Cloud platform-oriented virtual machine kernel hot patch loading method and system

Abstract

The invention belongs to the technical field of information, and particularly discloses a virtual machine kernel hotfix loading method and system oriented to a cloud platform, and the method comprises the steps: obtaining a virtual machine kernel hotfix file; based on the virtual machine kernel hot patch file, patch functions corresponding to the target functions are loaded, jump instructions are configured at the addresses of the target functions, and the jump instructions are used for indicating jump to the patch functions corresponding to the target functions. According to the application, the hot patch loading function of the virtual machine kernel is integrated in the virtual machine manager, the patch function corresponding to each target function can be loaded, and the jump instruction is configured at the address of each target function, so that the virtual machine kernel jumps to the newly loaded patch function when calling the target function; the virtual machine service interruption in the virtual machine kernel function updating and vulnerability repairing process is avoided, the continuous operation of the virtual machine operation system is ensured, and the vulnerability repairing timeliness is ensured.

Description

Technical Field

[0001] The present application belongs to the field of information technology, and more specifically, relates to a method and system for loading hot patches for a virtual machine kernel on a cloud platform. Background Art

[0002] Virtualization technology abstracts and logicalizes computer hardware resources to form one or more virtual computer systems. Virtualization technology can divide a physical computer into multiple virtual machines (VMs), each of which can run different operating systems and applications, and are independent of each other and do not affect each other. On the one hand, virtualization technology can fully utilize physical hardware resources and improve resource utilization. On the other hand, it can dynamically create and delete virtual machines according to demand, improving the flexibility and scalability of resource utilization.

[0003] Cloud computing technology is a computing service model built on virtualization technology, which provides computing resources, storage resources and application services through the network. Cloud computing technology can allocate computing resources on demand according to user needs, and realize dynamic scaling and efficient management of computing resources.

[0004] A cloud platform is a collection of computing resources and services built on cloud computing technology, and is provided to users through the Internet. It can provide a variety of computing resources (such as virtual machines, storage, networks, etc.), applications, and services to meet user needs. A cloud platform's virtual machine refers to a virtual computer instance running in a cloud computing environment. It divides physical computer resources into multiple virtual computers through software technology, and each virtual machine has its own operating system and application.

[0005] Virtual machines can be dynamically created, started, stopped, and deleted on the cloud platform, and users can flexibly adjust the number and configuration of virtual machines according to their needs. Virtual machines can provide computing power similar to that of physical computers, including resources such as processors, memory, storage, and networks.

[0006] Virtualization technology and cloud computing technology have significant advantages in resource management and flexibility. Information systems built on cloud computing technology are developing continuously in the fields of Internet of Things, artificial intelligence, automotive electronics, etc. However, the security and stability of virtual machine operating systems directly affect the reliability and sustainability of information systems. Traditional methods of updating and repairing the kernel of virtual machine operating systems require restarting the virtual machine, resulting in service interruption; or require virtual machine operating system operation and maintenance personnel to log in to the virtual machine for invasive updates and repairs, which reduces the timeliness of vulnerability repairs and creates the risk of kernel attacks. Summary of the invention

[0007] In view of the defects of the prior art, the present application aims to solve the problems of service interruption and reduced vulnerability repair timeliness caused by virtual machine kernel updates and upgrades in existing cloud computing platforms.

[0008] To achieve the above objectives, in a first aspect, the present application provides a virtual machine kernel hot patch loading method for a cloud platform, comprising:

[0009] Obtain a virtual machine kernel hot patch file, the virtual machine kernel hot patch file includes a patch function corresponding to each target function, the target function is a function to be modified in the virtual machine kernel, and the patch function is used to replace the target function;

[0010] Based on the virtual machine kernel hot patch file, the patch function corresponding to each target function is loaded, and a jump instruction is configured at the address of each target function, the jump instruction is used to indicate jumping to the patch function corresponding to the target function.

[0011] In a possible implementation, obtaining a virtual machine kernel hot patch file includes:

[0012] Based on the source code of the patch function, a patch target code is generated by compiling, and the patch target code is an executable target file corresponding to the patch function;

[0013] A virtual machine kernel hot patch file is generated based on the patch target code, patch metadata and target function address table. The patch metadata is used to characterize the virtual machine kernel adapted by the patch function, and the target function address table is used to represent the address of the function to be modified.

[0014] In a possible implementation, generating a virtual machine kernel hot patch file based on the patch target code, the patch metadata, and the target function address table includes:

[0015] Perform signature processing on the patch target code, patch metadata and target function address table to obtain signature data;

[0016] Generate a virtual machine kernel hot patch file based on the patch target code, patch metadata, target function address table and signature data.

[0017] In a possible implementation, the signature data includes: a patch target code data signature, a patch metadata signature, and a target function address table signature;

[0018] Accordingly, the patch target code, patch metadata and target function address table are signed to obtain signature data, including:

[0019] Based on the patch target code and the hash check value corresponding to the patch target code, signature processing is performed to obtain the patch target code data signature;

[0020] Based on the patch metadata and the hash check value corresponding to the patch metadata, signature processing is performed to obtain the patch metadata signature;

[0021] Based on the target function address table and the hash check value corresponding to the target function address table, signature processing is performed to obtain the signature of the target function address table.

[0022] In a possible implementation, based on the virtual machine kernel hot patch file, the patch functions corresponding to each target function are loaded, including:

[0023] Based on the signature data, the patch target code, patch metadata and target function address table in the virtual machine kernel hot patch file are verified to obtain the signature verification result;

[0024] When the signature verification result indicates that the verification is passed, based on the patch metadata, the compatibility between the patch function and the running virtual machine kernel is verified to obtain a compatibility verification result;

[0025] When the compatibility check result indicates that the patch function is compatible with the running virtual machine kernel, the patch object code is loaded.

[0026] In a possible implementation, a jump instruction is configured at the address of each target function, including:

[0027] Based on the target function address table and the addresses of the respective patch functions, a jump instruction is configured at the address of each target function.

[0028] In a second aspect, the present application provides a virtual machine kernel hot patch loading system for a cloud platform, comprising:

[0029] A virtual machine kernel hot patch generating device, used for obtaining a virtual machine kernel hot patch file, wherein the virtual machine kernel hot patch file includes a patch function corresponding to each target function, wherein the target function is a function to be modified in the virtual machine kernel, and the patch function is used to replace the target function;

[0030] A virtual machine kernel hot patch loading device is used to load patch functions corresponding to each target function based on a virtual machine kernel hot patch file, and configure jump instructions at the addresses of each target function, wherein the jump instructions are used to indicate jumping to the patch function corresponding to the target function.

[0031] In a possible implementation, the virtual machine kernel hot patch loading device is arranged in the virtual machine manager.

[0032] In a third aspect, the present application provides an electronic device comprising: at least one memory for storing programs; and at least one processor for executing the programs stored in the memory. When the program stored in the memory is executed, the processor is used to execute the method described in the first aspect or any possible implementation of the first aspect.

[0033] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the method described in the first aspect or any possible implementation of the first aspect.

[0034] In general, the above technical solutions conceived by this application have the following beneficial effects compared with the prior art:

[0035] (1) By obtaining the virtual machine kernel hot patch file, the function to be modified in the virtual machine kernel (target function) and the patch function used to replace the target function can be determined. Then, by integrating the virtual machine kernel hot patch loading function into the virtual machine manager, the patch function corresponding to each target function can be loaded, and a jump instruction can be configured at the address of each target function. Then, when the virtual machine kernel calls the target function, it jumps to the newly loaded patch function, thereby realizing real-time batch update and upgrade of the virtual machine kernel using the cloud platform, avoiding virtual machine service interruption during the virtual machine kernel function update and vulnerability repair process, ensuring the continuous operation of the virtual machine operating system, and ensuring the timeliness of vulnerability repair.

[0036] (2) By integrating the hot patch loading function of the virtual machine operating system into the virtual machine manager, the advantages of the flexible management of the cloud computing platform can be fully utilized to achieve batch updates of the virtual machine operating system and improve the efficiency of updating and upgrading the virtual machine operating system functions. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a flow chart of a method for hot patch loading of a virtual machine kernel for a cloud platform provided in an embodiment of the present application;

[0038] Figure 2 It is a schematic diagram of an implementation framework of a virtual machine kernel hot patch loading method for a cloud platform provided in an embodiment of the present application;

[0039] Figure 3 It is a schematic diagram of the virtual machine kernel hot patch file format provided in an embodiment of the present application;

[0040] Figure 4 It is a structural diagram of a virtual machine kernel hot patch loading system for a cloud platform provided in an embodiment of the present application;

[0041] Figure 5It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0043] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0044] In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more than two. For example, multiple processing units refer to two or more processing units, etc.; multiple elements refer to two or more elements, etc.

[0045] The embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application.

[0046] Figure 1 It is a flow chart of a method for hot patch loading of a virtual machine kernel for a cloud platform provided in an embodiment of the present application. The method includes the following steps S101 and S102.

[0047] Step S101, obtaining a virtual machine kernel hot patch file, the virtual machine kernel hot patch file including patch functions corresponding to each target function, the target function is a function to be modified in the virtual machine kernel, and the patch function is used to replace the target function;

[0048] Step S102 , based on the virtual machine kernel hot patch file, loading the patch function corresponding to each target function, and configuring a jump instruction at the address of each target function, the jump instruction is used to instruct to jump to the patch function corresponding to the target function.

[0049] Figure 2 is a schematic diagram of an implementation framework of a virtual machine kernel hot patch loading method for a cloud platform provided in an embodiment of the present application, such as Figure 2As shown, the virtual machine kernel hot patch generating device is used to execute the above step S101, and the virtual machine kernel hot patch loading device is used to execute the above step S102. By obtaining the virtual machine kernel hot patch file, the function to be modified in the virtual machine kernel (target function) and the patch function used to replace the target function can be determined, and then by integrating the virtual machine kernel hot patch loading function into the virtual machine manager, the patch function corresponding to each target function can be loaded, and the jump instruction can be configured at the address of each target function, and then the virtual machine kernel jumps to the newly loaded patch function when calling the target function, so as to realize the real-time batch update and upgrade of the virtual machine kernel by using the cloud platform, avoid the interruption of virtual machine service during the virtual machine kernel function update and vulnerability repair process, ensure the continuous operation of the virtual machine operating system, and ensure the timeliness of vulnerability repair.

[0050] Figure 3 Schematic diagram of the virtual machine kernel hot patch file format provided in the embodiment of the present application, such as Figure 3 As shown in the figure, the virtual machine kernel hot patch file format contains patch metadata, target function address table, patch target code, patch signature, etc. The specific contents are as follows:

[0051] Offset 0, size 4 bytes, virtual machine kernel hot patch format magic word (0xcaadfeed), used to mark the file format as a virtual machine kernel hot patch;

[0052] Offset 4, size 4 bytes, reserved;

[0053] Offset 8, size 8 bytes, the offset of the patch metadata within the file;

[0054] Offset 16, size 8 bytes, size of patch metadata;

[0055] Offset 24, size 8 bytes, signature of patch metadata;

[0056] Offset 32, size 8 bytes, the offset of the patch target code data within the file;

[0057] Offset 40, size 8 bytes, the size of the patch target code data;

[0058] Offset 48, size 8 bytes, signature of the patch target code data;

[0059] Offset 56, size 8 bytes, the offset of the target function address table within the file;

[0060] Offset 64, size 8 bytes, the size of the target function address table;

[0061] Offset 72, size 8 bytes, signature of the target function address table;

[0062] After offset 80, patch metadata, patch target code data, and target function address table.

[0063] Exemplarily, step S101 specifically includes the following steps S201 to S212.

[0064] Step S201: Generate a differential file path.diff of a specified submission record using a code version management tool.

[0065] Step S202, scanning all modified functions and their source code files in the path.diff file, recorded as [func, file].

[0066] Step S203, extracting the source code of the function func in the corresponding file file from the specified submission record according to the [func, file] record, and writing the source code into the source code file [file]-[func].c.

[0067] Step S204, repeat step S203 until all [func, file] combinations found in step S202 are traversed.

[0068] Step S205, using the template Makefile.in to write all the files generated in step S203 into Makefile.

[0069] Step S206, using the kernel building tool and the Makefile generated in step S205 to build the patch target code, the patch target code is the executable target file corresponding to the patch function.

[0070] Kernel build tools are software tools used to compile and build operating system kernels. They provide a set of commands and scripts to automate the build process, including steps such as compiling source code, linking object files, generating executable files, and installing to the target system.

[0071] Makefile is a text file that describes the build rules and dependencies of a software project and is used to automate the build process. By parsing rules and executing build commands, it automatically builds target files, such as patch target codes.

[0072] Makefile.in is a template file that contains some placeholders and rules for generating the final Makefile file.

[0073] Step S207, loading the patch target code, patch metadata (used to characterize the virtual machine kernel adapted by the patch function), and target function address table (used to indicate the address of the function to be modified).

[0074] Step S208: Generate a temporary file according to the virtual machine kernel hot patch format.

[0075] Step S209, calculate the hash check value of the patch target code, merge the check value with the target code, then use the GPG tool to sign the merged data, and write the signature data to the corresponding position of the temporary file.

[0076] GPG (GNU Privacy Guard) verification is a security verification method based on public key encryption technology. By generating a unique fingerprint (i.e. checksum) of the file, it can ensure that the file has not been tampered with or damaged during the transmission process, thus ensuring the security and integrity of the file transmission. Specifically, the file publisher uses a private key to digitally sign the file, and the file receiver verifies the signature by downloading the corresponding public key. If the verification passes, it proves that the file comes from a trusted source and the content has not been modified.

[0077] Step S210, calculate the hash check value of the patch metadata, merge the check value with the metadata, then use the GPG tool to sign the merged data, and write the signature data to the location corresponding to the temporary file.

[0078] Step S211, calculate the hash check value of the target function address table, and merge the check value with the target function address table, then use the GPG tool to sign the merged data, and write the signature data to the corresponding position of the temporary file.

[0079] Step S212, calculate the size of the entire file, write the file size into the offset 4 position of the temporary file, and obtain the final patch file.

[0080] Exemplarily, step S102 specifically includes the following steps S301 to S308.

[0081] Step S301, reading and verifying the signature of the kernel hot patch.

[0082] Step S302, read the virtual machine architecture, kernel version, kernel signature and other information from the virtual kernel hot patch metadata, and check the compatibility of the running virtual machine kernel.

[0083] Step S303, read a dynamic link item from the dynamic link segment in the virtual machine kernel hot patch target code data, the item including the undefined function name and the relocation write address.

[0084] The dynamic link segment is a special segment in an executable object file (such as a patch object code) that is used to store information required by the dynamic linker. In the dynamic link segment, dynamic link items can be found, each of which contains the name of an undefined function and a relocation write address.

[0085] An undefined function is a function that is called in the current executable target file, but the implementation of the function is not in the current file, but in other executable files or shared libraries. Therefore, when the program executes to the location where the undefined function is called, the dynamic linker needs to find the implementation of the function in other executable files or shared libraries based on the undefined function name in the dynamic link item.

[0086] Relocation write address means that after finding the implementation of an undefined function, the dynamic linker needs to write the implementation address of the function into the relocation write address in the dynamic link item. In this way, when the program executes to the location where the undefined function is called again, it can directly jump to the implementation address of the function to complete the function call.

[0087] By reading the dynamic link item in the dynamic link segment, the dynamic linker can find the implementation of the function according to the name of the undefined function, and write the implementation address into the relocation write address, thereby realizing the dynamic link process. In this way, the program can dynamically load and link functions in other executable files or shared libraries at runtime, thereby achieving more flexible and efficient program execution.

[0088] Step S304: searching for the undefined function address in the symbol table file of the virtual machine operating system kernel according to the undefined function name.

[0089] The kernel symbol table file is an important debugging and development tool in the operating system. It contains the names of all functions, variables, and macros in the kernel and their address information in the memory. It is like a huge address book, allowing developers or debuggers to query or modify the corresponding data in the kernel through symbolic names, thereby performing source code-level analysis and performance tuning.

[0090] Step S305, writing the undefined function address into the address pointed to by the relocation write address.

[0091] Step S306, repeating steps S303-S305 until all undefined functions in the dynamic link segment are relocated.

[0092] Step S307, sending a memory application request to the virtual machine kernel, and writing the virtual machine kernel hot patch target code into the virtual address.

[0093] Specifically, step S307 includes the following steps S3071 to S3075.

[0094] Step S3071, writing the target code address space size required for the hot patch into a specified location, and then sending a memory request interrupt to the virtual machine kernel;

[0095] Step S3072, the virtual machine kernel receives the memory request interrupt, then reads the target code address space size required for the hot patch from the specified location and allocates a memory space of the corresponding size;

[0096] Step S3073, the virtual machine kernel converts the first address of the allocated address space into a physical address, and writes the physical address into a designated location;

[0097] Step S3074, reading the physical address from the specified location, and mapping the physical address to a virtual address through the virtual machine manager address mapping interface;

[0098] Step S3075, writing the virtual machine kernel hot patch target code into the virtual address, thereby completing the kernel hot patch loading.

[0099] Step S308, read the target function table in the virtual machine kernel hot patch file, use the virtual machine operating system symbol table to find the function address in the target function address table that needs to apply the hot patch, and set the jump instructions at all target function addresses so that the virtual machine kernel jumps to the newly loaded hot patch when calling the target function.

[0100] The following is a description of the cloud platform-oriented virtual machine kernel hot patch loading system provided by the present application. The cloud platform-oriented virtual machine kernel hot patch loading system described below and the cloud platform-oriented virtual machine kernel hot patch loading method described above can be referenced to each other.

[0101] Figure 4 is a schematic diagram of the structure of a virtual machine kernel hot patch loading system for a cloud platform provided in an embodiment of the present application, such as Figure 4 As shown, the system includes: a virtual machine kernel hot patch generating device 10 and a virtual machine kernel hot patch loading device 20. Among them:

[0102] A virtual machine kernel hot patch generating device 10 is used to obtain a virtual machine kernel hot patch file, wherein the virtual machine kernel hot patch file includes a patch function corresponding to each target function, the target function is a function to be modified in the virtual machine kernel, and the patch function is used to replace the target function;

[0103] The virtual machine kernel hot patch loading device 20 is used to load the patch function corresponding to each target function based on the virtual machine kernel hot patch file, and configure a jump instruction at the address of each target function, the jump instruction is used to indicate a jump to the patch function corresponding to the target function.

[0104] In a possible implementation, the virtual machine kernel hot patch loading device is arranged in the virtual machine manager.

[0105] A Virtual Machine Manager is a software tool used to create, configure, monitor and manage the operation of virtual machines. A Virtual Machine Manager can create and run multiple virtual machine instances on a physical server, each of which can independently run an operating system and applications.

[0106] The main functions of the virtual machine manager include:

[0107] (1) Create and configure virtual machines: The virtual machine manager can provide a user interface or command line interface to allow users to create virtual machine instances and configure the virtual machine's hardware resources (such as CPU, memory, disk space, etc.) and network settings.

[0108] (2) Monitor and manage virtual machines: The virtual machine manager can monitor the operating status of virtual machines in real time, including CPU utilization, memory usage, network traffic, etc. It can also provide management functions such as starting, stopping, pausing, and resuming virtual machines, as well as migrating virtual machines to other physical servers.

[0109] (3) Resource allocation and scheduling: The virtual machine manager can dynamically allocate and schedule virtual machine resources based on the needs of the virtual machines and the resource conditions of the physical server. It can migrate virtual machines to physical servers with more sufficient resources based on load balancing strategies to improve overall performance and availability.

[0110] (4) Security and Isolation: The virtual machine manager can provide security and isolation functions to ensure that the mutual impact between different virtual machines is minimized. It can allocate independent resources to each virtual machine and provide security mechanisms such as virtual networks and firewalls to protect the security of virtual machines and physical servers.

[0111] In the embodiment of the present application, in addition to the above functions (1)-(4), the virtual machine manager also has a kernel hot patch loading function, that is, a virtual machine kernel hot patch loading device (as a functional module of the virtual machine manager) is provided in the virtual machine manager.

[0112] It can be understood that the detailed functional implementation of each of the above-mentioned units / modules can be found in the introduction of the aforementioned method embodiment, and will not be repeated here.

[0113] It should be understood that the above-mentioned device is used to execute the method in the above-mentioned embodiment. The implementation principle and technical effect of the corresponding program module in the device are similar to those described in the above-mentioned method. The working process of the device can refer to the corresponding process in the above-mentioned method, which will not be repeated here.

[0114] Based on the method in the above embodiment, an embodiment of the present application provides an electronic device, Figure 5is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Figure 5 As shown, the electronic device may include: a processor (Processor) 810, a communication interface (CommunicationsInterface) 820, a memory (Memory) 830 and a communication bus 840, wherein the processor 810, the communication interface 820, and the memory 830 communicate with each other through the communication bus 840. The processor 810 can call the logic instructions in the memory 830 to execute the method in the above embodiment.

[0115] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application.

[0116] Based on the method in the above embodiment, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the method in the above embodiment.

[0117] Based on the method in the above embodiment, an embodiment of the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the method in the above embodiment.

[0118] It is understandable that the processor in the embodiment of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0119] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC.

[0120] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions may be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

[0121] It should be understood that the various numerical numbers involved in the embodiments of the present application are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application.

[0122] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A virtual machine kernel hot patch loading method for a cloud platform, characterized in that: include: Obtaining a virtual machine kernel hot patch file, wherein the virtual machine kernel hot patch file includes a patch function corresponding to each target function, wherein the target function is a function to be modified in the virtual machine kernel, and the patch function is used to replace the target function; Based on the virtual machine kernel hot patch file, the patch function corresponding to each target function is loaded, and a jump instruction is configured at the address of each target function, wherein the jump instruction is used to instruct to jump to the patch function corresponding to the target function.

2. According to the cloud platform-oriented virtual machine kernel hot patch loading method according to claim 1, it is characterized in that: The step of obtaining a virtual machine kernel hot patch file includes: Based on the source code of the patch function, a patch target code is generated by compiling, wherein the patch target code is an executable target file corresponding to the patch function; The virtual machine kernel hot patch file is generated based on the patch target code, patch metadata and target function address table, wherein the patch metadata is used to characterize the virtual machine kernel adapted by the patch function, and the target function address table is used to represent the address of the function to be modified.

3. According to the cloud platform-oriented virtual machine kernel hot patch loading method of claim 2, it is characterized in that: The generating the virtual machine kernel hot patch file based on the patch target code, patch metadata and target function address table includes: Performing signature processing on the patch target code, the patch metadata and the target function address table to obtain signature data; A virtual machine kernel hot patch file is generated based on the patch target code, the patch metadata, the target function address table and the signature data.

4. The method for loading hot patches for virtual machine kernels in a cloud platform according to claim 3 is characterized in that: The signature data includes: patch target code data signature, patch metadata signature and target function address table signature; Accordingly, the step of performing signature processing on the patch target code, the patch metadata and the target function address table to obtain signature data includes: Perform signature processing based on the patch target code and the hash check value corresponding to the patch target code to obtain the data signature of the patch target code; Perform signature processing based on the patch metadata and the hash check value corresponding to the patch metadata to obtain the patch metadata signature; Based on the target function address table and the hash check value corresponding to the target function address table, signature processing is performed to obtain the signature of the target function address table.

5. The method for loading hot patches for virtual machine kernels in a cloud platform according to claim 3 is characterized in that: The step of loading the patch functions corresponding to the target functions based on the virtual machine kernel hot patch file includes: Based on the signature data, verify the patch target code, patch metadata and target function address table in the virtual machine kernel hot patch file to obtain a signature verification result; If the signature verification result indicates that the verification is passed, based on the patch metadata, verify the compatibility between the patch function and the running virtual machine kernel, and obtain a compatibility verification result; When the compatibility check result indicates that the patch function is compatible with the running virtual machine kernel, the patch object code is loaded.

6. The method for loading hot patches for virtual machine kernels in a cloud platform according to claim 5, characterized in that: The step of configuring a jump instruction at the address of each target function includes: Based on the target function address table and the addresses of the patch functions, a jump instruction is configured at the address of each target function.

7. A virtual machine kernel hot patch loading system for a cloud platform, characterized in that: include: A virtual machine kernel hot patch generating device, used for obtaining a virtual machine kernel hot patch file, wherein the virtual machine kernel hot patch file includes a patch function corresponding to each target function, wherein the target function is a function to be modified in the virtual machine kernel, and the patch function is used to replace the target function; A virtual machine kernel hot patch loading device is used to load the patch functions corresponding to each target function based on the virtual machine kernel hot patch file, and configure a jump instruction at the address of each target function, wherein the jump instruction is used to indicate a jump to the patch function corresponding to the target function.

8. The virtual machine kernel hot patch loading system for cloud platforms according to claim 7 is characterized in that: The virtual machine kernel hot patch loading device is arranged in the virtual machine manager.

9. An electronic device, characterized in that: include: at least one memory for storing a computer program; At least one processor is used to execute the program stored in the memory. When the program stored in the memory is executed, the processor is used to execute the method according to any one of claims 1 to 6.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program runs on a processor, the processor is caused to execute the method according to any one of claims 1 to 6.

Images