WO2018214482A1 - 一种虚拟机的监控方法和装置 - Google Patents

一种虚拟机的监控方法和装置 Download PDF

Info

Publication number
WO2018214482A1
WO2018214482A1 PCT/CN2017/116278 CN2017116278W WO2018214482A1 WO 2018214482 A1 WO2018214482 A1 WO 2018214482A1 CN 2017116278 W CN2017116278 W CN 2017116278W WO 2018214482 A1 WO2018214482 A1 WO 2018214482A1
Authority
WO
WIPO (PCT)
Prior art keywords
ept
instruction
physical page
network device
monitoring
Prior art date
Application number
PCT/CN2017/116278
Other languages
English (en)
French (fr)
Inventor
蔡启申
袁劲枫
李小勇
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2018214482A1 publication Critical patent/WO2018214482A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/445—Program loading or initiating
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances

Definitions

  • the present application relates to the field of information technology (IT), and in particular, to a method and device for monitoring a virtual machine (VM).
  • IT information technology
  • VM virtual machine
  • the operating system has the highest authority and is responsible for managing the resources of the entire hardware platform, namely the Central Processing Unit (CPU), memory and peripherals.
  • the Virtual Machine Monitor is located between the operating system and the hardware platform and has the highest privilege level to manage the hardware platform. Therefore, the VMM can learn the internal state of the virtual machine by intercepting internal events of the virtual machine (VM), making it possible to monitor the virtual machine from outside the virtual machine.
  • the VMM writes an interrupt instruction (int3) at the monitoring point.
  • the virtual processor (VCPU) will fall into the VMM when executing the int3 instruction, and the VMM collects information about the virtual machine.
  • the VMM writes back the original instruction incl%eax of the monitoring point, and sets the VCPU to enter the single-step debugging mode.
  • the VCPU steps into the original instruction incl%eax and then falls into the VMM again.
  • the VMM writes the interrupt instruction to the monitoring point again, so that the original program can be monitored at the monitoring point for the next time.
  • the existing monitoring scheme is difficult to cope with the scenario where multiple VCPUs exist in the virtual machine. For example, when the virtual machine has two VCPUs executing the instruction stream at the same time, the first VCPU just writes back the original instruction, and the second VCPU happens to execute to the monitoring point. At this time, the monitoring point corresponds to the original instruction written back, that is, At this point, the interrupt command is not written at the monitoring point. At this time, the second VCPU avoids the monitoring point, resulting in omission of monitoring.
  • the embodiment of the present application provides a method for monitoring a virtual machine, which can solve the problem that the monitoring of the virtual machine including multiple VCPUs is missed.
  • the embodiment of the present application provides a method for monitoring a virtual machine, including: when the network device determines that a guest virtual machine (GVA) of the first VCPU is interrupted, the network device The extended page table (EPT) pointer of the first VCPU is adjusted from pointing to the first EPT to point to the second EPT; wherein the monitoring point is used to indicate the GVA to be monitored, and the first EPT includes the guest virtual machine corresponding to the monitoring point.
  • the mapping relationship between the physical physical address (GPA) and the host physical address (HPA) corresponding to the interrupt instruction, and the second EPT includes the mapping relationship between the GPA corresponding to the monitoring point and the HPA corresponding to the monitoring instruction.
  • Network device based on monitoring point and second EPT Reading the monitoring instruction and executing the monitoring instruction; when the network device executes the monitoring instruction, the network device adjusts the EPT pointer of the first VCPU from pointing to the second EPT to point to the first EPT, so that the first VCPU performs the interruption according to the first EPT. instruction.
  • the VMM rewrites the interrupt instruction to the original instruction, which may cause other VCPUs to monitor and miss.
  • the original instruction is not required to be rewritten, but the ECPU pointer of the VCPU is pointed to the second EPT when the VCPU needs to execute the monitoring instruction, so that the VCPU can execute the monitoring instruction according to the second EPT, and the other VCPU can continue according to the An EPT executes an interrupt instruction, thereby solving the problem of omission of monitoring of a virtual machine including a plurality of VCPUs.
  • the method before the network device points the EPT pointer of the first VCPU from the first EPT to the second EPT, the method further includes: determining, by the network device, the monitoring point and the first physical page, the content of the first physical page Empty; the network device copies the instruction of the second physical page to the first physical page; wherein the instruction of the second physical page includes the monitoring instruction; the network device replaces the monitoring instruction in the first physical page with the interrupt instruction; The mapping relationship between the GPA corresponding to the second physical page and the first physical page; the network device establishes the first EPT according to the mapping relationship between the GPA corresponding to the second physical page and the first physical page.
  • the network device may also create a second EPT by default.
  • the main difference between the first EPT and the second EPT is that the monitoring point corresponds to the first physical page in the first EPT, and the monitoring point is indicated by the HPA corresponding to the first physical page.
  • the storage unit stores an interrupt instruction
  • the monitoring point corresponds to the second physical page in the second EPT
  • the monitoring point stores the monitoring instruction in the storage unit indicated by the HPA corresponding to the second physical page.
  • the method further includes: the network device sets the first physical page to be unreadable and/or non-writable; and when the network device determines that the GVA of the first VCPU generates a read operation or a write operation corresponds to the first physical page, Then the network device adjusts the EPT pointer of the first VCPU from pointing to the first EPT to point to the second EPT; the network device performs a read operation or a write operation on the second physical page according to the second EPT; when the network device finishes reading the second physical page In operation or write operation, the network device adjusts the EPT pointer of the first VCPU from pointing to the second EPT to point to the first EPT, so that the network device executes the interrupt instruction according to the first EPT.
  • the method further includes: the network device determining whether the GVA in which the write operation includes the monitoring point; and when the GVA of the write operation includes the monitoring point, the network device reads the second physical page except the monitoring point The HPA instruction of the write operation other than the corresponding HPA, and the HPA instruction of the write operation other than the HPA corresponding to the monitoring point is written into the first physical page; when the GVA of the write operation does not include the monitoring point, the network The device reads the instructions of all HPAs that have a write operation in the second physical page and writes all HPA instructions that have a write operation to the first physical page.
  • the VMM can point the pointer of the VCPU to the second EPT, so that the VCPU writes the instruction that needs to be written first. Two physical pages. Then, the VMM can determine whether the instruction to perform the write operation in the second physical page includes the monitoring instruction. If included, the VMM reads the instruction of the second physical page other than the monitoring instruction, and writes in addition to the monitoring instruction. The instruction of the operation is written to the first physical page; If not included, the VMM writes all instructions that have a write operation to the first physical page. In this way, it is ensured that the interrupt instruction in the second physical page is not rewritten, and the instruction flow executed by the virtual machine is not changed, thereby avoiding the risk of the virtual machine crashing.
  • the interrupt is injected into the first virtual machine.
  • the VMM adjusts the pointer of the VCPU from pointing to the first EPT to point to the second EPT
  • the monitoring instruction itself may be an interrupt instruction inserted by the system, and this type is encountered.
  • the VMM does not need to collect monitoring information when interrupting instructions. Therefore, when the VMM determines that the EPT pointer when the VCPU is interrupted points to the second EPT, it can be determined that the interrupt is an interrupt instruction inserted by the system, and the VMM can directly inject the interrupt into the virtual machine.
  • the embodiment of the present application provides a network device, including: an adjusting unit, configured to: adjust an EPT pointer of a first VCPU from a first EPT when determining that an interrupted GVA in the first VCPU is a monitoring point To point to the second EPT, wherein the monitoring point is used to indicate the GVA to be monitored, the first EPT includes a mapping relationship between the GPA corresponding to the monitoring point and the HPA corresponding to the interrupt instruction, and the second EPT includes the GPA and the monitoring corresponding to the monitoring point.
  • a mapping relationship between the HPAs corresponding to the instruction a processing unit, configured to read the monitoring instruction according to the monitoring point and the second EPT, and execute the monitoring instruction; the adjusting unit is further configured to: when the monitoring instruction is executed, the first VCPU The EPT pointer is adjusted from pointing to the second EPT to point to the first EPT so that the first VCPU executes the interrupt instruction according to the first EPT.
  • the processing unit is further configured to: determine a monitoring point and a first physical page, the content of the first physical page is empty; copy the instruction of the second physical page to the first physical page;
  • the instructions of the two physical pages include a monitoring instruction; the monitoring instruction in the first physical page is replaced with an interrupt instruction; the mapping relationship between the GPA corresponding to the first physical page and the first physical page is established; and the GPA and the corresponding corresponding to the second physical page A physical page mapping relationship establishes a first EPT.
  • the processing unit is further configured to: set the first physical page to be unreadable and/or non-writable; and when it is determined that the GVA of the first VCPU generates a read operation or a write operation corresponds to the first physical page, The unit adjusts the EPT pointer of the first VCPU from pointing to the first EPT to point to the second EPT; performing a read operation or a write operation on the second physical page according to the second EPT; the adjusting unit is configured to: point the EPT pointer of the first VCPU from The second EPT is adjusted to point to the first EPT so that the processing unit executes the interrupt instruction in accordance with the first EPT.
  • the processing unit is further configured to: determine whether the GVA in which the write operation occurs includes a monitoring point; and when the GVA of the write operation includes the monitoring point, read the HPA corresponding to the monitoring point in the second physical page.
  • the instruction of the HPA that has a write operation is written, and the instruction of the HPA that has a write operation other than the HPA corresponding to the monitoring point is written into the first physical page; when the GVA of the write operation does not include the monitoring point, the second is read. All HPA instructions that have a write operation in the physical page, and all HPA instructions that have a write operation are written to the first physical page.
  • the processing unit is further configured to: if it is determined that the EPT pointer when the first VCPU is interrupted points to the second EPT, inject the interrupt into the first virtual machine.
  • the embodiment of the present application provides a network device, including: a processor, configured to: when determining that an interrupted GVA in a first VCPU is a monitoring point, adjust an EPT pointer of the first VCPU from the first EPT In order to point to the second EPT, wherein the monitoring point is used to indicate the GVA to be monitored, the first EPT includes a mapping relationship between the GPA corresponding to the monitoring point and the HPA corresponding to the interrupt instruction, and the second EPT includes the GPA corresponding to the monitoring point.
  • the processor is further configured to: determine the monitoring point and the first physical page, the content of the first physical page is empty; copy the instruction of the second physical page to the first physical page;
  • the instructions of the two physical pages include a monitoring instruction; the monitoring instruction in the first physical page is replaced with an interrupt instruction; the mapping relationship between the GPA corresponding to the first physical page and the first physical page is established; and the GPA and the corresponding corresponding to the second physical page A physical page mapping relationship establishes a first EPT.
  • the processor is further configured to: set the first physical page to be unreadable and/or non-writable; when it is determined that the GVA of the first VCPU to perform a read operation or a write operation corresponds to the first physical page,
  • the EPT pointer of a VCPU is adjusted from pointing to the first EPT to point to the second EPT; the second physical page is read or written according to the second EPT; and the EPT pointer of the first VCPU is adjusted from pointing to the second EPT to point to the first EPT to execute an interrupt instruction according to the first EPT.
  • the processor is further configured to: determine whether the GVA in which the write operation includes the monitoring point; when the GVA of the write operation includes the monitoring point, read the HPA corresponding to the monitoring point in the second physical page.
  • the instruction of the HPA that has a write operation is written, and the instruction of the HPA that has a write operation other than the HPA corresponding to the monitoring point is written into the first physical page; when the GVA of the write operation does not include the monitoring point, the second is read. All HPA instructions that have a write operation in the physical page, and all HPA instructions that have a write operation are written to the first physical page.
  • the processor is further configured to: if it is determined that the EPT pointer when the first VCPU is interrupted points to the second EPT, inject the interrupt into the first virtual machine.
  • an embodiment of the present invention provides a device, which is in the form of a product of a chip.
  • the device includes a processor and a memory, and the memory is coupled to the processor to save necessary program instructions of the device. And data, the processor is operative to execute program instructions stored in the memory such that the apparatus performs the functions of the network device in the method described above.
  • the embodiment of the present invention provides a network device, where the network device can implement the functions performed by the network device in the foregoing method, where the function can be implemented by using hardware or by executing corresponding software through hardware.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • the network device includes a processor and a communication interface, and the processor is configured to support the network device to perform a corresponding function in the foregoing method.
  • the communication interface is used to support communication between the network device and other network elements.
  • the network device can also include a memory for coupling with the processor that holds the necessary program instructions and data for the network device.
  • an embodiment of the present invention provides a computer readable storage medium, comprising instructions, when executed on a computer, causing a computer to perform any one of the methods provided by the first aspect.
  • an embodiment of the present invention provides a computer program product comprising instructions that, when run on a computer, cause the computer to perform any of the methods provided by the first aspect.
  • the first VCPU can execute an interrupt instruction corresponding to the monitoring point according to the first EPT, and the first VCPU will fall into the VMM after executing the interrupt instruction, and the VMM can collect the first VCPU.
  • Monitoring information and directing the EVT pointer of the first VCPU to the second EPT so that A VCPU can execute a monitoring instruction corresponding to the monitoring point according to the second EPT.
  • the VMM then adjusts the pointer of the first VCPU from pointing to the second EPT to point to the first EPT, so that the first VCPU can continue to execute the interrupt instruction corresponding to the monitoring point according to the first EPT.
  • the VMM rewrites the interrupt instruction to the original instruction, which may cause other VCPUs to monitor and miss.
  • the original instruction is not required to be rewritten, but the EPT pointer of the first VCPU is adjusted from pointing to the first EPT to point to the second EPT when the VCPU needs to execute the monitoring instruction, so that the first VCPU can execute the monitoring instruction, and the other The VCPU can continue to execute the interrupt instruction according to the first EPT, thereby solving the problem that the monitoring of the virtual machine of the multi-VCPU is missed.
  • FIG. 1 is a schematic diagram of a comparison between a conventional architecture and a virtualization architecture related to the present invention
  • FIG. 2 is a schematic diagram of steps of a virtual machine external monitoring solution according to an embodiment of the present application
  • FIG. 3 is a schematic diagram of a method for external monitoring of a virtual machine according to an embodiment of the present disclosure
  • FIG. 4 is a schematic diagram of an address translation method according to an embodiment of the present application.
  • FIG. 5 is a schematic diagram of deployment in a network device according to an embodiment of the present application.
  • FIG. 5 is a schematic diagram of deployment in a network device according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of an internal structure of a network device according to an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of a method for monitoring a virtual machine according to an embodiment of the present disclosure
  • FIG. 8 is a schematic structural diagram of a second EPT according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of a second EPT according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of a first EPT and a second EPT according to an embodiment of the present disclosure
  • FIG. 11 is a schematic flowchart diagram of a method for monitoring a virtual machine according to an embodiment of the present disclosure
  • FIG. 12 is a schematic flowchart of a method for monitoring a virtual machine according to an embodiment of the present disclosure
  • FIG. 13 is a schematic structural diagram of a network device according to an embodiment of the present disclosure.
  • FIG. 14 is a schematic structural diagram of a network device according to an embodiment of the present disclosure.
  • VM A virtual machine is a special kind of software.
  • a virtual machine can create an environment between a computer platform and an end user so that the end user can operate other software based on the environment created by the virtual machine. From an application perspective, the program runs on the virtual machine as it does on its corresponding physical machine.
  • the VCPU is the CPU of the virtual machine with respect to the physical CPU.
  • EPT A hardware mechanism provided by the physical CPU to speed up virtual machine address translation. On Intel CPUs, this mechanism is called EPT. On AMD CPUs, this mechanism is called Nested Page Tables (NPT).
  • NPT Nested Page Tables
  • the GVA of the function to be monitored is determined as the monitoring point.
  • the GVA of the function to be monitored is usually the GVA of the first instruction of the function to be monitored.
  • GPA The physical address of the guest virtual machine.
  • GVA Customer virtual machine virtual address.
  • HPA Host physical address.
  • Host physical page The memory address where the instruction stream and data are stored.
  • the storage unit in the physical page of the host is indicated by HPA.
  • the value obtained by dividing HPA by 4096 is the page number of the physical page of the host.
  • the physical page of the host is referred to as a physical page.
  • VMM The virtual machine monitor is also a special kind of software.
  • the VMM can manage and externally monitor the VM.
  • VMM is also called a hypervisor.
  • the embodiment of the present application can be applied to a scenario of external monitoring of a virtual machine, for example, a scenario in which the VMM externally monitors a VM having multiple VCPUs, and can also be applied to a scenario in which the VMM externally monitors multiple VMs having multiple VCPUs.
  • the VCPU of the VM can be considered to execute a binary instruction stream stored in the memory.
  • the target instruction stream is a stream of binary instructions stored in the memory, and when the VM is running, the VCPU can be considered to be executing the target instruction stream.
  • the VMM When the VMM monitors the running status of the VM, it can interrupt the normal execution flow of the VCPU at the monitoring point and cause the VCPU to jump to the VMM to execute. Then, the VMM can obtain the current running state of the VCPU, such as process information, register information, and then return the VCPU execution flow to the normal execution flow.
  • the VCPU needs to obtain the instruction of the target instruction stream from the memory when executing the target instruction stream.
  • the VCPU accesses the memory, as shown in (a) of FIG. 4, it needs to undergo at least two steps of conversion, that is, the GVA of the instruction is converted into GPA and converting GPA to HPA.
  • the VCPU can convert the GVA to GPA according to the page table, and then convert the GPA to HPA according to the EPT. It can be understood that, as shown in (b) of FIG. 4, if there are multiple different EPTs, the VCPU can convert the GPA into different HPAs according to the EPT, that is, the same GPA can be converted into different HPAs.
  • the GPA is converted to the first HPA according to the first EPT, and the GPA is converted to the second HPA according to the second EPT.
  • the VCPU can use multiple EPTs to address the GPA to the HPA. That is, when different VCPUs access the same GVA or GPA, the corresponding HPA and access rights can be different.
  • the embodiment of the present application is described by taking the VCPU through two EPT addressing as an example.
  • the system architecture of the network device in the embodiment of the present application is as shown in FIG. 5a, that is, the VMM and the VM may be deployed on the network device.
  • the VMM dynamically deploys monitoring points in the VM and monitors the VMs according to the monitoring points.
  • the network device in the embodiment of the present application may include a terminal device or a server, and the terminal device may include a personal computer (PC), a tablet, and the like.
  • a VMM, a VM, and a security domain may be deployed on the network device, and the security domain may deploy a security tool, and the security tool may be used to monitor the VM through an interface of the VMM.
  • the security domain can be another virtual machine, but the security domain is not invaded and destroyed by viruses.
  • FIG. 6 is a schematic diagram of an internal structure of a network device according to the present application.
  • the network device may include a processing module 601 and an input/output module 602.
  • the processing module 601 can run VMM6011 and VM6012, and the VM6012 can run multiple VCPUs, for example, including VCPU0 and VCPU1.
  • the VMM 6011 can be used to determine if the interrupted GVA in the first VCPU is a monitoring point.
  • the first VCPU may be VCPU0 and VCPU1. If yes, the network device collects the monitoring information of the first VCPU; and may also be used to set the EPT pointer of the first VCPU to point to the second EPT.
  • VCPU0 or VCPU1 can be used to execute monitoring instructions.
  • Input/output module 602 can be used to receive instructions to perform related operations in accordance with the instructions. For example, input/output module 602 can be used to receive user instructions to determine monitoring points.
  • An embodiment of the present application provides a method for monitoring a virtual machine, as shown in FIG. 7, including:
  • the network device determines a monitoring point.
  • the network device can determine the function to be monitored, and then the VMM of the network device can obtain the GVA of the function to be monitored according to the kernel symbol table, and The GVA is determined as a monitoring point. Further, the network device may obtain the GPA corresponding to the monitoring point according to the page table.
  • the kernel symbol table is used to determine the GVA of the function to be monitored according to the function to be monitored
  • the page table is used to determine the GPA of the function to be monitored according to the GVA of the function to be monitored.
  • the operating system kernel of the VM is 64-bit linux, and the kernel version is 4.2.0-27.
  • the function to be monitored is sys-open, and the instructions are as follows:
  • VMM can get the GS of sys_open according to the kernel symbol table to 0xfffffff 811ea640.
  • the GVA of sys_open is the GVA corresponding to the first instruction nop of sys_open, so the monitoring instruction corresponding to the monitoring point is the first instruction nop of sys_open.
  • the VMM can obtain that the GPA corresponding to nop is 0x11ea640 according to the page table.
  • the network device creates a first EPT, where the first EPT includes a mapping relationship between the GPA corresponding to the monitoring point and the HPA corresponding to the interrupt instruction.
  • the network device creates a first EPT through the VMM. It should be noted that before the VMM creates the first EPT, the VMM can create a second EPT by default, and the second EPT is used to indicate the mapping relationship between the GPA and the HPA.
  • the mapping relationship between the GPA and the HPA includes all the GPAs corresponding to the instruction stream. Mapping relationship with all HPAs.
  • the second EPT may include a level 4 page table, a level 3 page table, a level 2 page table, and a level 1 page table.
  • each entry of the level 4 page table corresponds to each page of the level 3 page table
  • each item of the level 3 page table corresponds to each page of the level 2 page table
  • each entry of the level 2 page table corresponds to For each page of the level 1 page table, each entry of the level 1 page table corresponds to each page of the physical page.
  • the second EPT indicates the mapping relationship between the GPA and the HPA
  • the VCPU determines the HPA corresponding to the GPA corresponding to the monitoring point according to the second EPT.
  • the HPA corresponding to the GPA corresponding to the monitoring point is the HPA corresponding to the monitoring point.
  • the VCPU determines the HPA corresponding to the GPA corresponding to the monitoring point according to the level one level of each level page table.
  • the GPA converted to binary is determined by the decimal value. For example, as shown in FIG. 9, if the GPA corresponding to the monitoring point is 0x11ea640 in hexadecimal, then 000000000,000000000, 000001000, 111101010, and 011001000000 in binary, which can be divided into the first 9-bit bit, Two 9-bit bits, a third 9-bit bit, a fourth 9-bit bit, and a fifth 12-bit bit, for a total of 48 bits.
  • the VCPU locates the 4-level page table of the second EPT according to the EPT pointer, and then converts the first 9-bit bit of the GPA under the binary into a decimal value, that is, converts 000000000 to 0, and 0 corresponds to the 4-level page table.
  • the first entry of the 4-level page table corresponds to the first page of the 3-level page table, and can be located according to the value 0 of the second 9-bit bit conversion.
  • To the first entry of the first page of the level 3 page table it can be seen that the first entry of the first page of the level 3 page table corresponds to the first page of the level 2 page table, and is converted according to the third 9-bit bit.
  • the value 8 can be located to the eighth entry of the first page of the level 2 page table.
  • the eighth entry of the first page of the level 2 page table corresponds to the eighth page of the level 1 page table, according to the fourth 9 bits.
  • the bit-converted value 492 can be located to the 492th entry of the eighth page of the level 1 page table. It can be seen that the 492th entry of the eighth page of the level 1 page table corresponds to the physical page whose page number is 0x17a4, and the physical page is The monitoring point is on the second physical page corresponding to the second EPT.
  • the second physical page corresponding to the monitoring point stores a part of the instruction stream, where the part of the instruction stream includes a monitoring instruction.
  • the virtual machine determines, according to the hexadecimal value 640 of the fifth 12-bit bit conversion, that the address of the second physical page whose offset is 0x640 is the monitoring point corresponding to the HPA, and the storage unit indicated by the HPA corresponding to the monitoring point. There are monitoring instructions written in it.
  • the VMM creates the first EPT. Briefly, first, the VMM applies for the first physical page, and then copies the content of the second physical page corresponding to the second EPT to the first physical page, and writes the interrupt instruction in the first physical page.
  • the page number of the second physical page corresponding to the monitoring point is 0x17a4, and the HPA corresponding to the monitoring point is offset by 0x640 in the page of the second physical page.
  • a monitoring instruction is stored in the unit. Assuming that the page number of the first physical page of the VMM application is 0x17a5, the VMM copies the partial instruction stream stored in the second physical page of page number 0x17a4 to the first physical page of page number 0x17a5, and at the first The page offset of the physical page is 0x640, and the original monitor instruction is replaced with the interrupt instruction.
  • the interrupt instruction can be int3, which is 0xCC.
  • the VMM can establish an initial first EPT according to the second EPT, and the initial first EPT and the second EPT have the same table structure. Then, the VMM establishes a mapping relationship between the monitoring point and the first physical page in the initial first EPT to establish the first EPT in the embodiment of the present application.
  • a, b, c, and d are a 4-level page table, a 3-level page table, a 2-level page table, and a level 1 page table of the second EPT, respectively. It is assumed that in the second EPT, the VCPU can determine the second physical page corresponding to the monitoring point according to a, b, c, and d, and the VMM can replace a, b, c, and d with a1 in the initial first EPT. B1, c1, and d1, so that the virtual machine can determine the first physical page corresponding to the monitoring point according to a1, b1, c1, and d1, and the first EPT after the replacement is the first EPT in the embodiment of the present application.
  • the structure and content of the other page tables except the a1, b1, c1, and d1 can be consistent with the second EPT.
  • the main difference between the first EPT and the second EPT is that the monitoring point corresponds to the first physical page according to the first EPT, and the monitoring point stores an interrupt instruction in the storage unit indicated by the HPA corresponding to the first physical page.
  • the monitoring point corresponds to the second physical page according to the second EPT, and the monitoring point stores the monitoring instruction in the storage unit indicated by the HPA corresponding to the second physical page.
  • the page numbers of the first physical page and the second physical page are different, and the stored information is not completely the same.
  • the EPT pointer of all VCPUs in the network device setting VM points to the first EPT.
  • the network device sets the EPT pointer of all VCPUs to the first EPT through the VMM. It can be understood that when the EPT pointer of the VCPU points to the first EPT, the VCPU converts the GPA into the corresponding HPA according to the first EPT, and executes the instructions stored in the corresponding storage unit indicated by the HPA.
  • the network device determines whether the GVA that is interrupted in the first VCPU is a monitoring point.
  • the VMM protects the interrupted site, and the interrupted GVA included in the protected interrupt site determines whether the interrupted GVA is a monitoring point. If yes, step 705 is performed; if not, it can be determined that the interrupt is an interrupt instruction in the instruction stream, instead of the interrupt instruction corresponding to the monitoring point, first The VCPU can inject the interrupt into the virtual machine.
  • the network device collects monitoring information of the first VCPU, and adjusts the EPT pointer of the first VCPU from pointing to the first EPT to point to the second EPT.
  • the network device can directly collect the monitoring information of the first VCPU through the VMM, and the monitoring information may include a process identifier (Identity, ID), a function ID, and a function parameter.
  • the monitoring information may include a process identifier (Identity, ID), a function ID, and a function parameter.
  • the network device may collect the monitoring information of the first VCPU through a monitoring program, and the monitoring program may collect the monitoring information of the first VCPU through the interface of the VMM.
  • the network device may adjust the EPT pointer of the first VCPU from the first EPT to the second EPT through the VMM, and the first VCPU converts the GPA corresponding to the monitoring point into the HPA according to the second EPT, as indicated by the HPA.
  • the storage unit stores a monitoring instruction, and the VMM executes the monitoring instruction.
  • the VMM can also set the first VCPU to the single-step debugging mode, so that after the first VCPU executes the monitoring instruction, the single-step debugging mode is re-trapped into the VMM, and then the network device performs step 706.
  • the VMM directly injects the interrupt. virtual machine. This is because the interrupt occurs at this time because the monitoring instruction itself is an interrupt instruction. In this case, the VMM does not need to collect the monitoring information of the first VCPU, but can directly inject the interrupt into the virtual machine.
  • the network device adjusts the EPT pointer of the first VCPU from pointing to the second EPT to point to the first EPT.
  • the VMM After the first VCPU is trapped in the VMM due to the single-step debugging mode, the VMM adjusts the EPT pointer of the first VCPU from pointing to the second EPT to point to the first EPT, and cancels the single-step debugging mode of the first VCPU. If the network device does not adjust the EPT pointer of the first VCPU to point to the first EPT, that is, the EPT pointer of the first VCPU still points to the second EPT, when the first VCPU executes the instruction stream again, the interrupt instruction is not executed. VMM will not be able to continue to monitor the first VCPU.
  • the EPT pointer of the first VCPU can be adjusted from pointing to the second EPT to point to the first EPT, so that the first VCPU can continue to execute the instruction stream after the monitoring instruction in the instruction stream, and can ensure that the first VCPU executes again.
  • the VMM can continue to monitor the first VCPU.
  • the first VCPU can execute an interrupt instruction according to the first EPT
  • the VMM can collect the monitoring information of the first VCPU when the first VCPU executes the interrupt instruction, and will The EPT pointer of a VCPU points to the second EPT, so that the first VCPU can execute the monitoring instruction corresponding to the monitoring point according to the second EPT.
  • the VMM redirects the pointer of the first VCPU to the first EPT so that the first VCPU can continue to execute the interrupt instruction corresponding to the monitoring point according to the first EPT.
  • the VMM rewrites the interrupt instruction to the original instruction, which may cause other VCPUs to monitor and miss.
  • the original instruction is not required to be rewritten, but the ECPU pointer of the VCPU is directed to the second EPT when the VCPU needs to execute the monitoring instruction, so that the VCPU can execute the monitoring instruction, and the other VCPU can continue to execute the interrupt according to the first EPT.
  • the instruction solves the problem of the omission of monitoring of the virtual machine of multiple VCPUs.
  • the following provides a virtual machine monitoring method, as shown in FIG. 11, which can solve the problem that the monitoring method is opaque to the user.
  • the first physical page of the network device setting is not readable.
  • the page number of the first physical page corresponding to the first instruction nop of sys_open is 0x17a5. It is assumed that the GPA corresponding to the monitoring point corresponds to the first physical page in the first EPT, and the HPA corresponding to the first physical page is 0x17a5640, and the content of 16 bytes starting from 0x17a5640 is as follows:
  • cc is the interrupt instruction.
  • the first VCPU When the first VCPU needs to read the content of the first physical page 0x17a5, the first VCPU reads the interrupt instruction in the first physical page, so the VMM can set the first physical page 0x17a5 unreadable in the first EPT, that is, the first The read/write permission portion of the page table entry pointing to the first physical page in an EPT is set to be unreadable.
  • the memory permission exception is triggered, and the first VCPU executing the read command will fall into the VMM.
  • the network device determines that the GVA of the read operation of the first VCPU corresponds to the first physical page, the network device adjusts the EPT pointer of the first VCPU from pointing to the first EPT to point to the second EPT, and sets the first VCPU to be a single step. Debug mode.
  • the first VCPU After the EPT pointer of the first VCPU points to the second EPT, the first VCPU reads the content of the second physical page corresponding to the abnormal EPT at the second EPT when the read command is executed, so that the first corresponding to the monitoring point is not read. Interrupt instructions written in the physical page ensure transparency to the user.
  • the abnormal interruption point is the GPA of the read operation. In the embodiment of the present application, the default abnormal interruption point corresponds to the first physical page in the first EPT and the second physical page in the second EPT.
  • the network device reads the content of the second physical page corresponding to the second EPT by the abnormal interruption point.
  • the content of the second physical page corresponding to the second EPT of the abnormal interruption point is a monitoring instruction.
  • the page number of the second physical page corresponding to the second EPT is 0x17a4
  • the offset within the page is 0x640
  • the content of 16 bytes starting from 0x17a4640 is as follows:
  • the monitoring point is a monitoring instruction in the 0x17a4640 corresponding to the second EPT, instead of the interrupt instruction, that is, the instruction read by the first VCPU is "66", thereby ensuring the transparency of the monitoring method to the user.
  • the network device adjusts the EPT pointer of the first VCPU from pointing to the second EPT to point to the first EPT.
  • the network device does not adjust the EPT pointer of the first VCPU to point to the first EPT, that is, the EPT pointer of the first VCPU still points to the second EPT, the first VCPU cannot continue to execute the interrupt instruction, and the VMM cannot be The first VCPU is monitored.
  • the first physical page written with the interrupt instruction when the first physical page written with the interrupt instruction is read, the content in the first physical page is not read, and the content in the second physical page is read, so that the interrupt is not read.
  • the instructions ensure that the monitoring method is transparent to the user.
  • the following provides a virtual machine monitoring method, as shown in FIG. 12, which can solve the problem of monitoring failure caused by the modification of the interrupt instruction.
  • the network device sets the first physical page to be unwritable.
  • the read/write permission portion of the page table entry pointing to the first physical page in the first EPT is set to be non-writable. For specific implementation, refer to step 1101.
  • the network device determines that the GVA in which the first VCPU generates a write operation corresponds to the first physical page, the network device adjusts the EPT pointer of the first VCPU from pointing to the first EPT to point to the second EPT, and sets the first VCPU to be a single step. Debug mode.
  • the instruction to be written is written to the abnormal interrupt point in the second physical page corresponding to the second EPT, so that The write monitoring point is in the first physical page corresponding to the first EPT, ensuring that the interrupt instruction is not overwritten.
  • the network device modifies an instruction of the abnormal interruption point in the second physical page corresponding to the second EPT.
  • the network device writes an instruction to be modified in the second physical page corresponding to the abnormal interruption point through the VMM.
  • the network device determines whether the GVA of the write operation includes a monitoring point.
  • step 1205 If yes, the network device performs step 1205; if no, the network device performs step 1206.
  • the network device reads an instruction of the HPA that has a write operation other than the HPA corresponding to the monitoring point in the second physical page, and writes an instruction of the HPA that has a write operation other than the HPA corresponding to the monitoring point to the first physical page. .
  • the HPA corresponding to the monitoring point on the second physical page is 0x17a4640
  • the HPA corresponding to the monitoring point on the first physical page is 0x17a5640. If the network device writes through the VMM in step 1203, the byte is 0x17a4640.
  • the first 5 bytes of the start address, the HPA instructions after the write operation are as follows:
  • VMM reads the first 4 bytes starting with 0x17a4641, and copies the 4-byte instruction into the first 4 bytes starting from 0x17a5641.
  • the modified byte instructions are as follows Shown as follows:
  • the network device reads an instruction of all HPAs that have a write operation in the second physical page, and writes an instruction of all HPAs that have a write operation into the first physical page.
  • the network device can write all HPA instructions that have a write operation to the first physical page.
  • the network device adjusts the EPT pointer of the first VCPU from pointing to the second EPT to point to the first EPT.
  • the network device can re-adjust the EPT pointer of the first VCPU to point to the first EPT through the VMM.
  • the VMM may point the pointer of the first VCPU to the second EPT so that the first VCPU will need to write the instruction. Write the second physical page first. Then, the VMM can determine whether the instruction to perform the write operation in the second physical page includes the monitoring instruction. If included, the VMM reads the instruction of the second physical page other than the monitoring instruction, and writes in addition to the monitoring instruction. The instructions of the operation are written to the first physical page; if not, the VMM writes all instructions that have a write operation to the first physical page. In this way, it is ensured that the interrupt instruction in the second physical page is not rewritten, and the instruction flow executed by the virtual machine is not changed, thereby avoiding the risk of the virtual machine crashing.
  • the network device includes a corresponding hardware structure and/or software module for executing each function. Piece.
  • the present application can be implemented in a combination of hardware or hardware and computer software in conjunction with the algorithm steps described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present application.
  • the embodiment of the present application may perform the division of the function module on the network device according to the foregoing method example.
  • each function module may be divided according to each function, or two or more functions may be integrated into one processing module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of the module in the embodiment of the present application is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • FIG. 13 is a schematic diagram showing a possible structure of the network device 13 involved in the foregoing embodiment.
  • the network device includes: an adjusting unit 1301 and a processing unit 1302.
  • the adjusting unit 1301 is configured to support the network device to perform the processes 705-706 in FIG. 7, the processes 1102 and 1104 in FIG. 11, the processes 1202 and 1207 in FIG. 12;
  • the processing unit 1302 is configured to support the network device to perform the process in FIG. 701-704, processes 1101 and 1103 in FIG. 11, processes 1201-1206 in FIG. All the related content of the steps involved in the foregoing method embodiments may be referred to the functional descriptions of the corresponding functional modules, and details are not described herein again.
  • the network device can be implemented by the computer device (or system) of FIG.
  • FIG. 14 is a schematic diagram of a computer device according to an embodiment of the present application.
  • Computer device 1400 includes at least one processor 1401, a communication bus 1402, a memory 1403, and at least one communication interface 1404.
  • the processor 1401 may be a general central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more for controlling the execution of the program of the present application. integrated circuit.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • Communication bus 1402 can include a path for communicating information between the components described above.
  • Communication interface 1404 using any type of transceiver, for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc. .
  • RAN radio access network
  • WLAN wireless local area networks
  • the memory 1403 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type that can store information and instructions.
  • the dynamic storage device can also be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, and a disc storage device. (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be Any other media accessed, but not limited to this.
  • the memory can exist independently and be connected to the processor via a bus.
  • the memory can also be integrated with the processor.
  • the memory 1403 is configured to store application code for executing the solution of the present application, and is controlled by the processor 1401 for execution.
  • the processor 1401 is configured to execute the application code stored in the memory 1403, thereby implementing the present The function in the patented method.
  • the processor 1401 may include one or more CPUs, such as CPU0 and CPU1 in FIG.
  • computer device 1400 can include multiple processors, such as processor 1401 and processor 1407 in FIG. Each of these processors can be a single-CPU processor or a multi-core processor.
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data, such as computer program instructions.
  • computer device 1400 can also include an output device 1405 and an input device 1406.
  • Output device 1405 is in communication with processor 1401 and can display information in a variety of ways.
  • the output device 1405 can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. Wait.
  • Input device 1406 is in communication with processor 1401 and can accept user input in a variety of ways.
  • input device 1406 can be a mouse, keyboard, touch screen device, or sensing device, and the like.
  • the computer device 1400 described above can be a general purpose computer device or a special purpose computer device.
  • the computer device 1400 can be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device, an embedded device, or have FIG. A device of similar structure.
  • PDA personal digital assistant
  • the embodiment of the present application does not limit the type of computer device 1400.
  • the steps of a method or algorithm described in connection with the present disclosure may be implemented in a hardware or may be implemented by a processor executing software instructions.
  • the software instructions may be comprised of corresponding software modules that may be stored in RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disk, removable hard disk, read-only optical disk, or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor to enable the processor to read information from, and write information to, the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and the storage medium can be located in an ASIC. Additionally, the ASIC can be located in a core network interface device.
  • the processor and the storage medium may also exist as discrete components in the core network interface device.
  • the functions described herein can be implemented in hardware, software, firmware, or any combination thereof.
  • the functions may be stored in a computer readable medium or transmitted as one or more instructions or code on a computer readable medium.
  • Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another.
  • a storage medium may be any available media that can be accessed by a general purpose or special purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer And Data Communications (AREA)
  • Memory System Of A Hierarchy Structure (AREA)
  • Debugging And Monitoring (AREA)

Abstract

一种虚拟机的监控方法和装置，涉及IT领域，应用于虚拟机的外部监控，能够解决具有多个VCPU的虚拟机的监控发生遗漏的问题。其方法为：当网络设备确定第一VCPU中发生中断的客户虚拟机虚拟地址GVA为监控点时，网络设备将第一VCPU的EPT指针从指向第一EPT调整为指向第二EPT；网络设备根据监控点和第二EPT读取监控指令，并执行监控指令；当网络设备执行完监控指令时，网络设备将第一VCPU的EPT指针从指向第二EPT调整为指向第一EPT，以便第一VCPU根据第一EPT执行中断指令。

Description

一种虚拟机的监控方法和装置
本申请要求于2017年05月24日提交中国专利局、申请号为201710378105.4、申请名称为“一种虚拟机的监控方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及信息技术(Information Technology，IT)领域，尤其涉及一种虚拟机(Virtual Machine，VM)的监控方法和装置。
背景技术
随着近年来多核系统、集群以及云计算的广泛部署，虚拟化技术在商业应用上的优势日益体现，虚拟化架构安全监控的研究也有了新的进展。如图1所示，在计算机体系的传统架构中，操作系统具有最高权限，负责管理整个硬件平台的资源，即中央处理器(Central Processing Unit，CPU)、内存和外设等。而在虚拟化架构中，虚拟机监控器(Virtual Machine Monitor，VMM)位于操作系统和硬件平台之间，具有最高的特权级，能够管理硬件平台。因此VMM可以通过截获虚拟机(Virtual Machine，VM)的内部事件，获知虚拟机的内部状态，使得从虚拟机外部监控虚拟机成为可能。
下面介绍一种从外部监控虚拟机的方法，如图2所示，假设指令流中的incl％eax对应的地址为监控点，第一步，VMM在监控点处写入中断指令(int3)，虚拟处理器(Virtual CPU，VCPU)在执行到int3指令时会陷入到VMM，VMM收集虚拟机的相关信息。第二步，VMM回写监控点的原指令incl％eax，并设置VCPU进入单步调试模式，VCPU单步执行监控点原指令incl％eax后再次陷入到VMM。第三步，VMM再次将中断指令写入到监控点，以便下一次继续在该监控点对原程序进行监控。
但是，现有的监控方案难以应对虚拟机中存在多VCPU的场景。例如，当虚拟机有两个VCPU同时执行指令流时，第一个VCPU刚回写完原指令，第二个VCPU恰好执行到监控点，此时，监控点对应回写的原指令，也就是此时监控点处并未写入中断指令，这时第二个VCPU就避开了监控点，导致监控出现遗漏。
发明内容
本申请实施例提供一种虚拟机的监控方法，能够解决包括多个VCPU的虚拟机的监控发生遗漏的问题。
第一方面，本申请实施例提供一种虚拟机的监控方法，包括：当网络设备确定第一VCPU中发生中断的客户虚拟机虚拟地址(Guest Virtual Address，GVA)为监控点时，网络设备将第一VCPU的扩展页表(Extended Page Tables，EPT)指针从指向第一EPT调整为指向第二EPT；其中，监控点用于指示待监控的GVA，第一EPT包括监控点对应的客户虚拟机物理地址(Guest Physical Address，GPA)与中断指令对应的主机物理地址(Host Physical Address，HPA)之间的映射关系，第二EPT包括监控点对应的GPA与监控指令对应的HPA之间的映射关系；网络设备根据监控点和第二EPT 读取监控指令，并执行监控指令；当网络设备执行完监控指令时，网络设备将第一VCPU的EPT指针从指向第二EPT调整为指向第一EPT，以便第一VCPU根据第一EPT执行中断指令。相比现有技术，当VCPU需要执行原指令时，VMM将中断指令改写为原指令，这可能导致其他VCPU发生监控遗漏。本申请实施例中，无需改写原指令，而是在VCPU需要执行监控指令时将该VCPU的EPT指针指向第二EPT，使得该VCPU可以根据第二EPT执行监控指令，而其他VCPU可以继续根据第一EPT执行中断指令，从而解决了包括多个VCPU的虚拟机的监控发生遗漏的问题。
在一种可能的实施方式中，网络设备将第一VCPU的EPT指针从第一EPT指向第二EPT之前，该方法还包括：网络设备确定监控点和第一物理页，第一物理页的内容为空；网络设备将第二物理页的指令拷贝至第一物理页；其中，第二物理页的指令包括监控指令；网络设备将第一物理页中的监控指令替换为中断指令；网络设备建立第二物理页对应的GPA与第一物理页的映射关系；网络设备根据第二物理页对应的GPA与第一物理页的映射关系建立第一EPT。另外，网络设备还可以默认创建一个第二EPT，第一EPT和第二EPT的主要区别在于：监控点在第一EPT对应第一物理页，监控点在该第一物理页对应的HPA所指示的存储单元中存储有中断指令，而监控点在第二EPT对应第二物理页，监控点在该第二物理页对应的HPA所指示的存储单元中存储有监控指令。这样一来，当对第一VCPU进行外部监控时，可以将第一VCPU的EPT指针指向第一EPT，以便第一VCPU可以根据第一EPT执行中断指令，当需要第一VCPU执行监控指令时，可以将第一VCPU的EPT指针指向第二EPT。
在一种可能的实施方式中，该方法还包括：网络设备设置第一物理页不可读和/或不可写；当网络设备确定第一VCPU发生读操作或写操作的GVA对应第一物理页，则网络设备将第一VCPU的EPT指针从指向第一EPT调整为指向第二EPT；网络设备根据第二EPT对第二物理页进行读操作或写操作；当网络设备对第二物理页完成读操作或写操作时，网络设备将第一VCPU的EPT指针从指向第二EPT调整为指向第一EPT，以便网络设备根据第一EPT执行中断指令。这样一来，在对写有中断指令的第一物理页进行读操作或写操作时，不会读到第一物理页中的内容或将新的内容写入到第一物理页中，而会读到第二物理页中的内容或将新的内容写到第二物理页中，保证了监控方法对用户是透明的，而且用户也无法改写中断指令，避免了因中断指令被改写造成的监控失效的问题。
在一种可能的实施方式中，该方法还包括：网络设备判断发生写操作的GVA是否包括监控点；当写操作的GVA包括监控点时，则网络设备读取第二物理页中除监控点对应的HPA以外发生写操作的HPA的指令，并将除监控点对应的HPA以外发生写操作的HPA的指令写入到第一物理页中；当写操作的GVA不包括监控点时，则网络设备读取第二物理页中所有发生写操作的HPA的指令，并将所有发生写操作的HPA的指令写入到第一物理页中。简要来说，当VCPU的EPT指针指向第一EPT时，若需要对第一物理页进行写操作，则VMM可以将VCPU的指针指向第二EPT，以便VCPU将需要写入的指令先写入第二物理页。而后，VMM可以判断第二物理页中进行写操作的指令是否包括监控指令，若包括，则VMM读取第二物理页中除监控指令以外发生写操作的指令，并将除监控指令以外发生写操作的指令写入到第一物理页中； 若不包括，则VMM将所有发生写操作的指令写入第一物理页中。如此一来，保证了第二物理页中的中断指令不被改写，且没有改变虚拟机执行的指令流，避免了虚拟机崩溃的风险。
在一种可能的实施方式中，若网络设备确定第一VCPU发生中断时的EPT指针指向第二EPT，则将中断注入第一虚拟机。在一种可能的情况下，在VMM将VCPU的指针从指向第一EPT调整为指向第二EPT，VCPU执行监控指令时，由于监控指令本身可能是一个系统插入的中断指令，而碰到此类中断指令时，VMM无需收集监控信息。从而当VMM确定VCPU发生中断时的EPT指针指向第二EPT，也就可以确定该中断为系统插入的中断指令，此时VMM可以直接将该中断注入虚拟机即可。
第二方面，本申请实施例提供一种网络设备，包括：调整单元，用于：当确定第一VCPU中发生中断的GVA为监控点时，将第一VCPU的EPT指针从指向第一EPT调整为指向第二EPT；其中，监控点用于指示待监控的GVA，第一EPT包括监控点对应的GPA与中断指令对应的HPA之间的映射关系，第二EPT包括监控点对应的GPA与监控指令对应的HPA之间的映射关系；处理单元，用于根据监控点和第二EPT读取监控指令，并执行监控指令；调整单元还用于：当执行完监控指令时，将第一VCPU的EPT指针从指向第二EPT调整为指向第一EPT，以便第一VCPU根据第一EPT执行中断指令。
在一种可能的实施方式中，处理单元还用于：确定监控点和第一物理页，第一物理页的内容为空；将第二物理页的指令拷贝至第一物理页；其中，第二物理页的指令包括监控指令；将第一物理页中的监控指令替换为中断指令；建立第二物理页对应的GPA与第一物理页的映射关系；根据第二物理页对应的GPA与第一物理页的映射关系建立第一EPT。
在一种可能的实施方式中，处理单元还用于：设置第一物理页不可读和/或不可写；当确定第一VCPU发生读操作或写操作的GVA对应第一物理页，则通过调整单元将第一VCPU的EPT指针从指向第一EPT调整为指向第二EPT；根据第二EPT对第二物理页进行读操作或写操作；调整单元用于：将第一VCPU的EPT指针从指向第二EPT调整为指向第一EPT，以便处理单元根据第一EPT执行中断指令。
在一种可能的实施方式中，处理单元还用于：判断发生写操作的GVA是否包括监控点；当写操作的GVA包括监控点时，则读取第二物理页中除监控点对应的HPA以外发生写操作的HPA的指令，并将除监控点对应的HPA以外发生写操作的HPA的指令写入到第一物理页中；当写操作的GVA不包括监控点时，则读取第二物理页中所有发生写操作的HPA的指令，并将所有发生写操作的HPA的指令写入到第一物理页中。
在一种可能的实施方式中，处理单元还用于：若确定第一VCPU发生中断时的EPT指针指向第二EPT，则将中断注入第一虚拟机。
第三方面，本申请实施例提供一种网络设备，包括：处理器，用于：当确定第一VCPU中发生中断的GVA为监控点时，将第一VCPU的EPT指针从指向第一EPT调整为指向第二EPT；其中，监控点用于指示待监控的GVA，第一EPT包括监控点对应的GPA与中断指令对应的HPA之间的映射关系，第二EPT包括监控点对应的GPA 与监控指令对应的HPA之间的映射关系；根据监控点和第二EPT读取监控指令，并执行监控指令；当执行完监控指令时，将第一VCPU的EPT指针从指向第二EPT调整为指向第一EPT，以便第一VCPU根据第一EPT执行中断指令。
在一种可能的实施方式中，处理器还用于：确定监控点和第一物理页，第一物理页的内容为空；将第二物理页的指令拷贝至第一物理页；其中，第二物理页的指令包括监控指令；将第一物理页中的监控指令替换为中断指令；建立第二物理页对应的GPA与第一物理页的映射关系；根据第二物理页对应的GPA与第一物理页的映射关系建立第一EPT。
在一种可能的实施方式中，处理器还用于：设置第一物理页不可读和/或不可写；当确定第一VCPU发生读操作或写操作的GVA对应第一物理页，则将第一VCPU的EPT指针从指向第一EPT调整为指向第二EPT；根据第二EPT对第二物理页进行读操作或写操作；将第一VCPU的EPT指针从指向第二EPT调整为指向第一EPT，以便根据第一EPT执行中断指令。
在一种可能的实施方式中，处理器还用于：判断发生写操作的GVA是否包括监控点；当写操作的GVA包括监控点时，则读取第二物理页中除监控点对应的HPA以外发生写操作的HPA的指令，并将除监控点对应的HPA以外发生写操作的HPA的指令写入到第一物理页中；当写操作的GVA不包括监控点时，则读取第二物理页中所有发生写操作的HPA的指令，并将所有发生写操作的HPA的指令写入到第一物理页中。
在一种可能的实施方式中，处理器还用于：若确定第一VCPU发生中断时的EPT指针指向第二EPT，则将中断注入第一虚拟机。
第四方面，本发明实施例提供了一种装置，该装置以芯片的产品形态存在，该装置的结构中包括处理器和存储器，该存储器用于与处理器耦合，保存该装置必要的程序指令和数据，该处理器用于执行存储器中存储的程序指令，使得该装置执行上述方法中网络设备的功能。
第五方面，本发明实施例提供了一种网络设备，该网络设备可以实现上述方法实施例中网络设备所执行的功能，所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个上述功能相应的模块。
在一种可能的实施方式中，该网络设备的结构中包括处理器和通信接口，该处理器被配置为支持该网络设备执行上述方法中相应的功能。该通信接口用于支持该网络设备与其他网元之间的通信。该网络设备还可以包括存储器，该存储器用于与处理器耦合，其保存该网络设备必要的程序指令和数据。
第六方面，本发明实施例提供一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行第一方面提供的任意一种方法。
第七方面，本发明实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行第一方面提供的任意一种方法。
由此，当全部VCPU的EPT指针指向第一EPT时，第一VCPU可以根据第一EPT执行监控点对应的中断指令，第一VCPU执行到中断指令后会陷入VMM中，VMM可以收集第一VCPU的监控信息，并将第一VCPU的EPT指针指向第二EPT，以便第 一VCPU便可以根据第二EPT执行监控点对应的监控指令。而后VMM将第一VCPU的指针从指向第二EPT调整为指向第一EPT，以便第一VCPU可以继续根据第一EPT执行监控点对应的中断指令。相比现有技术，当VCPU需要执行原指令时，VMM将中断指令改写为原指令，这可能导致其他VCPU发生监控遗漏。本申请实施例中，无需改写原指令，而是在VCPU需要执行监控指令时将第一VCPU的EPT指针从指向第一EPT调整为指向第二EPT，使得第一VCPU可以执行监控指令，而其他VCPU可以继续根据第一EPT执行中断指令，从而解决了多VCPU的虚拟机的监控发生遗漏的问题。
附图说明
图1为与本发明相关的一种传统架构与虚拟化架构的对比示意图；
图2为本申请实施例提供的一种虚拟机外部监控方案的步骤示意图；
图3为本申请实施例提供的一种虚拟机的外部监控方法示意图；
图4为本申请实施例提供的一种地址转换方法的示意图；
图5a为本申请实施例提供的一种网络设备内的部署示意图；
图5b为本申请实施例提供的一种网络设备内的部署示意图；
图6为本申请实施例提供的一种网络设备的内部结构示意图；
图7为本申请实施例提供的一种虚拟机的监控方法的流程示意图；
图8为本申请实施例提供的一种第二EPT的结构示意图；
图9为本申请实施例提供的一种第二EPT的结构示意图；
图10为本申请实施例提供的一种第一EPT和第二EPT的结构示意图；
图11为本申请实施例提供的一种虚拟机的监控方法的流程示意图；
图12为本申请实施例提供的一种虚拟机的监控方法的流程示意图；
图13为本申请实施例提供的一种网络设备的结构示意图；
图14为本申请实施例提供的一种网络设备的结构示意图。
具体实施方式
为了下述各实施例的描述清楚简洁，首先给出相关概念或技术的简要介绍：
VM：即虚拟机，是一种特殊的软件。虚拟机可以在计算机平台和终端用户之间创建一种环境，以便于终端用户基于虚拟机所创建的环境来操作其他软件。从应用程序的角度看，程序运行在虚拟机上与运行在其对应的实体计算机上一样。
VCPU：相对于物理CPU而言，VCPU是虚拟机的CPU。
EPT：是物理CPU提供的一种加速虚拟机地址转换的硬件机制。在Intel CPU上，这种机制被称为EPT，在AMD CPU上，这种机制被称为嵌套页表(Nested Page Tables，NPT)。本申请实施例统一使用EPT这个术语。
监控点：用户确定出待监控的函数后，进而将待监控的函数的GVA确定为监控点。通常待监控的函数的GVA即为待监控的函数的第一条指令的GVA。
GPA：客户虚拟机物理地址。
GVA：客户虚拟机虚拟地址。
HPA：主机物理地址。
主机物理页：存放指令流和数据的内存地址，主机物理页中的存储单元由HPA指 示，HPA除以4096得到的值为主机物理页的页号。本申请实施例中简称主机物理页为物理页。
VMM：即虚拟机监控器，也是一种特殊的软件。VMM可以对VM进行管理和外部监控。另外，VMM也称为管理程序(hypervisor)。
本申请实施例可应用于虚拟机外部监控的场景，例如应用于VMM对具有多个VCPU的VM进行外部监控的场景，也可以应用于VMM对具有多个VCPU的多个VM进行外部监控的场景。可以理解的是，当VM在运行时，可以认为VM的VCPU在执行内存中存储的二进制指令流。举例来说，如图3所示，假设目标指令流是内存中存储的一段二进制指令流，当VM在运行的时候，可以认为VCPU在执行目标指令流。VMM在对VM的运行情况进行监控时，可以在监控点中断VCPU正常的执行流程，并使VCPU跳转到VMM去执行。而后，VMM可以获取VCPU当前的运行状态，比如说进程信息，寄存器信息，然后再将VCPU的执行流程返回到正常的执行流程之中。
其中，VCPU在执行目标指令流时，需要从内存中获取目标指令流的指令，VCPU在访问内存时，如图4中(a)所示，需要经过至少两步转换，即将指令的GVA转换为GPA以及将GPA转换为HPA。具体地，VCPU可以根据页表将GVA转换为GPA，然后再根据EPT将GPA转换为HPA。可以理解的是，如图4中(b)所示，若有多个不同的EPT，则VCPU可以根据EPT将GPA转换为不同的HPA，即同一个GPA可以被转换为不同的HPA。例如，根据第一EPT将GPA转换为第一HPA，根据第二EPT将GPA转换为第二HPA。此时，通过动态修改VCPU中的EPT指针寄存器的内容，VCPU可以使用多个EPT进行GPA到HPA的寻址，即不同VCPU访问同一GVA或GPA时，对应的HPA和访问权限可以是不同的。本申请实施例以VCPU通过两个EPT寻址为例进行说明。
本申请实施例中的网络设备的系统架构如图5a所示，即网络设备上可以部署有VMM和VM。其中，VMM动态的在VM中部署监控点，并根据监控点监控VM。本申请实施例中的网络设备可以包括终端设备或服务器，终端设备可以包括个人计算机(Personal Computer，PC)和平板电脑(pad)等。
在一种可能的实施方式中，如图5b所示，网络设备上可以部署有VMM、VM和安全域，安全域可以部署安全工具，安全工具可以用于通过VMM的相关接口监控VM。其中，安全域可以是另一台虚拟机，但安全域不会被病毒入侵和破坏。
图6为本申请的网络设备的一种内部结构示意图，在本申请中，网络设备可以包括处理模块601和输入/输出模块602。其中，处理模块601上可以运行有VMM6011和VM6012，VM6012上可以运行多个VCPU，例如，包括VCPU0和VCPU1。VMM6011可以用于确定第一VCPU中发生中断的GVA是否为监控点。其中，第一VCPU可以为VCPU0和VCPU1。若确定是，则网络设备收集第一VCPU的监控信息；还可以用于设置第一VCPU的EPT指针指向第二EPT。VCPU0或VCPU1可以用于执行监控指令。输入/输出模块602可以用于接收指令，以便根据指令执行相关操作。例如，输入/输出模块602可以用于接收用户的指令，以确定监控点。
本申请实施例提供一种虚拟机的监控方法，如图7所示，包括：
701、网络设备确定监控点。
当网络设备的输入/输出模块接收到用户输入的确定待监控函数的指令时，网络设备可以确定出待监控的函数，而后网络设备的VMM可以根据内核符号表得到待监控的函数的GVA，并将该GVA确定为监控点。进一步地，网络设备可以根据页表获取监控点对应的GPA。其中，内核符号表用于根据待监控函数确定待监控函数的GVA，页表用于根据待监控函数的GVA确定待监控函数的GPA。
举例来说，以VM的操作系统内核为64位linux，内核版本为4.2.0-27为例，假设待监控的函数是sys-open，其指令如下：
nop
push％rbp
mov％rsp，％rbp
VMM可以根据内核符号表得到sys_open的GVA为0xffffffff811ea640。本申请实施例中，sys_open的GVA即sys_open的第一条指令nop对应的GVA，因此监控点对应的监控指令即sys_open的第一条指令nop。
进一步地，VMM可以根据页表得出nop对应的GPA为0x11ea640。
702、网络设备创建第一EPT，第一EPT包括监控点对应的GPA与中断指令对应的HPA之间的映射关系。
即网络设备通过VMM创建第一EPT。需要说明的是，在VMM创建第一EPT前，VMM可以默认创建一个第二EPT，第二EPT用于指示GPA与HPA的映射关系,其中，GPA与HPA的映射关系包括指令流对应的全部GPA与全部HPA的映射关系。
举例来说，如图8所示，为一个第二EPT的结构示意图。第二EPT可以包括4级页表、3级页表、2级页表和1级页表。其中，4级页表有一页；3级页表可以有512页(图8中仅以两页示意)；2级页表可以有512*512＝262，144页；1级页表可以有262144*512＝134，217，728页。每一页可以包括512个条目(图8中仅以6个条目示意)，每个条目为8个字节，也就是说，每一页有512*8＝4096个字节，即每一页为4k。其中，4级页表的每个条目对应3级页表的每一页，类似地，3级页表的每个条目对应2级页表的每一页，2级页表的每个条目对应1级页表的每一页，1级页表的每个条目对应物理页的每一页。
下面介绍第二EPT怎样指示GPA与HPA的映射关系，以及VCPU如何根据第二EPT确定监控点对应的GPA所对应的HPA。本申请实施例中，监控点对应的GPA所对应的HPA即监控点对应的HPA。通俗来说，VCPU根据各级页表一级一级确定监控点对应的GPA所对应的HPA。对于每一级页表，既要确定该级页表的页数，也要确定该页的条目，该级页表的页数可以根据上一级页表的条目确定，该页的条目可以根据二进制下的GPA转换成的10进制数值确定。举例来说，如图9所示，若监控点对应的GPA在16进制下为0x11ea640，则在二进制下为000000000，000000000，000001000，111101010，011001000000，可以分为第一个9位比特，第二个9位比特，第三个9位比特，第四个9位比特以及第五个12位比特，共48位。首先，VCPU根据EPT指针定位到第二EPT的4级页表，而后将二进制下的GPA的第一个9位比特转换为10进制的数值，即将000000000转换为0，0对应4级页表的第1个条目，可知该4级页表的第1个条目对应3级页表的第一页，根据第二个9位比特转换的数值0可以定位 到3级页表的第一页的第1个条目，可知该3级页表的第一页的第1个条目对应2级页表的第一页，根据第三个9位比特转换为的数值8可以定位到2级页表的第一页的第8个条目，可知该2级页表的第一页的第8个条目对应1级页表的第八页，根据第四个9位比特转换的数值492可以定位到1级页表的第八页的第492个条目，可知该1级页表的第八页的第492个条目对应页号为0x17a4的物理页，该物理页即监控点在第二EPT对应的第二物理页。其中，监控点对应的第二物理页中存储有部分的指令流，该部分指令流包括监控指令。而后虚拟机根据第五个12位比特转换的16进制的数值640确定该第二物理页的页内偏移为0x640的地址即为监控点对应HPA，监控点对应的HPA所指示的存储单元中写有监控指令。
下面介绍VMM如何创建第一EPT。简要来说，首先，VMM申请第一物理页，而后将监控点在第二EPT对应的第二物理页的内容拷贝至第一物理页，并在第一物理页中写入中断指令。
根据上述举例，监控点对应的第二物理页的页号为0x17a4，监控点对应的HPA在第二物理页的页内偏移为0x640，可以理解的是，监控点对应的HPA所指示的存储单元中存储有监控指令。假设VMM申请的第一物理页的页号为0x17a5，则VMM将页号为0x17a4的第二物理页中存储的部分指令流拷贝到页号为0x17a5的第一物理页中，并在该第一物理页的页内偏移为0x640处写入中断指令，也就是将原有的监控指令替换为中断指令。其中，中断指令可以是int3，即0xCC。
然后，VMM可以根据第二EPT建立初始的第一EPT，此时初始的第一EPT与第二EPT拥有相同的表结构。而后，VMM在初始的第一EPT建立监控点与第一物理页的映射关系，以建立本申请实施例中的第一EPT。
如图10所示，a、b、c和d分别为第二EPT的4级页表、3级页表、2级页表和1级页表。假设在第二EPT中，VCPU可以根据a、b、c和d确定出监控点对应的第二物理页，则VMM可以在初始的第一EPT中将a、b、c和d替换为a1、b1、c1和d1，使虚拟机可以根据a1、b1、c1和d1确定出监控点对应的第一物理页，替换后的第一EPT即本申请实施例中的第一EPT。可以理解的是，第一EPT除a1、b1、c1和d1外，其他页表的结构及内容可以与第二EPT一致。由此可见，第一EPT和第二EPT的主要区别在于：监控点根据第一EPT对应第一物理页，监控点在该第一物理页对应的HPA所指示的存储单元中存储有中断指令，而监控点根据第二EPT对应第二物理页，监控点在该第二物理页对应的HPA所指示的存储单元中存储有监控指令。总的来说，第一物理页和第二物理页的页号是不同的，存储的信息也不完全相同。
703、网络设备设置VM中的全部VCPU的EPT指针指向第一EPT。
即网络设备通过VMM设置全部VCPU的EPT指针指向第一EPT。可以理解的是，当VCPU的EPT指针指向第一EPT时，VCPU根据第一EPT将GPA转换为相应的HPA，并执行相应的HPA所指示的存储单元中存储的指令。
704、网络设备确定第一VCPU中发生中断的GVA是否为监控点。
当第一VCPU发生中断时，VMM保护中断现场，所保护的中断现场中包括的发生中断的GVA，VMM确定该发生中断的GVA是否为监控点。若是，则执行步骤705；若否，则可以确定该中断是指令流中的中断指令，而非监控点对应的中断指令，第一 VCPU将该中断注入虚拟机即可。
705、网络设备收集第一VCPU的监控信息，将第一VCPU的EPT指针从指向第一EPT调整为指向第二EPT。
网络设备可以通过VMM直接收集第一VCPU的监控信息，监控信息可以包括进程标识(Identity，ID)，函数ID以及函数参数等。
在一种可能的实施方式中，网络设备可以通过监控程序收集第一VCPU的监控信息，监控程序可以通过VMM的接口收集第一VCPU的监控信息。
网络设备收集监控信息后，可以通过VMM将第一VCPU的EPT指针从指向第一EPT调整为指向第二EPT，第一VCPU根据第二EPT将监控点对应的GPA转换为HPA，该HPA所指示的存储单元中存储有监控指令，VMM执行该监控指令。VMM还可以将第一VCPU设置为单步调试模式，以便第一VCPU执行完监控指令后，因单步调试模式重新陷入VMM，而后网络设备执行步骤706。
在一种可能的实施方式中，若在设置第一VCPU进入单步调试模式时再次发生中断，也就是若VMM确定第一VCPU发生中断时的EPT指针指向第二EPT，则VMM直接将中断注入虚拟机。这是因为此时发生中断是由于监控指令本身是个中断指令，在这种情况下，VMM无需收集第一VCPU的监控信息，而可以直接将该中断注入到虚拟机中。
706、网络设备将第一VCPU的EPT指针从指向第二EPT调整为指向第一EPT。
当第一VCPU因单步调试模式陷入VMM后，VMM将第一VCPU的EPT指针从指向第二EPT调整为指向第一EPT，并取消第一VCPU的单步调试模式。若网络设备不将第一VCPU的EPT指针调整为指向第一EPT，即第一VCPU的EPT指针仍指向第二EPT，那么当第一VCPU再次执行指令流时，就不会执行到中断指令，VMM也就无法继续对第一VCPU进行监控了。因此可以将第一VCPU的EPT指针从指向第二EPT调整为指向第一EPT，这样一来，第一VCPU可以继续执行指令流中监控指令后的指令流，并且可以保证当第一VCPU再次执行指令流时，VMM可以继续对第一VCPU进行监控。
这样一来，当全部VCPU的EPT指针指向第一EPT时，第一VCPU可以根据第一EPT执行中断指令，VMM可以在第一VCPU执行到中断指令时收集第一VCPU的监控信息，并将第一VCPU的EPT指针指向第二EPT，以便第一VCPU便可以根据第二EPT执行监控点对应的监控指令。而后VMM重新将第一VCPU的指针指向第一EPT，以便第一VCPU可以继续根据第一EPT执行监控点对应的中断指令。相比现有技术，当VCPU需要执行原指令时，VMM将中断指令改写为原指令，这可能导致其他VCPU发生监控遗漏。本申请实施例中，无需改写原指令，而是在VCPU需要执行监控指令时将该VCPU的EPT指针指向第二EPT，使得该VCPU可以执行监控指令，而其他VCPU可以继续根据第一EPT执行中断指令，从而解决了多VCPU的虚拟机的监控发生遗漏的问题。
下面提供一种虚拟机监控方法，如图11所示，能够解决监控方法对用户不透明的问题。
1101、网络设备设置第一物理页不可读。
以图7所示方法的软件环境为例，sys_open的第一条指令nop对应的第一物理页的页号为0x17a5。假设监控点对应的GPA在第一EPT中对应第一物理页，且在第一物理页对应的HPA为0x17a5640，以0x17a5640为起始地址的16个字节的内容如下所示：
0x17a5640:cc 66 66 66 90 55 0f b7
0x17a5648:ca 89 f2 80 ce 80 48 89
其中，cc即中断指令。
当第一VCPU需要读取第一物理页0x17a5的内容时，第一VCPU会读到第一物理页中的中断指令，因此VMM可以在第一EPT中设置第一物理页0x17a5不可读，即将第一EPT中指向第一物理页的页表条目中读/写权限部分设置为不可读。这样当读取该第一物理页的内容时，会触发内存权限异常，执行读指令的第一VCPU会陷入到VMM。
1102、若网络设备确定第一VCPU发生读操作的GVA对应第一物理页，则网络设备将第一VCPU的EPT指针从指向第一EPT调整为指向第二EPT，并设置第一VCPU为单步调试模式。
第一VCPU的EPT指针指向第二EPT后，第一VCPU在执行读指令时会读到异常中断点在第二EPT对应的第二物理页的内容，从而不会读到监控点对应的第一物理页中写入的中断指令，保证了对用户的透明。其中，异常中断点即发生读操作的GPA，本申请实施例中默认异常中断点在第一EPT中对应第一物理页，在第二EPT中对应第二物理页。
1103、网络设备读取异常中断点在第二EPT对应的第二物理页的内容。
根据步骤1101中的举例，假设异常中断点为监控点对应的GPA，则异常中断点在第二EPT对应的第二物理页的内容为监控指令。根据上述举例，监控点在第二EPT对应的第二物理页的页号为0x17a4，页内偏移0x640，以0x17a4640为起始地址的16个字节的内容如下所示：
0x17a4640:66 66 66 66 90 55 0f b7
0x17a4648:ca 89 f2 80 ce 80 48 89
可以理解的是，监控点在第二EPT对应的0x17a4640中为监控指令，而非中断指令，即第一VCPU读取到的指令为“66”，从而保证了监控方法对用户的透明。
1104、网络设备将第一VCPU的EPT指针从指向第二EPT调整为指向第一EPT。
这是由于若网络设备不将第一VCPU的EPT指针调整为指向第一EPT，即第一VCPU的EPT指针仍指向第二EPT，那么第一VCPU就无法继续执行中断指令，VMM也就无法对第一VCPU进行监控了。
这样一来，当对写有中断指令的第一物理页进行读操作时，不会读到第一物理页中的内容，而会读到第二物理页中的内容，从而不会读到中断指令，保证了监控方法对用户是透明的。
下面提供一种虚拟机监控方法，如图12所示，能够解决中断指令被修改造成的监控失效的问题。
1201、网络设备设置第一物理页不可写。
即将第一EPT中指向第一物理页的页表条目中读/写权限部分设置为不可写。具体实现方式可以参考步骤1101。
1202、若网络设备确定第一VCPU发生写操作的GVA对应第一物理页，则网络设备将第一VCPU的EPT指针从指向第一EPT调整为指向第二EPT，并设置第一VCPU为单步调试模式。
第一VCPU的EPT指针指向第二EPT后，第一VCPU返回后继续执行写指令时，会将需要写入的指令写入异常中断点在第二EPT对应的第二物理页中，从而不会写入监控点在第一EPT对应的第一物理页中，保证了中断指令不会被改写。
1203、网络设备修改异常中断点在第二EPT对应的第二物理页中的指令。
即网络设备通过VMM在异常中断点对应的第二物理页中写入需要修改的指令。
1204、网络设备确定写操作的GVA是否包括监控点。
若确定是，则网络设备执行步骤1205；若确定否，则网络设备执行步骤1206。
1205、网络设备读取第二物理页中除监控点对应的HPA以外发生写操作的HPA的指令，并将除监控点对应的HPA以外发生写操作的HPA的指令写入到第一物理页中。
举例来说，假设监控点在第二物理页对应的HPA为0x17a4640，监控点在第一物理页对应的HPA为0x17a5640，若网络设备在步骤1203中通过VMM发生写操作的字节为以0x17a4640为起始地址的前5个字节，发生写操作后的HPA的指令如下所示：
0x17a4640:e8 bb 59 e3 3e
则VMM读取以0x17a4641为起始地址的前4个字节，并将该4个字节的指令复制到以0x17a5641为起始地址的前4个字节中，修改后的字节的指令如下所示：
0x17a5640:cc bb 59 e3 3e
这样一来，保证了第一物理页中的中断指令不被改写，且没有改变虚拟机执行的指令流，避免了虚拟机崩溃的风险。
1206、网络设备读取第二物理页中所有发生写操作的HPA的指令，并将所有发生写操作的HPA的指令写入第一物理页中。
由于发生写操作的GVA不包括监控点，因此网络设备可以将所有发生写操作的HPA的指令写入第一物理页中。
1207、网络设备将第一VCPU的EPT指针从指向第二EPT调整为指向第一EPT。
网络设备可以通过VMM重新将第一VCPU的EPT指针调整为指向第一EPT。
简要来说，当第一VCPU的EPT指针指向第一EPT时，若第一物理页发生写操作，则VMM可以将第一VCPU的指针指向第二EPT，以便第一VCPU将需要写入的指令先写入第二物理页。而后，VMM可以判断第二物理页中进行写操作的指令是否包括监控指令，若包括，则VMM读取第二物理页中除监控指令以外发生写操作的指令，并将除监控指令以外发生写操作的指令写入到第一物理页中；若不包括，则VMM将所有发生写操作的指令写入第一物理页中。如此一来，保证了第二物理页中的中断指令不被改写，且没有改变虚拟机执行的指令流，避免了虚拟机崩溃的风险。
上述主要从网络设备的角度对本申请实施例提供的方案进行了介绍。可以理解的是，网络设备为了实现上述功能，其包括了执行各个功能相应的硬件结构和/或软件模 块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对网络设备进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用对应各个功能划分各个功能模块的情况下，图13示出了上述实施例中所涉及的网络设备13的一种可能的结构示意图，网络设备包括：调整单元1301和处理单元1302。调整单元1301用于支持网络设备执行图7中的过程705-706，图11中的过程1102和1104，图12中的过程1202和1207；处理单元1302用于支持网络设备执行图7中的过程701-704，图11中的过程1101和1103，图12中的过程1201-1206。其中，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
在一种可能的实施方式中，网络设备可以通过图14中的计算机设备(或系统)来实现。
图14所示为本申请实施例提供的计算机设备示意图。计算机设备1400包括至少一个处理器1401，通信总线1402，存储器1403以及至少一个通信接口1404。
处理器1401可以是一个通用中央处理器(central processing unit，CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
通信总线1402可包括一通路，在上述组件之间传送信息。
通信接口1404，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网，无线接入网(radio access network，RAN)，无线局域网(wireless local area networks，WLAN)等。
存储器1403可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过总线与处理器相连接。存储器也可以和处理器集成在一起。
其中，存储器1403用于存储执行本申请方案的应用程序代码，并由处理器1401来控制执行。处理器1401用于执行存储器1403中存储的应用程序代码，从而实现本 专利方法中的功能。
在具体实现中，作为一种实施例，处理器1401可以包括一个或多个CPU，例如图14中的CPU0和CPU1。
在具体实现中，作为一种实施例，计算机设备1400可以包括多个处理器，例如图14中的处理器1401和处理器1407。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
在具体实现中，作为一种实施例，计算机设备1400还可以包括输出设备1405和输入设备1406。输出设备1405和处理器1401通信，可以以多种方式来显示信息。例如，输出设备1405可以是液晶显示器(liquid crystal display，LCD),发光二级管(light emitting diode，LED)显示设备，阴极射线管(cathode ray tube，CRT)显示设备，或投影仪(projector)等。输入设备1406和处理器1401通信，可以以多种方式接受用户的输入。例如，输入设备1406可以是鼠标、键盘、触摸屏设备或传感设备等。
上述的计算机设备1400可以是一个通用计算机设备或者是一个专用计算机设备。在具体实现中，计算机设备1400可以是台式机、便携式电脑、网络服务器、掌上电脑(personal digital assistant，PDA)、移动手机、平板电脑、无线终端设备、通信设备、嵌入式设备或有图14中类似结构的设备。本申请实施例不限定计算机设备1400的类型。
结合本申请公开内容所描述的方法或者算法的步骤可以硬件的方式来实现，也可以是由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于RAM、闪存、ROM、EPROM、EEPROM、寄存器、硬盘、移动硬盘、只读光盘或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于核心网接口设备中。当然，处理器和存储介质也可以作为分立组件存在于核心网接口设备中。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本申请所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上所述的具体实施方式，对本申请的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本申请的具体实施方式而已，并不用于限定本申请的保护范围，凡在本申请的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本申请的保护范围之内。

Claims (13)

  1. 一种虚拟机的监控方法，其特征在于，包括：
    当网络设备确定第一虚拟处理器VCPU中发生中断的客户虚拟机虚拟地址GVA为监控点时，所述网络设备将所述第一VCPU的扩展页表EPT指针从指向第一EPT调整为指向第二EPT；其中，所述监控点用于指示待监控的GVA，所述第一EPT包括所述监控点对应的客户虚拟机物理地址GPA与中断指令对应的主机物理地址HPA之间的映射关系，所述第二EPT包括所述监控点对应的GPA与监控指令对应的HPA之间的映射关系；
    所述网络设备根据所述监控点和所述第二EPT读取所述监控指令，并执行所述监控指令；
    当所述网络设备执行完所述监控指令时，所述网络设备将所述第一VCPU的EPT指针从指向所述第二EPT调整为指向所述第一EPT，以便所述第一VCPU根据所述第一EPT执行所述中断指令。
  2. 根据权利要求1所述的方法，其特征在于，所述网络设备将所述第一VCPU的EPT指针从第一EPT指向第二EPT之前，所述方法还包括：
    所述网络设备确定所述监控点和第一物理页，所述第一物理页的内容为空；
    所述网络设备将第二物理页的指令拷贝至所述第一物理页；其中，所述第二物理页的指令包括所述监控指令；
    所述网络设备将所述第一物理页中的所述监控指令替换为所述中断指令；
    所述网络设备建立所述第二物理页对应的GPA与所述第一物理页的映射关系；
    所述网络设备根据所述第二物理页对应的GPA与所述第一物理页的映射关系建立所述第一EPT。
  3. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    所述网络设备设置所述第一物理页不可读和/或不可写；
    当所述网络设备确定所述第一VCPU发生读操作或写操作的GVA对应所述第一物理页，则所述网络设备将所述第一VCPU的EPT指针从指向所述第一EPT调整为指向所述第二EPT；
    所述网络设备根据所述第二EPT对所述第二物理页进行所述读操作或写操作；
    当所述网络设备对所述第二物理页完成所述读操作或写操作时，所述网络设备将所述第一VCPU的EPT指针从指向所述第二EPT调整为指向所述第一EPT，以便所述网络设备根据所述第一EPT执行所述中断指令。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    所述网络设备判断发生所述写操作的GVA是否包括所述监控点；
    当所述写操作的GVA包括所述监控点时，则所述网络设备读取所述第二物理页中除所述监控点对应的HPA以外发生所述写操作的HPA的指令，并将除所述监控点对应的HPA以外发生所述写操作的HPA的指令写入到所述第一物理页中；
    当所述写操作的GVA不包括所述监控点时，则所述网络设备读取所述第二物理页中所有发生所述写操作的HPA的指令，并将所述所有发生所述写操作的HPA的指令写入到所述第一物理页中。
  5. 根据权利要求1-4所述的方法，其特征在于，若所述网络设备确定所述第一VCPU发生中断时的EPT指针指向所述第二EPT，则将所述中断注入所述第一虚拟机。
  6. 一种网络设备，其特征在于，包括：
    调整单元，用于：当确定第一虚拟处理器VCPU中发生中断的客户虚拟机虚拟地址GVA为监控点时，将所述第一VCPU的扩展页表EPT指针从指向第一EPT调整为指向第二EPT；其中，所述监控点用于指示待监控的GVA，所述第一EPT包括所述监控点对应的客户虚拟机物理地址GPA与中断指令对应的主机物理地址HPA之间的映射关系，所述第二EPT包括所述监控点对应的GPA与监控指令对应的HPA之间的映射关系；
    处理单元，用于根据所述监控点和所述第二EPT读取所述监控指令，并执行所述监控指令；
    所述调整单元还用于：当执行完所述监控指令时，将所述第一VCPU的EPT指针从指向第二EPT调整为指向所述第一EPT，以便所述第一VCPU根据所述第一EPT执行所述中断指令。
  7. 根据权利要求6所述的网络设备，其特征在于，所述处理单元还用于：
    确定所述监控点和第一物理页，所述第一物理页的内容为空；
    将第二物理页的指令拷贝至所述第一物理页；其中，所述第二物理页的指令包括所述监控指令；
    将所述第一物理页中的所述监控指令替换为所述中断指令；
    建立所述第二物理页对应的GPA与所述第一物理页的映射关系；
    根据所述第二物理页对应的GPA与所述第一物理页的映射关系建立所述第一EPT。
  8. 根据权利要求7所述的网络设备，其特征在于，所述处理单元还用于：
    设置所述第一物理页不可读和/或不可写；
    当确定所述第一VCPU发生读操作或写操作的GVA对应所述第一物理页，则通过所述调整单元将所述第一VCPU的EPT指针从指向所述第一EPT调整为指向所述第二EPT；
    根据所述第二EPT对所述第二物理页进行所述读操作或写操作；
    所述调整单元用于：将所述第一VCPU的EPT指针从指向所述第二EPT调整为指向所述第一EPT，以便所述处理单元根据所述第一EPT执行所述中断指令。
  9. 根据权利要求8所述的网络设备，其特征在于，所述处理单元还用于：
    判断发生所述写操作的GVA是否包括所述监控点；
    当所述写操作的GVA包括所述监控点时，则读取所述第二物理页中除所述监控点对应的HPA以外发生所述写操作的HPA的指令，并将除所述监控点对应的HPA以外发生所述写操作的HPA的指令写入到所述第一物理页中；
    当所述写操作的GVA不包括所述监控点时，则读取所述第二物理页中所有发生所述写操作的HPA的指令，并将所述所有发生所述写操作的HPA的指令写入到所述第一物理页中。
  10. 根据权利要求6-9所述的网络设备，其特征在于，所述处理单元还用于：若确定所述第一VCPU发生中断时的EPT指针指向所述第二EPT，则将所述中断注入所 述第一虚拟机。
  11. 一种网络设备，其特征在于，包括：处理器、存储器和通信接口；
    所述存储器用于存储计算机执行指令，当所述网络设备运行时，所述处理器执行所述存储器存储的所述计算机执行指令，以使所述网络设备执行如权利要求1-5中任意一项所述的虚拟机的监控方法。
  12. 一种包含指令的计算机程序产品，其特征在于，当其在计算机上运行时，使得计算机执行如权利要求1-5中任意一项所述的虚拟机的监控方法。
  13. 一种计算机可读存储介质，其特征在于，包括计算机指令，当其在计算机上运行时，使得计算机执行如权利要求1-5中任意一项所述的虚拟机的监控方法。
PCT/CN2017/116278 2017-05-24 2017-12-14 一种虚拟机的监控方法和装置 WO2018214482A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710378105.4 2017-05-24
CN201710378105.4A CN108958879B (zh) 2017-05-24 2017-05-24 一种虚拟机的监控方法和装置

Publications (1)

Publication Number Publication Date
WO2018214482A1 true WO2018214482A1 (zh) 2018-11-29

Family

ID=64395338

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/116278 WO2018214482A1 (zh) 2017-05-24 2017-12-14 一种虚拟机的监控方法和装置

Country Status (2)

Country Link
CN (1) CN108958879B (zh)
WO (1) WO2018214482A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109784062B (zh) * 2018-12-29 2021-07-20 360企业安全技术(珠海)有限公司 漏洞检测方法及装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101403983A (zh) * 2008-11-25 2009-04-08 北京航空航天大学 基于虚拟机的多核处理器的资源监控方法及系统
CN103744765A (zh) * 2013-10-25 2014-04-23 中国科学院计算技术研究所 一种虚拟化环境下的磁盘访问请求监控系统及其方法
CN104036185A (zh) * 2014-06-23 2014-09-10 常熟理工学院 基于虚拟化的宏内核操作系统载入模块权能隔离方法
CN105138388A (zh) * 2014-06-09 2015-12-09 腾讯科技（深圳）有限公司 虚拟机监控方法及装置
CN106354543A (zh) * 2016-08-11 2017-01-25 上海交通大学 一种基于虚拟机和宿主机内存地址转换的numa内存迁页方法
US20170090966A1 (en) * 2015-09-28 2017-03-30 Intel Corporation Method and apparatus for light-weight virtualization contexts

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101882113B (zh) * 2009-05-05 2012-02-22 北京大学 一种基于客户操作系统内核代码替换的内存虚拟化方法
US8726404B2 (en) * 2011-11-14 2014-05-13 Intel Corporation Regulating access to and protecting portions of applications of virtual machines
US9405570B2 (en) * 2011-12-30 2016-08-02 Intel Corporation Low latency virtual machine page table management
US9898430B2 (en) * 2014-11-12 2018-02-20 Vmware, Inc. Tracking virtual machine memory modified by a single root I/O virtualization (SR-IOV) device
CN104809401B (zh) * 2015-05-08 2017-12-19 南京大学 一种操作系统内核完整性保护方法
CN106295385B (zh) * 2015-05-29 2019-10-22 华为技术有限公司 一种数据保护方法和装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101403983A (zh) * 2008-11-25 2009-04-08 北京航空航天大学 基于虚拟机的多核处理器的资源监控方法及系统
CN103744765A (zh) * 2013-10-25 2014-04-23 中国科学院计算技术研究所 一种虚拟化环境下的磁盘访问请求监控系统及其方法
CN105138388A (zh) * 2014-06-09 2015-12-09 腾讯科技（深圳）有限公司 虚拟机监控方法及装置
CN104036185A (zh) * 2014-06-23 2014-09-10 常熟理工学院 基于虚拟化的宏内核操作系统载入模块权能隔离方法
US20170090966A1 (en) * 2015-09-28 2017-03-30 Intel Corporation Method and apparatus for light-weight virtualization contexts
CN106354543A (zh) * 2016-08-11 2017-01-25 上海交通大学 一种基于虚拟机和宿主机内存地址转换的numa内存迁页方法

Also Published As

Publication number Publication date
CN108958879B (zh) 2021-02-26
CN108958879A (zh) 2018-12-07

Similar Documents

Publication Publication Date Title
US8631222B2 (en) Translation of input/output addresses to memory addresses
US9134911B2 (en) Store peripheral component interconnect (PCI) function controls instruction
US8478922B2 (en) Controlling a rate at which adapter interruption requests are processed
EP1939754B1 (en) Providing protected access to critical memory regions
JP4688862B2 (ja) 仮想マシン環境における仮想マシンのシングルステップ機能のサポートを提供すること
US8572635B2 (en) Converting a message signaled interruption into an I/O adapter event notification
US8510599B2 (en) Managing processing associated with hardware events
US8458387B2 (en) Converting a message signaled interruption into an I/O adapter event notification to a guest operating system
CA2800630C (en) Runtime determination of translation formats for adapter functions
RU2562372C2 (ru) Активация/деактивация адаптеров вычислительной среды
US8505032B2 (en) Operating system notification of actions to be taken responsive to adapter events
US20060010440A1 (en) Optimizing system behavior in a virtual machine environment
JP7335339B2 (ja) 有向割り込みの仮想化方法、システム、プログラム
KR101733903B1 (ko) 피어 모니터에서 신뢰성, 이용 가능성 및 서비스 가능성(ｒａｓ) 흐름들을 지원하기 위한 메커니즘
US8621112B2 (en) Discovery by operating system of information relating to adapter functions accessible to the operating system
US20180004675A1 (en) Application execution enclave memory method and apparatus
WO2011160708A1 (en) Multiple address spaces per adapter
JP2022520329A (ja) 割り込みテーブルを使用したマルチレベルの仮想化のための有向割り込み方法、システム、プログラム
JP2022520523A (ja) マルチレベルの仮想化のための有向割り込み方法、システム、プログラム
US10482008B2 (en) Aligned variable reclamation
US10565141B1 (en) Systems and methods for hiding operating system kernel data in system management mode memory to thwart user mode side-channel attacks
WO2018214482A1 (zh) 一种虚拟机的监控方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17911133

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17911133

Country of ref document: EP

Kind code of ref document: A1