CN114840433A

CN114840433A - Method and device for managing kernel configuration

Info

Publication number: CN114840433A
Application number: CN202210542848.1A
Authority: CN
Inventors: 陈青松; 喻望; 晏艳; 刘守业
Original assignee: Alipay Hangzhou Information Technology Co Ltd
Current assignee: Alipay Hangzhou Information Technology Co Ltd
Priority date: 2022-05-18
Filing date: 2022-05-18
Publication date: 2022-08-02

Abstract

The present disclosure provides a method and apparatus for managing kernel configuration. The method comprises the following steps: running a first business system in an operating system; in the running process of the first service system, testing at least part of kernel configuration items in a kernel of the operating system to determine the code coverage rate of the at least part of kernel configuration items; and cutting the codes of at least part of the kernel configuration items according to the code coverage rate of at least part of the kernel configuration items.

Description

Method and device for managing kernel configuration

Technical Field

The present disclosure relates to the field of computer technologies, and in particular, to a method and an apparatus for managing kernel configuration.

Background

In order to support various service systems to normally run in the kernel of the operating system, many kernel configuration items need to be arranged in the kernel to provide different functions for different service systems. Taking Linux operating system as an example, currently, more than 5000 kernel configuration items are provided in Linux operating system to support the running of various types of service systems. However, the excessive kernel configuration items make the code of the kernel configuration items in the kernel longer, and the overlong code causes the installation and/or upgrade of the kernel to take longer time.

Disclosure of Invention

In view of the above, the embodiments of the present disclosure are directed to a method and apparatus for managing kernel configuration.

In a first aspect, a method for managing kernel configuration is provided, including: running a first business system in an operating system; in the running process of the first service system, testing at least part of kernel configuration items in a kernel of the operating system to determine the code coverage rate of the at least part of kernel configuration items; and cutting the codes of at least part of the kernel configuration items according to the code coverage rate of at least part of the kernel configuration items.

In a possible implementation manner, the cutting the code of the at least part of the kernel configuration items according to the code coverage of the at least part of the kernel configuration items includes: and if the code coverage rate of a first kernel configuration item in the at least part of kernel configuration items is zero, deleting the first kernel configuration item from the kernel of the operating system.

In a possible implementation manner, the cutting the code of the at least part of the kernel configuration items according to the code coverage of the at least part of the kernel configuration items includes: and if the code coverage rate of a second kernel configuration item in the at least part of kernel configuration items is larger than zero and smaller than a preset threshold value, deleting the unexecuted codes in the second kernel configuration item from the second kernel configuration item.

In a possible implementation manner, the at least part of the kernel configuration items include a first kernel configuration item and a second kernel configuration item, and the first kernel configuration item and the second kernel configuration item correspond to different clipping policies.

In a possible implementation manner, before the first service system is run in the operating system, the method further includes: and performing code instrumentation on the at least part of kernel configuration items in the operating system to acquire the code coverage rate of the at least part of kernel configuration items.

In a possible implementation manner, the operating system is a Linux system, the Linux system is deployed with a container, and the first service system runs in the container.

In a second aspect, an apparatus for managing kernel configuration is provided, including: the processing unit is used for running a first business system in the operating system; the test unit is used for testing at least part of kernel configuration items in the kernel of the operating system in the running process of the first service system so as to determine the code coverage rate of the at least part of kernel configuration items; and the cutting unit is used for cutting the codes of at least part of the kernel configuration items according to the code coverage rate of at least part of the kernel configuration items.

In a possible implementation manner, the clipping unit is further configured to: and if the code coverage rate of a first kernel configuration item in the at least part of kernel configuration items is zero, deleting the first kernel configuration item from the kernel of the operating system.

In a possible implementation manner, the clipping unit is further configured to: and if the code coverage rate of a second kernel configuration item in the at least part of kernel configuration items is larger than zero and smaller than a preset threshold value, deleting the unexecuted codes in the second kernel configuration item from the second kernel configuration item.

In a possible implementation manner, the processing unit is further configured to: and performing code instrumentation on the at least part of kernel configuration items in the operating system to acquire the code coverage rate of the at least part of kernel configuration items.

In a third aspect, there is provided an apparatus for managing kernel configuration, where the apparatus has the function of implementing the apparatus for managing kernel configuration in the method design of the first aspect. These functions may be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more units corresponding to the above functions.

In a fourth aspect, an apparatus for managing core configuration is provided that includes a processor and a memory. The memory is used for storing a computer program, and the processor is used for calling and running the computer program from the memory, so that the device for managing the kernel configuration executes the method in the first aspect.

In a fifth aspect, there is provided a computer program product comprising: computer program code which, when run on a computer, causes the computer to perform the method of the above-mentioned aspects.

In a sixth aspect, a computer-readable medium is provided, which stores program code, which, when run on a computer, causes the computer to perform the method of the above-mentioned aspects.

During the running process of the first service system, testing at least part of kernel configuration items in the kernel of the operating system to determine the code coverage rate of at least part of kernel configuration items; and cutting the codes of at least part of the kernel configuration items according to the code coverage rate of at least part of the kernel configuration items. The method and the device avoid the situation that in the traditional operation process of the first service system, the kernel contains too many kernel configuration items which are irrelevant to the operation of the first service system, and are beneficial to reducing the code length of the kernel configuration items in the kernel so as to shorten the time for installing and/or upgrading the kernel.

Drawings

Fig. 1 is a schematic diagram of an architecture to which the present disclosure is applicable.

Fig. 2 is a schematic flow chart diagram of a method of managing kernel configuration according to an embodiment of the present disclosure.

Fig. 3 is an architecture diagram of an apparatus for managing kernel configuration, to which another embodiment of the present disclosure is applicable.

Fig. 4 is a schematic flow chart diagram of a method of managing kernel configuration according to another embodiment of the present disclosure.

Fig. 5 is a schematic diagram of an apparatus for managing kernel configuration according to an embodiment of the present disclosure.

Fig. 6 is a schematic block diagram of an apparatus of another embodiment of the present disclosure.

Detailed Description

The technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the drawings in the embodiments of the present disclosure, and it is obvious that the described embodiments are only a part of the embodiments of the present disclosure, and not all of the embodiments.

For ease of understanding, the following first presents an architecture to which the embodiments of the present disclosure are applicable, and terms to which the present disclosure pertains, in conjunction with fig. 1. The architecture 100 shown in fig. 1 includes a hardware device 110 and an operating system 120.

The hardware device 110, which may also be referred to as "computer hardware," includes hardware devices such as a CPU, a hard disk, and an Input/Output (I/O) device. In general, hardware devices 110 may provide computing resources and storage resources for the operation of business systems.

The operating system 120 is essentially a program, consisting of many source files, which need to be compiled into an operating system program. It mainly serves to manage the hardware device 110 and provide an execution environment for the application program. Such as operating systems like Linux, Windows, Android, etc.

A Kernel (Kernel) may be the most basic part of the operating system 120 and may provide secure access to computer hardware for a number of business systems (e.g., applications, containers, etc.). Typically, such access is limited and the kernel determines when and for how long a business system can operate on some portion of the hardware in hardware device 110. The business system is very complex to operate directly on the hardware, so a hardware abstraction method can be provided by the kernel to help the business system access the hardware device. After the kernel is introduced, the service system can indirectly control the required hardware resources (particularly, CPU and IO devices) through an interprocess communication mechanism and a system call. Taking Linux operating system as an example, a kernel conforming to POSIX standard and a set of Application Programming Interfaces (APIs) are provided, so that the service system can interact with hardware through the kernel through the interface.

Since the service system needs to access the hardware device through the kernel, the kernel needs to provide the required functions (or feature support) for the operation of the service system. Currently, the kernel can provide the required functions for the operation of the service system through kernel configuration items.

Taking Linux operating system as an example, the kernel configuration items in the kernel generally include: general core configuration items, core configuration items related to loadable modules, core configuration items related to block device layers, core configuration items related to bus support, core configuration items related to core features, and the like.

Accordingly, a developer may customize the kernel based on settings for the kernel configuration items. In some implementations, the developer may have three options for each kernel configuration item. In the first option, the developer may choose to compile kernel configuration items into the kernel. In the second selection mode, the developer can choose to compile the kernel configuration item into a loadable module. In the third selection mode, the developer can configure the kernel not to provide the function corresponding to the kernel configuration item.

Virtualization (Virtualization)

Virtualization technology is a resource management technology, and can present various hardware devices (CPU, memory, disk space, network adapter, etc.) of a computer after abstraction and conversion, so as to be divided and combined into a configuration environment of one or more computers. Thus, the barrier of non-cuttability among entity structures is broken, and the resources provided by the hardware devices can be applied by a user in a better mode than the original configuration. The virtualized resources may not be limited by existing hardware installation, geographic or physical configurations.

Container (Container)

Containers can utilize resource separation mechanisms in the kernel (e.g., cgroups provided by linux operating systems), as well as namespaces (namespaces), to create independent runtime environments. The support of the kernel to the name space completely isolates the resources of the service system in the working environment. The resource isolation mechanism provides resource isolation, including, for example, isolation of hardware resources such as CPU, memory, block I/O, and network. Therefore, the container is more portable, and hardware equipment can be effectively utilized. Currently, due to the standardization of containers, containers can be deployed anywhere regardless of Infrastructure (Infrastructure) differences.

Yunsheng (Cloud Native)

The method is a method for constructing and running the application program, and is a set of technical system and methodology. The cloud native technology is beneficial to the establishment and the operation of elastically expandable application of various organizations in novel dynamic environments such as public cloud, private cloud, mixed cloud and the like. Representative technologies of cloud-native include containers, service grids, microservices, immutable infrastructure, and declarative application interfaces. These techniques enable the construction of a loosely coupled system that is fault tolerant, easy to manage, and easy to observe. In conjunction with reliable automation, cloud-native technology enables engineers to easily make frequent and predictable major changes to the system.

In order to support various service systems to normally run in the kernel of the operating system, many kernel configuration items need to be arranged in the kernel to provide different functions for different service systems. Taking Linux operating system as an example, currently, more than 5000 kernel configuration items are provided in Linux operating system to support the running of various types of service systems. However, too many kernel configuration items make the code of the kernel configuration items in the kernel longer, and on the one hand, the too long code causes a longer time for installing and/or upgrading the kernel. On the other hand, too long code may increase the attack surface of the code and reduce the security of the kernel.

The applicant has found that the kernel configuration items required by different types of business systems are often different, so that some kernel configuration items may be useless when running a certain business system or certain business systems in an operating system. Accordingly, applicants provide a method to manage kernel configuration. In the method, the kernel configuration item in the kernel can be cut based on a business system (hereinafter, also referred to as a first business system) running in the operating system, so as to reduce the code length of the kernel configuration item in the kernel. On one hand, the method is beneficial to reducing the time for installing and/or upgrading the kernel, on the other hand, the method is beneficial to reducing the code attack surface of the kernel and improving the security of the kernel.

The method for managing kernel configuration according to the embodiment of the present disclosure is described below with reference to fig. 2, where the method shown in fig. 2 includes steps S210 to S230. In some implementations, the method described in fig. 2 may be performed by a test system.

Step S210, running the first service system in the operating system.

In some implementations, the first business system can be an application, such as a web browser, a database, and the like. The container can efficiently utilize resources, and can be deployed to any operating system regardless of the difference of technical facilities (Infrastructure), so that the container is widely applied. Currently, applications can be distributed and deployed at the granularity of containers, which provide a standard way to package the code, configuration, dependencies of an application into a single object. Therefore, when the first business system is an application program, the first business system can run in a container of the operating system. Of course, in other implementations, the first service system may also be a container.

Step S220, in the running process of the first service system, testing at least part of kernel configuration items in the kernel of the operating system to determine the code coverage of at least part of kernel configuration items.

The kernel of the operating system may be a general-purpose kernel in the operating system. Of course, the kernel of the operating system may also be a client kernel, which is not limited in this embodiment of the present application.

The code coverage rate is used for indicating the proportion and the degree of the code of the kernel configuration item to be tested in the running process (or in the testing process) of the first service system. Generally, the code coverage rate of the kernel configuration item is low, which may mean that the kernel configuration item is used to a low degree in the test process. Conversely, a higher code coverage of a kernel configuration item may indicate a higher degree of use of the kernel configuration item during testing.

In some implementations, the code coverage of the kernel configuration item may be obtained by performing code instrumentation (also referred to as "program instrumentation") on the code of the kernel configuration item. Alternatively, before step S210, the method further includes: and performing code instrumentation on at least part of kernel configuration items in the operating system to acquire the code coverage rate of at least part of kernel configuration.

The code instrumentation of the kernel configuration item can be understood as that, on the basis of ensuring the original logic integrity of the code (i.e., the program under test) of the kernel configuration item, some probes (also called "detectors") are inserted into the code of the kernel configuration item, which are essentially code segments for information acquisition, for example, may be assignment statements or statements calling functions for acquiring coverage rate, characteristic data of the code operation of the kernel configuration item is thrown out through the execution of the probes, and the control flow and data flow information of the code of the kernel configuration item can be obtained through the analysis of the characteristic data, so as to obtain the code coverage rate of the kernel configuration item.

It should be noted that, in the embodiment of the present disclosure, only a part of the core configuration items in the core may be tested, which is beneficial to reducing the overhead required by the test process. Of course, in the embodiment of the present disclosure, all the core configuration items in the cores may also be tested, so as to improve the comprehensiveness of the test.

And step S230, cutting the codes of at least part of the kernel configuration items according to the code coverage rate of at least part of the kernel configuration items.

The above cutting of the code of the kernel configuration item may be understood as deleting all or part of the code corresponding to the kernel configuration item. When all the codes of the kernel configuration item are deleted, the kernel configuration item can be understood to be deleted from the kernel.

In what case, all code of the kernel configuration may be removed, and in what case, a portion of the code lines of the kernel configuration may be removed, which may be customized based on a clipping policy. For ease of understanding, two possible clipping strategies provided by embodiments of the present disclosure are described below.

In the clipping policy 1, if the code coverage of a certain kernel configuration item (also referred to as a "first kernel configuration item") in the kernel is zero, the first kernel configuration item may be deleted from the kernel.

If the code coverage of the first kernel configuration item is zero, it may be stated that, in the process of running the first service system, the code of the first kernel configuration item is not executed, that is, for the first service system, the first kernel configuration item is a useless kernel configuration item. At this point, the first kernel configuration item may be deleted from the kernel.

In the clipping policy 2, if the code coverage of a certain kernel configuration item (also referred to as a second kernel configuration item) in the kernels is greater than zero and less than a preset threshold, the unexecuted code in the second kernel configuration item is deleted from the second kernel configuration item.

If the code coverage rate of the second kernel configuration item is greater than zero and smaller than the preset threshold, it indicates that the executed degree of the second kernel configuration item is low in the operation process of the first service system. Some unexecuted code may be contained in the code of such kernel configuration item, and therefore, the unexecuted code line in such kernel configuration item may be deleted in the clipping policy 2.

It should be noted that the embodiment of the present disclosure may also be applicable to other clipping policies, for example, for the second kernel configuration item, the second kernel configuration item may also be directly deleted from the kernel. The embodiments of the present disclosure are not limited thereto.

In addition, in the embodiment of the present disclosure, the cutting policy 1 and the cutting policy 2 may be used alone or in combination with each other. When the cutting policy 1 and the cutting policy 2 are used in combination, it can be understood that the at least part of the kernel configuration items include a first kernel configuration item and a second kernel configuration item, and the first kernel configuration item and the second kernel configuration item correspond to different cutting policies.

The container can efficiently utilize resources, and can be deployed to any operating system regardless of the difference of technical facilities (Infrastructure), so that the container is widely applied. Currently, applications can be distributed and deployed at the granularity of containers, which provide a standard way to package the code, configuration, dependencies of an application into a single object. Therefore, when the first business system is an application program, the first business system can run in the container.

As introduced above, the first business system may be an application running in a container. Currently, some containers may contain a guest kernel (kernel) that may also provide some functionality for the running of applications. In some scenarios, the functionality provided by the client kernel for the application may be similar to the functionality provided by a kernel configuration item in a host kernel (also referred to as a general kernel) of the operating system, and in this case, the client kernel may support the running of the application instead of the kernel configuration item. At this time, the kernel configuration item may be understood as a useless kernel configuration item for the operation of the application program.

Under the above scenario, with the solution of the embodiment of the present disclosure, the kernel configuration item replaced by the client kernel may be tested, so that such kernel configuration item may also be deleted from the kernel.

In some scenarios, the core configuration item may include a plurality of source files, and in the process of determining the code coverage of the core configuration item, the code coverage of the plurality of source files may be considered comprehensively, which will be described below with reference to fig. 5, and for brevity, no further description is given here.

For ease of understanding, the method of the embodiment of the present disclosure is described below with reference to fig. 3 to fig. 4 by taking a Linux operating system (e.g., may be a certain release version of the Linux operating system) as an example. Fig. 3 is an architecture diagram of an apparatus 300 for managing kernel configuration to which embodiments of the present disclosure are applicable. It should be noted that the architecture shown in fig. 3 may be one possible implementation manner of the architecture to which the embodiment of the present disclosure is applicable. The apparatus to which the disclosed embodiments are applicable may also have other architectures, such as the apparatus shown in fig. 5 and 6.

Referring to fig. 3, the apparatus 300 may include a compiling module 310, a testing module 320, an analyzing module 330, and an optimizing module 340.

The compiling module 310 is configured to perform code instrumentation on the kernel configuration items in the kernel.

In some implementations, when compiling the kernel image of the Linux operating system, the compiling module 310 may analyze a source file list related to each kernel configuration item in the kernel of the Linux operating system, and perform code instrumentation on a code block related to the kernel configuration item in the source file, or add a piece of code for updating the code coverage statistics after an executable statement of the code block. In other implementations, the code coverage statistics may be configured to be stored in a target file. For example, it can be expressed as "code coverage file.

Generally, the compiling module 310 may be located on a physical machine having a Linux operating system.

The testing module 320 is configured to test at least part of kernel configuration items in a kernel of the operating system during the running process of the first service system, so as to determine the code coverage of at least part of kernel configuration items.

The operating system may be constructed from a kernel image generated by the compiling module 310. The testing module 320 may generate a code coverage file for the source file list configured by each kernel by using a program interface reserved when the compiling module 310 performs code instrumentation.

It should be noted that, for a scenario that needs to be compatible with multiple service systems, the testing module 320 tests at least a part of kernel configuration items in the kernels of the operating systems during the running process of the multiple service systems. The embodiments of the present disclosure are not limited thereto.

In addition, the test module 320 may be located on a real service system operating device. For example, when the first business system is a certain business system in the cloud, the testing module 320 may be located in the cloud. Of course, the test module 320 may also be located in the test system, and at this time, the test system may simulate the operation of the first service system.

The analysis module 330 is configured to generate a clipping suggestion for the kernel configuration item according to a source file list (denoted as "CONFIG _. filelist") associated with each kernel configuration and a code coverage file corresponding to the source file list. Wherein, the clipping suggestion comprises suggestion clipping and suggestion reservation.

As introduced above, some kernel configurations may contain multiple source files, and FIG. 4 shows the flow of the analysis module 330 in counting the code coverage of each of at least some of the kernel configurations. The method shown in fig. 4 is described by taking an example of analyzing all kernel configuration items in a kernel, and the method shown in fig. 4 includes steps S410 to S470.

In step S410, the analysis module 330 obtains a source file list of all kernel configuration items in at least part of the kernel configuration items.

In step S420, the analysis module 330 obtains the code coverage rate file of all the kernel configuration items in at least some of the kernel configuration items.

In step S430, the analysis module 330 determines whether at least some of the kernel configuration items have source file lists corresponding to kernel configuration items to be processed.

And if the source file list corresponding to the kernel configuration item to be processed does not exist, ending the analysis process. If the source file list corresponding to the core configuration item to be processed, step S440 is executed.

In step S440, the analysis module 330 obtains a source file list corresponding to the to-be-processed kernel configuration item.

In step S450, the analysis module 330 determines whether an unprocessed source file is contained in the source file list acquired in step S440.

If the analysis module 330 determines that no unprocessed source file is contained, step S430 is performed. If the analysis module 330 determines that an unprocessed source file is included, step S460 is performed.

In step S460, the analysis module 330 counts the code coverage of the kernel configuration item corresponding to the source file list acquired in step S440.

In some implementations, the analysis module 330 may store the code coverage rate of at least some of the kernel configuration items in an output file (which may be denoted as "CONFIG _. hit") of the analysis module 330, so that the code coverage rate of the kernel configuration items may be obtained by querying the output file later.

And the optimizing module 340 is configured to cut the code of at least part of the kernel configuration items according to the code coverage of at least part of the kernel configuration items.

In some implementations, the optimization module 340 can utilize the clipping policy 1 and the clipping policy 2 described above to clip the code of at least part of the kernel configuration item according to the code coverage of at least part of the kernel configuration item.

For example, if the code coverage of the kernel configuration item #1 in at least some of the kernel configuration items is zero, the optimization module 340 may directly delete the code of the kernel configuration item # 1.

For another example, if the code coverage of the core configuration item #2 in at least some of the core configuration items is smaller than the preset threshold and the code coverage of the core configuration item #2 is greater than zero, the optimization module 340 may delete the unexecuted code line in the code of the core configuration item #2 according to the line coverage result of the core configuration item # 2.

It should be noted that the code coverage of at least part of the kernel configuration items may be obtained from the output file of the analysis module 340.

Method embodiments of the present disclosure are described in detail above in conjunction with fig. 1-4, and apparatus embodiments of the present disclosure are described in detail below in conjunction with fig. 5-6. It is to be understood that the description of the method embodiments corresponds to the description of the apparatus embodiments, and therefore reference may be made to the preceding method embodiments for parts not described in detail.

Fig. 5 is a schematic diagram of an apparatus for managing kernel configuration according to an embodiment of the present disclosure. The apparatus 500 shown in fig. 5 comprises: a processing unit 510, a testing unit 520, and a clipping unit 530.

A processing unit 510, configured to run a first business system in an operating system;

a testing unit 520, configured to test at least part of kernel configuration items in a kernel of the operating system in an operating process of the first service system, so as to determine a code coverage rate of the at least part of kernel configuration items;

a clipping unit 530, configured to clip the code of the at least part of the kernel configuration items according to the code coverage of the at least part of the kernel configuration items.

In one possible implementation, the clipping unit is further configured to: and if the code coverage rate of a first kernel configuration item in the at least part of kernel configuration items is zero, deleting the first kernel configuration item from the kernel of the operating system.

In one possible implementation, the clipping unit is further configured to: and if the code coverage rate of a second kernel configuration item in the at least part of kernel configuration items is larger than zero and smaller than a preset threshold value, deleting the unexecuted codes in the second kernel configuration item from the second kernel configuration item.

In an alternative embodiment, the processing unit 510, the testing unit 520, and the clipping unit 530 may be a processor 620, and the apparatus may further include an input/output interface 630 and a memory 610, as shown in fig. 6.

Fig. 6 is a schematic block diagram of an apparatus of another embodiment of the present disclosure. The apparatus 600 shown in fig. 6 may include: memory 610, processor 620, input/output interface 630. The memory 610, the processor 620 and the input/output interface 630 are connected through an internal connection path, the memory 610 is used for storing instructions, and the processor 620 is used for executing the instructions stored in the memory 620, so as to control the input/output interface 630 to receive input data and information, output data such as operation results, and control the transceiver 640 to transmit signals.

It should be understood that, in the embodiment of the present disclosure, the processor 620 may adopt a general-purpose Central Processing Unit (CPU), a microprocessor, an Application Specific Integrated Circuit (ASIC), or one or more integrated circuits, for executing related programs to implement the technical solutions provided by the embodiments of the present disclosure.

The memory 610 may include a read-only memory and a random access memory, and provides instructions and data to the processor 620. A portion of processor 620 may also include non-volatile random access memory. For example, the processor 620 may also store information of the device type.

In implementation, the steps of the above method may be performed by integrated logic circuits of hardware or instructions in the form of software in the processor 620. The method for requesting uplink transmission resources disclosed in connection with the embodiments of the present disclosure may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor. The software module may be located in ram, flash memory, rom, prom, or eprom, registers, etc. storage media as is well known in the art. The storage medium is located in the memory 610, and the processor 620 reads the information in the memory 610 and performs the steps of the above method in combination with the hardware thereof. To avoid repetition, it is not described in detail here.

It should be understood that, in the embodiments of the present disclosure, the processor may be a Central Processing Unit (CPU), and the processor may also be other general-purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

It should be understood that in the embodiments of the present disclosure, "B corresponding to a" means that B is associated with a, from which B can be determined. It should also be understood that determining B from a does not mean determining B from a alone, but may be determined from a and/or other information.

It should be understood that the term "and/or" herein is merely one type of association relationship that describes an associated object, meaning that three relationships may exist, e.g., a and/or B may mean: a exists alone, A and B exist simultaneously, and B exists alone. In addition, the character "/" herein generally indicates that the former and latter related objects are in an "or" relationship.

It should be understood that, in various embodiments of the present disclosure, the sequence numbers of the above-mentioned processes do not mean the execution sequence, and the execution sequence of each process should be determined by its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present disclosure.

In the several embodiments provided in the present disclosure, it should be understood that the disclosed system, apparatus, and method may be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present disclosure may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit.

In the above embodiments, the implementation may be wholly or partially realized by software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. The procedures or functions described in accordance with the embodiments of the disclosure are, in whole or in part, generated when the computer program instructions are loaded and executed on a computer. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable device. The computer instructions may be stored on a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, from one website, computer, server, or data center to another website, computer, server, or data center via wire (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer readable storage medium may be any available medium that can be read by a computer or a data storage device including one or more available media integrated servers, data centers, and the like. The usable medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a Digital Versatile Disk (DVD)), or a semiconductor medium (e.g., a Solid State Disk (SSD)), among others.

The above description is only for the specific embodiments of the present disclosure, but the scope of the present disclosure is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present disclosure, and all the changes or substitutions should be covered within the scope of the present disclosure. Therefore, the protection scope of the present disclosure shall be subject to the protection scope of the claims.

Claims

1. A method of managing kernel configuration, comprising:

running a first business system in an operating system;

in the running process of the first service system, testing at least part of kernel configuration items in a kernel of the operating system to determine the code coverage rate of the at least part of kernel configuration items;

and cutting the codes of at least part of the kernel configuration items according to the code coverage rate of at least part of the kernel configuration items.

2. The method of claim 1, wherein the clipping the code of the at least partial kernel configuration item according to the code coverage of the at least partial kernel configuration item comprises:

and if the code coverage rate of a first kernel configuration item in the at least part of kernel configuration items is zero, deleting the first kernel configuration item from the kernel of the operating system.

3. The method of claim 1, wherein the clipping the code of the at least part of the kernel configuration item according to the code coverage of the at least part of the kernel configuration item comprises:

and if the code coverage rate of a second kernel configuration item in the at least part of kernel configuration items is larger than zero and smaller than a preset threshold value, deleting the unexecuted codes in the second kernel configuration item from the second kernel configuration item.

4. The method of claim 1, wherein the at least some kernel configuration items include a first kernel configuration item and a second kernel configuration item, and the first kernel configuration item and the second kernel configuration item correspond to different clipping policies.

5. The method of claim 1, prior to running the first business system in the operating system, the method further comprising:

and performing code instrumentation on the at least part of kernel configuration items in the operating system to acquire the code coverage rate of the at least part of kernel configuration items.

6. The method of claim 1, the operating system being a Linux system deployed with a container in which the first business system runs.

7. An apparatus to manage kernel configuration, comprising:

the processing unit is used for running a first business system in the operating system;

the test unit is used for testing at least part of kernel configuration items in the kernel of the operating system in the running process of the first service system so as to determine the code coverage rate of the at least part of kernel configuration items;

and the cutting unit is used for cutting the codes of at least part of the kernel configuration items according to the code coverage rate of at least part of the kernel configuration items.

8. The apparatus of claim 7, the cropping unit to further:

9. The apparatus of claim 7, the clipping unit to further:

and if the code coverage rate of a second core configuration item in the at least part of core configuration items is greater than zero and less than a preset threshold value, deleting the unexecuted codes in the second core configuration item from the second core configuration item.

10. The apparatus of claim 7, the at least some kernel configuration items comprising a first kernel configuration item and a second kernel configuration item, the first kernel configuration item and the second kernel configuration item corresponding to different clipping policies.

11. The apparatus of claim 7, the processing unit to further:

12. The apparatus of claim 7, the operating system being a Linux system deployed with a container in which the first business system runs.

13. An apparatus for managing kernel configuration, comprising a memory having stored therein executable code and a processor configured to execute the executable code to cause the apparatus to implement the method of any of claims 1-6.