Document observation method, electronic device, chip and program product

Abstract

The present application provides a file observation method, electronic device, chip and program product. In this method, at the creation point of the index node inode of the target file, the file path information is pre-recorded in the extended Berkeley Packet Filter Map information BPF map. When the target file needs to be observed, the corresponding path information can be obtained from the BPF map using the identification information of the target file, so that the file can be observed according to the path information, providing important data support for system tuning.

Description

Technical Field

[0001] The present application belongs to the field of kernel observation, and in particular relates to a file observation method, electronic equipment, chip and program product. Background Art

[0002] The Linux kernel has numerous modules and complex implementation mechanisms, so various logic or performance issues may arise during operation. For example, if the output of a function is inconsistent with the expected value, it is necessary to track the files or data of key nodes to find the cause of the problem. Or if the system's response speed slows down, it may be necessary to identify functions that take a long time to execute. Kernel observability is a key capability that supports observing the operating status of the system. When conducting kernel observation, a key branch is observing files. File-related observation metrics, such as file read step length, file hotness and coldness, and file pre-read parameters, are crucial for system tuning. Therefore, how to conduct file observation is an issue that needs to be considered at present. Summary of the Invention

[0003] Embodiments of the present application provide a file observation method, electronic device, chip, and program product. These methods can pre-record file path information in an extended Berkeley packet filter map (eBPFmap) so that the file can be subsequently observed based on the path information, providing important data support for system tuning.

[0004] In a first aspect, a file observation method is provided, which is applied to an electronic device and specifically includes:

[0005] After obtaining first identification information corresponding to the first target file, first path information corresponding to the first identification information is determined using the first BPF map, and finally, the first target file is observed based on the first path information. The first identification information is used to uniquely identify an index node (inode) of the first target file. The target association relationship between the first identification information and the first path information is pre-recorded in the first BPF map. The first path information is used to indicate the storage address of the first target file in the storage space of the electronic device.

[0006] In the above scheme, the electronic device pre-stores the target association relationship between the first identification information and the first path information of the first target file in the first BPF map, that is, maintains the above target association relationship in the first BPF map. When the first target file is to be observed, the first identification information is obtained and the target association relationship is read from the first BPF map. Finally, the first path information corresponding to the first target file can be determined based on the first identification information and the target association relationship. In this scheme, the first path information of the first target file can be quickly determined directly through the pre-recorded target association relationship, thereby realizing file observation and providing data support for system tuning and security analysis. At the same time, this solution does not require re-parsing the file path, which can reduce frequent access to the file path, thereby reducing the probability of lock conflicts, livelocks, deadlocks and other problems. In addition, this solution can support recording the association relationship corresponding to any number of files (that is, the association relationship between the file identification information and the path information), without being limited by the number of trace points, so any number of files can be observed. That is to say, at any location observable by the kernel, when we need to observe a certain file, we only need to obtain the file identification information, and then we can determine the file path information through the first BPF map, which greatly increases the number of observable files, thereby improving the accuracy of file input and output (I / O) problem analysis.

[0007] In combination with the first aspect, in some possible implementations of the first aspect, before obtaining the first identification information corresponding to the first target file at the target observation location, the method also includes: recording the target association relationship in the first BPF map at the creation point of the inode.

[0008] In the above scheme, the process of creating an inode generates first identification information and determines the storage location of the first target file (i.e., the first path information). At this time, the target association relationship between the first identification information and the first path information is stored in the first BPF map. This ensures that the first path information can be captured as soon as possible at the moment of file creation. This can minimize the situation where the target association relationship cannot be found from the first BPF map when observing the first target file.

[0009] In combination with the first aspect, in some possible implementations of the first aspect, after recording the target association relationship in the first BPF map, the method further includes: continuing to maintain the target association relationship when the first target file is deleted or destroyed.

[0010] In the above scheme, the target association relationship is persistently maintained in the first BPF map. Since the first target file is dynamic in the system, it may be deleted or destroyed at any time. By persistently maintaining the target association relationship, even if the first target file is subsequently deleted, the first target file can still be analyzed and tracked based on the target association relationship maintained in the first BPF map, providing data support for system optimization and security analysis. In other words, when the first target file is deleted or destroyed, the electronic device continues to maintain the target association relationship in the first BPF map. This persistence mechanism can be implemented through a database or log file to ensure data integrity and traceability.

[0011] In combination with the first aspect, in some possible implementations of the first aspect, recording the target association relationship in the first BPF map includes: when the thread corresponding to the first target file is a preset thread, and / or when the process corresponding to the first target file is a preset process, recording the target association relationship in the first BPF map.

[0012] In the above solution, it is also possible to record only the association relationships corresponding to some files in the first BPF map. That is, the association relationships corresponding to all files are not saved in the first BPF map, so that in most scenarios, the size of the first BPF map can be prevented from exceeding the preset warning value, and there is no need to perform the above-mentioned space recovery operation. In one example, files can be filtered by thread and / or process. For example, when the thread corresponding to a file is a preset thread, and / or when the process corresponding to a file is a preset process, the association relationship corresponding to the file is stored in the first BPF map. In other words, this solution only focuses on files of specific threads and / or processes, thereby reducing unnecessary data collection and processing. Such a filtering mechanism can significantly improve the performance of the system, especially in a high-load environment.

[0013] For example, at the creation point of the inode of the first target file, the identifier of the thread corresponding to the first target file (referred to as the first thread identifier) is queried. If the first thread identifier is the same as the preset thread identifier, the target association relationship corresponding to the first target file is recorded in the first BPF map; otherwise, the target association relationship corresponding to the first target file is not recorded in the first BPF map.

[0014] For another example, at the creation point of the inode of the first target file, the identifier of the process corresponding to the first target file (referred to as the first process identifier) is queried. If the first process identifier is the same as the preset process identifier, the target association relationship corresponding to the first target file is recorded in the first BPF map; otherwise, the target association relationship corresponding to the first target file is not recorded in the first BPF map.

[0015] For another example, at the creation point of the inode of the first target file, the thread identifier (referred to as the first thread identifier) and the process identifier (referred to as the first process identifier) corresponding to the first target file are queried. If the first thread identifier is the same as the preset thread identifier, and the first process identifier is the same as the preset process identifier, the target association relationship corresponding to the first target file is recorded in the first BPF map. Otherwise, the target association relationship corresponding to the first target file is not recorded in the first BPF map.

[0016] In combination with the first aspect, in some possible implementations of the first aspect, determining the first path information corresponding to the first identification information through the first BPF map includes: reading the target association relationship from the first BPF map through a processing module, where the processing module is located in the user space of the electronic device; and determining the first path information corresponding to the first identification information through the processing module based on the target association relationship.

[0017] In combination with the first aspect, in some possible implementations of the first aspect, the first path information corresponding to the first identification information is determined by a processing module, including: when the data volume of the data to be observed is greater than or equal to a preset threshold, the first path information corresponding to the first identification information is determined by the processing module, and the first target file is associated with the data to be observed.

[0018] In the above solution, a processing module in user space can be used to perform path matching. Furthermore, in a further possible implementation, the processing module can only read the target association relationship and match the first path information when the amount of data to be observed is greater than or equal to a preset threshold, where the first target file is associated with the data to be observed. It is understood that if the amount of data to be observed is relatively large (e.g., greater than or equal to the preset threshold), using a kernel space module for path matching may affect the kernel space's response speed. In severe cases, this may cause the electronic device's system to freeze or even crash, thereby affecting the user experience. However, the impact of user space overhead on user experience is relatively small. Therefore, if the amount of data to be observed is relatively large, using a user space software module (i.e., a processing module) for batch path matching can improve efficiency, reduce kernel space usage, and enhance system fluency.

[0019] In combination with the first aspect, in some possible implementations of the first aspect, determining the first path information corresponding to the first identification information through the first BPF map includes: reading the target association relationship from the first BPF map through the kernel observation module, the kernel observation module is located in the kernel space of the electronic device; based on the target association relationship, determining the first path information corresponding to the first identification information through the kernel observation module.

[0020] In combination with the first aspect, in some possible implementations of the first aspect, the first path information corresponding to the first identification information is determined through the kernel observation module, including: when the data amount of the data to be observed is less than a preset threshold, the first path information corresponding to the first identification information is determined through the kernel observation module, and the first target file is associated with the data to be observed.

[0021] In the above scheme, the kernel observation module in the kernel space can also be used to perform path matching. In a further possible implementation, the target association relationship can be read and the first path information can be matched through the processing module only when the data volume of the data to be observed is less than a preset threshold. It can be understood that when the data volume of the data to be observed is relatively small (such as less than the preset threshold), even if a module in the kernel space (such as the kernel observation module) is used for path matching, it will not greatly affect the response speed of the kernel space. Since modules in the kernel space can directly access the kernel and file subsystems, performing path matching through the kernel observation module in the kernel space can improve the efficiency of path matching, realize real-time data tracking, and greatly improve the precision and accuracy of file I / O problem analysis.

[0022] In combination with the first aspect, in some possible implementations of the first aspect, obtaining first identification information corresponding to the first target file includes: obtaining the first identification information through a file structure and / or inode structure corresponding to the first target file.

[0023] In the above scheme, the first identification information can be obtained through the file structure and / or inode structure corresponding to the first target file. Among them, the file structure and the inode structure are both important data structures in the Linux kernel. The file structure represents an open file instance, which contains the file status information, a pointer to the inode, and a file descriptor, etc.; and the inode structure is a structure used to store file metadata in the file system, which contains information such as the file's permissions, size, creation time, and modification time. Since the file structure and the inode structure are basic data structures, the electronic device can easily obtain the first identification information, thereby providing a basis for executing subsequent steps.

[0024] In conjunction with the first aspect, in certain possible implementations of the first aspect, a first BPF map records multiple sets of association relationships, including a target association relationship. The method further includes: checking the multiple sets of association relationships in the first BPF map according to a first preset period; and if first identification information corresponding to at least two sets of association relationships in the first BPF map is identical, storing the at least two sets of association relationships in a second BPF map, the second BPF map being different from the first BPF map.

[0025] In combination with the first aspect, in some possible implementations of the first aspect, after storing at least two sets of association relationships in a second BPF map, the method further includes: obtaining second identification information corresponding to the second target file, the second identification information being used to uniquely identify the inode of the second target file; determining second path information corresponding to the second identification information through the second BPF map, the at least two sets of association relationships including an association relationship between the second identification information and the second path information; and observing the second target file through the second path information.

[0026] As is understandable, with the creation and deletion of a large number of files in a file system, conflicts may arise between the identification information of two files. For example, after a file is deleted for a period of time, the system may assign its identification information to another file. In this case, two associations in the first BPF map may have identical identification information. Specifically, two data items in the first BPF map may have the same key. BPF technology lacks a sophisticated conflict resolution mechanism, which can lead to errors during subsequent path matching. To minimize this risk, the above solution provides a conflict resolution mechanism that supports transferring conflicting associations to an additional BPF map (denoted as the second BPF map), minimizing data anomalies in the original first BPF map. For example, the electronic device may check the multiple associations in the first BPF map at a first predetermined period, for example, every 30 seconds. If the first identification information corresponding to at least two associations in the first BPF map is identical, the at least two associations are stored in a second BPF map, which is different from the first BPF map. In other words, the electronic device maintains a second BPF map in addition to the first BPF map. If conflicting relationships are found (i.e., the identification information in two or more associations is the same), these conflicting relationships are stored in the second BPF map and deleted from the first BPF map. This ensures the uniqueness of the identification information of each association stored in the first BPF map.

[0027] In combination with the first aspect, in some possible implementations of the first aspect, the method further includes: querying the size of the first BPF map according to a second preset period through an independent thread; when the first BPF map is greater than or equal to a preset warning value, checking whether the inode corresponding to the first target file still exists in the file system of the electronic device; when the inode still exists in the file system, deleting the target association relationship from the first BPF map; or, when the inode no longer exists in the file system, continuing to maintain the target association relationship in the first BPF map.

[0028] In the above scheme, space is reclaimed when the size of the first BPF map exceeds a preset threshold. It is understood that the first BPF map typically records multiple sets of associations (these associations refer to the associations between the path information and identification information of the files to be observed), and the target association is only one of these sets. If the amount of data to be observed is large, the information recorded in the first BPF map will increase, potentially exceeding the maximum value set for the first BPF map, resulting in failure to record new data. In this case, a preset threshold can be set. If the size of the first BPF map exceeds this threshold, some associations are deleted to ensure sufficient space in the first BPF map for recording new information. In one example, some associations can be deleted according to a preset rule. For example, the preset rule is: if a file's inode has not been deleted, the corresponding association is deleted. In other words, if a file's inode has been deleted, the corresponding association is retained. This is because if a file's inode has been deleted, it is difficult to obtain the file's corresponding path information through methods other than the first BPF map. If the corresponding association is deleted from the first BPF map, subsequent effective observation of the file becomes difficult. Conversely, if a file's inode has not been deleted, it is possible to query the file's path information through methods other than the first BPF map. That is, even if the file's corresponding relationships are deleted from the first BPF map, there are still ways to continue observing the file, though the efficiency may be lower. For example, the lsof command can be used to query the file's full path based on the file's identification information. For example, an independent thread is first set up to query the size of the first BPF map at a second preset period. This independent thread periodically checks the size of the first BPF map, for example, every 10 seconds. When the first BPF map is greater than or equal to a preset alert value, the independent thread traverses the first BPF map to query whether the inodes corresponding to multiple groups of relationships in the first BPF map exist. If the inodes corresponding to some relationships do not exist, these relationships are retained; if the inodes corresponding to some relationships still exist, these relationships are removed from the first BPF map to reclaim space. Taking the first target file in the embodiments of the present application as an example, the size of the first BPF map is queried by an independent thread at a second preset period. When the first BPFmap is greater than or equal to the preset warning value, it is checked whether the inode corresponding to the first target file still exists in the file system of the electronic device.If the inode still exists in the file system, the target association relationship is deleted from the first BPF map; or, if the inode no longer exists in the file system, the target association relationship continues to be maintained in the first BPF map.

[0029] In conjunction with the first aspect, in certain possible implementations of the first aspect, observing the first target file based on the first path information includes: obtaining a file observation indicator corresponding to the first target file, the file observation indicator being used to optimize the system performance of the electronic device, the file observation indicator including one or more of the following: a read step length of the first target file, or hot and cold conditions of the first target file, or pre-read parameters of the first target file, or file page jitter of the first target file. A second aspect provides an electronic device comprising a memory and a processor, the memory storing a computer program executable on the processor, wherein when the processor executes the computer program, the electronic device implements the steps of any of the methods described in the first aspect.

[0030] In a third aspect, a computer-readable storage medium is provided, which stores a computer program. When the computer program is executed by a processor, the steps of the method described in any one of the first aspects are implemented.

[0031] In a fourth aspect, a computer program product is provided. When the computer program product is run on an electronic device, the electronic device executes any one of the methods in the first aspect.

[0032] In a fifth aspect, a chip system is provided, which includes a processor coupled to a memory, and the processor executes a computer program stored in the memory to implement any method described in the first aspect.

[0033] The chip system may be a single chip or a chip module composed of multiple chips.

[0034] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A schematic diagram of a software structure of an operating system of an electronic device provided in an embodiment of the present application;

[0036] Figure 2 A schematic diagram of the interaction between internal modules in the software architecture diagram provided in an embodiment of the present application;

[0037] Figure 3 An exemplary flow chart of method 200 provided in an embodiment of the present application;

[0038] Figure 4 A statistical diagram of the number of thrashing times corresponding to different files in a practical application scenario is given.

[0039] Figure 5 Another interactive diagram of the internal modules in the software architecture diagram provided in the embodiment of the present application;

[0040] Figure 6 A hardware architecture diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0042] An embodiment of the present application provides a file observation method, which can be applied to electronic devices such as mobile phones, tablet computers, desktop computers, laptop computers, handheld computers, notebook computers, ultra-mobile personal computers (UMPCs), netbooks, augmented reality (AR) devices, virtual reality (VR) devices, artificial intelligence (AI) devices, wearable devices, vehicle-mounted devices, smart home devices and / or smart city devices, etc. The embodiment of the present application does not impose any special restrictions on the specific type of the electronic device.

[0043] An operating system runs on an electronic device. An operating system is a built-in program in an electronic device that is used to coordinate various hardware and software inside the electronic device, so that the electronic device deployed with the operating system can interact with the user. The electronic device can be regarded as an instance of a computing resource running an operating system. Specifically, an operating system is part of the software in an electronic device. It is the first layer of software based on the hardware in the electronic device, and serves as a bridge (or interface) for communication between the hardware and other software in the electronic device. The operating system can control the operation of other programs in the electronic device, manage the system resources of the electronic device, and provide the most basic computing functions (such as managing and configuring memory, determining the priority of system resource supply and demand, and providing some basic service programs, etc.). Among them, the operating system may include but is not limited to: Linux, Windows, Android, and IOS, etc. For convenience, the embodiment of this application is explained using the Android operating system as an example, wherein the Android operating system is an operating system based on the Linux kernel.

[0044] Figure 1A software structure diagram of the operating system of the electronic device 100 provided in the embodiment of the present application. Figure 1 As shown, the present application divides the Linux system into a user space 101 (user space may also be referred to as a user layer), a kernel space 102 (kernel space may also be referred to as a kernel layer), and a hardware layer 103 from top to bottom.

[0045] User space 101 and kernel space 102 both represent virtual memory within the operating system. This virtual memory space is created by the operating system for a process, providing that process with independent and private memory. The hardware layer 103 includes various hardware devices, such as memory. The aforementioned process is a program's execution on a data set within an electronic device. It serves as the basic unit for resource allocation and scheduling within the system and forms the foundation of the operating system's architecture. Simply put, a process can be understood as a program running within an operating system. For example, when a game application is opened and run on an electronic device, a process must be initiated for the game to run successfully. Furthermore, a thread is an entity within a process and serves as the basic unit for CPU scheduling and dispatching. It is a smaller unit than a process and can run independently.

[0046] User space 101 is a virtual concept relative to kernel space 102. It refers to the environment that a user can see and operate when using electronic device 100. It includes the command line interpreter, file system, applications, system libraries, and configuration files. It is the environment for running applications and supports users' operations such as creating, deleting, and modifying files and directories. In one example, user space 101 consists of a system runtime library layer and an application framework layer, including applications, library functions, and a shell. System calls (syscalls) connect the kernel space 102 and user space 101.

[0047] The kernel space 102 is the core of the operating system, responsible for managing the hardware and software resources of the operating system and controlling the operation of the hardware and software of the operating system. The kernel space provides various system services and resource management functions, such as process management, memory management, device drivers, and file systems.

[0048] Please see further Figure 2 The kernel is the first layer of software expansion within the kernel system, built on top of the hardware layer 103. It provides the most basic operating system functions and serves as the foundation for the operating system. The kernel is generally responsible for process scheduling and management, thread scheduling and management, file system management, memory management, device driver management, and network system management.

[0049] The kernel controls the computer's hardware resources and provides a standard interface for devices in hardware layer 103 (such as processors, memory, disks, printers, etc.) through the hardware abstraction layer (HAL). The HAL is a hardware interface layer abstracted from a specific hardware platform. It is responsible for implementing the functionality and control of that specific hardware platform while also providing a unified API interface for other software modules. Specifically, the HAL abstracts the commonalities of hardware operation and control, hiding the hardware interface details of a specific platform. It then provides a unified virtual hardware platform and control interface to upper-level software, isolating other software modules from the underlying hardware and facilitating system porting to new hardware platforms.

[0050] Kernel space 102 also includes a file subsystem. It is understood that in a computer system, a series of operations are required on executable program code segments and resource files during program execution. For example, data may be read from a storage device into memory (e.g., a read operation) or data that needs to be persisted may be written back to the storage device (e.g., a write operation). These operations are implemented within the system as different I / O requests. Specifically, the Linux system manages memory in pages, and different operations (such as the aforementioned read or write operations) can be implemented by initiating different I / O requests through different threads. Specifically, the file read / write module in user space 101 can perform read or write operations on file pages through the file subsystem in kernel space 102. The file subsystem may include a directory entry cache (DCache), a page cache (PCache), a file system, and blocks. The file system and page cache are used to manage cached file pages and temporarily store file data. The file read / write module may be a software module within the application. In a specific example, a thread within an application can trigger an I / O request to the file subsystem through the file read / write module, requesting data processing, such as reading or writing data. After the file subsystem receives the I / O request and initiates the I / O operation, it submits a BIO structure to the block. For example, the file system layer can submit the BIO structure to the block by calling submit_bio. The BIO structure is the data structure of the block's I / O request and represents an ongoing I / O operation. The block can provide multiple interfaces for processing I / O requests. The block includes an I / O scheduler, which manages the request queue for I / O requests. This scheduler determines the order in which requests are queued and when to dispatch them. The I / O scheduler converts received BIOs into messages with request structures and sends these messages to the device driver. The device driver is the interface between the I / O system and related hardware, used to drive the corresponding hardware devices. Device drivers include, for example, memory drivers, camera drivers, processor drivers, display drivers, and audio drivers. The device driver converts received requests into I / O commands, which it uses to instruct the components of the hardware layer 103 to perform the corresponding I / O operation.

[0051] Kernel observability is central to system performance tuning and security debugging. Kernel observability, also known as kernel traceability, refers to the ability to observe the kernel's internal operating state or execution status through instrumentation. Kernel observability enables the acquisition of kernel behavior or status, including process scheduling, memory management, and file types read and written. This helps developers diagnose performance bottlenecks, locate root causes, and optimize system behavior.

[0052] Therefore, one of the important branches of the kernel observation task is the observation task for kernel-related files. In the embodiment of the present application, file observation refers to the detection of characteristics or parameters related to the target file based on preset file observation indicators. For example, the reading step length, file hot and cold, file pre-reading parameters, etc. of the target file are detected based on the preset file observation indicators, so as to perform system performance tuning or system security debugging according to these parameters. Among them, the target file involved in the embodiment of the present application refers to the file to be observed, or the file associated with the data to be observed (such as the file read by the data to be observed); the above-mentioned file observation indicators are used to indicate which characteristics or parameters of the target file are to be detected. The file observation indicators can be pre-configured or temporarily set by the developer or user. The present application does not limit the specific content of the file observation indicators.

[0053] Please continue reading Figure 2 In one possible example provided by the embodiments of the present application, the kernel and file subsystem can be observed using the kernel observation module in kernel space 102, and the processing module in user space 101 can be used to process the relevant observation data. However, when performing kernel observation, due to complex data synchronization issues and difficulty in obtaining file paths, it is often difficult to directly observe files. Therefore, how to perform file observation is currently an issue that needs to be considered.

[0054] In view of the above problems, an embodiment of the present application provides a file observation method, which can conveniently obtain the file path of a target file, thereby enabling observation of the target file through the file path.

[0055] In one possible implementation (denoted as Option 1), the target file's file path is obtained layer by layer through directory analysis. It's understood that a file's file path typically consists of multiple directory names, separated by " / ", with the outermost directory being the root directory. For example, assuming the target file's file path is "home / user / documents / ", "home / " is the target file's root directory, and "documents / " is the last directory level where the target file resides.

[0056] In this implementation, the target file's directory names are retrieved layer by layer through a hierarchical iterative approach. That is, the target file's last directory name is first obtained through directory analysis, and then the directory name is analyzed layer by layer until the target file's root directory is found. A possible execution code is given below:

[0057] while(dentry !root->dentry&mnt->mnt !root->mnt){

[0058] const struct dentry *parent READ_ONCE (dentry->d_parent); / / This means that the directory name is obtained layer by layer through directory analysis until the root is found

[0059] …

[0060] prefetch(parent);

[0061] if (!prepend_name(p, &dentry->d_name))

[0062] break;

[0063] dentry parent;

[0064] }

[0065] However, due to issues such as directory entry caching and file lifecycle, the file system uses a complex lock dependency structure and runtime checks. For details, see the following example:

[0066] char *d path (const struct path *path, char *buf, int buflen)

[0067] rcu_read_lock(); / / This represents the first layer of read-copy update (rcu) lock

[0068] get_fs_root_rcu(current->fs, &root); / / This represents the second level sequential lock (read_segcount_begin)

[0069] if (unlikely (d_unlinked (path->dentry))) / / This means that the file may be destroyed at any time

[0070] prepend(&b,"(deleted)",11);

[0071] prepend_path(path,&root,&b);

[0072] rcu_read_lock(); / / This represents the third layer of rcu lock

[0073] read_seqbegin_or_lock(&mount_1ock,&m_seq); / / This represents the fourth level sequence lock

[0074] As can be seen from the above example, the lock dependency structure in the file system is complex. Therefore, when performing directory analysis in the kernel, problems such as lock conflicts, livelocks, deadlocks, hungry tasks, and use-after-free (UAF) memory usage are prone to occur.

[0075] In another possible implementation (denoted as Solution 2), the file path can be obtained based on the extended Berkeley packet filter (eBPF).

[0076] eBPF is a technology that allows user-written programs to run in the Linux kernel without modifying the kernel code or loading kernel modules. In simple terms, eBPF makes the Linux kernel programmable. It can be used to safely and efficiently extend the functionality of the kernel without having to modify the kernel source code or load kernel modules.

[0077] In this implementation, eBPF technology is used to perform points at any location in the kernel, that is, to insert software code to obtain the kernel execution status, such as obtaining the path information of the target file. For example, multiple trace points can be defined in eBPF. These trace points allow the eBPF program to be executed when specific events occur in the kernel. In other words, the eBPF program can be similar to adding a listener to the kernel. When a preset event (such as system call, file reading and writing, function entry / exit, network event, etc.) occurs, the corresponding eBPF program will be triggered and executed. In this way, eBPF can flexibly expand kernel functions without affecting kernel stability, and realize various uses such as performance monitoring, security protection, and network packet filtering. The following is an example of defining multiple trace points in an eBPF program:

[0078] BPF_CALL_3 (bpf_d_path, struct path *path, char *buf, u32, sz)

[0079] {

[0080] …

[0081] p = d_path(©, buf, sz);

[0082] …

[0083] }

[0084] BTF_SET_START(btf_allowlist_d_path)

[0085] #ifdef CONFIG_SECURITY

[0086] BTF_ID(func, security_file_permission) / / trace point 1

[0087] BTF_ID(func, security_inode_getattr) / / trace point 2

[0088] BTF_ID(func, security_file_open) / / trace point 3

[0089] #endif

[0090] #ifdef CONFIG_SECURITY_PATH

[0091] BTF_ID(func, security_path_truncate) / / trace point 4

[0092] #endif

[0093] ​​​​​​​​​​​​​​​BTF_SET_END (btf_allowlist_d_path)

[0099] As can be seen from the above example, although the path of the target file can be easily obtained through eBPF technology, the file path can only be obtained at a maximum of 9 trace points. The remaining locations cannot be accurately observed, which seriously affects the accuracy of file I / O problem analysis.

[0100] In another possible implementation (denoted as Option 3), with the help of eBPF technology, the target association relationship between the identification information of the target file and the corresponding path information is recorded in the BPF map in advance. When the target file needs to be observed, the target association relationship can be directly read from the BPF map, and the path information of the target file can be determined based on the target association relationship, so that the target file can be observed. In this way, frequent access to the file path can be reduced, thereby reducing the probability of lock conflicts, livelocks, deadlocks and other problems. At the same time, it can also support the acquisition of path information of any number of files, that is, any number of files can be observed, thereby improving the accuracy of file I / O problem analysis. The following is combined with Figure 3 Method 200 in the embodiment exemplifies the specific implementation process of this possible implementation method.

[0101] S210: Obtain first identification information corresponding to the first target file.

[0102] Exemplarily, when it is determined to observe the first target file, first identification information corresponding to the first target file is obtained.

[0103] The first target file is used to represent any file to be observed, and a file is a collection of information using the storage space of an electronic device as a carrier.

[0104] The first identification information is used to uniquely identify the index node (inode) of the first target file.

[0105] An inode is a data structure used to store file metadata in the Linux file system. It is a core data structure for a file. Each file has a corresponding inode. In addition to the file name, all file information is stored in the inode, such as the file's byte count, the file owner, the group ID to which the file belongs (Group ID), the file's timestamp, and so on. In other words, each file typically corresponds to one inode, so this first identification information can also be used to uniquely identify the first target file. That is, the first identification information can be used to identify and identify the first target file within the file system. As an example, this first identification information can be denoted as i_ino or inode id.

[0106] This application does not limit the timing when the electronic device triggers the observation of the first target file.

[0107] As an example, when a specific event occurs with respect to a first target file in the data to be observed, such as opening the first target file, the electronic device determines to observe the first target file. It is understood that the data to be observed here refers to any line of kernel code to be observed selected by a developer or user, or any line of code at a target observation location. The data to be observed is associated with the first target file, meaning that the data to be observed performs an operation with respect to the first target file, such as reading, writing, deleting, or modifying.

[0108] When creating the inode of the first target file, the first identification information corresponding to the first target file is also generated. Therefore, when determining to observe the first target file, the first identification information can be easily obtained. For example, the first identification information can be obtained through the file structure and / or inode structure corresponding to the first target file. Among them, the file structure and the inode structure are both important data structures in the Linux kernel. The file structure represents an open file instance, which contains the file status information, a pointer to the inode, and a file descriptor, etc.; and the inode structure is a structure for storing file metadata in the file system, which contains information such as the file's permissions, size, creation time, and modification time.

[0109] An example of an inode structure is as follows:

[0110] struct inode {

[0111] umode_t i_mode;

[0112] …

[0113] / / Dynamically allocate the first identification information of the first target file (hereinafter i_ino represents the first identification information)

[0114] unsigned longi_ino;

[0115] …

[0116] }

[0117] As can be seen from the above, the inode structure includes the first identification information, so the first identification information of the first target file can be directly obtained from the inode structure.

[0118] An example of a file structure is as follows:

[0119] struct file {

[0120] / / Only save 1 layer of file name / directory

[0121] struct path f_path;

[0122] / / Cached data can be obtained without lock

[0123] struct inode *f_inode;

[0124] …

[0125] }

[0126] As can be seen from the above, the file structure includes a pointer to the inode structure, so the inode structure can be found according to the pointer, thereby obtaining the first identification information in the inode structure.

[0127] Since the file structure and the inode structure are basic data structures, the electronic device can easily obtain the first identification information, thereby providing a basis for executing subsequent steps.

[0128] S220: Determine first path information corresponding to the first identification information through a first BPF map.

[0129] Exemplarily, after acquiring the first identification information, first path information corresponding to the first identification information is determined, wherein the first path information is used to indicate a storage address of the first target file in the storage space of the electronic device.

[0130] In one implementation, the electronic device pre-stores the target association relationship between the first identification information and the first path information in a first BPF map. For example, in step S211, at the creation point of the inode (i.e., when the inode is created, or after the inode is created), or when the first target file is opened, the target association relationship between the first identification information and the first path information is recorded in the first BPF map. A specific example is given below:

[0131] struct file *do_filp_open(int dfd,struct filename *pathname, conststruct open_flags *op)

[0132] {

[0133] struct nameidata nd;

[0134] int flags op->lookup_flags;

[0135] struct file *filp;

[0136] set nameidata(&nd, dfd, pathname, NULL);

[0137] filp path_openat(&nd, op, flags LOOKUP_RCU);

[0138] if (unlikely(filp =ERR_PTR(-ECHILD)))filp path_openat(&nd,op,flags);

[0139] if (unlikely(filp =ERR_PTR(-ESTALE)))filp path_openat(&nd,op,flagsLOOKUP_REVAL);

[0140] restore_nameidata();

[0141] return filp;

[0142] }

[0143] It should be noted here that the process of creating an inode generates first identification information and determines the storage location of the first target file (i.e., the first path information). At this time, the target association relationship between the first identification information and the first path information is stored in the first BPF map. This ensures that the first path information can be captured as soon as possible at the moment of file creation. This can minimize the situation where the target association relationship cannot be found from the first BPF map when observing the first target file.

[0144] It is understandable that when opening the first target file, if the inode of the first target file has not been created, the creation of the inode of the first target file is triggered first. Therefore, the above target association relationship can also be recorded in the first BPF map when opening the first target file.

[0145] In addition, BPF map can also be called eBPF map, which is a set of mapping relationships. BPF map is a mechanism provided by eBPF technology to support data sharing between kernel space and user space. It allows eBPF programs to store and retrieve data in kernel space, and can also access and modify this data through user-mode tools. BPF map supports a variety of data structures, such as hash tables, arrays, queues, etc., which can meet the data storage and retrieval needs in different scenarios. It can be seen that BPF map can be used to realize two-way data exchange between kernel eBPF programs and user applications, and is an important basic data structure in eBPF technology. Therefore, storing the above-mentioned target association relationship in the first BPF map can facilitate the software modules in user space and kernel space to obtain the target association relationship, thereby providing technical support for the execution of subsequent solutions.

[0146] In an optional solution, the life cycle of the first BPF map can be managed. For example, the life cycle of the first BPF map is set to be from the beginning to the end of the trace, that is, the first BPF map is generated after the kernel observation starts, and the first BPF map is cleared after the kernel observation ends. This can not only play the role of the first BPF map in the entire kernel observation cycle, but also reduce the maintenance time of the first BPF map and save resources.

[0147] It is understandable that step S220 can be executed by a software module inside the electronic device. This application does not limit the location of the software module, that is, the software module can be in the user space of the electronic device or in the kernel space of the electronic device.

[0148] by Figure 2 Take the software architecture diagram in as an example: In one possible implementation, the processing module in the user space 101 can be used to execute step S220. In this implementation, step S220 includes: reading the target association relationship from the first BPFmap through the processing module, and the processing module is located in the user space of the electronic device; based on the target association relationship, determining the first path information corresponding to the first identification information through the processing module. In a further possible implementation, the target association relationship can be read and the first path information can be matched through the processing module only when the amount of data to be observed is greater than or equal to a preset threshold, wherein the first target file is associated with the data to be observed.

[0149] Understandably, if the amount of data to be observed is relatively large (e.g., greater than or equal to a preset threshold), using a kernel-space module for path matching may affect kernel-space response speed. In severe cases, this may cause system lag or even crashes, impacting the user experience. However, the impact of user-space overhead on user experience is relatively small. Therefore, if the amount of data to be observed is relatively large, using a user-space software module (i.e., a processing module) for batch path matching can improve efficiency, reduce kernel-space usage, and enhance system fluency.

[0150] In another possible implementation, step S220 may also be performed using a kernel observation module in kernel space 102. In this implementation, step S220 includes: reading a target association relationship from a first BPF map via a kernel observation module located in the kernel space of the electronic device; and determining, via the kernel observation module, first path information corresponding to the first identification information based on the target association relationship. In a further possible implementation, the target association relationship may be read and the first path information may be matched via the processing module only when the amount of data to be observed is less than a preset threshold.

[0151] It's understandable that if the amount of data to be observed is relatively small (e.g., below a preset threshold), using a kernel-space module (such as the kernel observation module) for path matching will not significantly impact kernel-space response speed. Because kernel-space modules can directly access the kernel and file subsystems, using the kernel observation module for path matching improves path matching efficiency, enables real-time data tracking, and significantly enhances the precision and accuracy of file I / O problem analysis.

[0152] Based on the above solution, the electronic device can store the target association relationship between the first identification information and the first path information of the first target file in the first BPF map at the creation point of the inode of the first target file, that is, maintain the target association relationship in the first BPF map. When it is determined that the first target file is to be observed, the first identification information is obtained and the target association relationship is read from the first BPF map. Finally, the first path information corresponding to the first target file can be determined based on the first identification information and the target association relationship. In this solution, the first path information of the first target file can be quickly determined directly through the pre-recorded target association relationship. Compared with the above-mentioned solution one, this solution does not need to re-parse the file path, which can reduce frequent access to the file path, thereby reducing the probability of lock conflicts, livelocks, deadlocks and other problems. In addition, this solution can support recording the association relationships corresponding to any number of files (that is, the association relationship between the file identification information and the path information), without being restricted by the number of trace points, so any number of files can be observed. That is to say, at any location observable by the kernel, when we need to observe a certain file, we only need to obtain the file identification information, and then we can determine the file path information through the first BPF map. Compared with the above-mentioned solution two, the number of observable files is greatly increased, thereby improving the accuracy of file I / O problem analysis.

[0153] It is understood that the present application does not limit the duration of maintaining the target association relationship in the first BPF map. The target association relationship can be maintained persistently or cleared when needed. The present application does not impose any restrictions on this. Several possible examples are given below.

[0154] Optionally, in one possible implementation, the target association relationship is persistently maintained in the first BPF map. Since the first target file is dynamic in the system, it may be deleted or destroyed at any time. By persistently maintaining the target association relationship, even if the first target file is subsequently deleted, the first target file can still be analyzed and tracked based on the target association relationship maintained in the first BPF map, providing data support for system optimization and security analysis. That is to say, in the case that the first target file is deleted or destroyed, the electronic device continues to maintain the target association relationship in the first BPF map. This persistence mechanism can be implemented through a database or log file to ensure data integrity and traceability.

[0155] Optionally, in another possible implementation, when the size of the first BPF map exceeds a preset warning value, space recovery is performed. It is understandable that the first BPF map usually records multiple sets of association relationships (the association relationship refers to the association relationship between the path information and identification information of the file to be observed), and the target association relationship is only one of them. If there is a lot of data to be observed, the information recorded in the first BPF map will become more and more, and may exceed the set maximum value of the first BPF map, thereby causing subsequent new data recording to fail. In this case, a preset warning value can be set. If the size of the first BPF map exceeds the preset warning value, some association relationships need to be deleted to ensure that there is enough space in the first BPF map to record new information.

[0156] In one example, some associations can be deleted according to a preset rule. For example, the preset rule is: if a file's inode has not been deleted, the association corresponding to the file is deleted. In other words, if a file's inode has been deleted, the association corresponding to the file is retained. This is because if a file's inode has been deleted, it is difficult to obtain the file's corresponding path information through methods other than the first BPF map. If the association corresponding to the file is deleted from the first BPF map, subsequent effective observation of the file becomes difficult. Conversely, if a file's inode has not been deleted, it is possible to query the file's path information through methods other than the first BPF map. That is, even if the association corresponding to the file has been deleted from the first BPF map, it is still possible to continue observing the file, though the efficiency may be lower. For example, the full path of a file can be queried using the lsof command based on the file's identification information. For example, a separate thread is first set up to query the size of the first BPF map at a second preset period, i.e., periodically checking the size of the first BPF map, for example, every 10 seconds. When the first BPF map is greater than or equal to the preset warning value, the independent thread traverses the first BPF map to query whether the inodes corresponding to the multiple groups of association relationships in the first BPF map exist. If the inodes corresponding to some association relationships do not exist, these association relationships continue to be saved; if the inodes corresponding to some association relationships still exist, these association relationships are removed from the first BPF map to reclaim space. Taking the first target file involved in the embodiment of the present application as an example: the size of the first BPF map is queried by an independent thread according to the second preset period. When the first BPF map is greater than or equal to the preset warning value, check whether the inode corresponding to the first target file still exists in the file system of the electronic device. If the inode still exists in the file system, delete the target association relationship from the first BPF map; or, if the inode no longer exists in the file system, continue to maintain the target association relationship in the first BPF map.

[0157] Optionally, in a possible implementation, only the association relationships corresponding to some files can be recorded in the first BPF map. That is, the association relationships corresponding to all files are not saved in the first BPF map, so that in most scenarios, the size of the first BPF map can be prevented from exceeding the preset warning value, and there is no need to perform the above-mentioned space recovery operation. In one example, files can be filtered by thread and / or process. For example, when the thread corresponding to a file is a preset thread, and / or when the process corresponding to a file is a preset process, the association relationship corresponding to the file is stored in the first BPF map. In other words, this solution only focuses on files of specific threads and / or processes, thereby reducing unnecessary data collection and processing. Such a filtering mechanism can significantly improve the performance of the system, especially in a high-load environment.

[0158] For example, at the creation point of the inode of the first target file, the identifier of the thread corresponding to the first target file (referred to as the first thread identifier) is queried. If the first thread identifier is the same as the preset thread identifier, the target association relationship corresponding to the first target file is recorded in the first BPF map; otherwise, the target association relationship corresponding to the first target file is not recorded in the first BPF map.

[0159] For another example, at the creation point of the inode of the first target file, the identifier of the process corresponding to the first target file (referred to as the first process identifier) is queried. If the first process identifier is the same as the preset process identifier, the target association relationship corresponding to the first target file is recorded in the first BPF map; otherwise, the target association relationship corresponding to the first target file is not recorded in the first BPF map.

[0160] For another example, at the creation point of the inode of the first target file, the thread identifier (referred to as the first thread identifier) and the process identifier (referred to as the first process identifier) corresponding to the first target file are queried. If the first thread identifier is the same as the preset thread identifier, and the first process identifier is the same as the preset process identifier, the target association relationship corresponding to the first target file is recorded in the first BPF map. Otherwise, the target association relationship corresponding to the first target file is not recorded in the first BPF map.

[0161] It is understandable that in a file system, as a large number of files are created and deleted, there may be a conflict in the identification information of two files. For example, after a file is deleted for a period of time, the system may assign its identification information to other files. At this time, it may appear that the identification information in the two associations in the first BPF map is the same, that is, the keys of two data items in the first BPF map are the same, and there is no complex conflict resolution mechanism in the BPF technology, which may cause errors in subsequent path matching. In order to minimize this risk, the embodiment of the present application also provides a conflict handling mechanism, which supports the transfer of conflicting associations to an additional BPFmap (referred to as the second BPF map) to ensure that the data in the original first BPF map is not abnormal.

[0162] For example, the electronic device can check the multiple groups of association relationships in the first BPF map according to the first preset period. For example, the multiple groups of association relationships in the first BPF map are checked every 30 seconds. In the case that the first identification information corresponding to at least two groups of association relationships in the first BPF map is the same, the at least two groups of association relationships are stored in the second BPF map, and the second BPF map is different from the first BPF map. That is, the electronic device maintains an additional second BPF map on the basis of the first BPF map. If a conflicting relationship is found (that is, the identification information in two or more association relationships is the same), these conflicting association relationships are stored in the second BPF map and deleted from the first BPF map. In this way, the uniqueness of the identification information of each association relationship stored in the first BPF map can be ensured.

[0163] In the above example, the second BPF map records the conflicting association relationship. Subsequent electronic devices can use the first BPF map and the second BPF map at the same time for path matching. For example, when it is determined that the second target file is to be observed, the second identification information corresponding to the second target file is obtained, and the second identification information is used to uniquely identify the inode of the second target file. First, you can use the second identification information to search from the first BPF map. If no corresponding result is retrieved, continue to search from the second BPF map. If there is an association relationship between the second identification information and the second path information in the second BPF map, the second path information can be determined as the path information of the second target file.

[0164] It is understood that because the second BPF map is used to store conflicting relationships, searching the second BPF map using the second identification information may result in finding two or more sets of relationships. In this case, the path information in all found relationships can be recorded and observed in sequence; alternatively, the path information in one of the relationships can be randomly selected for observation; or alternatively, the path information in the most recently recorded relationship can be selected for observation. This application does not limit this.

[0165] S230: Observe the first target file according to the first path information.

[0166] Exemplarily, after obtaining first path information corresponding to the first target file, the first target file is observed based on the first path information. Specifically, the first target file can be observed based on a file observation indicator corresponding to the first target file, where the file observation indicator is used to tune the system performance of the electronic device, and the file observation indicator may include, for example, one or more of the following: a read step length of the first target file, or a hot / cold state of the first target file, or a pre-read parameter of the first target file, or a file page bumping condition of the first target file.

[0167] In summary, an embodiment of the present application provides a file observation method that allows for the safe and accurate acquisition of the path information of a target file for file observation. This solution can not only reduce the probability of problems such as lock conflicts, livelocks, and deadlocks, but also allow for the observation of any number of tracking points. In this solution, by using the unique identifier of the target file to match the corresponding path information, high-precision acquisition of the path information can be achieved, and the overall level of kernel observability can be greatly improved, providing developers and operation and maintenance personnel with more powerful tool support.

[0168] For example, in an exemplary scenario, file page thrashing may cause system cold start performance to deteriorate. The solution of the present application can accurately locate the specific path of the file that causes the cold start performance deterioration and produces thrashing, so that targeted performance optimization can be performed. Figure 4 A statistical diagram of the number of thrashing times corresponding to different files in an actual application scenario is given. It should be understood that Figure 4 The horizontal axis represents different files (the numbers on the horizontal axis can be regarded as the identification of different files). Figure 4The vertical axis represents the number of filemapfaluts corresponding to the file, i.e., the number of file thrashings. The solid line in the figure represents the statistical data under heavy load, while the dashed line represents the statistical data under unloaded load. Based on the statistical data, the files to be observed can be determined. For example, the three files with the most thrashings can be identified as the files to be observed. Based on the solution provided in the embodiments of the present application, the association relationship corresponding to each file (i.e., the association relationship between the file's identification information and path information) is pre-stored in the BPF map at the creation point of the inode corresponding to each file. After the files to be observed are determined, the corresponding path information can be obtained by matching the identification information of the files to be observed with the association relationship stored in the BPF map. The query results are shown in Table 1. In addition to the file name and path information (path), Table 1 also includes data such as the number of empty loads (count-empty), the number of heavy loads (count-heavy), the time spent in empty loads (dur-empty), and the time spent in heavy loads (dur-heavy). This data can provide a reference when analyzing and processing the files to be observed. However, this data is used as an example in this application only; other types of data can also be used in actual scenarios.

[0169] Table 1

[0170]

[0171] In addition, in an optional solution, the target association relationship of the target file is maintained through persistence, so that the path tracking capability of the file can be maintained even after the target file is deleted.

[0172] In another optional solution, by performing conflict management on the association relationships maintained in the first BPF map, the stability and performance of the system can be further improved.

[0173] Figure 4 A software architecture diagram for applying the present application scheme is shown below, which is briefly described. Figure 4In the software architecture diagram shown, at the creation point of the inode of the first target file, the kernel observation module in the kernel space 102 serves as the execution subject, and stores the association relationship between the first path information and the first identification information of the first target file in the first BPF map. It can be understood that the data in the first BPF map is shared data between the user space and the kernel space. Therefore, when it is determined to observe the first target file, the kernel observation module or the processing module can obtain the target association relationship from the first BPF map, and perform path matching based on the target association relationship, thereby obtaining the first path information of the first target file. Optionally, when the amount of data to be observed is relatively large, the processing module of the user space 101 can query the target association relationship and perform path matching, and when the amount of data to be observed is relatively small, the kernel observation module of the kernel space can query the target association relationship and perform path matching.

[0174] Corresponding to the methods provided in the above-mentioned method embodiments, the embodiments of the present application also provide corresponding electronic devices. Figure 6 A structural diagram of an electronic device 300 provided in an embodiment of the present application is shown. The electronic device 300 includes: at least one processor 310 and at least one memory 320.

[0175] As an example, the storage 320 includes a memory and a hard disk, and data input, reading, and storage are all carried out back and forth between them.

[0176] Memory can include random access memory (RAM), read-only memory (ROM), and cache. Memory is the workspace of electronic device 300, providing operating space for electronic device 300 and temporarily storing data generated by programs. However, since memory typically uses semiconductor storage cells, data is lost after a power outage. To preserve data, a storage device, a hard disk, is required that persists even after a power outage.

[0177] The following is an example of a hard disk structure. A hard disk is divided into two areas. One is the inode area, which stores file attribute information contained in the inode. The other is the data area, which stores file data, that is, the actual file content. The file attribute information stored in the inode area includes directory entries and inodes. Directory entries record the file name (i.e., file name), inode pointers, and their relationships with other directory entries. Multiple associated directory entries constitute the file system's directory structure. Inodes record file metadata. Inodes correspond one-to-one to files and are persistently stored on disk.

[0178] An index node includes the inode number, file size, read / write permissions, file type, modification time, access time, and more. It also contains a pointer to the file entity, but does not include the file name. This is because each inode has an inode number. When a terminal device opens a file, it uses the inode number to identify different files, regardless of the file name.

[0179] For example, the data area includes an index node area and a data block area. The index node area is used to store index nodes, and the data block area is used to store the actual content of the file.

[0180] In the solution provided by the embodiment of the present application, at the creation point of the inode of the target file, or when the target file is opened, the target association relationship between the identification information and the path information of the target file is stored in the BPF map in the memory. The eBPF program can directly access and operate these BPF map data stored in the memory during runtime. For example, both the user space program and the kernel space program can access and operate the BPF map to realize data exchange between the kernel space and the user space. Therefore, when it is determined that the target file is to be observed, the kernel space program (such as Figure 5 The kernel observation module in the BPF map reads the BPF map from the memory and searches for the path information corresponding to the target file through path matching; or, it can be done by a user space program (such as Figure 5 The processing module in the process reads the BPF map from the memory and searches for the path information corresponding to the target file through path matching.

[0181] It is understood that the memory may store computer executable program code, which includes instructions. The processor 310 may control the electronic device 300 to execute the file observation method provided by the present application by running the instructions stored in the memory.

[0182] It is also understandable that the electronic device 300 may further include Figure 6 This application does not limit other hardware structures not shown, such as display screens, sensors, cameras, communication modules, speakers, microphones, headphone jacks, etc.

[0183] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned various method embodiments can be implemented.

[0184] An embodiment of the present application provides a computer program product. When the computer program product runs on a device, the device can implement the steps in the above-mentioned method embodiments when the computer program product is executed.

[0185] The present application provides a chip for executing instructions. When the chip is running, the technical solution of the above embodiment is executed. The implementation principle and technical effect are similar and will not be described here.

[0186] In the above embodiments, all or part of the embodiments can be implemented using software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer, or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a high-density digital video disc (DWD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0187] If the integrated unit is implemented as a software functional unit and sold or used as a standalone product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application can implement all or part of the process steps in the above-mentioned method embodiments by using a computer program to instruct the relevant hardware. The computer program can be stored in a computer-readable storage medium. When executed by a processor, the computer program can implement the steps of each of the above-mentioned method embodiments. The computer program includes computer program code, which can be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a camera / electronic device, recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signals, telecommunication signals, and software distribution media. Examples include USB flash drives, removable hard drives, magnetic disks, or optical disks. In some jurisdictions, based on legislation and patent practice, computer-readable media cannot be electric carrier signals or telecommunication signals.

[0188] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0189] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0190] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0191] It should be understood that the “embodiment” mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, the various embodiments in the entire specification do not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in the various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.

[0192] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.

[0193] In addition, it should be noted that the various numerical references used in this application (such as the terms "first," "second," "third," "fourth," and other terminology (if any) in the specification, claims, and accompanying drawings) are provided for descriptive purposes only and are not intended to limit the scope of this application. The sequence numbers of the various processes do not imply a specific order of execution; the execution order of the processes should be determined by their functionality and inherent logic.

[0194] The terms "including" and "having" and any variations thereof mean "including but not limited to," unless specifically stated otherwise. For example, a process, method, system, product, or apparatus that includes a series of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, product, or apparatus.

[0195] In the embodiments of this application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplarily" or "for example" in the embodiments of this application should not be construed as preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplarily" or "for example" is intended to present the relevant concepts in a concrete manner.

[0196] In the various embodiments of this application, unless otherwise specified or logically conflicting, the terms and / or descriptions between different embodiments are consistent and can be referenced from each other. The technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships. The specific operating methods in the method embodiments of this application can also be applied to the device embodiments or system embodiments.

Claims

1. A file observation method, characterized in that: Applied to electronic equipment, the method includes: Obtaining first identification information corresponding to a first target file, where the first identification information is used to uniquely identify an inode of the first target file; Determining first path information corresponding to the first identification information through a first BPF map, wherein the BPF map is Berkeley packet filter mapping information, a target association relationship between the first identification information and the first path information is pre-recorded in the first BPF map at the creation point of the inode or when the first target file is opened, the first path information is used to indicate a storage address of the first target file in a storage space of the electronic device, and the first BPF map is generated when a kernel observation task is started; observing the first target file according to the first path information; If the first BPF map is greater than or equal to a preset warning value, checking whether the inode corresponding to the first target file still exists in the file system of the electronic device; If the inode still exists in the file system, delete the target association relationship from the first BPF map; or, if the inode no longer exists in the file system, continue to maintain the target association relationship in the first BPF map; After the kernel observation task is completed, the first BPF map is cleared.

2. The method according to claim 1, characterized in that The method further comprises: When the first target file is deleted or destroyed, the target association relationship continues to be maintained.

3. The method according to claim 1 or 2, characterized in that The method further comprises: When the thread corresponding to the first target file is a preset thread, and / or when the process corresponding to the first target file is a preset process, the target association relationship is recorded in the first BPF map.

4. The method according to claim 1 or 2, characterized in that The determining, by using the first BPF map, the first path information corresponding to the first identification information includes: Reading the target association relationship from the first BPF map by a processing module, where the processing module is located in a user space of the electronic device; Based on the target association relationship, the first path information corresponding to the first identification information is determined by the processing module.

5. The method according to claim 4, characterized in that The determining, by the processing module, first path information corresponding to the first identification information includes: When the amount of the data to be observed is greater than or equal to a preset threshold, the processing module determines the first path information corresponding to the first identification information, and the first target file is associated with the data to be observed.

6. The method according to claim 1 or 2, characterized in that The determining, by using the first BPF map, the first path information corresponding to the first identification information includes: Reading the target association relationship from the first BPF map through a kernel observation module, where the kernel observation module is located in a kernel space of the electronic device; Based on the target association relationship, the first path information corresponding to the first identification information is determined by the kernel observation module.

7. The method according to claim 6, characterized in that The determining, by the kernel observation module, the first path information corresponding to the first identification information includes: When the amount of the data to be observed is less than a preset threshold, the kernel observation module determines the first path information corresponding to the first identification information, and the first target file is associated with the data to be observed.

8. The method according to claim 1 or 2, characterized in that The obtaining of first identification information corresponding to the first target file includes: The first identification information is obtained through the file structure and / or inode structure corresponding to the first target file.

9. The method according to claim 1 or 2, characterized in that The first BPF map records a plurality of association relationships, wherein the plurality of association relationships include the target association relationship; The method further comprises: Checking the plurality of association relationships in the first BPF map according to a first preset period; When there are at least two groups of association relationships in the first BPF map and the first identification information corresponding to the same group is the same, the at least two groups of association relationships are stored in a second BPF map, and the second BPF map is different from the first BPF map.

10. The method according to claim 9, characterized in that After storing the at least two sets of association relationships in the second BPF map, the method further includes: Obtain second identification information corresponding to the second target file, where the second identification information is used to uniquely identify an inode of the second target file; Determining, by the second BPF map, second path information corresponding to the second identification information, wherein the at least two sets of association relationships include an association relationship between the second identification information and the second path information; The second target file is observed through the second path information.

11. The method according to claim 1 or 2, characterized in that The method further comprises: The size of the first BPF map is queried according to a second preset period by an independent thread.

12. The method according to claim 1 or 2, characterized in that The observing the first target file according to the first path information includes: Obtain a file observation indicator corresponding to the first target file, where the file observation indicator is used to optimize the system performance of the electronic device, and the file observation indicator includes one or more of the following: The read step length of the first target file, or the hotness or coldness of the first target file, or the pre-read parameter of the first target file, or the file page bumping condition of the first target file.

13. An electronic device, characterized in that: The electronic device comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the electronic device implements the method according to any one of claims 1 to 12.

14. A chip system, characterized in that: The chip system is applied to an electronic device, and the chip system includes one or more processors, and the one or more processors are used to call computer instructions so that the electronic device executes the method as described in any one of claims 1-12.

15. A computer program product, characterized in that The invention comprises a computer program, which, when being executed, enables the method according to any one of claims 1 to 12 to be performed.

Images