User program running method, system, device, apparatus and storage medium

Abstract

Embodiments of the present application provide a user program running method, system, device, equipment and storage medium, the method comprises: in response to the kernel state operation of user program, through the hook function in the operating system to obtain the machine code file corresponding to the user program and the function to be detected. Then, in response to the execution operation of the kernel to the function to be detected in the operating system, the machine code file corresponding to the user program is written into the preset detection framework deployed by the kernel, so as to obtain the kernel module, and the user program is run in the kernel state of the operating system by using the kernel module. In the above method, the kernel module for executing the user program can be generated in real time by file writing, so that the user program can run in the kernel without modifying the user program, that is, the normal operation of the user program in the operating system kernel state.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and in particular, to a user program running method, system, device, equipment and storage medium. BACKGROUND

[0002] Linux is a UNIX-like operating system that is free to use and free to distribute. The user program installed in the Linux operating system, such as eBPF program, can run in the user state or kernel state of the operating system. And with the upgrade of the kernel version in the Linux operating system, since the corresponding kernel module will be deployed in advance in the high version kernel, the eBPF program can be directly run in the kernel state of the operating system by using this kernel module, that is, the eBPF program is run in the high version kernel.

[0003] But for the operating system deployed with the low version kernel, the eBPF program cannot run in the kernel state of the operating system, that is, the eBPF program cannot run in the low version kernel. At this time, how to make the eBPF program run in the low version kernel becomes a problem to be solved. SUMMARY

[0004] Therefore, the embodiments of the present application provide a user program running method, system, device, equipment and storage medium to enable the user program to run in the low version kernel.

[0005] In a first aspect, the embodiments of the present application provide a user program running method, comprising:

[0006] In response to the kernel state running operation of the user program, the machine code file corresponding to the user program and the function to be detected are obtained according to the hook function in the operating system;

[0007] In response to the execution of the function to be detected by the kernel in the operating system, the machine code file is written into the preset detection framework deployed in the kernel to obtain the kernel module corresponding to the user program;

[0008] According to the kernel module, the user program is run in the kernel state of the operating system.

[0009] In a second aspect, the embodiments of the present application provide a user program running system deployed in the operating system, wherein the user program is installed in the operating system; the user program running system comprises: a hook function in the operating system and a preset detection framework deployed in the kernel of the operating system;

[0010] The hook function is configured to obtain the machine code file corresponding to the user program and the function to be detected in response to the kernel state running operation of the user program.

[0011] The user program running system is configured to, in response to execution of the to-be-probed function by the kernel of the operating system, write the machine code file into the preset probing framework to obtain a kernel module corresponding to the user program; and run the user program in a kernel state of the operating system according to the kernel module.

[0012] In a third aspect, an embodiment of the present application provides a user program running apparatus, comprising:

[0013] The obtaining module is configured to, in response to a kernel state running operation of a user program, obtain a machine code file corresponding to the user program and a to-be-probed function according to a hook function in an operating system.

[0014] The writing module is configured to, in response to execution of the to-be-probed function by the kernel of the operating system, write the machine code file into a preset probing framework deployed by the kernel to obtain a kernel module corresponding to the user program.

[0015] The running module is configured to run the user program in a kernel state of the operating system according to the kernel module.

[0016] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory is configured to store one or more computer instructions, and the one or more computer instructions are executed by the processor to implement the user program running method in the first aspect. The electronic device can further comprise a communication interface configured to communicate with other devices or communication networks.

[0017] In a fifth aspect, an embodiment of the present application provides a non-transitory machine readable storage medium, which stores executable code, and when the executable code is executed by a processor of an electronic device, the processor can at least implement the user program running method in the first aspect.

[0018] The user program running method provided by the embodiment of the present application, in response to a kernel state running operation of a user program, obtains a machine code file corresponding to the user program and a to-be-probed function through a hook function in an operating system. Then, in response to execution of the to-be-probed function by the kernel of the operating system, the machine code file corresponding to the user program is written into a preset probing framework deployed by the kernel, so as to obtain a kernel module, and the user program is run in a kernel state of the operating system by using the kernel module.

[0019] In the above method, the kernel module for executing the user program can be generated in real time through file writing, so that the user program can run in a kernel (i.e. a low-version kernel) without being pre-configured with the kernel module, i.e. the user program can run in the kernel state of an operating system containing the low-version kernel without modification. Meanwhile, the above method can actually obtain kernel modules corresponding to different user programs respectively, so that different user programs can run in the low-version kernel, and the user program execution capability of the low-version kernel in the operating system is enhanced. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort based on these drawings.

[0021] Figure 1 A flowchart of a user program running method provided by an embodiment of the present application;

[0022] Figure 2 A flowchart of another user program running method provided by an embodiment of the present application;

[0023] Figure 3 A flowchart of still another user program running method provided by an embodiment of the present application;

[0024] Figure 4 A schematic diagram of a user program running process provided by an embodiment of the present application;

[0025] Figure 5 A structural schematic diagram of a user program running system provided by an embodiment of the present application;

[0026] Figure 6 A structural schematic diagram of another user program running system provided by an embodiment of the present application;

[0027] Figure 7 A structural schematic diagram of a user program running device provided by an embodiment of the present application;

[0028] Figure 8 A structural schematic diagram of an electronic device corresponding to the user program running method provided by the embodiment shown in Figure 7 A structural schematic diagram of an electronic device corresponding to the user program running method provided by the embodiment shown in DETAILED DESCRIPTION

[0029] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application but not all the embodiments. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of the present application.

[0030] The terms used in the embodiments of the present application are only for the purpose of describing particular embodiments and are not intended to limit the present application. The singular forms "a", "said" and "the" used in the embodiments of the present application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. "Plural" generally includes at least two but does not exclude the case of including at least one.

[0031] It should be understood that the term "and / or" used herein is only to describe the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which means that there are three cases of A alone, A and B together, and B alone. In addition, the character " / " herein generally represents an "or" relationship between the front and rear associated objects.

[0032] Depending on the context, the word "if" as used herein can be interpreted as meaning "when" or "upon" or "in response to determining" or "in response to identifying". Similarly, depending on the context, the phrase "if it is determined" or "if it is identified (a stated condition or event)" can be interpreted as meaning "when it is determined" or "in response to determining" or "when it is identified (a stated condition or event)" or "in response to identifying (a stated condition or event)".

[0033] It should also be noted that the terms "comprising", "including", or any other variant thereof are intended to cover non-exclusive inclusion, so that a product or system including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such product or system. Without more limitations, the element defined by the phrase "comprising a" does not exclude the presence of additional identical elements in the product or system comprising the element.

[0034] Some embodiments of the present application will be described in detail below with reference to the accompanying drawings. The following embodiments and features in the embodiments can be combined with each other without conflict between the embodiments. In addition, the step sequence in each of the following method embodiments is only an example and is not strictly limited.

[0035] Figure 1A flowchart of a user program running method provided by an embodiment of the present application is shown in the figure. The user program running method provided by the embodiment of the present application can be executed by an operating system deployed in an electronic device.

[0036] As shown in the figure, the method comprises the following steps: Figure 1

[0037] S101, in response to a kernel state running operation of a user program, a hook function in an operating system is used to obtain a machine code file corresponding to the user program and a function to be probed.

[0038] S102, in response to execution of the function to be probed by a kernel of the operating system, the machine code file is written into a preset probing framework deployed by the kernel to obtain a kernel module corresponding to the user program.

[0039] S103, the user program is run in a kernel state of the operating system according to the kernel module.

[0040] The user program is installed in an operating system, and the operating system does not have a kernel module that can directly run the user program, that is, the kernel of the operating system is a low version. Optionally, the operating system executing the embodiment can be a Linux system, and the user program can be an eBPF program installed in the Linux system.

[0041] Based on the above premise, when the operating system with a low version kernel is started, a user of the operating system can trigger a user state running operation for the user program. The operating system responds to the user state running operation to run the user program in a user state of the operating system. At this time, the user program is not running in a kernel state of the operating system.

[0042] In the actual running process of the user program, the user program also needs to run in the kernel state of the operating system. At this time, the user of the operating system can further trigger a kernel state running operation for the user program. The operating system responds to the operation to first use a hook function in the operating system to obtain a machine code file corresponding to the user program running in the user state and a function to be probed. Then, in response to execution of the function to be probed by the kernel of the operating system, the operating system writes the machine code file obtained above into a preset probing framework deployed by the kernel to obtain a kernel module for executing the user program. Finally, the operating system uses the kernel module to execute the user program in the kernel state of the operating system.

[0043] ​The machine code file corresponding to the user program can be directly executed by the kernel, and thus can be considered as an executable file of the user program. The to-be-detected function can be a detection function included in a preset detection framework deployed in the operating system kernel, and the to-be-detected function has a one-to-one or one-to-many relationship with the user program. The to-be-detected function is used to detect whether there is a user program that needs to run in the operating system kernel. If the to-be-detected function is executed by the kernel of the operating system, it indicates that there is currently a user program that needs to run in the kernel mode of the operating system. Whether the to-be-detected function is executed can also be obtained by a hook function in the operating system.

[0044] Optionally, for the obtained to-be-detected function, it can be automatically executed, that is, after obtaining the machine code file corresponding to the user program and the to-be-detected function, the to-be-detected function is automatically executed; or the to-be-detected function can be executed after a human triggering operation. For example, a user of the operating system can trigger the to-be-detected function to trigger an execution operation, and the operating system kernel executes the to-be-detected function in response to the operation. Of course, the execution operation is triggered after the operation is run in the kernel mode.

[0045] Optionally, the preset detection framework deployed in the kernel can be a kprobe detection framework, a tracepoint detection framework, or the like. For the process of writing the machine code file into the preset detection framework to generate the kernel module: when the preset detection framework is a tracepoint detection framework, optionally, the tracepoint detection framework has a table table pre-stored therein indicating a correspondence between the alternative function parameters and the user program, and then the target function parameter corresponding to the user program can be determined from the table, and the target function parameter is filled into the machine code file, so as to obtain the kernel module corresponding to the user program. When the preset detection framework is a kprobe detection framework, optionally, the target function in the kprobe detection framework can be directly filled into the machine code file, so as to obtain the kernel module corresponding to the user program.

[0046] Since the machine code file can include a plurality of functions required for the user program to normally run in the kernel mode of the operating system, the above process of writing the machine code file into the framework can actually be considered as a process of filling the target function parameter in the framework into the machine code file. Compared with the kprobe detection framework, the tracepoint detection framework can support more types of user programs.

[0047] In this embodiment, in response to the kernel-mode execution of the user program, the machine code file corresponding to the user program and the function to be probed are obtained through hook functions in the operating system. Then, in response to the kernel's execution of the function to be probed, the machine code file corresponding to the user program is written into a preset probe framework deployed in the kernel, thereby obtaining the kernel module. The kernel module is then used to run the user program in the kernel mode of the operating system.

[0048] In the above method, the kernel module used to execute user programs can be generated in real time through file writing. Therefore, user programs can run on low-version kernels without modification, even when running in kernel mode of an operating system containing a low-version kernel. Furthermore, this method can also generate kernel modules corresponding to different user programs, enabling different user programs to run on low-version kernels, thus enhancing the execution capability of user programs on low-version kernels within the operating system.

[0049] Furthermore, for operating systems containing higher-version kernels, the corresponding user programs can be executed directly using the pre-deployed kernel modules corresponding to the user programs within the higher-version kernel. User programs without deployed corresponding kernel modules cannot run in higher-version kernels. However, since the kernel modules in the user program execution method provided in this embodiment are generated in real-time based on the user program's machine code file, using the method provided in this embodiment can also improve the above-mentioned problems, enabling different types of user programs to run within lower-version kernels.

[0050] Figure 1 The illustrated embodiment has disclosed that the operating system can generate kernel modules corresponding to user programs in real time through file writing. Figure 1 Based on the illustrated embodiment, Figure 2 This is a flowchart illustrating another user program execution method provided in an embodiment of the present invention. Figure 2 As shown, the method may include the following steps:

[0051] S201 responds to the kernel-mode operation of the user program and obtains the bytecode file and the function to be probed corresponding to the user program based on the hook function in the operating system.

[0052] In practice, the bytecode file corresponding to the user program is often obtained using hook functions included in the operating system. In this case, the bytecode file needs to be verified and compiled to obtain the machine code file corresponding to the user program. The specific processing steps are described below. Furthermore, the execution process of step S201 is similar to the corresponding steps in the aforementioned embodiments, and can be found in... Figure 1The related description in the illustrated embodiment will not be repeated here.

[0053] S202, verifying the security of the user program according to the bytecode file.

[0054] S203, compiling the bytecode file to obtain a machine code file.

[0055] For the bytecode file obtained in step S201, the bytecode file can be verified by using a user-mode verifier in the operating system to verify the security of the user program. For the bytecode file that passes the security verification, the bytecode file can be further compiled by using a JIT compiler in the operating system to obtain a machine code file corresponding to the user program. If the bytecode file fails to pass the security verification, a prompt information indicating that the verification fails can be output to a user of the operating system, and the user program cannot run in the kernel mode of the operating system.

[0056] S204, in response to execution of the to-be-probed function by the kernel in the operating system, writing the machine code file into a preset probing framework deployed by the kernel to obtain a kernel module corresponding to the user program.

[0057] S205, running the user program in the kernel mode of the operating system according to the kernel module.

[0058] The execution processes of steps S204 to S205 are similar to the corresponding steps of the foregoing embodiments, and can be seen from the related description in the foregoing embodiments. Figure 1 The related description in the illustrated embodiment will not be repeated here.

[0059] In this embodiment, the bytecode file of the user program is first obtained by using a hook function in the operating system, and then the bytecode file is verified and compiled to obtain a machine code file corresponding to the user program. Then, the kernel module for running the user program in the kernel mode is obtained by writing the file into a preset probing framework, so that the user program can run in the kernel mode of the operating system containing a low-version kernel without modifying the user program. In addition, the contents not described in detail in this embodiment and the technical effects that can be achieved can be seen from the description in the foregoing embodiments, and will not be repeated here. Figure 1 The related description in the illustrated embodiment will not be repeated here.

[0060] When the user program actually runs in the kernel mode or the user mode of the operating system, the database corresponding to the user program can be accessed, and the database supports a key-value data storage structure. Figure 3 A flowchart of another method for running a user program is provided in this embodiment. As shown in Figure 3 The method can further include the following steps.

[0061] S301, in response to a starting operation of the operating system, loading the driver.

[0062] S302, according to a hook function in the operating system, obtaining a database establishment request sent by the user program.

[0063] S303, sending the database establishment request to the driver to establish the database corresponding to the user program by the driver.

[0064] Specifically, after the operating system is started by the developer, the operating system can load the driver into the kernel. After the operating system is started, in response to the user state starting operation of the user program, the user program can run in the user state of the operating system. In the process of running the user program, the operating system can also respond to the operation of the developer to make the user program generate a database establishment request. At this time, the hook function in the operating system can obtain and forward the database establishment request to the driver to establish the database corresponding to the user program by means of the driver.

[0065] It should be noted that since the user program can access the database corresponding to the user program when running in the user state or the kernel state of the operating system, the above-mentioned database establishment process can be performed immediately after the user program is started.

[0066] It can be seen that the embodiment provides a brand-new process of establishing the database corresponding to the user program by using the driver.

[0067] Optionally, the driver also provides a plurality of interfaces. After the database is established, if the user program runs in the user state of the operating system, the user program can access the database corresponding to the user program according to the first interface provided by the driver, that is, read the data in the database. The first interface can be an export symbol interface. Figure 1 or Figure 2 The method provided in the embodiment makes the user program run in the kernel state of the operating system, and then the user program can access the database corresponding to the user program according to the first interface provided by the driver, that is, read the data in the database. The first interface can be an export symbol interface.

[0068] Similarly, based on the established database, when the user program runs in the user state of the operating system, the user program can read the data in the database according to the second interface provided by the driver. The second interface can be an iotcl interface.

[0069] Optionally, in response to the user state running operation of the user program, the operating system can obtain the bytecode file corresponding to the user program by means of the hook function, and convert the function identifier of the auxiliary function contained in the bytecode file into the corresponding function address by means of the first interface provided by the driver, so that the user program can access the database when running in the user state or the kernel state of the operating system by using the function address.

[0070] According to the above description, it can be known that the driver actually provides two functions, i.e. the driver can establish the database corresponding to the user program and provide the function address for accessing the database. The driver separates the original bytecode file compiling function and the security checking function, thereby obtaining the simplified driver, i.e. reducing the complexity of the driver. According to the above description, the driver can establish the database corresponding to the user program and provide the function address for accessing the database. Figure 2 According to the above description, it can be known that the driver actually provides two functions, i.e. the driver can establish the database corresponding to the user program and provide the function address for accessing the database. The driver separates the original bytecode file compiling function and the security checking function, thereby obtaining the simplified driver, i.e. reducing the complexity of the driver. According to the above description, the driver can establish the database corresponding to the user program and provide the function address for accessing the database.

[0071] According to the above description, it can be known that the driver actually provides two functions, i.e. the driver can establish the database corresponding to the user program and provide the function address for accessing the database. The driver separates the original bytecode file compiling function and the security checking function, thereby obtaining the simplified driver, i.e. reducing the complexity of the driver. According to the above description, the driver can establish the database corresponding to the user program and provide the function address for accessing the database. Figure 4 According to the above description, it can be known that the driver actually provides two functions, i.e. the driver can establish the database corresponding to the user program and provide the function address for accessing the database. The driver separates the original bytecode file compiling function and the security checking function, thereby obtaining the simplified driver, i.e. reducing the complexity of the driver. According to the above description, the driver can establish the database corresponding to the user program and provide the function address for accessing the database.

[0072] According to the above description, it can be known that the driver actually provides two functions, i.e. the driver can establish the database corresponding to the user program and provide the function address for accessing the database. The driver separates the original bytecode file compiling function and the security checking function, thereby obtaining the simplified driver, i.e. reducing the complexity of the driver. According to the above description, the driver can establish the database corresponding to the user program and provide the function address for accessing the database.

[0073] According to the above description, it can be known that the driver actually provides two functions, i.e. the driver can establish the database corresponding to the user program and provide the function address for accessing the database. The driver separates the original bytecode file compiling function and the security checking function, thereby obtaining the simplified driver, i.e. reducing the complexity of the driver. According to the above description, the driver can establish the database corresponding to the user program and provide the function address for accessing the database.

[0074] According to the above description, it can be known that the driver actually provides two functions, i.e. the driver can establish the database corresponding to the user program and provide the function address for accessing the database. The driver separates the original bytecode file compiling function and the security checking function, thereby obtaining the simplified driver, i.e. reducing the complexity of the driver. According to the above description, the driver can establish the database corresponding to the user program and provide the function address for accessing the database. Figure 4 According to the above description, it can be known that the driver actually provides two functions, i.e. the driver can establish the database corresponding to the user program and provide the function address for accessing the database. The driver separates the original bytecode file compiling function and the security checking function, thereby obtaining the simplified driver, i.e. reducing the complexity of the driver. According to the above description, the driver can establish the database corresponding to the user program and provide the function address for accessing the database.

[0075] According to the above description, it can be known that the driver actually provides two functions, i.e. the driver can establish the database corresponding to the user program and provide the function address for accessing the database. The driver separates the original bytecode file compiling function and the security checking function, thereby obtaining the simplified driver, i.e. reducing the complexity of the driver. According to the above description, the driver can establish the database corresponding to the user program and provide the function address for accessing the database.

[0076] According to the above description, it can be known that the driver actually provides two functions, i.e. the driver can establish the database corresponding to the user program and provide the function address for accessing the database. The driver separates the original bytecode file compiling function and the security checking function, thereby obtaining the simplified driver, i.e. reducing the complexity of the driver. According to the above description, the driver can establish the database corresponding to the user program and provide the function address for accessing the database.

[0077] When the user program runs in the user state of the operating system, the user program can further generate a database establishment request, and the operating system can obtain and forward the database establishment request to the loaded driver according to the hook function, and establish the database corresponding to the user program by means of the driver.

[0078] In addition, for the obtained bytecode file, the auxiliary function identifier contained in the bytecode file can be converted into a function address by means of the first interface provided by the driver. At this time, the user program continues to run in the user state of the operating system, and when the user program needs to access the database corresponding to the user program, the second interface of the driver can be used to access the database corresponding to the user program according to the function address. In practice, the user program can also be switched from the user state of the operating system to the kernel state to run, and at this time, the user program can be accessed according to the function address. Figure 1 Or Figure 2 The embodiment shown in the manner makes the user program run in the kernel state of the operating system. When the user program runs in the kernel state of the operating system, the database corresponding to the user program can also be accessed by means of the first interface provided by the driver.

[0079] That is, for the bytecode file corresponding to the user program obtained by means of the hook function, on the one hand, it is used to establish the database corresponding to the user program by means of the driver, and on the other hand, it is used to compile the file into a machine code file and write it into a preset detection framework to generate a kernel module, so as to realize the execution of the user program in the kernel state of the operating system. And different interfaces provided by the driver can be used to enable the user program running in the user state or the kernel state of the operating system to access the database corresponding to itself.

[0080] Figure 5 A structural schematic diagram of a user program running system provided by the embodiment of the present application is provided. The user program system is deployed in an operating system, and the user program is installed in the operating system. As shown in Figure 5 The system can include: a hook function in the operating system and a preset detection framework deployed in the kernel of the operating system.

[0081] The hook function is used to obtain the machine code file and the function to be detected corresponding to the user program according to the hook function in the operating system in response to the kernel state running operation of the user program.

[0082] The user program running system is used to write the machine code file into the preset detection framework to obtain the kernel module corresponding to the user program in response to the execution of the function to be detected by the kernel of the operating system. Finally, the kernel module is used to run the user program in the kernel state of the operating system.

[0083] The contents not described in detail in the embodiments and the technical effects that can be achieved can be understood in combination with the above Figure 1 The embodiments shown in the above description can be understood.

[0084] In Figure 5 On the basis of the embodiments shown in the above description, optionally, Figure 6 Another structure schematic diagram of a user program running system provided by the embodiments of the present application is shown in the figure. The user program running system can further include a compiler.

[0085] In practice, the bytecode file corresponding to the user program is often obtained by using the hook function in the operating system. Then, the bytecode file can be compiled by using the compiler in the user program running system to obtain the machine code file corresponding to the user program.

[0086] Optionally, the user program running system can further include a verifier configured to verify the security of the user program according to the bytecode file corresponding to the user program. Only the user program that passes the verification can run in the kernel mode of the operating system.

[0087] Optionally, the user program running system can further include a driver.

[0088] The operating system loads the driver into the kernel of the operating system in response to a start operation. Further, the operating system can also run the user program in the user state of the operating system in response to a user state running operation of the user program. When the user program runs in the user state of the operating system, the driver can obtain the database establishment request generated by the user program according to the hook function in the operating system, and establish the database corresponding to the user program in response to the establishment request. Optionally, the driver also provides a plurality of interfaces, so that the user program running in the user state or the kernel state of the operating system can access the database corresponding to the user program by means of the corresponding interfaces.

[0089] Optionally, the function identifier of the auxiliary function in the bytecode file corresponding to the user program can also be converted by using the interface provided by the driver to obtain the function address of the auxiliary function, and the user program running in the user state or the kernel state can be enabled to access the database according to the function address and the corresponding interface.

[0090] In addition, the parts not described in detail in the embodiments can be referred to the related description of the embodiments shown in the above description. The execution process and technical effects of the technical solutions can be referred to the description in the embodiments shown in the above description, and will not be described here. Figures 1 to 4 Figures 1 to 4

[0091] ​​The user program running apparatus of one or more embodiments of the present application will be described in detail below. Those skilled in the art can understand that these user program running apparatuses can be configured by using commercially available hardware components through the steps taught by the present solution.

[0092] Figure 7 The structural schematic diagram of the user program running apparatus provided for the embodiments of the present application is shown in Figure 7 The apparatus comprises:

[0093] The obtaining module 11 is configured to, in response to a kernel state running operation of a user program, obtain a machine code file and a to-be-probed function corresponding to the user program according to a hook function in an operating system.

[0094] The writing module 12 is configured to, in response to execution of the to-be-probed function by a kernel in the operating system, write the machine code file into a preset probing framework deployed by the kernel, so as to obtain a kernel module corresponding to the user program.

[0095] The running module 13 is configured to run the user program in a kernel state of the operating system according to the kernel module.

[0096] Optionally, the user program comprises an eBPF program.

[0097] Optionally, the obtaining module 11 is specifically configured to: obtain a bytecode file corresponding to the user program; and compile the bytecode file to obtain the machine code file.

[0098] Optionally, the apparatus further comprises a verification module 14 configured to verify the security of the user program according to the bytecode file.

[0099] Optionally, the writing module 12 is specifically configured to: determine a target function parameter corresponding to the user program from alternative function parameters stored in the preset probing framework; and generate the kernel module according to the target function parameter and the machine code file.

[0100] Optionally, the apparatus further comprises a loading module 15 and a sending module 16.

[0101] The loading module 15 is configured to load a driver program in response to a starting operation of the operating system.

[0102] The obtaining module 11 is configured to obtain a database establishment request sent by the user program according to a hook function in the operating system.

[0103] The sending module 16 is configured to send the database establishment request to the driver program, so that the driver program establishes a database corresponding to the user program.

[0104] Optionally, the apparatus further comprises a conversion module 17 and an access module 18.

[0105] The conversion module 17 is configured to convert a function identifier of an auxiliary function in the bytecode file into a function address according to a first interface provided by a driver.

[0106] The access module 18 is configured to access the database according to the function address.

[0107] Optionally, the access module 18 is specifically configured to read data in the database corresponding to the user program according to the first interface provided by the driver according to the function address when the user program runs in a kernel state of an operating system, and read data in the database according to a second interface provided by the driver according to the function address when the user program runs in a user state of the operating system.

[0108] Figure 7 The apparatus can perform Figures 1 to 4 The method of the embodiment is not described in detail, and reference can be made to the related description of the Figures 1 to 4 The embodiment. The execution process and technical effects of the technical solution are described in the Figures 1 to 4 The embodiment, which will not be described here.

[0109] The above describes the internal functions and structures of the user program running apparatus. In one possible design, the structure of the user program running apparatus can be implemented as an electronic device, such as Figure 8 The electronic device can include a processor 21 and a memory 22. The memory 22 is configured to store a program supporting the electronic device to perform the user program running method provided in the Figures 1 to 4 The embodiment. The processor 21 is configured to execute the program stored in the memory 22.

[0110] The program includes one or more computer instructions, wherein the one or more computer instructions are executed by the processor 21 to implement the following steps:

[0111] In response to a kernel state running operation of a user program, a machine code file corresponding to the user program and a to-be-detected function are obtained according to a hook function in an operating system.

[0112] In response to execution of the to-be-detected function by a kernel in the operating system, the machine code file is written into a preset detection framework deployed by the kernel to obtain a kernel module corresponding to the user program.

[0113] According to the kernel module, the user program runs in a kernel state of the operating system.

[0114] Optionally, the processor 21 is further configured to perform the foregoing Figures 1 to 4 all or part of the steps in the illustrated embodiments.

[0115] The electronic device can further include a communication interface 23 in its structure, for communication between the electronic device and other devices or communication networks.

[0116] In addition, the embodiment of the present application provides a computer storage medium for storing computer software instructions for the electronic device, which includes computer software instructions for executing the foregoing Figures 1 to 4 The program involved in the method for running the user program in the method embodiment.

[0117] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for running a user program, characterized in that, include: In response to the kernel-mode operation of the user program, the machine code file and the function to be probed corresponding to the user program are obtained according to the hook function in the operating system. The machine code file is the executable file of the user program. If the kernel in the operating system executes the function to be probed, then it is determined that the user program needs to run in the operating system kernel; In response to the execution of the function to be probed, the machine code file is written into the preset probe framework deployed in the kernel to obtain the kernel module corresponding to the user program; The user program runs in the kernel mode of the operating system according to the kernel module.

2. The method according to claim 1, characterized in that, The user program includes an eBPF program.

3. The method according to claim 1 or 2, characterized in that, The step of obtaining the machine code file and the function to be probed corresponding to the user program includes: Obtain the bytecode file corresponding to the user program; The bytecode file is compiled to obtain the machine code file.

4. The method according to claim 3, characterized in that, The method for compiling the bytecode file, as described above, further includes: The security of the user program is verified based on the bytecode file.

5. The method according to claim 1 or 2, characterized in that, The step of writing the machine code file into the preset detection framework deployed in the kernel to obtain the kernel module corresponding to the user program includes: Among the candidate function parameters stored in the preset detection framework, the target function parameter corresponding to the user program is determined; The kernel module is generated based on the target function parameters and the machine code file.

6. The method according to claim 3, characterized in that, The method further includes: In response to the operating system's startup operation, the driver is loaded; Based on the hook function in the operating system, obtain the database establishment request sent by the user program; The database creation request is sent to the driver so that the driver can create the database corresponding to the user program.

7. The method according to claim 6, characterized in that, After obtaining the machine code file and the function to be probed corresponding to the user program, the method further includes: Based on the first interface provided by the driver, the function identifiers of the auxiliary functions in the bytecode file are converted into function addresses; Access the database according to the function address.

8. The method according to claim 7, characterized in that, Accessing the database according to the function address includes: When the user program runs in the kernel mode of the operating system, it reads data from the database corresponding to the user program according to the function address and the first interface provided by the driver. When the user program runs in the user mode of the operating system, it reads data from the database according to the function address and the second interface provided by the driver.

9. A user program execution system, characterized in that, The user program is deployed within the operating system; The user program execution system includes: hook functions in the operating system and a preset detection framework deployed in the kernel of the operating system; The hook function is used to respond to the kernel-mode operation of the user program, obtain the machine code file and the function to be probed corresponding to the user program, wherein the machine code file is the executable file of the user program; The user program execution system is configured to determine that the user program needs to run in the operating system kernel if the kernel of the operating system executes the function to be probed; in response to the execution of the function to be probed, write the machine code file into the preset probe framework to obtain the kernel module corresponding to the user program; and run the user program in the kernel mode of the operating system according to the kernel module.

10. The system according to claim 9, characterized in that, The system also includes a compiler for compiling bytecode files to obtain the machine code files.

11. The system according to claim 9, characterized in that, The system also includes: a driver; The operating system is used to load the driver in response to the startup operation of the operating system; The driver is used to obtain the database establishment request sent by the user program according to the hook function in the operating system; The database creation request is sent to the driver so that the driver can create the database corresponding to the user program.

12. A user program execution device, characterized in that, include: The acquisition module is used to respond to the kernel-mode operation of the user program and, based on the hook function in the operating system, acquire the machine code file and the function to be probed corresponding to the user program. The machine code file is the executable file of the user program. The writing module is used to determine that the user program needs to run in the operating system kernel if the kernel in the operating system executes the function to be probed; In response to the execution of the function to be probed, the machine code file is written into the preset probe framework deployed in the kernel to obtain the kernel module corresponding to the user program; The runtime module is used to run the user program in the kernel mode of the operating system, based on the kernel module.

13. An electronic device, characterized in that, include: A memory and a processor; wherein the memory stores executable code, and when the executable code is executed by the processor, the processor performs the user program execution method as described in any one of claims 1 to 8.

14. A non-transitory machine-readable storage medium, characterized in that, The non-transitory machine-readable storage medium stores executable code that, when executed by a processor of an electronic device, causes the processor to perform the user program execution method as described in any one of claims 1 to 8.

Images