot switch to the Hypervisor to obtain a higher operating authority

Images