A virtual machine kernel monitoring method, device, equipment and storage medium

Abstract

This specification provides a virtual machine kernel monitoring method, device, equipment and storage medium, the method comprising: the VMM obtains an eBPF program, parses the eBPF program into at least one system call instruction and encapsulates it into a corresponding system call message, and then sends it from the outside of the target virtual machine to the kernel of the target virtual machine; the kernel of the target virtual machine receives the system message, mounts each of the system call instructions to a target function, so as to execute the system call instruction when the target function is called, and returns the execution result to the VMM.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of computer technology, and in particular to a virtual machine kernel monitoring method, device, equipment and storage medium. Background Art

[0002] At present, virtualization technology is widely used. The actual services provided to users are generally virtual machines running on physical hosts by cloud vendors. Due to the isolation of virtualization technology, the information between the host and the virtual machine is not transparent. In this case, it is necessary to perform security monitoring inside the virtual machine to ensure the data security of the company and users. Security monitoring can be achieved by adding a kernel monitoring module inside the virtual machine and running the monitoring program configured in the monitoring module, but the flexibility and versatility of monitoring are low; it can also be achieved using eBPF programs, but it is necessary to reserve an interface for the installation of the eBPF program and add a corresponding user-mode client. Summary of the invention

[0003] To overcome the problems existing in the related art, this specification provides a virtual machine kernel monitoring method, device, equipment and storage medium.

[0004] According to a first aspect of an embodiment of this specification, a virtual machine kernel monitoring method is provided, the method comprising:

[0005] The VMM obtains the eBPF program, parses the eBPF program into at least one system call instruction, encapsulates the eBPF program into a corresponding system call message, and sends the message to the kernel of the target virtual machine from the outside of the target virtual machine;

[0006] The kernel of the target virtual machine receives the system call message, mounts each of the system call instructions to the target function, executes the system call instruction when the target function is called, and returns the execution result to the VMM.

[0007] According to a second aspect of an embodiment of this specification, a virtual machine kernel monitoring method is provided, which is applied to a VMM, and the method includes:

[0008] Get the eBPF program;

[0009] Parsing the eBPF program into at least one system call instruction;

[0010] Encapsulating each of the system call instructions into a corresponding system call message and sending the message to the kernel of the target virtual machine from the outside of the target virtual machine;

[0011] Receive an execution result corresponding to the system call instruction returned by the kernel of the target virtual machine.

[0012] According to a third aspect of an embodiment of this specification, a virtual machine kernel monitoring method is provided, which is applied to a virtual machine kernel, and the method includes:

[0013] Receive a system call message sent by the VMM, where the system call message encapsulates at least one system call instruction in the eBPF program;

[0014] Each of the system call instructions is mounted to a target function, so that the system call instruction is executed when the target function is called, and the execution result is returned to the VMM.

[0015] According to a fourth aspect of an embodiment of this specification, a virtual machine kernel monitoring device is provided, which is applied to a VMM, including:

[0016] Get module, used to get eBPF program;

[0017] A parsing module, configured to parse the eBPF program into at least one system call instruction;

[0018] A first sending module, used for encapsulating each of the system call instructions into a corresponding system call message and sending the message to the kernel of the target virtual machine from the outside of the target virtual machine;

[0019] The first receiving module is used to receive the execution result corresponding to the system call instruction returned by the kernel of the target virtual machine.

[0020] According to a fifth aspect of an embodiment of this specification, a virtual machine kernel monitoring device is provided, which is applied to a virtual machine kernel, including:

[0021] A second receiving module is used to receive a system call message sent by the VMM, where the system call message encapsulates at least one system call instruction in the eBPF program;

[0022] A mounting module, used for mounting each of the system call instructions to a target function;

[0023] An execution module, used for executing the system call instruction when the target function is called;

[0024] The second sending module is used to return the execution result to the VMM.

[0025] According to the sixth aspect of the embodiments of this specification, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method provided in any one of the first to third aspects is implemented.

[0026] According to the seventh aspect of the embodiments of this specification, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and the computer program is used to instruct related hardware to complete the method provided in any one of the first to third aspects above.

[0027] The technical solutions provided by the embodiments of this specification may have the following beneficial effects:

[0028] In the embodiments of this specification, the VMM converts the eBPF program into instructions and system call events that can be executed by the virtual machine kernel, and sends them to the virtual machine kernel by means of messages. The virtual machine kernel directly executes the corresponding system call events and mounts each instruction to the target function to realize the loading of the eBPF program in the virtual machine kernel. By injecting system call events and instructions of the eBPF program that need to be executed by the kernel from the outside of the virtual machine, the virtual machine operating system does not need to reserve an interface for installing the eBPF program, nor does it need to configure a user-mode client for the eBPF program to implement the monitoring function, thereby improving the security of the virtual machine operating environment. In addition, the monitoring program is separated from the virtual machine, and only the monitoring program needs to be modified to perform various monitoring tasks without modifying the virtual machine kernel, thereby improving the flexibility and versatility of monitoring.

[0029] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present specification. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the specification and, together with the description, serve to explain the principles of the specification.

[0031] Figure 1 This is an interactive schematic diagram of a virtual machine kernel monitoring method shown in this specification according to an exemplary embodiment.

[0032] Figure 2A This is a schematic diagram of loading and mounting an eBPF program into a virtual machine kernel as shown in this specification.

[0033] Figure 2B This is a schematic diagram of loading and mounting a system call instruction in an eBPF program into a virtual machine kernel according to an exemplary embodiment of this specification.

[0034] Figure 3 This is an interactive schematic diagram of a virtual machine kernel monitoring method according to another exemplary embodiment of the present specification.

[0035] Figure 4AThe flowchart of a virtual machine kernel monitoring method applied to a VMM is shown in this specification according to an exemplary embodiment.

[0036] Figure 4B The present specification is a flowchart of a virtual machine kernel monitoring method applied to a virtual machine kernel according to an exemplary embodiment.

[0037] Figure 5 It is a hardware structure diagram of the computer device where the virtual machine kernel monitoring device of the embodiment of this specification is located.

[0038] Fig. 6A The present specification is a block diagram of a virtual machine kernel monitoring device for a VMM according to an exemplary embodiment.

[0039] Figure 6B The present specification is a block diagram of a virtual machine kernel monitoring device for a virtual machine kernel according to an exemplary embodiment. DETAILED DESCRIPTION

[0040] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this specification. Instead, they are merely examples of devices and methods consistent with some aspects of this specification as detailed in the appended claims.

[0041] The terms used in this specification are for the purpose of describing specific embodiments only and are not intended to limit this specification. The singular forms "a", "the" and "the" used in this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0042] It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0043] First, the professional terms involved in one or more embodiments of this specification are introduced.

[0044] Virtual Machine: A complete computer system with complete hardware system functions that runs in a completely isolated environment and can perform the tasks that can be completed in a physical computer.

[0045] Host machine: A virtual machine must run on a physical computer. The physical computer that runs the virtual machine is the host machine of the virtual machine.

[0046] VMM (Virtural Machine Monitor): A virtual machine manager, an intermediate software layer running between a physical server and an operating system that allows multiple operating systems and applications to share hardware, is used to create and run virtual machines, and allocates computer resources to virtual machines.

[0047] eBPF (extended Berkeley Packet Filter): A sandboxed program that can run in the Linux kernel without changing the source code or loading kernel modules.

[0048] perf: A performance analysis tool provided by the Linux kernel that can perform hot spot searches at the function level and instruction level. It can be used to analyze the CPU usage of hot functions in a program to locate performance bottlenecks.

[0049] perf buffer: The buffer used by perf to temporarily store event data.

[0050] epoll: An I / O event notification mechanism, an implementation of IO multiplexing in the Linux kernel.

[0051] Vsock: virtio-vsock channel, used for communication between virtual machines and the VMM that manages the virtual machines.

[0052] Security monitoring client: runs on the host machine.

[0053] At present, virtualization technology is widely used. The actual services provided to users are generally virtual machines running on physical host machines by cloud vendors. Due to the isolation of virtualization technology, the information between the host and the virtual machine is not transparent. In this case, it is necessary to conduct security monitoring inside the virtual machine to ensure the data security of the company and users.

[0054] The following two points need to be considered when monitoring the virtual machine kernel. The first is how to run a given monitoring program inside the virtual machine, and the second is how to transmit the generated monitoring data to the security monitoring client located in the host machine in a timely and efficient manner. The operation of the monitoring program can be achieved by adding a kernel monitoring module inside the virtual machine and running the monitoring program configured in the monitoring module. However, once the monitoring program configured in the kernel monitoring module is set, it can only perform one monitoring task and cannot be dynamically adjusted at any time, which is not flexible and universal. In addition, the eBPF program can also be used to monitor the virtual machine kernel, but the operating system needs to reserve an interface for installing the eBPF program and configure a user-mode client inside the virtual machine. On the one hand, this leads to the risk of the virtual machine being attacked, and on the other hand, a new process is added inside the virtual machine, which increases the complexity of the architecture and is not conducive to subsequent technological evolution.

[0055] In view of this, the embodiment of this specification proposes a virtual machine kernel monitoring method, which uses the eBPF program as a monitoring program to monitor the virtual machine kernel configured with a Linux operating system. The VMM encapsulates each system call instruction in the eBPF program into a system call message and sends it from the outside of the virtual machine to the virtual machine kernel. The virtual machine kernel mounts the received system call instruction on the target function to provide a monitoring environment for the generation of monitoring data. By converting the eBPF program into a system call instruction executable by the virtual machine kernel and importing it from the outside of the virtual machine, on the one hand, it helps to improve the security of the virtual machine operating environment, and on the other hand, it can modify the system call instructions in the eBPF program to complete different monitoring tasks, thereby having flexibility and versatility.

[0056] Next, the embodiments of this specification are described in detail.

[0057] like Figure 1 As shown, Figure 1 This is an interactive schematic diagram of a virtual machine kernel monitoring method according to an exemplary embodiment of the present specification, comprising the following steps:

[0058] Step 102, VMM 120 obtains the eBPF program;

[0059] In the process of monitoring the virtual machine kernel, there is also a security monitoring client installed on the host machine. The monitoring program can be issued by the security monitoring client, and the monitoring data generated during the monitoring process needs to be transmitted to the security monitoring client to judge the running state of the virtual machine kernel. In one embodiment of this specification, the eBPF program is sent to the VMM by the security monitoring client installed on the host machine.

[0060] Step 104, VMM 120 parses the eBPF program into at least one system call instruction;

[0061] Step 106, VMM 120 encapsulates each system call instruction into a corresponding system call message and sends it to the kernel 130 of the target virtual machine from the outside of the target virtual machine;

[0062] Step 108, the kernel 130 of the target virtual machine receives the system call message and mounts each system call instruction to the target function;

[0063] Step 110 , the kernel 130 of the target virtual machine executes the system call instruction when the target function is called, and returns the execution result to the VMM 120 .

[0064] The eBPF program runs in the virtual machine kernel, that is, the virtual machine kernel executes the various system call instructions contained in the eBPF program. Therefore, the embodiment of this specification can also achieve the monitoring task by sending the system call instructions in the eBPF program to the virtual machine kernel, and the virtual machine kernel executes the system call instructions. Before the various system call instructions in the eBPF are executed, the eBPF system call instructions need to be loaded and mounted in the virtual machine kernel.

[0065] eBPF programs can be written in C language and can be flexibly adjusted according to different monitoring tasks. Figure 2A The figure shows a schematic diagram for implementing the loading and mounting of an eBPF program into a virtual machine kernel, which generally includes the following operations: before loading into the virtual machine kernel, the eBPF program 210 needs to be compiled into an eBPF bytecode 220 using LLVM or Clang, and then the eBPF bytecode 220 is loaded into the virtual machine kernel through a BPF system call and a data storage area Map 240 is created for it; then the virtual machine kernel performs security verification on the eBPF bytecode 220, and after the verification passes, the eBPF bytecode 220 is compiled into an eBPF machine code 230, namely, an eBPF system call instruction, and finally each system call instruction in the eBPF program is mounted onto a specified hook function 250.

[0066] Among them, Program refers to various system call instructions in the eBPF program 210, and Map240 is used to store the execution results of various system call instructions in the eBPF program 210 after being executed and the data required when being executed. For example, if an instruction in the eBPF program 210 increases the count value by one each time it is run, then the current count value is stored in Map240 after each run, and the current count value is increased by one based on the next run. User 260 can also access Map240 and read the data therein. After the eBPF program is successfully loaded in the virtual machine kernel, the corresponding file descriptor (fd) will be automatically assigned to Map240 and Program. The file descriptor is used as the identifier of Map and Program, and is used as a function parameter when it is necessary to add, delete, check or modify the data in the Map or the code corresponding to the Program. For example, the file descriptor of Map can be used as a parameter of the read() function to view the data stored in Map240. The mounted hook function 250 is the object monitored by the eBPF program 210. When the hook function is called, the system call instruction in the eBPF program 210 mounted thereon is executed, the relevant data generated when the hook function 250 is called is monitored, and the monitored data is stored for subsequent feedback to the security monitoring client.

[0067] In summary, eBPF programs need to go through the processes of loading, verification, compilation, and mounting before running. This can be achieved by writing relevant programs in the virtual machine kernel, but it also has the disadvantages of increasing the virtual machine kernel process and increasing the complexity of the virtual machine architecture.

[0068] like Figure 2BThe figure shows a schematic diagram of loading and mounting the system call instruction in the eBPF program to the virtual machine kernel according to an embodiment of the present specification. In the embodiment of the present specification, the process of loading and mounting the system call instruction in the eBPF program to the virtual machine kernel basically follows the above process. The difference is that before loading, the VMM performs security verification on the eBPF program 210 and compiles it into eBPF machine code 230 to obtain the eBPF system call instruction. Then, the VMM encapsulates each system call instruction into a system message and sends it to the virtual machine kernel. After receiving the system message, the virtual machine kernel mounts the eBPF system call instruction to the hook function. In order to enable the VMM to have the function of compiling the eBPF program, as an embodiment, the libbpf library can be integrated into the VMM, and the libbpf library can be modified to adapt it to the VMM and output the system call event corresponding to the instruction obtained after compilation. It should be noted that it does not exclude the technical personnel in the field from realizing this function by other technical means. The method of sending the system call event corresponding to the execution instruction by the VMM is adopted to realize the loading of the eBPF program in the virtual machine kernel, and there is no need to configure the corresponding program in the virtual machine kernel, which helps to improve the efficiency of loading the eBPF program.

[0069] There are many ways for the VMM to communicate with the kernel of the virtual machine. Any network communication method can be used for communication, and the system call event can be encapsulated according to the corresponding communication protocol. For example, communication can be achieved through a dedicated vsock channel between the VMM and the kernel of the virtual machine. In one embodiment of the present specification, the VMM establishes a vsock channel with the kernel of the target virtual machine, and the vsock channel is used for communication between the VMM and the kernel of the target virtual machine.

[0070] After receiving the system call message sent by the VMM, the kernel of the target virtual machine mounts the system call instruction encapsulated in the system message to the hook function (target function) specified in the kernel of the virtual machine. In one embodiment of this specification, after the mounting is successful, the kernel of the target virtual machine returns the file descriptors of the Map segment and Program segment of the eBPF program to the VMM.

[0071] When the target function is called, the virtual machine executes the instructions mounted on it and captures the data generated when the target function is called. The captured data is the monitoring data. The monitoring data can be stored in the Map, but the monitoring data stored in the Map requires the user to actively access and filter it before it can be read, which is not conducive to the monitoring data being fed back to the security monitoring client in an instant and efficient manner. In view of this, an embodiment of the present specification creates a dedicated storage area for monitoring data and creates a notification mechanism for sending notifications when monitoring data is generated to improve the transmission efficiency of obtaining monitoring data. In one embodiment of the present specification, before executing a system call instruction, the VMM encapsulates the system call events used to create a buffer and create a notification mechanism into a corresponding system call message, and sends it from the outside of the target virtual machine to the kernel of the target virtual machine; the buffer is used to store the monitoring data generated when the system call instruction is executed, and the notification mechanism is used to send a notification to the VMM after detecting that the monitoring data has been generated.

[0072] It should be noted that the operation required to create a buffer for storing the monitoring data is not limited to creating a buffer, but also requires providing a method for writing the monitoring data into the buffer so that the virtual machine can store the monitoring data in the provided manner when executing each system call instruction in the eBPF program. That is to say, the instructions corresponding to the storage of the monitoring data in the eBPF program need to be written according to the specific storage method. In addition, in addition to using tools with monitoring and notification functions, the creation of the notification mechanism also requires providing the monitored object. The storage of monitoring data and the notification of the generation of monitoring data can be realized respectively by the perf tool and the epoll instance. In another embodiment of the present specification, the kernel of the target virtual machine receives the system call event for creating a buffer and creating a notification mechanism and encapsulates it into a corresponding system call message, and the steps performed include: creating a perf event and an epoll instance; allocating a corresponding buffer for the perf event; writing the file descriptor of the perf event into the Map of the eBPF program, so that when executing the system call instruction, the generated monitoring data is stored in the buffer corresponding to the perf event by calling the file descriptor of the perf event; writing the file descriptor of the perf event into the epoll instance, so as to notify the VMM of the file descriptor of the called perf event through the epoll instance.

[0073] There is at least one CPU on a virtual machine, and any CPU can call the target function of the kernel mounted with various instructions in the eBPF program during operation. In this case, the user needs to distinguish which CPU the monitoring data is generated from, which can be achieved by binding a perf event to each CPU respectively, and creating a perf event according to the number of CPUs in the virtual machine. In another embodiment of the present specification, the number of CPUs of the target virtual machine is at least one, and each CPU is bound to a perf event. When the virtual machine successfully creates a perf event and an epoll instance, it will automatically allocate file descriptors for the two, and return the file descriptor and the address of the buffer allocated by each perf event to the VMM. It should be noted that the address of the buffer here is the physical address (Guest Physical Address, GPA) on the virtual machine.

[0074] The file descriptor of the perf event is written into the Map field of the eBPF program so that the virtual machine can obtain the fd of the perf event from the Map when executing the instruction to store monitoring data in the eBPF program to write the monitoring data in the corresponding buffer. It should be noted that if the monitoring data is stored in the above manner, the instructions corresponding to the above output method need to be written in the eBPF program, that is, the instructions for storing monitoring data in the eBPF program obtained in step 102 are written according to the method of storing the monitoring data in the data buffer corresponding to the perf event.

[0075] The file descriptor of the perf event is written into the epoll instance in order to use the perf event as the detection object of epoll. Once the file descriptor of the perf event is called, epoll will know that the buffer corresponding to the perf event has written data. Thus, the generation of monitoring data can be known without the user frequently accessing the storage area of ​​the monitoring data. However, epoll will not actively notify the VMM after detecting the generation of monitoring data, and will only notify after the user sends a message to it. In one embodiment of the present application, the VMM packages the system call corresponding to the wait instruction into a system call message and sends it to the virtual machine kernel. After receiving the instruction, the epoll instance returns the file descriptor of the perf event that generates monitoring data within a preset time period to the VMM, for example, the file descriptor of the perf event that generates monitoring data within 5 minutes from the receipt of the wait instruction is returned to the VMM.

[0076] VMM is a device that creates and allocates computer resources to virtual machines, and stores the mapping relationship between the virtual machine physical address (GPA) and the host virtual address (HVA). That is to say, after obtaining the file descriptor of the perf event that stores the monitoring data, VMM can obtain the HVA address of the buffer corresponding to the perf event through the mapping relationship between the stored GPA and HVA, thereby directly accessing the HVA address to obtain the monitoring data. In one embodiment of the present specification, the monitoring data is obtained by the VMM directly accessing the HVA address of the buffer and then sending it to the security monitoring client. This can overcome the disadvantages of adding an agent client inside the virtual machine to send monitoring data from the inside of the virtual machine to the monitoring client, which increases the complexity of the architecture and increases the virtual machine process.

[0077] Next, the virtual machine kernel monitoring method proposed in the embodiment of this specification is described through another embodiment (such as Figure 3 As shown), all instructions executed by the virtual machine kernel are sent to the virtual machine kernel via the vsock channel by VMM340 by encapsulating the corresponding system call events into system call messages.

[0078] Step 301, VMM 340 establishes a vsock channel with the virtual machine kernel 350;

[0079] Step 302, the security monitoring client 330 sends the eBPF program to the VMM 340;

[0080] Step 303, VMM 340 parses the eBPF program into a number of system call instructions;

[0081] Step 304, VMM 340 encapsulates the parsed system call instructions into a system call message and sends it to the virtual machine kernel 350;

[0082] Step 305, the virtual machine kernel 350 mounts the received system call instructions to the specified hook function and returns the file descriptors of the Map segment and the Program segment to the VMM 340;

[0083] Step 306, VMM 340 returns the received Map segment and Program segment information to the security monitoring client 330 for backup;

[0084] Step 307, VMM 340 sends a system call message to the virtual machine kernel 350, which includes instructions: create a perf event according to the number of CPUs;

[0085] Step 308, the virtual machine kernel 350 returns the file descriptors of each perf event to the VMM 340 after executing the received instructions;

[0086] Step 309 , VMM 340 sends a system call message to virtual machine kernel 350 , which includes instructions: allocate a buffer address for each perf event;

[0087] Step 310, after executing the received instruction, the virtual machine kernel 350 returns the GPA address of the buffer corresponding to each perf event to the VMM 340;

[0088] Step 311, VMM 340 sends a system call message to the virtual machine kernel 350, which includes instructions: create an epoll instance;

[0089] Step 312, the virtual machine kernel 350 executes the received instruction and returns the file descriptor of the epoll instance to the VMM 340;

[0090] Step 313, VMM 340 sends a system call message to the virtual machine kernel 350, which includes instructions: write the file descriptor of each perf event into the Map and epoll instance;

[0091] Step 314, VMM 340 sends a system call message to the virtual machine kernel 350, which includes instructions: epoll instance wait instruction;

[0092] Step 315, after the designated hook function is called, monitoring data is generated, and the virtual machine kernel 350 stores the monitoring data in a buffer corresponding to the corresponding perf event and sends the file descriptor of the perf event storing the monitoring data to the VMM 340 through the epoll instance;

[0093] Step 316 , the VMM 340 obtains the HVA address of the buffer corresponding to the received perf event according to the stored memory mapping relationship, accesses the HVA address to read the monitoring data, and sends it to the security monitoring client 330 .

[0094] like Figure 4A As shown, corresponding to the above method embodiment, the embodiment of this specification also provides a virtual machine kernel monitoring method, which is applied to VMM, including:

[0095] Step 401, obtain the eBPF program;

[0096] Step 403, parsing the eBPF program into at least one system call instruction;

[0097] Step 405, encapsulating each system call instruction into a corresponding system call message and sending it from the outside of the target virtual machine to the kernel of the target virtual machine;

[0098] Step 407: Receive the execution result corresponding to the system call instruction returned by the kernel of the target virtual machine.

[0099] In some embodiments of the present specification, the VMM is also used to encapsulate the system call events used to create a buffer and a notification mechanism into corresponding system call messages, and then send them from the outside of the target virtual machine to the kernel of the target virtual machine; the buffer is used to store the monitoring data generated when the system call instructions are executed, and the notification mechanism is used to send a notification to the VMM after detecting the generation of the monitoring data.

[0100] In some embodiments of the present specification, the VMM is further configured to establish a vsock channel with the kernel of the target virtual machine, and communicate with the kernel of the virtual machine through the vsock channel.

[0101] In some embodiments of the present specification, the VMM is further configured to obtain monitoring data after accessing the HVA address of the buffer.

[0102] In addition, if Figure 4B As shown, the embodiment of this specification also provides a virtual machine kernel monitoring method, which is applied to the virtual machine kernel, including:

[0103] Step 402, receiving a system call message sent by the VMM, wherein the system call message encapsulates at least one system call instruction in the eBPF program;

[0104] Step 404, mount each system call instruction to the target function;

[0105] Step 406: Execute the system call instruction when the target function is called, and return the execution result to the VMM.

[0106] In some embodiments of the present specification, the virtual machine kernel is further configured to receive a system call event for creating a buffer and a notification mechanism and encapsulate it into a corresponding system call message and then execute the following steps:

[0107] Create perf events and epoll instances; allocate corresponding buffers for perf events;

[0108] Writing the file descriptor of the perf event into the Map of the eBPF program, so that when the system call instruction is executed, the generated monitoring data is stored in the buffer corresponding to the perf event by calling the file descriptor of the perf event;

[0109] The file descriptor of the perf event is written into the epoll instance, so as to notify the VMM of the file descriptor of the perf event being called through the epoll instance; wherein the buffer is used to store the monitoring data generated when the system call instruction is executed, and the notification mechanism is used to send a notification to the VMM after detecting the generation of the monitoring data.

[0110] In some embodiments of the present specification, the virtual machine kernel is also used to establish a vsock channel with the VMM.

[0111] Corresponding to the embodiments of the aforementioned method, this specification also provides embodiments of a device and a terminal to which it is applied.

[0112] The embodiments of the virtual machine kernel monitoring device in this specification can be applied to electronic devices. The device embodiments can be implemented by software, hardware, or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor in which the security protection is located to read the corresponding computer program instructions in the non-volatile memory into the memory and run it. From the hardware level, if Figure 5 The figure is a hardware structure diagram of the electronic device where the safety protection device of the embodiment of this specification is located, except Figure 5 In addition to the processor 510, memory 530, network interface 520, and non-volatile memory 540 shown, the electronic device where the device 531 is located in the embodiment may also include other hardware according to the actual function of the electronic device, which will not be described in detail.

[0113] like Fig. 6A As shown, Fig. 6A This is a block diagram of a virtual machine kernel monitoring device for a VMM according to an exemplary embodiment of the present specification, the device comprising:

[0114] An acquisition module 610 is used to acquire an eBPF program;

[0115] A parsing module 620, configured to parse the eBPF program into at least one system call instruction;

[0116] A first sending module 630, configured to encapsulate each of the system call instructions into a corresponding system call message and then send the message from the outside of the target virtual machine to the kernel of the target virtual machine;

[0117] The first receiving module 640 is used to receive the execution result corresponding to the system call instruction returned by the kernel of the target virtual machine.

[0118] like Figure 6B As shown, Figure 6BThis is a block diagram of a virtual machine kernel monitoring device for a virtual machine kernel according to an exemplary embodiment of the present specification, the device comprising:

[0119] A second receiving module 650 is used to receive a system call message sent by the VMM, wherein the system call message encapsulates at least one system call instruction in the eBPF program;

[0120] A mounting module 660, used for mounting each of the system call instructions to a target function;

[0121] An execution module 670, configured to execute the system call instruction when the target function is called;

[0122] The second sending module 680 is used to return the execution result to the VMM.

[0123] The implementation process of the functions and effects of each module in the above modules is specifically described in the implementation process of the corresponding steps in the above method, which will not be repeated here.

[0124] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. A person of ordinary skill in the art can understand and implement it without paying creative labor.

[0125] Accordingly, this specification also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in any of the above method embodiments when executing the program. This specification also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program is used to instruct related hardware to complete the method described in any of the above method embodiments.

[0126] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0127] Those skilled in the art will readily appreciate other embodiments of the specification after considering the specification and practicing the inventions claimed herein. The specification is intended to cover any variations, uses, or adaptations of the specification that follow the general principles of the specification and include common knowledge or customary techniques in the art that are not claimed in the specification. The specification and examples are to be considered exemplary only, and the true scope and spirit of the specification are indicated by the claims.

[0128] It should be understood that the present description is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present description is limited only by the appended claims.

[0129] The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims

1. A virtual machine kernel monitoring method, the method comprising: The VMM obtains the eBPF program, parses the eBPF program into at least one system call instruction, encapsulates the eBPF program into a corresponding system call message, and sends the message to the kernel of the target virtual machine from the outside of the target virtual machine; The kernel of the target virtual machine receives the system call message, mounts each of the system call instructions to the target function, executes the system call instruction when the target function is called, and returns the execution result to the VMM.

2. The method according to claim 1, before executing the system call instruction, the method further comprises: The VMM encapsulates the system call events for creating a buffer and a notification mechanism into corresponding system call messages, and sends the messages from the outside of the target virtual machine to the kernel of the target virtual machine; The buffer is used to store monitoring data generated when the system call instruction is executed, and the notification mechanism is used to send a notification to the VMM after detecting that the monitoring data is generated.

3. According to the method of claim 2, the steps performed after the kernel of the target virtual machine receives the system call event for creating a buffer and a notification mechanism and encapsulates it into a corresponding system call message include: Create perf events and epoll instances; Allocate a corresponding buffer for the perf event; Writing the file descriptor of the perf event into the Map of the eBPF program, so that when the system call instruction is executed, the generated monitoring data is stored in the buffer corresponding to the perf event by calling the file descriptor of the perf event; The file descriptor of the perf event is written into the epoll instance, so as to notify the VMM of the file descriptor of the perf event being called through the epoll instance.

4. According to the method of claim 3, the number of CPUs of the target virtual machine is at least one, and each of the CPUs is bound to one perf event.

5. The method according to claim 1, further comprising: The VMM establishes a vsock channel with the kernel of the target virtual machine, and the vsock channel is used for communication between the VMM and the kernel of the target virtual machine.

6. The method according to claim 2, further comprising: The VMM obtains the monitoring data after accessing the HVA address of the buffer.

7. A virtual machine kernel monitoring method, applied to a VMM, the method comprising: Get the eBPF program; Parsing the eBPF program into at least one system call instruction; Encapsulating each of the system call instructions into a corresponding system call message and sending the message to the kernel of the target virtual machine from the outside of the target virtual machine; Receive an execution result corresponding to the system call instruction returned by the kernel of the target virtual machine.

8. A virtual machine kernel monitoring method, applied to a virtual machine kernel, the method comprising: Receive a system call message sent by the VMM, where the system call message encapsulates at least one system call instruction in the eBPF program; Each of the system call instructions is mounted to a target function, so that the system call instruction is executed when the target function is called, and the execution result is returned to the VMM.

9. A virtual machine kernel monitoring device, applied to a VMM, the device comprising: Get module, used to get eBPF program; A parsing module, configured to parse the eBPF program into at least one system call instruction; A first sending module, used for encapsulating each of the system call instructions into a corresponding system call message and sending the message to the kernel of the target virtual machine from the outside of the target virtual machine; The first receiving module is used to receive the execution result corresponding to the system call instruction returned by the kernel of the target virtual machine.

10. A virtual machine kernel monitoring device, applied to a virtual machine kernel, the device comprising: A second receiving module is used to receive a system call message sent by the VMM, wherein the system call message encapsulates at least one system call instruction in the eBPF program; A mounting module, used for mounting each of the system call instructions to a target function; An execution module, used for executing the system call instruction when the target function is called; The second sending module is used to return the execution result to the VMM.

11. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 8 is implemented.

12. A computer-readable storage medium storing a computer program, wherein the computer program is used to instruct related hardware to implement the method according to any one of claims 1 to 8.

Images