A virtual machine fault detection and recovery system and control method thereof

Abstract

The present invention provides a virtual machine fault detection and recovery system and a control method thereof, comprising a virtual machine root context module and a virtual machine execution context module; the virtual machine root context module saves the virtual machine state and memory management data before the fault occurs, and the virtual machine execution context module provides a temporary execution environment for the virtual machine and monitors the virtual machine's access to the memory; compared with the virtual machine snapshot technology, the method proposed by the present invention can more easily locate the task that triggers the client operating system fault and more quickly restore the virtual machine to a normal state, and at the same time can completely save the execution environment and memory data of the malicious program for subsequent analysis and prevention; and compared with the dual redundant hardware system, the present invention can detect errors and damages occurring on the memory, and can shield the damage of part of the memory without affecting the operation of the system, thereby improving the robustness and availability of the single system.

Description

Technical Field

[0001] The present invention relates to the technical field of virtual machine fault processing, and in particular to a virtual machine fault detection and recovery system and a control method thereof. Background Art

[0002] Virtual machine technology creates an environment between the computer platform and the end user. The end user can operate the corresponding software based on the environment created by this software, so that the end user can realize the corresponding software operation requirements by running the computer software program.

[0003] During the use of a virtual machine, it is inevitable that a malicious program will cause the client operating system to fail. The existing technology solves this problem by including virtual machine memory snapshot technology and dual redundant hardware system technology;

[0004] Virtual machine memory snapshot technology creates virtual machine snapshots by saving the data and status of the virtual machine during operation, and restores the operation of the virtual machine through the virtual machine snapshot. It can be used for virtual machine migration, fault recovery, quick startup, and releasing idle virtual machines to save memory. However, it cannot effectively locate the task that triggers the client operating system failure, nor can it completely save the execution environment and memory data of the malicious program, and cannot provide an effective theoretical basis and guidance for subsequent analysis and prevention;

[0005] Dual redundant hardware system technology achieves high reliability and fault recovery capabilities by integrating multiple redundant hardware in the same system, which requires the implementation of hardware self-check programs, multi-processor arbitrators, clock synchronization technology, etc. However, this solution cannot detect errors and damages that occur on the memory, nor can it shield memory damage.

[0006] Therefore, there is an urgent need to provide a virtual machine fault detection and recovery system and a control method thereof to solve the defects and shortcomings in the above-mentioned prior art. Summary of the invention

[0007] In order to solve the defects and shortcomings in the prior art, the present invention provides a virtual machine fault detection and recovery system and a control method thereof.

[0008] The specific scheme provided by the present invention is:

[0009] A virtual machine fault detection system, characterized in that: the virtual machine fault detection system includes a virtual machine management system, the virtual machine management system includes a virtual machine root context module and a virtual machine execution context module; the virtual machine root context module saves the virtual machine state and memory management data before the fault occurs, the virtual machine execution context module provides a temporary execution environment for the virtual machine, and monitors the virtual machine's access to the memory; wherein,

[0010] The virtual machine root context module includes:

[0011] A virtual machine CPU register state root unit, wherein the virtual machine CPU register state unit stores the CPU registers of the virtual machine;

[0012] A virtual machine memory mapping state root unit, wherein the virtual machine memory mapping state root unit stores a mapping relationship between a virtual machine memory address and a physical memory and access attributes;

[0013] A physical memory ECC check code root unit, wherein the physical memory ECC check code root unit stores ECC check codes of all physical memory pages used by the virtual machine;

[0014] An immutable memory region information table, wherein the immutable memory region information table stores immutable memory regions explicitly declared when the virtual machine is running;

[0015] The virtual machine execution context module includes:

[0016] A virtual machine CPU register state execution unit, wherein the data stored in the virtual machine CPU register state execution unit is the same as the data in the virtual machine CPU register state root unit at the initialization and reset time;

[0017] A virtual machine memory mapping state execution unit, at the initialization and reset, the data stored in the virtual machine memory mapping state execution unit is consistent with the data of the virtual machine memory mapping state root unit, but all mapping relationships within it are set to be inaccessible, and a trap is triggered when the client operating system accesses the memory, and the virtual machine management system records the access information and updates the corresponding memory access attributes;

[0018] A physical memory ECC check code execution unit, when initially and when reset, the data stored in the physical memory ECC check code execution unit is the same as the data in the physical memory ECC check code root unit, and serves as a backup of the ECC check code in the physical memory ECC check code root unit;

[0019] Memory access information table, the memory access information table records the memory area where only read access or write access occurs.

[0020] Furthermore, the present invention also provides a control method for a virtual machine fault detection system, which is characterized by comprising the following steps:

[0021] S1: modify the client operating system code, call the virtual machine root context module creation interface of the virtual machine management system after the system is started, and call the virtual machine anomaly detection interface of the virtual machine management system at the task switching code;

[0022] S2: The virtual machine management system creates a virtual machine and loads the image of the client operating system into the memory of the virtual machine, then starts the virtual machine, and the virtual machine starts to execute the code of the client operating system; when the client operating system executes to the system startup is completed, it calls the virtual machine root context module creation interface, at which time the CPU will be trapped, and then jump to the virtual machine root context module creation interface of the client operating system to start execution;

[0023] S3: The virtual machine root context module creation interface of the virtual machine management system will create a virtual machine root context data structure, and save the CPU register state and memory mapping relationship and access attributes of the current virtual machine to the virtual machine root context module, and at the same time calculate the ECC check code of each physical memory page of the memory belonging to the virtual machine, and save the ECC check code to the virtual machine root context module, then the virtual machine management system creates a virtual machine execution context module corresponding to the virtual machine root context module;

[0024] S4: The virtual machine management system resumes the execution of the virtual machine in the virtual machine execution context module, and the virtual machine continues to execute the code of the client operating system;

[0025] S5: Detect whether a fault occurs during the operation of the client operating system and notify the virtual machine management system through a fault notification interface of the virtual machine management system;

[0026] S6: When the client operating system runs to the task switching code, the virtual machine management system detects it through the virtual machine anomaly detection interface:

[0027] The virtual machine management system first detects whether the memory that has only been read by the client operating system has any memory particle damage failure:

[0028] The virtual machine management system then checks whether a memory out-of-bounds access fault occurs in the memory that has only been written by the client operating system;

[0029] And determine the subsequent corresponding operations according to the corresponding detection results;

[0030] S7: When the virtual machine management system detects neither a memory particle corruption fault nor a memory out-of-bounds access fault, the virtual machine management system completes data synchronization from the virtual machine execution context module to the virtual machine root context module;

[0031] S8: The virtual machine management system resets the virtual machine execution context module according to the virtual machine root context module;

[0032] S9: The virtual machine management system will restore the virtual machine from the virtual machine execution context module again and continue to execute the code of the client operating system.

[0033] As a further preferred implementation of the present invention, in step S1, when the client operating system executes the two interface calls, the CPU will switch from a low privilege level to a high privilege level and start executing the system call program corresponding to the virtual machine management system.

[0034] As a further preferred embodiment of the present invention, the step S5 includes the following steps:

[0035] S5.1: If the client operating system does not fail during operation, the client operating system calls the immutable memory declaration interface of the virtual machine management system during operation;

[0036] S5.2: If a client operating system fails during operation, it is determined that a malicious program caused the client operating system failure, and the malicious program failure handling process is entered: At this time, the following steps are included:

[0037] S5.21: The virtual machine management system creates a new virtual machine execution context module from the virtual machine root context module, and the virtual machine management system injects an abnormal malicious program into the new virtual machine execution context module;

[0038] S5.22: The virtual machine management system saves the original memory data information in the virtual machine execution context module when the failure occurs;

[0039] S5.23: The virtual machine management system resumes the execution of the client operating system from the new virtual machine execution context module. At this time, the client operating system enters the malicious program exception handler, and the client operating system resets the malicious program that caused the exception.

[0040] S5.24: After the client operating system completes the exception handling, it exits from the exception handling program, and task scheduling is triggered.

[0041] As a further preferred embodiment of the present invention, step S6 includes the following steps:

[0042] When the virtual machine management system detects whether a memory particle damage fault occurs in the memory that has only been read by the client operating system, it calculates whether the ECC check code of the memory area read and accessed by the client operating system is the same as the ECC check code corresponding to the memory area in the virtual machine root context module. If they are the same, it is determined that no memory particle damage fault occurs; if they are different, it is determined that a memory particle damage fault occurs;

[0043] When the virtual machine management system detects whether a memory out-of-bounds access fault occurs in the memory that has only been written by the client operating system, it calculates whether the memory area that has been written and accessed by the client operating system has been marked by the immutable memory area information table in the virtual machine root context module. If it has not been marked, it is determined that no memory out-of-bounds access fault has occurred; if it has been marked, it is determined that a memory out-of-bounds access fault has occurred.

[0044] As a further preferred embodiment of the present invention, in step S6,

[0045] When the virtual machine management system detects neither a memory particle corruption fault nor a memory out-of-bounds access fault, the virtual machine management system synchronizes the corresponding data in the virtual machine execution context module to the virtual machine root context module;

[0046] When the virtual machine management system detects a memory particle damage fault, the virtual machine management system enters the memory particle damage fault recovery process;

[0047] When the virtual machine management system detects a memory out-of-bounds access fault, the virtual machine management system first determines whether the fault is caused by a malicious program, and if so, enters the malicious program fault handling process.

[0048] As a further preferred embodiment of the present invention,

[0049] In step S6, the memory chip damage failure recovery process includes:

[0050] The virtual machine management system records the memory area information read and accessed by the client operating system into the memory access information table in the virtual machine execution context module;

[0051] The virtual machine management system compares the memory area read by the guest operating system with the access attributes of the same memory area in the virtual machine root context module:

[0052] If it is readable, then the memory attribute in the virtual machine execution context module is synchronously set to readable;

[0053] If it is unreadable, a client operating system failure is triggered and the client operating system failure handling process is entered.

[0054] As a further preferred embodiment of the present invention,

[0055] In step S6, the malicious program fault handling process includes:

[0056] The virtual machine management system records the memory area information accessed by the client operating system into the memory access information table in the virtual machine execution context module;

[0057] The virtual machine management system allocates new memory and maps the new memory to the accessed area;

[0058] The virtual machine management system copies the memory data corresponding to the accessed area in the memory mapping relationship of the virtual machine root context module to the newly allocated memory;

[0059] The virtual machine management system compares the memory area that is write-accessed by the guest operating system with the access attributes of the same memory area in the virtual machine's root context module:

[0060] If it is writable, then the memory attribute in the virtual machine execution context module is synchronously set to be writable;

[0061] If it is not writable, a client operating system failure is triggered and the client operating system failure handling process is entered.

[0062] As a further preferred embodiment of the present invention,

[0063] The virtual machine management system synchronizes the corresponding data in the virtual machine execution context module to the virtual machine root context module, including the following steps:

[0064] The virtual machine management system synchronizes the CPU register state in the virtual machine CPU register state execution unit in the virtual machine execution context module to the virtual machine CPU register state root unit in the virtual machine root context module;

[0065] The virtual machine management system maps the written memory area in the virtual machine root context module to the physical memory corresponding to the area in the virtual machine execution context module, and then releases the original physical memory of the area in the virtual machine root context module;

[0066] The virtual machine management system recalculates the ECC check code of the updated memory area in the virtual machine root context module, and updates the ECC check code to the physical memory ECC check code root unit in the virtual machine root context module.

[0067] As a further preferred embodiment of the present invention, the virtual machine management system resets the virtual machine execution context module according to the virtual machine root context module, including the following steps:

[0068] The virtual machine management system copies the CPU register state in the virtual machine CPU register state root unit from the virtual machine root context module to the virtual machine CPU register state execution unit in the virtual machine execution context module;

[0069] The virtual machine management system resets all memory mapping relationships in the virtual machine execution context module to inaccessible attributes;

[0070] The virtual machine management system copies the data in the physical memory ECC check code root unit from the virtual machine root context module and saves it to the physical memory ECC check code execution unit in the virtual machine execution context module;

[0071] The virtual machine management system resets all memory access information tables to an initial value of zero.

[0072] Compared with the prior art, the present invention can achieve the following technical effects:

[0073] 1) The present invention provides a virtual machine fault detection and recovery system and a control method thereof. When a malicious program in a virtual machine causes a client operating system to fail, the virtual machine management system can notify the client operating system to terminate the execution of the malicious program, save the memory dump file of the malicious program, and quickly restore the virtual machine to a normal state before the failure occurs.

[0074] 2) The present invention provides a virtual machine fault detection and recovery system and a control method thereof. When a client operating system fails due to damage to some memory particles, the virtual machine management system can detect the damaged memory area, then allocate undamaged memory to the virtual machine for use, and quickly restore the virtual machine to a normal state before the failure occurs.

[0075] 3) The present invention provides a virtual machine fault detection and recovery system and a control method thereof, which are used to recover client operating system faults caused by malicious programs and client operating system faults caused by damage to some memory particles. The present invention modifies the client operating system code, calls the virtual machine root context module creation interface after startup, calls the fault detection interface before task switching, and calls the immutable memory setting interface during runtime; when the client operating system executes the interface call code, it triggers an exception trap and jumps to the virtual machine management system code execution, the virtual machine management system implements the functions of each interface, and performs fault detection and recovery operations.

[0076] 4) The present invention provides a virtual machine fault detection and recovery system and a control method thereof. Compared with the virtual machine snapshot technology, the method proposed by the present invention can more easily locate the task that triggers the client operating system failure and restore the virtual machine to a normal state more quickly, and at the same time can completely save the execution environment and memory data of the malicious program for subsequent analysis and prevention; and compared with the dual redundant hardware system, the present invention can detect errors and damage occurring in the memory, and can shield the damage of part of the memory without affecting the operation of the system, thereby improving the robustness and availability of the single system. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] Figure 1 Shown is a schematic diagram of the logical structure of the system provided by the present invention.

[0078] Figure 2 Shown is a flow chart of the steps of the method provided by the present invention.

[0079] Figure 3 Shown is a flow chart of step S6 of the method provided by the present invention.

[0080] Figure 4 The figure shows a flow chart of the synchronization process in step S7 of the method provided by the present invention.

[0081] Figure 5 Shown is a flowchart of the reset process in step S8 of the method provided by the present invention. DETAILED DESCRIPTION

[0082] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0083] In the description of the present invention, it should be noted that the terms "upper", "lower", "inner", "outer", "front end", "rear end", "two ends", "one end", "the other end" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance.

[0084] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "provided with", "connected", etc. should be understood in a broad sense. For example, "connected" can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0085] [First embodiment]

[0086] like Figure 1The first embodiment provided by the present invention is shown, and the embodiment provides a virtual machine fault detection and recovery system. The virtual machine fault detection system includes a virtual machine management system. The virtual machine management system Hypervisor is a program that runs directly on computer hardware, and the program can create and manage virtual machines. The virtual machine GuestVM is a hardware context created by the virtual machine management system. The context consists of a set of hardware registers and virtual machine state data. The virtual machine management system can set the execution environment of the client operating system by restoring the context to the hardware registers. The client operating system GuestOS is an operating system program running in the virtual machine. The client application Task is a program running in the client operating system.

[0087] In this embodiment,

[0088] The virtual machine management system includes a virtual machine root context module and a virtual machine execution context module; wherein,

[0089] The virtual machine root context module saves the virtual machine state and memory management data before the failure occurs; the virtual machine root context module includes:

[0090] A virtual machine CPU register state root unit, the virtual machine CPU register state unit stores the CPU registers of the virtual machine;

[0091] A virtual machine memory mapping state root unit, which stores the mapping relationship between the virtual machine memory address and the physical memory and the access attributes;

[0092] A physical memory ECC check code root unit, which stores the ECC check codes of all physical memory pages used by the virtual machine;

[0093] An immutable memory region information table, which stores immutable memory regions explicitly declared when the virtual machine is running;

[0094] The virtual machine execution context module provides a temporary execution environment for the virtual machine and monitors the virtual machine's access to memory; the virtual machine execution context module includes:

[0095] The virtual machine CPU register state execution unit, when initially and when reset, the data stored in the virtual machine CPU register state execution unit is the same as the data in the virtual machine CPU register state root unit;

[0096] The virtual machine memory mapping state execution unit, at the initialization and reset, the data saved by the virtual machine memory mapping state execution unit is consistent with the data of the virtual machine memory mapping state root unit, but all its internal mapping relationships are set to be inaccessible. When the client operating system accesses the memory, it will trigger a trap, and the virtual machine management system records the access information and updates the corresponding memory access attributes;

[0097] Physical memory ECC check code execution unit. When it is initialized and reset, the data saved in the physical memory ECC check code execution unit is the same as the data in the physical memory ECC check code root unit, and it is used as a backup of the ECC check code in the physical memory ECC check code root unit in fault monitoring.

[0098] The memory access information table records the memory areas where only read access or write access has occurred, and will be used in the fault monitoring of memory failure and client operating system.

[0099] [Second embodiment]

[0100] like Figure 2 The second embodiment provided by the present invention is shown, and this embodiment provides a control method of the virtual machine fault detection and recovery system mentioned in the first embodiment, comprising the following steps:

[0101] S1: Modify the client operating system code, call the virtual machine root context module of the virtual machine management system to create an interface after the system is started, and call the virtual machine abnormality detection interface of the virtual machine management system at the task switching code; when the client operating system executes these two interface calls, the CPU will switch from a low privilege level to a high privilege level and start executing the system call program corresponding to the virtual machine management system to ensure that the two interface calls have high priority;

[0102] S2: The virtual machine management system creates a virtual machine and loads the image of the client operating system into the memory of the virtual machine, then starts the virtual machine, and the virtual machine starts to execute the code of the client operating system; when the client operating system executes to the system startup is completed, it calls the virtual machine root context module creation interface, at which time the CPU will be trapped, and then jump to the virtual machine root context module creation interface of the client operating system to start execution;

[0103] S3: The virtual machine root context module creation interface of the virtual machine management system will create a virtual machine root context data structure, and save the CPU register state and memory mapping relationship and access attributes of the current virtual machine to the virtual machine root context module, and at the same time calculate the ECC check code of each physical memory page of the memory belonging to the virtual machine, and save the ECC check code to the virtual machine root context module, then the virtual machine management system creates a virtual machine execution context module corresponding to the virtual machine root context module;

[0104] S4: The virtual machine management system resumes the execution of the virtual machine in the virtual machine execution context module, and the virtual machine continues to execute the code of the client operating system;

[0105] S5: Detect whether a fault occurs during the operation of the client operating system and notify the virtual machine management system through the fault notification interface of the virtual machine management system; the specific steps include:

[0106] S5.1: If the client operating system does not fail during operation, the client operating system calls the immutable memory declaration interface of the virtual machine management system during operation; it is worth noting that this is not necessary, and the code in the client operating system can decide whether it is necessary to declare an immutable memory area. Once an immutable area is declared, the data in the area can no longer be modified, otherwise it will cause the client operating system to fail;

[0107] S5.2: If a client operating system fails during operation, it is determined that a malicious program caused the client operating system failure, and the malicious program failure handling process is entered: At this time, the following steps are included:

[0108] S5.21: The virtual machine management system creates a new virtual machine execution context module from the virtual machine root context module, and the virtual machine management system injects an abnormal malicious program into the new virtual machine execution context module;

[0109] S5.22: The virtual machine management system saves the original memory data information in the virtual machine execution context module when the failure occurs, and the saved information can be used for subsequent malicious program analysis;

[0110] S5.23: The virtual machine management system resumes the execution of the client operating system from the new virtual machine execution context module. At this time, the client operating system enters the malicious program exception handler, and the client operating system resets the malicious program that caused the exception.

[0111] S5.24: After the client operating system completes the exception handling, it exits from the exception handling program, and task scheduling is triggered.

[0112] S6: When the client operating system runs to the task switching code, the virtual machine management system detects through the virtual machine anomaly detection interface: Figure 3 As shown,

[0113] The virtual machine management system first detects whether a memory particle damage fault occurs in the memory that has only been read by the client operating system: When the virtual machine management system detects whether a memory particle damage fault occurs in the memory that has only been read by the client operating system, it calculates whether the ECC check code of the memory area read and accessed by the client operating system is the same as the ECC check code corresponding to the memory area in the virtual machine root context module. If they are the same, it is determined that no memory particle damage fault occurs; if they are different, it is determined that a memory particle damage fault occurs;

[0114] The virtual machine management system then detects whether a memory out-of-bounds access fault occurs in the memory that has only been written by the client operating system; when the virtual machine management system detects whether a memory out-of-bounds access fault occurs in the memory that has only been written by the client operating system, it calculates whether the memory area that has been accessed by the client operating system has been marked by the immutable memory area information table in the virtual machine root context module. If it has not been marked, it is determined that no memory out-of-bounds access fault has occurred; if it has been marked, it is determined that a memory out-of-bounds access fault has occurred.

[0115] And determine the subsequent corresponding operations according to the corresponding test results:

[0116] When the virtual machine management system detects neither a memory particle corruption fault nor a memory out-of-bounds access fault, the virtual machine management system synchronizes the corresponding data in the virtual machine execution context module to the virtual machine root context module;

[0117] When the virtual machine management system detects a memory chip damage fault, the virtual machine management system enters the memory chip damage fault recovery process. The memory chip damage fault recovery process includes:

[0118] The virtual machine management system records the memory area information read and accessed by the client operating system into the memory access information table in the virtual machine execution context module;

[0119] The virtual machine management system compares the memory area read by the guest operating system with the access attributes of the same memory area in the virtual machine root context module:

[0120] If it is readable, then the memory attribute in the virtual machine execution context module is synchronously set to readable;

[0121] If it is unreadable, a client operating system failure is triggered and the client operating system failure handling process is entered.

[0122] When the virtual machine management system detects a memory out-of-bounds access fault, the virtual machine management system first determines whether the fault is caused by a malicious program. If so, the malicious program fault handling process is entered; the malicious program fault handling process includes:

[0123] The virtual machine management system records the memory area information accessed by the client operating system into the memory access information table in the virtual machine execution context module;

[0124] The virtual machine management system allocates new memory and maps the new memory to the accessed area;

[0125] The virtual machine management system copies the memory data corresponding to the accessed area in the memory mapping relationship of the virtual machine root context module to the newly allocated memory;

[0126] The virtual machine management system compares the memory area that is write-accessed by the guest operating system with the access attributes of the same memory area in the virtual machine's root context module:

[0127] If it is writable, then the memory attribute in the virtual machine execution context module is synchronously set to be writable;

[0128] If it is not writable, a client operating system failure is triggered and the client operating system failure handling process is entered.

[0129] S7: When the virtual machine management system detects neither a memory particle corruption fault nor a memory out-of-bounds access fault, the virtual machine management system completes data synchronization from the virtual machine execution context module to the virtual machine root context module;

[0130] It is worth noting that the anomaly detection mentioned in this embodiment is initiated by the client operating system at a specific location of the client operating system, but the actual fault detection is completed by the virtual machine management system. It is mainly the detection and fault handling of memory faults. In step S5: detect whether a fault occurs during the operation of the client operating system, and in step S6: the virtual machine management system detects whether a memory out-of-bounds access fault occurs in the memory that has only been written by the client operating system. These are faults caused by different reasons, but the same fault handling process can be used.

[0131] like Figure 4 As shown, in this embodiment, the virtual machine management system synchronizes the corresponding data in the virtual machine execution context module to the virtual machine root context module, including the following steps:

[0132] The virtual machine management system synchronizes the CPU register state in the virtual machine CPU register state execution unit in the virtual machine execution context module to the virtual machine CPU register state root unit in the virtual machine root context module;

[0133] The virtual machine management system maps the written memory area in the virtual machine root context module to the physical memory corresponding to the area in the virtual machine execution context module, and then releases the original physical memory of the area in the virtual machine root context module; this is because the virtual machine is running in the virtual machine execution context module, and the memory belonging to the virtual machine will be read and written during the operation. The virtual machine execution context module manages the memory during the operation of the virtual machine, and the memory updated during the operation needs to be synchronized to the virtual machine root context module;

[0134] The virtual machine management system recalculates the ECC check code of the updated memory area in the virtual machine root context module, and updates the ECC check code to the physical memory ECC check code root unit in the virtual machine root context module;

[0135] S8: The virtual machine management system resets the virtual machine execution context module according to the virtual machine root context module;

[0136] like Figure 5 As shown, in this embodiment, the virtual machine management system resets the virtual machine execution context module according to the virtual machine root context module, including the following steps:

[0137] The virtual machine management system copies the CPU register state in the virtual machine CPU register state root unit from the virtual machine root context module to the virtual machine CPU register state execution unit in the virtual machine execution context module;

[0138] The virtual machine management system resets all memory mapping relationships in the virtual machine execution context module to inaccessible attributes;

[0139] The virtual machine management system copies the data in the physical memory ECC check code root unit from the virtual machine root context module and saves it to the physical memory ECC check code execution unit in the virtual machine execution context module;

[0140] The virtual machine management system resets all memory access information tables to an initial value of zero.

[0141] S9: The virtual machine management system will restore the virtual machine from the virtual machine execution context module again and continue to execute the code of the client operating system.

[0142] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A virtual machine fault detection and recovery system, characterized in that: The virtual machine fault detection and recovery system includes a virtual machine management system, which includes a virtual machine root context module and a virtual machine execution context module; the virtual machine root context module saves the virtual machine state and memory management data before the fault occurs, and the virtual machine execution context module provides a temporary execution environment for the virtual machine and monitors the virtual machine's access to the memory; wherein, The virtual machine root context module includes: A virtual machine CPU register state root unit, wherein the virtual machine CPU register state root unit stores a CPU register of the virtual machine; A virtual machine memory mapping state root unit, wherein the virtual machine memory mapping state root unit stores a mapping relationship between a virtual machine memory address and a physical memory and access attributes; A physical memory ECC check code root unit, wherein the physical memory ECC check code root unit stores ECC check codes of all physical memory pages used by the virtual machine; An immutable memory region information table, wherein the immutable memory region information table stores immutable memory regions explicitly declared when the virtual machine is running; The virtual machine execution context module includes: A virtual machine CPU register state execution unit, wherein the data stored in the virtual machine CPU register state execution unit is the same as the data in the virtual machine CPU register state root unit at the initialization and reset time; A virtual machine memory mapping state execution unit, at the initialization and reset, the data stored in the virtual machine memory mapping state execution unit is consistent with the data of the virtual machine memory mapping state root unit, but all mapping relationships within it are set to be inaccessible, and a trap is triggered when the client operating system accesses the memory, and the virtual machine management system records the access information and updates the corresponding memory access attributes; A physical memory ECC check code execution unit, when initially and when reset, the data stored in the physical memory ECC check code execution unit is the same as the data in the physical memory ECC check code root unit, and serves as a backup of the ECC check code in the physical memory ECC check code root unit; Memory access information table, the memory access information table records the memory area where only read access or write access occurs.

2. A control method for a virtual machine fault detection and recovery system as claimed in claim 1, characterized in that: The following steps are involved: S1: modify the client operating system code, call the virtual machine root context module creation interface of the virtual machine management system after the system is started, and call the virtual machine anomaly detection interface of the virtual machine management system at the task switching code; S2: The virtual machine management system creates a virtual machine and loads the image of the client operating system into the memory of the virtual machine, then starts the virtual machine, and the virtual machine starts to execute the code of the client operating system; when the client operating system executes to the system startup is completed, it calls the virtual machine root context module creation interface, at which time the CPU will be trapped, and then jump to the virtual machine root context module creation interface of the client operating system to start execution; S3: The virtual machine root context module creation interface of the virtual machine management system creates a virtual machine root context data structure, and saves the CPU register state and memory mapping relationship and access attributes of the current virtual machine into the virtual machine root context module, and at the same time calculates the ECC check code of each physical memory page of the memory belonging to the virtual machine, and saves the ECC check code into the virtual machine root context module, and then the virtual machine management system creates a virtual machine execution context module corresponding to the virtual machine root context module; S4: The virtual machine management system resumes the execution of the virtual machine in the virtual machine execution context module, and the virtual machine continues to execute the code of the client operating system; S5: Detect whether a fault occurs during the operation of the client operating system and notify the virtual machine management system through a fault notification interface of the virtual machine management system; S6: When the client operating system runs to the task switching code, the virtual machine management system detects it through the virtual machine anomaly detection interface: The virtual machine management system first detects whether the memory that has only been read by the client operating system has any memory particle damage failure: The virtual machine management system then checks whether a memory out-of-bounds access fault occurs in the memory that has only been written by the client operating system; And determine the subsequent corresponding operations according to the corresponding detection results; S7: When the virtual machine management system detects neither a memory particle corruption fault nor a memory out-of-bounds access fault, the virtual machine management system completes data synchronization from the virtual machine execution context module to the virtual machine root context module; S8: The virtual machine management system resets the virtual machine execution context module according to the virtual machine root context module; S9: The virtual machine management system will restore the virtual machine from the virtual machine execution context module again and continue to execute the code of the client operating system.

3. The control method of the virtual machine fault detection and recovery system according to claim 2, characterized in that: In step S1, when the client operating system executes the two interface calls, the CPU switches from a low privilege level to a high privilege level and starts executing the system call program corresponding to the virtual machine management system.

4. The control method of the virtual machine fault detection and recovery system according to claim 2, characterized in that: The step S5 includes the following steps: S5.1: If the client operating system does not fail during operation, the client operating system calls the immutable memory declaration interface of the virtual machine management system during operation; S5.2: If a client operating system fails during operation, it is determined that a malicious program caused the client operating system failure, and the malicious program failure handling process is entered: At this time, the following steps are included: S5.21: The virtual machine management system creates a new virtual machine execution context module from the virtual machine root context module, and the virtual machine management system injects an abnormal malicious program into the new virtual machine execution context module; S5.22: The virtual machine management system saves the original memory data information in the virtual machine execution context module when the failure occurs; S5.23: The virtual machine management system resumes the execution of the client operating system from the new virtual machine execution context module. At this time, the client operating system enters the malicious program exception handler, and the client operating system resets the malicious program that caused the exception. S5.24: After the client operating system completes the exception handling, it exits from the exception handling program, and task scheduling is triggered.

5. The control method of the virtual machine fault detection and recovery system according to claim 2, characterized in that: The step S6 includes the following steps: When the virtual machine management system detects whether a memory particle damage fault occurs in the memory that has only been read by the client operating system, it calculates whether the ECC check code of the memory area read and accessed by the client operating system is the same as the ECC check code corresponding to the memory area in the virtual machine root context module. If they are the same, it is determined that no memory particle damage fault occurs; if they are different, it is determined that a memory particle damage fault occurs; When the virtual machine management system detects whether a memory out-of-bounds access fault occurs in the memory that has only been written by the client operating system, it calculates whether the memory area that has been written and accessed by the client operating system has been marked by the immutable memory area information table in the virtual machine root context module. If it has not been marked, it is determined that no memory out-of-bounds access fault has occurred; if it has been marked, it is determined that a memory out-of-bounds access fault has occurred.

6. The control method of the virtual machine fault detection and recovery system according to claim 4, characterized in that: In step S6, When the virtual machine management system detects neither a memory particle corruption fault nor a memory out-of-bounds access fault, the virtual machine management system synchronizes the corresponding data in the virtual machine execution context module to the virtual machine root context module; When the virtual machine management system detects a memory particle damage fault, the virtual machine management system enters the memory particle damage fault recovery process; When the virtual machine management system detects a memory out-of-bounds access fault, the virtual machine management system first determines whether the fault is caused by a malicious program, and if so, enters the malicious program fault handling process.

7. The control method of the virtual machine fault detection and recovery system according to claim 6, characterized in that: In step S6, the memory chip damage failure recovery process includes: The virtual machine management system records the memory area information read and accessed by the client operating system into the memory access information table in the virtual machine execution context module; The virtual machine management system compares the memory area read by the guest operating system with the access attributes of the same memory area in the virtual machine root context module: If it is readable, then the memory attribute in the virtual machine execution context module is synchronously set to readable; If it is unreadable, a client operating system failure is triggered and the client operating system failure handling process is entered.

8. The virtual machine fault detection system and recovery control method according to claim 6, characterized in that: In step S6, the malicious program fault handling process includes: The virtual machine management system records the memory area information accessed by the client operating system into the memory access information table in the virtual machine execution context module; The virtual machine management system allocates new memory and maps the new memory to the accessed area; The virtual machine management system copies the memory data corresponding to the accessed area in the memory mapping relationship of the virtual machine root context module to the newly allocated memory; The virtual machine management system compares the memory area that is write-accessed by the guest operating system with the access attributes of the same memory area in the virtual machine's root context module: If it is writable, then the memory attribute in the virtual machine execution context module is synchronously set to be writable; If it is not writable, a client operating system failure is triggered and the client operating system failure handling process is entered.

9. The control method of the virtual machine fault detection and recovery system according to claim 6, characterized in that: The virtual machine management system synchronizes the corresponding data in the virtual machine execution context module to the virtual machine root context module, including the following steps: The virtual machine management system synchronizes the CPU register state in the virtual machine CPU register state execution unit in the virtual machine execution context module to the virtual machine CPU register state root unit in the virtual machine root context module; The virtual machine management system maps the written memory area in the virtual machine root context module to the physical memory corresponding to the area in the virtual machine execution context module, and then releases the original physical memory of the area in the virtual machine root context module; The virtual machine management system recalculates the ECC check code of the updated memory area in the virtual machine root context module, and updates the ECC check code to the physical memory ECC check code root unit in the virtual machine root context module.

10. The control method of the virtual machine fault detection and recovery system according to claim 2, characterized in that: The virtual machine management system resets the virtual machine execution context module according to the virtual machine root context module, including the following steps: The virtual machine management system copies the CPU register state in the virtual machine CPU register state root unit from the virtual machine root context module to the virtual machine CPU register state execution unit in the virtual machine execution context module; The virtual machine management system resets all memory mapping relationships in the virtual machine execution context module to inaccessible attributes; The virtual machine management system copies the data in the physical memory ECC check code root unit from the virtual machine root context module and saves it to the physical memory ECC check code execution unit in the virtual machine execution context module; The virtual machine management system resets all memory access information tables to an initial value of zero.

Images