Super calling method and device of kernel state program of enhanced packet filter

Abstract

The embodiment of the present specification provides a hypercall method and device for a kernel-mode program of an enhanced packet filter. Applied to a virtual machine monitor, the method includes: in response to a virtualization page fault triggered by a kernel-mode program, obtaining a memory address that triggers the virtualization page fault; determining whether the memory address of the virtualization page fault is consistent with the memory address corresponding to the page fault key in a mapping table; wherein the mapping table records the mapping relationship between key-value pairs, the page fault key is a key determined by the kernel-mode program and the virtual machine monitor in the mapping table, and each key in the mapping table uniquely corresponds to a memory address; if the memory address of the virtualization page fault is consistent with the memory address corresponding to the page fault key, reading the page fault value mapped by the page fault key from the mapping table; wherein the page fault value includes the function type of the hypercall written by the kernel-mode program before triggering the virtualization page fault; and executing the hypercall of the function type based on the function type indicated by the page fault value.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of computer technology, and more particularly to a hypercall method and device for a kernel-mode program of an enhanced packet filter. Background Art

[0002] Extended Berkeley Packet Filter (eBPF) is a general-purpose execution engine that is widely used by developers because it can run special programs (such as sandbox programs) in an operating system kernel (such as the Linux kernel) without changing the kernel source code or loading kernel modules.

[0003] The architecture of the enhanced packet filter can include at least two parts: user-mode programs (or user space programs) and kernel-mode programs (or kernel programs). The user-mode program is used to load instruction codes (such as BPF bytecodes) into the kernel, and can also read information or events returned by the kernel; while the kernel-mode program is used to convert instruction codes into kernel executable instructions, which are then executed by the instruction program in the kernel.

[0004] In a virtualized environment (such as a virtual machine), a hypercall mechanism is provided. By calling Hypercall, a state switch from user mode to kernel mode can be achieved, thereby obtaining higher operating permissions in kernel mode.

[0005] However, if the enhanced packet filter running in a virtualized environment wants to obtain higher operating permissions, it needs to switch from the kernel state program to the underlying virtual machine monitor (Hypervisor, or virtual machine monitor, VMM) in the virtual machine; and the kernel state program of the existing enhanced packet filter cannot call Hypercall, and therefore cannot switch to the Hypervisor to obtain higher operating permissions. Summary of the invention

[0006] The embodiments of this specification provide a method and device for super calling a kernel-mode program of an enhanced packet filter:

[0007] According to a first aspect of an embodiment of the present specification, a hypercall method of a kernel-mode program of an enhanced packet filter is provided, which is applied to a virtual machine monitor, and the method includes:

[0008] In response to a virtualization page fault triggered by a kernel-mode program, obtaining a memory address that triggers the virtualization page fault;

[0009] Determine whether the memory address of the virtualized page fault is consistent with the memory address corresponding to the page fault key in the mapping table; wherein the mapping table records the mapping relationship between key-value pairs, the page fault key is a key determined by the kernel state program and the virtual machine monitor in the mapping table, and each key in the mapping table uniquely corresponds to a memory address;

[0010] If the memory address of the virtualized page fault is consistent with the memory address corresponding to the page fault key, read the page fault value mapped by the page fault key from the mapping table; wherein the page fault value includes the function type of the hypercall written by the kernel state program before triggering the virtualized page fault;

[0011] A hypercall of the function type is executed based on the function type indicated by the page fault value.

[0012] Optionally, the virtualized page fault in response to the triggering of the kernel-mode program includes:

[0013] A virtualized page fault is triggered in response to a kernel-mode program writing a hypercall function type into a page fault value mapped by a page fault key in a mapping table.

[0014] Optionally, different missing page keys are used to represent different numbers of parameters; the method further includes:

[0015] Based on the number of parameters represented by the page fault key, the parameter keys of the number of parameters are read in sequence starting from the first parameter key in the mapping table to obtain the parameter value mapped by each parameter key; wherein the parameter value is the parameter of the hypercall written by the kernel state program, and one parameter value corresponds to one parameter;

[0016] The step of executing a super call of the function type based on the function type indicated by the page fault key comprises:

[0017] Based on the identity information of the virtual machine where the virtual machine monitor is located, obtaining a mapping table maintained by the enhanced packet filter in the virtual machine;

[0018] Modify the negotiation value of the negotiation key mapping in the mapping table to a page fault key; so that the negotiation value of the negotiation key mapping maintained by the mapping table indicates the page fault key; wherein the negotiation key is a key determined jointly by the kernel-mode program and the virtual machine monitor in the mapping table.

[0019] According to a second aspect of an embodiment of this specification, a hypercall method for a kernel-mode program of an enhanced packet filter is provided, which is applied to a kernel-mode program, and the method includes:

[0020] In response to the hypercall instruction, read the negotiation value of the negotiation key mapping in the mapping table maintained by the enhanced packet filter; wherein the mapping table records the mapping relationship between the key-value pairs, and the negotiation value includes the value of the virtual machine monitor pre-written to indicate the page fault key; the negotiation key and the page fault key are the keys determined by the kernel state program and the virtual machine monitor in the mapping table;

[0021] Querying the missing page key mapped in the mapping table based on the negotiated value;

[0022] The function type of the super call specified in the super call instruction is written into the page fault value of the page fault key mapping, thereby triggering a virtualization page fault; so that the virtual machine monitor responds to the virtualization page fault and executes a super call of this function type based on the function type indicated by the page fault value.

[0023] Optionally, the method further includes:

[0024] When at least one parameter of the super call is also specified in the super call instruction, starting from the first parameter key in the mapping table, the at least one parameter is written into the parameter value mapped by the at least one parameter key in sequence, so that one parameter value corresponds to one parameter.

[0025] According to a third aspect of the embodiments of this specification, a hypercall device for a kernel-mode program of an enhanced packet filter is provided, which is applied to a virtual machine monitor, and the device includes:

[0026] A response unit, in response to a virtualization page fault triggered by a kernel-mode program, obtains a memory address that triggers the virtualization page fault;

[0027] A judgment unit, judging whether the memory address of the virtualized page fault is consistent with the memory address corresponding to the page fault key in the mapping table; wherein the mapping table records the mapping relationship between key-value pairs, the page fault key is a key determined by the kernel state program and the virtual machine monitor in the mapping table, and each key in the mapping table uniquely corresponds to a memory address;

[0028] A reading unit, if the memory address of the virtualized page fault is consistent with the memory address corresponding to the page fault key, reads the page fault value mapped by the page fault key from the mapping table; wherein the page fault value includes the function type of the hypercall written by the kernel state program before triggering the virtualized page fault;

[0029] The calling unit executes a hyper call of the function type based on the function type indicated by the page fault value.

[0030] Optionally, the response unit is further configured to respond to a virtualization page fault triggered after the kernel-mode program writes a function type of the hypercall into a page fault value mapped by a page fault key in a mapping table.

[0031] Optionally, different missing page keys are used to represent different numbers of parameters;

[0032] The reading unit is further used to read the parameter keys of the number of parameters in sequence starting from the first parameter key in the mapping table based on the number of parameters represented by the page fault key, so as to obtain the parameter value mapped by each parameter key; wherein the parameter value is the parameter of the hypercall written by the kernel state program, and one parameter value corresponds to one parameter;

[0033] The calling unit is further used to execute a super call of the function type based on the parameter indicated by the parameter value and the function type indicated by the page fault value.

[0034] Optionally, the device further comprises:

[0035] A writing unit, based on the identity information of the virtual machine where the virtual machine monitor is located, obtains a mapping table maintained by an enhanced packet filter in the virtual machine; modifies the negotiation value of the negotiation key mapping in the mapping table to a page fault key; so that the negotiation value of the negotiation key mapping maintained by the mapping table indicates the page fault key; wherein the negotiation key is a key determined jointly by the kernel-mode program and the virtual machine monitor in the mapping table.

[0036] According to a fourth aspect of the embodiments of this specification, a hypercall device for a kernel-mode program of an enhanced packet filter is provided, which is applied to a kernel-mode program, and the device includes:

[0037] A response unit, in response to a hypercall instruction, reads a negotiation value of a negotiation key mapping in a mapping table maintained by an enhanced packet filter; wherein the mapping table records a mapping relationship between key-value pairs, and the negotiation value includes a value pre-written by a virtual machine monitor for indicating a page fault key; the negotiation key and the page fault key are keys jointly determined in the mapping table by the kernel-mode program and the virtual machine monitor;

[0038] A query unit, querying the missing page key mapped in the mapping table based on the negotiated value;

[0039] The calling unit writes the function type of the super call specified in the super call instruction into the page fault value of the page fault key mapping, thereby triggering a virtualization page fault; so that the virtual machine monitor responds to the virtualization page fault and executes a super call of this function type based on the function type indicated by the page fault value.

[0040] Optionally, the calling unit is also used to, when at least one parameter of the super call is specified in the super call instruction, write the at least one parameter into the parameter value mapped to at least one parameter key in sequence, starting from the first parameter key in the mapping table, so that one parameter value corresponds to one parameter.

[0041] According to a fifth aspect of the embodiments of this specification, an electronic device is provided, including:

[0042] processor;

[0043] a memory for storing processor-executable instructions;

[0044] Wherein, the processor is configured as a hypercall method of a kernel-mode program of any of the above-mentioned enhanced packet filters.

[0045] According to the sixth aspect of the embodiments of this specification, a computer-readable storage medium is provided. When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any of the above-mentioned hypercall methods of the kernel mode program of the enhanced packet filter.

[0046] The embodiment of the present specification provides a hypercall solution for the kernel-mode program of an enhanced packet filter, which provides a hypercall function for the kernel-mode program of the enhanced packet filter based on virtualization page fault technology; without modifying the kernel source code, an indirect hypercall is implemented by calling the provided hypercall function. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a flowchart of a hypercall method of a kernel-mode program of an enhanced packet filter provided in an embodiment of the present specification;

[0048] Figure 2 is a schematic diagram of a Map provided in an embodiment of this specification;

[0049] Figure 3 It is a schematic diagram of a method embodiment using a virtual machine monitor as an execution subject provided by an embodiment of this specification;

[0050] Figure 4 It is a schematic diagram of a method embodiment provided by an embodiment of this specification with a kernel-mode program as the execution subject;

[0051] Figure 5 It is a hardware structure diagram of a hypercalling device of a kernel-mode program of an enhanced packet filter provided in an embodiment of the present specification;

[0052] Figure 6 It is a module of a hyper-calling device of a kernel-mode program of an enhanced packet filter provided in an embodiment of the present specification;

[0053] Figure 7 It is a module of a hyper-calling device of a kernel-mode program of an enhanced packet filter provided in an embodiment of the present specification. DETAILED DESCRIPTION

[0054] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this specification. Instead, they are merely examples of devices and methods consistent with some aspects of this specification as detailed in the appended claims.

[0055] The terms used in this specification are for the purpose of describing specific embodiments only and are not intended to limit this specification. The singular forms "a", "the" and "the" used in this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0056] It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0057] As mentioned above, the kernel-mode program of the enhanced packet filter (hereinafter referred to as eBPF) cannot directly call the hypercall (hereinafter referred to as Hypercall), and it is also impossible to switch from the kernel-mode program to the virtual machine monitor (hereinafter referred to as Hypervisor) to obtain higher operating permissions.

[0058] In the related art, Hypercall of eBPF kernel-mode programs can be implemented by modifying the kernel source code. Specifically, the existing kernel defines a series of Helper auxiliary functions, but does not provide a Helper auxiliary function to implement the Hypercall function; for this purpose, the kernel source code is modified to add the implementation of calling Hypercall through the Helper auxiliary function. However, this method requires modifying the kernel source code, and its applicability is poor and cannot be widely popularized.

[0059] This specification provides a hypercall solution for kernel-mode programs of an enhanced packet filter, which can implement the Hypercall function of eBPF kernel-mode programs without modifying the kernel source code.

[0060] The following combination Figure 1 A flowchart of an embodiment of a hypercall method for a kernel-mode program of an enhanced packet filter provided in this specification is introduced, and the method comprises:

[0061] Step 1.2: The kernel-mode program responds to a hypercall instruction by reading a negotiation value of a negotiation key mapping in a mapping table maintained by an enhanced packet filter; wherein the mapping table records a mapping relationship between key-value pairs, and the negotiation value includes a value pre-written by the virtual machine monitor for indicating a page fault key; the negotiation key and page fault key are keys determined jointly by the kernel-mode program and the virtual machine monitor in the mapping table.

[0062] Step 1.4: The kernel-mode program queries the fault page key mapped in the mapping table based on the negotiated value.

[0063] Step 1.6: The kernel-mode program writes the function type of the hypercall specified in the hypercall instruction into the page fault value of the page fault key mapping, thereby triggering a virtualized page fault.

[0064] Step 2.2: In response to a virtualization page fault triggered by a kernel-mode program, the virtual machine monitor obtains a memory address that triggers the virtualization page fault.

[0065] Step 2.4: The virtual machine monitor determines whether the memory address of the virtualized page fault is consistent with the memory address corresponding to the page fault key in the mapping table; wherein each key in the mapping table uniquely corresponds to a memory address.

[0066] Step 2.6: If the memory address of the virtualized page fault is consistent with the memory address corresponding to the page fault key, the virtual machine monitor reads the page fault value mapped by the page fault key from the mapping table.

[0067] Step 2.8: The virtual machine monitor executes a hypercall of the function type based on the function type indicated by the page fault value.

[0068] In this specification, at least one virtual machine can be generated in the kernel through virtualization technology, and eBPF (enhanced packet filter) can be run in each virtual machine, and one or more mapping tables are maintained in the eBPF. In this way, the virtual machine can include the kernel state program of eBPF, the mapping table, and the Hypervisor (virtual machine monitor) of the virtual machine itself.

[0069] The above mapping table can be understood as a data structure that records the mapping relationship between key-value pairs (i.e., key-value), such as Map. Map is a general key-value storage structure that can be used to store any type of data. Each key in the mapping table corresponds to a memory address.

[0070] In eBPF, mapping tables are generally used to provide two-way communication between user-mode programs and kernel-mode programs to achieve data interaction between user-mode programs and kernel-mode programs.

[0071] In this specification, by configuring or improving the above mapping table, it can also be used to provide bidirectional communication between eBPF and Hypervisor to realize data interaction between the kernel state program of eBPF and Hypervisor. The specific configuration or improvement of the above mapping table will be described in the subsequent embodiments.

[0072] Taking Map as an example, different types of Map types are derived to meet the needs of different scenarios, such as Array Map, Hash Map, etc. Different Map types have different characteristics and functions.

[0073] Taking Array Map as an example, since Array Map has the characteristics of high query efficiency and small memory usage, when Array Map is used as eBPF Map, the read and write efficiency of Map can be improved. For the embodiments in this specification, improving the read and write efficiency of Map means improving the response efficiency of kernel-mode program hypercall.

[0074] The following further describes how to configure or improve the mapping table to implement data interaction between the eBPF kernel program and the Hypervisor.

[0075] In this specification, one or more negotiation keys (hereinafter referred to as negotiation keys) need to be registered in the mapping table. The negotiation value (hereinafter referred to as negotiation value) corresponding to each negotiation key can be a page fault key (hereinafter referred to as page fault key) pre-written by the Hypervisor, that is, the negotiation value can be used to indicate the page fault key. The negotiation key and the page fault key can be the keys determined in advance by the kernel-mode program and the Hypervisor in the mapping table.

[0076] It should be noted that at the same time, a missing page key can only exist in one negotiated value, so as to avoid different negotiated values ​​pointing to the same missing page key at the same time, causing abnormal conflicts.

[0077] In an exemplary embodiment, the Hypervisor needs to obtain a mapping table before writing the negotiated value. The obtaining method may include:

[0078] The Hypervisor can obtain a mapping table maintained by an enhanced packet filter in the virtual machine based on the identity information of the virtual machine where the virtual machine monitor is located; further, modify the negotiation value of the negotiation key mapping in the mapping table to a page missing key; so that the negotiation value of the negotiation key mapping maintained by the mapping table indicates the page missing key.

[0079] During implementation, the Hypervisor may use a kernel analysis tool (e.g., Crash Utility) to obtain the above mapping table. Generally, the kernel analysis tool may locate the virtual machine based on its identity information as a unique identifier, and obtain the mapping table from the located virtual machine. The identity information may include, but is not limited to, the kernel version of the virtual machine (e.g., Linux Kernel version), symbol table, key data structure, and other information.

[0080] It should be noted that in some embodiments, the Hypervisor may also obtain the mapping table directly based on the identity information of the virtual machine without using the kernel analysis tool.

[0081] After the Hypervisor writes the missing page key into the negotiated value, the negotiated value can point to the missing page key in the mapping table. It should be noted that the missing page value of the missing page key can be empty initially, and the value of the missing page value needs to be written by the kernel state program later (this process will be described in the following embodiments).

[0082] The following combination Figure 2 In the schematic diagram of the Map shown, assuming that the first key is the negotiated key and the corresponding negotiated value is X, then the page fault key corresponding to the negotiated value in the Map is key=X at GPA0.

[0083] After the Hypervisor writes the negotiated value, the Hypervisor also needs to build a virtualized page fault for the page fault key, so that when the eBPF kernel-mode program subsequently writes any data to the page fault value corresponding to the page fault key, a virtualized page fault can be triggered.

[0084] The above-mentioned method of constructing a virtualized page fault for a page fault key may be to remove the virtual address of the page fault key from a page table. The page table is a table that manages the mapping relationship between virtual addresses and physical addresses. In addition, after the hypervisor removes the virtual address of the page fault key from the page table, in order to maintain the virtualized page fault, it is necessary to intercept and add a mapping for the virtual address of the page fault key.

[0085] After the Hypervisor writes the negotiated value, the eBPF kernel-mode program can use the Hypercall function to indirectly implement the Hypercall call.

[0086] In implementation, the kernel-mode program of eBPF may receive instructions, for example, from a user-mode program. If the instruction needs to be executed by the Hypervisor, the kernel-mode program needs to use Hypercall. Instructions that need to use Hypercall are referred to as Hypercall instructions below.

[0087] In response to the Hypercall instruction, the kernel-mode program first needs to read the negotiation value corresponding to the negotiation key in the mapping table.

[0088] Then, the negotiation value is used as an index to query the missing page key pointed to by the negotiation value in the mapping table.

[0089] Finally, the function type of the Hypercall specified in the Hypercall instruction is written as a value into the page fault value corresponding to the page fault key, thereby triggering a virtualized page fault.

[0090] Accordingly, the Hypervisor may, in response to a virtualization page fault triggered by a kernel-mode program, obtain a memory address that triggers the virtualization page fault, and determine whether the memory address of the virtualization page fault is consistent with a memory address corresponding to a page fault key;

[0091] If the memory address of the virtualized page fault is consistent with the memory address corresponding to the page fault key, the Hypervisor can determine that the eBPF kernel-mode program has indeed initiated a Hypercall call, and then use the negotiated value as an index to query the page fault key pointed to by the negotiated value in the mapping table.

[0092] At this time, the page fault value corresponding to the page fault key has been written with the value representing the function type of the Hypercall by the kernel-mode program; therefore, by reading the page fault value corresponding to the page fault key, it is possible to determine which Hypercall function type of Hypercall currently needs to be executed, and then complete the execution of the Hypercall.

[0093] By applying the above embodiment, the kernel-mode program of eBPF does not directly call Hypercall, but establishes a correspondence between the negotiation value corresponding to the negotiation key and the page fault key by setting the negotiation key and the page fault key in the mapping table; then, the virtualized page fault technology is used to use the page fault value mapped by the page fault key as the data transmission carrier of the Hypercall function type to realize the information interaction between the kernel-mode program and the Hypervisor; finally, the Hypervisor executes the Hypercall of the transmitted Hypercall function type; this is actually a way to indirectly realize Hypercall.

[0094] On the one hand, the page fault value can be written into any Hypercall function type, thus providing full-function type Hypercall for eBPF kernel-mode programs.

[0095] On the other hand, since the above-mentioned indirect implementation of Hypercall does not require modifying the kernel source code of the virtual machine, it can be widely used as a general hypercall solution for eBPF kernel-mode programs.

[0096] In actual applications, some services require the transmission of specific parameters to be executed correctly. Similarly, there is a need to transmit parameters when calling Hypercall. However, since the missing page value in the mapping table has been used to write the function type of the Hypercall, it can no longer be used to transmit the parameters of the Hypercall. Therefore, the above embodiment can only provide a Hypercall without parameters, but cannot provide a Hypercall with parameters.

[0097] In order to solve this problem, this specification also provides the following embodiments to implement a Hypercall with parameters for a kernel-mode program in an enhanced packet filter, and this Hypercall can support the passing of any number of parameters.

[0098] Specifically, multiple page fault keys can be set in the mapping table, and different page fault keys can be used to represent different number parameters; accordingly, different page fault keys also need to be written into the negotiation values ​​corresponding to different negotiation keys; and parameter keys for writing different parameters are set. Similar to the negotiation key and page fault key, the parameter key can also be determined by the kernel-mode program and the hypervisor after negotiation.

[0099] In the above step 1.6, you can also include:

[0100] When at least one parameter of the super call is also specified in the super call instruction, the kernel state program starts from the first parameter key in the mapping table and writes the at least one parameter into the parameter value mapped by the at least one parameter key in sequence, so that one parameter value corresponds to one parameter.

[0101] In this example, for the kernel-mode program, it is necessary to read the corresponding negotiation value according to the number of parameters in the Hypercall instruction. In addition, in addition to writing the function type of the Hypercall to be executed specified in the Hypercall instruction as the value value into the missing page value mapped by the missing page key pointed to by the negotiation value, the kernel-mode program also needs to start from the first parameter key and write the at least one parameter as the value value into the parameter value mapped by at least one parameter key in sequence, so that one parameter value corresponds to one parameter.

[0102] Accordingly, in the above step 2.6, the following steps may also be included:

[0103] The virtual machine monitor reads the parameter keys of the number of parameters in sequence starting from the first parameter key in the mapping table based on the number of parameters represented by the page fault key, so as to obtain the parameter value mapped by each parameter key.

[0104] In this example, for the Hypervisor, it can be determined whether it is a Hypercall with several parameters based on the memory address of the virtualization page fault; then the parameter keys of the number of parameters can be read in sequence starting from the first parameter key in the mapping table to obtain the parameter value mapped by each parameter key; finally, the Hypercall of this function type is executed based on the parameters indicated by the parameter value and the function type indicated by the page fault value.

[0105] Still combined Figure 2Assume that the memory address GPA0 corresponding to the page fault key = X indicates no parameter, the memory address GPA1 corresponding to the page fault key = X+1 indicates 1 parameter, and the memory address GPA2 corresponding to the page fault key = X+2 indicates 2 parameters;

[0106] Then, if the Hypercall instruction is a parameterless Hypercall_type1 function type, then the eBPF kernel-mode program can read the value = X corresponding to the parameterless negotiation key = 0, and write Hypercal_type1 to the page fault value corresponding to the page fault key = X to trigger a virtualization page fault. The Hypervisor obtains the memory address GPA0 of the virtualization page fault, indicating that it is a parameterless Hypercall, so there is no need to read the parameters, and only needs to execute the parameterless Hypercall based on the Hypercall_type1 function type indicated by the negotiation value.

[0107] For another example, if the Hypercall instruction is a Hypercall_type2 function type with one parameter, then the eBPF kernel-mode program can read the value = X+1 of the negotiation key = 1 corresponding to a parameter, and write Hypercal_type2 to the page fault value corresponding to the page fault key = X+1, and write parameter 1 to the parameter value corresponding to the first parameter key = Y, to trigger the virtualization page fault. The Hypervisor obtains the memory address GPA1 of the virtualization page fault, indicating that it is a Hypercall with one parameter, so it is necessary to read parameter 1 from the parameter value corresponding to parameter key = Y, and read the Hypercall_type2 function type from the page fault value corresponding to the page fault key = X+1; finally, the Hypercall is executed based on parameter 1 and the Hypercall_type3 function type.

[0108] For another example, if the Hypercall instruction is a Hypercall_type3 function type with two parameters, then the eBPF kernel-mode program can read the negotiation key=2 corresponding to the two parameters, value=X+2, and write Hypercal_type3 to the page fault value corresponding to the page fault key=X+2, as well as write parameter 1 to the parameter value corresponding to the first parameter key=Y, and write parameter 2 to the parameter value corresponding to the second parameter key=Y+1, to trigger the virtualization page fault. The Hypervisor obtains the memory address GPA2 of the virtualization page fault, indicating that it is a Hypercall with two parameters, so it is necessary to read parameter 1 and parameter 2 from the parameter values ​​corresponding to parameter key=Y and parameter key=Y+1, respectively, and read the Hypercall_type3 function type from the page fault value corresponding to the page fault key=X+2; finally, the Hypercall is executed based on parameter 1, parameter 2, and the Hypercall_type3 function type.

[0109] Similarly, similar processing is performed for Hypercall instructions with three parameters, four parameters, etc., which will not be repeated here.

[0110] In the above example, by setting the parameter key in the mapping table, the reference value mapped by the reference key is used as the data transfer carrier of the Hypercall parameter, and combined with the page fault value, not only can the full-function Hypercall be implemented, but also Hypercalls with different numbers of parameters can be supported.

[0111] The following references Figure 3 The schematic diagram of the method embodiment shown in FIG. 1 is a method in which a Hypervisor is used as an execution subject, and the method includes:

[0112] Step 310, in response to a virtualization page fault triggered by a kernel-mode program, obtaining a memory address that triggers the virtualization page fault;

[0113] Step 320, determining whether the memory address of the virtualized page fault is consistent with the memory address corresponding to the page fault key in the mapping table; wherein the mapping table records the mapping relationship between key-value pairs, the page fault key is a key determined by the kernel state program and the virtual machine monitor in the mapping table, and each key in the mapping table uniquely corresponds to a memory address;

[0114] Step 330: If the memory address of the virtualized page fault is consistent with the memory address corresponding to the page fault key, read the page fault value mapped by the page fault key from the mapping table; wherein the page fault value includes the function type of the hypercall written by the kernel state program before triggering the virtualized page fault;

[0115] Step 340: Execute a hypercall of the function type based on the function type indicated by the page fault value.

[0116] Above Figure 3 The illustrated embodiment and subsequent optional embodiments may correspond to the aforementioned Figure 1 For details of the specific steps, please refer to Figure 1 The relevant embodiments will not be described in detail here.

[0117] By applying the above embodiment, the negotiation key and page fault key in the mapping table are set, and a corresponding relationship between the negotiation value corresponding to the negotiation key and the page fault key is established; then the virtualization page fault technology is used to use the page fault value mapped by the page fault key as a data transmission carrier of the Hypercall function type to realize information interaction between the kernel-mode program and the Hypervisor.

[0118] Specifically, after the kernel-mode program writes the Hypercall function type into the page fault value mapped by the page fault key, a virtualization page fault is triggered; and in response to the virtualization page fault, the Hypervisor reads the Hypercall function type written by the kernel-mode program into the page fault value mapped by the page fault key, thereby executing the Hypercall of the Hypercall function type. In this way, the kernel-mode program of eBPF indirectly calls Hypercall.

[0119] On the one hand, the page fault value can be written into any Hypercall function type, thus providing full-function type Hypercall for eBPF kernel-mode programs.

[0120] On the other hand, since the above-mentioned indirect implementation of Hypercall does not require modifying the kernel source code of the virtual machine, it can be used as a hypercall solution for kernel-mode programs of a general enhanced packet filter.

[0121] In an exemplary optional embodiment, in step 310, responding to a virtualized page fault triggered by a kernel-mode program may include:

[0122] A virtualized page fault is triggered in response to a kernel-mode program writing a hypercall function type into a page fault value mapped by a page fault key in a mapping table.

[0123] As in the above example, by setting the page fault key, when the eBPF kernel-state program writes any data to the page fault value mapped by the page fault key, a virtualization page fault can be triggered, thereby using the page fault value as a data transfer carrier of the Hypercall function type to achieve information interaction between the eBPF kernel-state program and the virtual machine's Hypervisor.

[0124] In an exemplary optional embodiment, different missing page keys are used to represent different numbers of parameters; Figure 3 Based on the embodiment shown, the following may also be included:

[0125] Based on the number of parameters represented by the page fault key, the parameter keys of the number of parameters are read in sequence starting from the first parameter key in the mapping table to obtain the parameter value mapped by each parameter key; wherein the parameter value is the parameter of the hypercall written by the kernel state program, and one parameter value corresponds to one parameter;

[0126] The step 340, executing a hypercall of the function type based on the function type indicated by the page fault key, may include:

[0127] A hypercall of the function type is executed based on the parameter indicated by the parameter value and the function type indicated by the page fault value.

[0128] As in the above example, by setting the parameter key in the mapping table, and using the reference value mapped by the reference key as the data transfer carrier of the Hypercall parameter, combined with the page fault value, Hypercall with parameters can be implemented, and any number of parameters can be passed.

[0129] In an exemplary optional embodiment, before the above step 310, the following may also be included:

[0130] Based on the identity information of the virtual machine where the virtual machine monitor is located, obtaining a mapping table maintained by the enhanced packet filter in the virtual machine;

[0131] Modify the negotiation value of the negotiation key mapping in the mapping table to a page fault key; so that the negotiation value of the negotiation key mapping maintained by the mapping table indicates the page fault key; wherein the negotiation key is a key determined jointly by the kernel-mode program and the virtual machine monitor in the mapping table.

[0132] In the above example, the Hypervisor obtains the eBPF mapping table through the identity information of the virtual machine, and then writes the negotiated value used to point to the missing page key; after the negotiated value is written, the kernel-state program can have the Hypercall function, and then the Hypercall of the kernel-state program can be realized.

[0133] The following references Figure 4 The schematic diagram of the method embodiment shown in FIG. 1 is a schematic diagram of the method embodiment in which the kernel state program is the execution subject, and the method includes:

[0134] Step 410, in response to the hypercall instruction, read the negotiation value of the negotiation key mapping in the mapping table maintained by the enhanced packet filter; wherein the mapping table records the mapping relationship between key-value pairs, and the negotiation value includes a value pre-written by the virtual machine monitor for indicating the page fault key; the negotiation key and the page fault key are keys determined by the kernel state program and the virtual machine monitor in the mapping table;

[0135] Step 420, querying the missing page key mapped in the mapping table based on the negotiated value;

[0136] Step 430, write the function type of the super call specified in the super call instruction into the page fault value of the page fault key mapping, thereby triggering a virtualized page fault; so that the virtual machine monitor responds to the virtualized page fault and executes a super call of this function type based on the function type indicated by the page fault value.

[0137] Above Figure 4 The illustrated embodiment and subsequent optional embodiments may correspond to the aforementioned Figure 1 For details of the specific steps, please refer to Figure 1 The relevant embodiments will not be described in detail here.

[0138] By applying the above embodiment, the negotiation key and page fault key in the mapping table are set, and a corresponding relationship between the negotiation value corresponding to the negotiation key and the page fault key is established; then the virtualization page fault technology is used to use the page fault value mapped by the page fault key as a data transmission carrier of the Hypercall function type to realize information interaction between the kernel-mode program and the Hypervisor.

[0139] Specifically, after the kernel-mode program writes the Hypercall function type into the page fault value mapped by the page fault key, a virtualization page fault is triggered; and in response to the virtualization page fault, the Hypervisor reads the Hypercall function type written by the kernel-mode program into the page fault value mapped by the page fault key, thereby executing the Hypercall of the Hypercall function type. In this way, the kernel-mode program of eBPF indirectly calls Hypercall.

[0140] On the one hand, the page fault value can be written into any Hypercall function type, thus providing full-function type Hypercall for eBPF kernel-mode programs.

[0141] On the other hand, since the above-mentioned indirect implementation of Hypercall does not require modifying the kernel source code of the virtual machine, it can be used as a hypercall solution for kernel-mode programs of a general enhanced packet filter.

[0142] In an exemplary optional embodiment, the method further includes:

[0143] When at least one parameter of the super call is further specified in the super call instruction, starting from the first parameter key in the Map, the at least one parameter is sequentially written as a value into the parameter value corresponding to the at least one parameter key, so that one parameter value corresponds to one parameter;

[0144] The method of causing the virtual machine monitor to execute a hypercall of the function type based on the function type indicated by the page fault value includes:

[0145] So that the virtual machine monitor executes a hyper call of the function type based on the parameter indicated by the parameter value and the function type indicated by the page fault value.

[0146] As in the above example, by setting the parameter key in the Map, using the reference value corresponding to the reference key as the data transfer carrier of the Hypercall parameter, and cooperating with the page fault value, Hypercall with parameters can be implemented, and any number of parameters can be passed.

[0147] This embodiment corresponds to the aforementioned Figure 1 For details of the specific steps in the embodiment, please refer to Figure 1 The embodiments will not be described in detail in this embodiment.

[0148] Corresponding to the aforementioned embodiment of the hypercall method for the kernel-mode program of the enhanced packet filter, the present specification also provides an embodiment of the hypercall device for the kernel-mode program of the enhanced packet filter. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of the device in which it is located reading the corresponding computer business program instructions in the non-volatile memory into the internal memory for execution. From the hardware level, such as Figure 5 The figure is a hardware structure diagram of the device where the hypercall device of the kernel state program of the enhanced packet filter of this specification is located, except Figure 5 In addition to the processor, network interface, memory and non-volatile memory shown, the device where the apparatus in the embodiment is located may also include other hardware according to the actual function of the hypercall of the kernel state program of the enhanced packet filter, which will not be described in detail.

[0149] See also Figure 6 , is a block diagram of a hypercall device for a kernel-mode program of an enhanced packet filter provided in an embodiment of the present specification. The device corresponds to Figure 3 The embodiment shown is applied to a virtual machine monitor, and the device includes:

[0150] A response unit 610, in response to a virtualization page fault triggered by a kernel-mode program, obtains a memory address that triggers the virtualization page fault;

[0151] The judging unit 620 judges whether the memory address of the virtualized page fault is consistent with the memory address corresponding to the page fault key in the mapping table; wherein the mapping table records the mapping relationship between key-value pairs, the page fault key is a key determined by the kernel state program and the virtual machine monitor in the mapping table, and each key in the mapping table uniquely corresponds to a memory address;

[0152] The reading unit 630 reads the page fault value mapped by the page fault key from the mapping table if the memory address of the virtualized page fault is consistent with the memory address corresponding to the page fault key; wherein the page fault value includes the function type of the hypercall written by the kernel state program before triggering the virtualized page fault;

[0153] The calling unit 640 executes a hypercall of the function type based on the function type indicated by the page fault value.

[0154] Optionally, the response unit 610 is further configured to respond to a virtualized page fault triggered after the kernel-mode program writes the function type of the hypercall into the page fault value mapped by the page fault key in the mapping table.

[0155] Optionally, different missing page keys are used to represent different numbers of parameters;

[0156] The reading unit 630 is further used to read the parameter keys of the number of parameters in sequence starting from the first parameter key in the mapping table based on the number of parameters represented by the page fault key, so as to obtain the parameter value mapped by each parameter key; wherein the parameter value is the parameter of the hypercall written by the kernel state program, and one parameter value corresponds to one parameter;

[0157] The calling unit 640 is further configured to execute a hyper call of the function type based on the parameter indicated by the parameter value and the function type indicated by the page fault value.

[0158] Optionally, the device further comprises:

[0159] A writing unit, based on the identity information of the virtual machine where the virtual machine monitor is located, obtains a mapping table maintained by an enhanced packet filter in the virtual machine; modifies the negotiation value of the negotiation key mapping in the mapping table to a page fault key; so that the negotiation value of the negotiation key mapping maintained by the mapping table indicates the page fault key; wherein the negotiation key is a key determined jointly by the kernel-mode program and the virtual machine monitor in the mapping table.

[0160] See also Figure 7 , is a block diagram of a hypercall device for a kernel-mode program of an enhanced packet filter provided in an embodiment of the present specification. The device corresponds to Figure 4 The embodiment shown is applied to a kernel-mode program, and the device includes:

[0161] The response unit 710 reads the negotiation value of the negotiation key mapping in the mapping table maintained by the enhanced packet filter in response to the hypercall instruction; wherein the mapping table records the mapping relationship between the key-value pairs, and the negotiation value includes the value of the virtual machine monitor pre-written to indicate the page fault key; the negotiation key and the page fault key are the keys determined by the kernel state program and the virtual machine monitor in the mapping table;

[0162] A query unit 720 queries the missing page key mapped in the mapping table based on the negotiated value;

[0163] The calling unit 730 writes the function type of the super call specified in the super call instruction into the page fault value of the page fault key mapping, thereby triggering a virtualization page fault; so that the virtual machine monitor responds to the virtualization page fault and executes a super call of this function type based on the function type indicated by the page fault value.

[0164] Optionally, the calling unit 730 is also used to, when at least one parameter of the super call is specified in the super call instruction, write the at least one parameter into the parameter value mapped to at least one parameter key in sequence, starting from the first parameter key in the mapping table, so that one parameter value corresponds to one parameter.

[0165] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device or a combination of any of these devices.

[0166] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0167] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can refer to the partial description of the method embodiments. The device embodiments described above are only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. Ordinary technicians in this field can understand and implement it without paying creative work.

[0168] above Figure 6 and Figure 7 The internal functional modules and structure of the execution device of the smart contract in the blockchain described above are schematically shown. The actual execution subject can be an electronic device, including:

[0169] processor;

[0170] a memory for storing processor-executable instructions;

[0171] The processor is configured as an implementation of a hypercall of a kernel-mode program of any of the above-mentioned enhanced packet filters.

[0172] In the above-mentioned embodiment of the electronic device, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or the processor can be any conventional processor, etc., and the aforementioned memory can be a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk or a solid-state drive. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0173] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the electronic device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0174] Those skilled in the art will readily appreciate other embodiments of the specification after considering the specification and practicing the invention disclosed herein. The specification is intended to cover any variations, uses, or adaptations of the specification that follow the general principles of the specification and include common knowledge or customary techniques in the art that are not disclosed in the specification. The specification and examples are to be considered exemplary only, and the true scope and spirit of the specification are indicated by the following claims.

[0175] It should be understood that the present description is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present description is limited only by the appended claims.

Claims

1. A hypercall method for a kernel-mode program of an enhanced packet filter, applied to a virtual machine monitor, the method comprising: In response to a virtualization page fault triggered by a kernel-mode program, obtaining a memory address that triggers the virtualization page fault; Determine whether the memory address of the virtualized page fault is consistent with the memory address corresponding to the page fault key in the mapping table; wherein the mapping table records the mapping relationship between key-value pairs, the page fault key is a key determined by the kernel state program and the virtual machine monitor in the mapping table, and each key in the mapping table uniquely corresponds to a memory address; If the memory address of the virtualized page fault is consistent with the memory address corresponding to the page fault key, read the page fault value mapped by the page fault key from the mapping table; wherein the page fault value includes the function type of the hypercall written by the kernel state program before triggering the virtualized page fault; A hypercall of the function type is executed based on the function type indicated by the page fault value.

2. The method according to claim 1, wherein the virtualized page fault in response to the triggering of the kernel-mode program comprises: A virtualized page fault is triggered in response to a kernel-mode program writing a hypercall function type into a page fault value mapped by a page fault key in a mapping table.

3. The method according to claim 1, wherein different missing page keys are used to represent different numbers of parameters; the method further comprises: Based on the number of parameters represented by the page fault key, the parameter keys of the number of parameters are read in sequence starting from the first parameter key in the mapping table to obtain the parameter value mapped by each parameter key; wherein the parameter value is the parameter of the hypercall written by the kernel state program, and one parameter value corresponds to one parameter; The step of executing a super call of the function type based on the function type indicated by the page fault key comprises: A hypercall of the function type is executed based on the parameter indicated by the parameter value and the function type indicated by the page fault value.

4. The method according to claim 1, further comprising: Based on the identity information of the virtual machine where the virtual machine monitor is located, obtaining a mapping table maintained by the enhanced packet filter in the virtual machine; Modify the negotiation value of the negotiation key mapping in the mapping table to a page fault key; so that the negotiation value of the negotiation key mapping maintained by the mapping table indicates the page fault key; wherein the negotiation key is a key determined jointly by the kernel-mode program and the virtual machine monitor in the mapping table.

5. A hypercall method for a kernel-mode program of an enhanced packet filter, applied to a kernel-mode program, the method comprising: In response to the hypercall instruction, read the negotiation value of the negotiation key mapping in the mapping table maintained by the enhanced packet filter; wherein the mapping table records the mapping relationship between the key-value pairs, and the negotiation value includes the value of the virtual machine monitor pre-written to indicate the page fault key; the negotiation key and the page fault key are the keys determined by the kernel state program and the virtual machine monitor in the mapping table, and each key in the mapping table uniquely corresponds to a memory address; Querying the missing page key mapped in the mapping table based on the negotiated value; The function type of the super call specified in the super call instruction is written into the page fault value of the page fault key mapping, thereby triggering a virtualization page fault; so that the virtual machine monitor responds to the virtualization page fault and executes a super call of this function type based on the function type indicated by the page fault value.

6. The method according to claim 5, further comprising: When at least one parameter of the super call is also specified in the super call instruction, starting from the first parameter key in the mapping table, the at least one parameter is written into the parameter value mapped by the at least one parameter key in sequence, so that one parameter value corresponds to one parameter.

7. A hypercall device for a kernel-mode program of an enhanced packet filter, applied to a virtual machine monitor, the device comprising: A response unit, in response to a virtualization page fault triggered by a kernel-mode program, obtains a memory address that triggers the virtualization page fault; A judgment unit, judging whether the memory address of the virtualized page fault is consistent with the memory address corresponding to the page fault key in the mapping table; wherein the mapping table records the mapping relationship between key-value pairs, the page fault key is a key determined by the kernel state program and the virtual machine monitor in the mapping table, and each key in the mapping table uniquely corresponds to a memory address; A reading unit, if the memory address of the virtualized page fault is consistent with the memory address corresponding to the page fault key, reads the page fault value mapped by the page fault key from the mapping table; wherein the page fault value includes the function type of the hypercall written by the kernel state program before triggering the virtualized page fault; The calling unit executes a hyper call of the function type based on the function type indicated by the page fault value.

8. A hypercall device for a kernel-mode program of an enhanced packet filter, applied to a kernel-mode program, the device comprising: A response unit, in response to a hypercall instruction, reads a negotiation value of a negotiation key mapping in a mapping table maintained by an enhanced packet filter; wherein the mapping table records a mapping relationship between key-value pairs, and the negotiation value includes a value pre-written by a virtual machine monitor for indicating a page fault key; the negotiation key and the page fault key are keys jointly determined in the mapping table by the kernel-mode program and the virtual machine monitor, and each key in the mapping table uniquely corresponds to a memory address; A query unit, querying the missing page key mapped in the mapping table based on the negotiated value; The calling unit writes the function type of the super call specified in the super call instruction into the page fault value of the page fault key mapping, thereby triggering a virtualization page fault; so that the virtual machine monitor responds to the virtualization page fault and executes a super call of this function type based on the function type indicated by the page fault value.

9. An electronic device, comprising: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 1 to 6.

10. A computer-readable storage medium, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the method according to any one of claims 1 to 6.

Images