Virtualization log export methods, devices, terminals and storage media
By allocating a contiguous memory region as a buffer in the EL2 layer, directly writing fixed-length binary event records, and aggregating data by copying data into memory, the problem of high log transmission overhead between EL1 and EL2 is solved, achieving efficient log transmission and improved system performance.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- KYLIN CORP
- Filing Date
- 2026-05-29
- Publication Date
- 2026-06-30
AI Technical Summary
In a protected virtualization environment based on the ARM64 architecture, the security boundary between EL1 and EL2 results in significant log delivery overhead, impacting system performance. This is especially true in high-frequency log scenarios, where CPU usage and cache pressure are substantial, leading to increased tail latency and decreased throughput.
In the EL2 layer, a contiguous memory region is allocated as a buffer, the start timestamp of the log record is initialized, fixed-length binary event records are written directly, and data is aggregated into a composite event information structure by memory copying under preset conditions. The data is then transmitted through a memory-mapped window region and configured as EL1 read-only access to eliminate notification overhead across exception levels.
It optimizes cache memory space utilization, improves log aggregation efficiency, reduces CPU resource consumption and tail latency, and improves system throughput and latency stability, especially significantly saving system overhead in high-concurrency and high-throughput scenarios.
Smart Images
Figure CN122309287A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of log export technology, and in particular to a virtualized log export method, apparatus, terminal, and storage medium. Background Technology
[0002] In an ARM64 architecture protected virtualization (pKVM) environment, the hypervisor runs at the EL2 exception level, while the host kernel runs at EL1. Due to the strict security boundary between EL2 and EL1, the hypervisor cannot directly call the EL1 kernel logging interface. Related technologies perform a format identifier lookup table, string formatting, and data copying operation on the EL1 side for each log entry.
[0003] In the process of developing this invention, the inventors discovered the following technical problems: In high-frequency logging scenarios, the CPU usage and cache pressure of EL1 are significant using the above method, leading to increased tail latency and affecting the overall system throughput and latency stability. Performance deteriorates rapidly when the log frequency increases or concurrent reads increase; furthermore, EL1 typically needs to use HVC instructions to acquire pages and synchronize states when reading EL2 logs. When log events are intensive, upper layers read frequently in small batches, or multiple CPUs read concurrently, the HVC call frequency increases significantly. The overhead of a single HVC trap / return is approximately 200ns to 2μs. In extreme cases, high-frequency HVC not only severely consumes CPU time but also leads to a decrease in log throughput and a sharp increase in tail latency. Furthermore, it only supports a limited number of parameters and simple text, resulting in a limited amount of log information transmitted per transaction, further increasing the system overhead of log transmission. Summary of the Invention
[0004] This invention provides a virtualization log export method, apparatus, terminal, and storage medium to solve the technical problem in the prior art where the overhead of transferring virtual machine logs from EL2 to EL1 system is large, leading to system performance degradation.
[0005] In a first aspect, embodiments of the present invention provide a method for exporting virtualization logs, including: In the EL2 layer, a contiguous memory region is allocated as a cache, and the start timestamp for log recording is initialized; When a log event occurs, capture the current moment and collect event data; The event type and description are determined based on the event data, and the mask position in the cache is determined based on the event type. The event type and event description are directly written into the event description bitmap of the cache according to the mask position. The relative duration determined based on the start timestamp is written into the preset duration position. The process and CPU information corresponding to the event are written into the cache at a fixed length to generate a fixed-length binary event record. When the preset aggregation conditions are met, the valid event data in the cache area is directly aggregated into the composite event information structure by memory copying, forming a data packet to be exported for transmission across exception levels; EL2 writes the composite event information structure into the memory-mapped window region, which is configured for EL1 read-only access so that EL1 does not need to be trapped in EL2 reading the composite event information structure. When the memory-mapped window region changes from empty to non-empty, EL2 sends a notification to EL1 so that EL1 does not incur additional notification overhead during continuous reading.
[0006] Secondly, embodiments of the present invention also provide a virtualization log export device, comprising: The allocation module is used to allocate a contiguous memory region as a cache in the EL2 layer and initialize the start timestamp of log recording; The capture module is used to capture the current moment and collect event data when a log event occurs; The determination module is used to determine the event type and event description based on the event data, and to determine the mask position in the buffer based on the event type. The first writing module is used to directly write the event type and event description into the event description bitmap of the cache according to the mask position, write the relative duration determined based on the start timestamp into the preset duration position, and write the process and CPU information corresponding to the event into the cache at a fixed length to generate a fixed-length binary event record in the cache. The aggregation module is used to directly aggregate the valid event data in the cache into the composite event information structure by means of memory copy when the preset aggregation conditions are met, so as to form a data packet to be exported for transmission across the exception level. The second writing module is used to enable EL2 to write the composite event information structure into the memory-mapped window area, which is configured for EL1 read-only access so that EL1 does not need to be trapped in EL2 reading the composite event information structure. The notification module is used to send a notification from EL2 to EL1 when the memory-mapped window area changes from empty to non-empty, so that EL1 will not incur additional notification overhead during continuous reading.
[0007] Thirdly, embodiments of the present invention also provide a terminal, including: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the virtualization log export method as described in any of the above embodiments.
[0008] Fourthly, embodiments of the present invention also provide a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform the virtualization log export method provided in the above embodiments.
[0009] The virtualization log export method, apparatus, terminal, and storage medium provided in this invention, through the EL2 layer, allocate a contiguous memory region as a cache and initialize the start timestamp of log recording; when a log event occurs, capture the current moment and collect event data; determine the event type and event description based on the event data, and determine the mask position in the cache based on the event type; directly write the event type and event description into the event description bitmap of the cache according to the mask position, write the relative duration determined based on the start timestamp into a preset duration position, and write the process and CPU information corresponding to the event into the cache at a fixed length, so as to achieve the desired effect in the cache. Fixed-length binary event records are generated in the cache area. When preset aggregation conditions are met, valid event data in the cache area is directly aggregated into a composite event information structure via memory copy, forming a data packet to be exported for transmission across exception levels. EL2 writes the composite event information structure into a memory-mapped window area, which is configured for read-only access by EL1, so that EL1 does not need to be trapped in EL2 reading the composite event information structure. When the memory-mapped window area changes from empty to non-empty, EL2 sends a notification to EL1, so that EL1 does not incur additional notification overhead during continuous reading. The event description bitmap is directly written through the mask position, and combined with fixed-length process and CPU information, the log events are compactly compressed into fixed-length binary event records. This eliminates the calculation and parsing process for variable-length data boundaries, so that the recording process does not rely on complex dynamic memory allocation or formatting operations. The fixed-length structure greatly optimizes the utilization of cache memory space, allowing limited memory to accommodate more log events. When preset aggregation conditions are met, valid event data in the cache area is directly aggregated into the composite event information structure via memory copy. Because the underlying log records are of fixed length, the aggregation process does not require parsing data boundaries one by one or performing complex serialization operations. Batch data encapsulation can be completed directly through memory copying, greatly improving the execution efficiency of log aggregation. The composite event information structure is written to a memory-mapped window area configured for read-only access by EL1. EL1 can obtain log data by directly reading this memory area, completely eliminating the context switching overhead caused by exception level switching in the read path. Decoupling data production and consumption spatially achieves independence in their execution, ensuring their respective processing performance. When the memory-mapped window area changes from empty to non-empty, EL2 sends a notification to EL1 only once. Subsequently, during continuous data reading, EL1 can autonomously and continuously poll and read data without EL2 repeatedly triggering interrupts or notifications, effectively eliminating additional notification overhead in the log flow process. Especially in high-concurrency, high-throughput scenarios, this greatly saves CPU resources and reduces tail latency, significantly reducing the system overhead of log transmission. Attached Figure Description
[0010] Other features, objects, and advantages of the invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a flowchart illustrating the virtualization log export method provided in Embodiment 1 of the present invention; Figure 2 This is a flowchart illustrating the virtualization log export method provided in Embodiment 2 of the present invention; Figure 3 This is a schematic diagram of the virtualization log export device provided in Embodiment 3 of the present invention; Figure 4 This is a schematic diagram of the terminal provided in Embodiment 4 of the present invention. Detailed Implementation
[0011] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present invention, and not all of the structures.
[0012] Example 1 Figure 1 This is a flowchart of a virtualization log export method provided in Embodiment 1 of the present invention. This embodiment is applicable to the case of exporting virtualization logs from EL2 to EL1. The method can be executed by a virtualization log export device and specifically includes the following steps: Step 110: In the EL2 layer, allocate a contiguous memory region as a cache area and initialize the start timestamp for log recording.
[0013] In this embodiment, taking a protected virtualization environment based on the ARM64 architecture as an example, when the Hypervisor in the EL2 layer starts or the logging subsystem is initialized, the EL2 layer allocates a physical memory region with contiguous physical addresses as a buffer for log events through the memory management module inside the Hypervisor. Simultaneously or subsequently, the EL2 layer obtains the absolute timestamp of the current moment by reading a high-precision system timer, such as the cntvct_el0 register in the ARM64 architecture, and initializes this absolute timestamp as the start timestamp for log recording. This start timestamp is stored in the management metadata area of the buffer and used as the calculation base for the timestamps of all subsequent log events. When subsequent log events occur, the system no longer records the absolute timestamp of each event, but instead calculates the relative duration by comparing the current event occurrence time with the start timestamp.
[0014] Step 120: When a log event occurs, capture the current moment and collect event data.
[0015] When a Hypervisor running at the EL2 exception level executes critical logic, such as memory page allocation or virtual CPU creation, generating log events that require recording, the Hypervisor obtains the absolute timestamp of the log event by reading the high-precision timer register provided by the hardware architecture. Furthermore, the Hypervisor collects the necessary descriptive and contextual information based on the currently triggered log event type. For example, this is done according to a preset event pattern definition, including event type and descriptive data. Optionally, feature identifiers and specific business parameters of the current event can be extracted. For instance, for a memory allocation event, specific variable values are collected, including fields such as allocation function name, allocation size, allocation address, and caller information. These variable values correspond to structured fields defined in the pattern definition, and only meaningful parameters are collected to avoid redundant capture of irrelevant data. The Hypervisor also obtains the current execution environment's context information, including the process identifier corresponding to the current log event and the CPU identifier for the log execution time. This information is used to subsequently write event records at fixed lengths to identify the event source. For fields defined as optional in the event pattern, collection is only performed if they actually have valid values.
[0016] Step 130: Determine the event type and event description based on the event data, and determine the mask position in the cache area based on the event type.
[0017] After collecting the raw event data, the Hypervisor needs to perform pattern matching and field mapping at runtime to transform the unstructured raw data into structured indexes and descriptive information that can be serialized and written to the cache.
[0018] The EL2 layer extracts event feature identifiers from the collected event data and searches them in the event pattern table generated during compilation to determine the specific type of the current event. Simultaneously, based on the determined event type, it extracts specific business parameters from the event data as the event description. In this process, the event type clarifies which descriptive fields the event should include; for example, a memory allocation event includes fields such as function name, allocation size, and allocation address, as well as the data type of these fields and whether they are optional, thus providing a data dictionary basis for subsequent coding.
[0019] In structured serialization design, to support sparse encoding of optional fields and save buffer space, this embodiment uses an event description bitmap to indicate the actual description fields of the current event. The mask position can be the bit index of each description field included in the current event type within the event description bitmap. For example, each event type has its field set determined at compile time through a pattern definition, and a fixed bitmap index is assigned to each description field. At runtime, once the event type is determined, EL2 can quickly find the mapping relationship between all possible description fields and bitmap bits based on the event type's pattern definition. Using this method, the mask position of the event description field during subsequent bitmap writing can be accurately located.
[0020] Step 140: Write the event type and event description directly into the event description bitmap of the cache according to the mask position, write the relative duration determined based on the start timestamp into the preset duration position, and write the process and CPU information corresponding to the event into the cache at a fixed length to generate a fixed-length binary event record.
[0021] For example, it may include: determining an event type based on the event data; determining the start position of the event record in the contiguous memory region based on the event type; determining an event tag based on the event type and writing the event tag into the start position; generating an event description field based on the event data and writing it into an event description bitmap in the contiguous memory region based on the description field; determining the relative duration of the event based on the timestamp and writing the relative duration into a preset duration position in the contiguous memory region; and copying the process and CPU information corresponding to the event into the predetermined contiguous memory region according to a fixed type and length.
[0022] Based on the event type determined by the event data, the EL2 layer first determines the fixed byte length occupied by that type of event in a contiguous memory region, and accordingly moves the write pointer in the buffer to locate the starting position of the currently available event record. It then obtains the corresponding preset event tag based on the event type and writes the event tag directly to the starting position with a fixed length, serving as the type identifier for that record. In a fixed-length record structure, an event description bitmap can be used to compactly indicate the optional description fields carried by the event. The EL2 layer sets the corresponding bits of the event description bitmap according to the mask positions of each description field determined in the preceding steps. For example, if a field exists, the bit position corresponding to its mask position is set to 1, and the updated event description bitmap is written to the fixed bitmap offset position in the contiguous memory region.
[0023] Based on the event data, specific event description fields, such as function names and address parameters, are generated. These fields are sequentially written into the description field area of a contiguous memory region using a preset encoding format, such as TLV encoding or fixed-length truncation. The combination of bitmaps and variable-length field sequences ensures both the resolvability of the fixed-length record header with its fixed offset and sparse storage of optional fields, significantly saving cache space. The EL2 layer calculates the difference between the absolute timestamp of the current event (obtained from the above steps) and the previously initialized start timestamp, using this difference as the event's relative duration. To compress storage space, the relative duration can be encoded using variable-length integers, and the encoded relative duration data is written to a preset duration position within the contiguous memory region. This preset duration position has a fixed offset within the fixed-length record structure, allowing the EL1 layer to quickly locate and reconstruct the absolute time during parsing. Furthermore, the EL2 layer directly reads the process identifier (PID) and CPU identifier of the current execution context, and copies the process and CPU information to a predetermined offset position in a contiguous memory region according to a preset fixed type and fixed length (e.g., PID occupies 4 bytes and CPU ID occupies 2 bytes). The fixed length ensures that different event records are stored in an aligned manner in the cache.
[0024] Using the above method, the EL2 layer can compactly encode the timestamp, type, description, and context information of a log event into a fixed-length binary event record and write it sequentially to the buffer. The entire process involves pointer offsets and data movement on contiguous memory, achieving zero-allocation writes with constant time complexity.
[0025] Step 150: When the preset aggregation conditions are met, the valid event data in the cache area is directly aggregated into the composite event information structure by memory copying to form a data packet to be exported for transmission across exception levels.
[0026] To overcome the high trap overhead caused by frequent communication across anomaly levels, this step adopts a strategy of batch encapsulation and zero-copy aggregation to aggregate fine-grained, multi-entity event records in the cache into a coarse-grained, self-contained composite event information structure, thereby significantly reducing the cross-domain transmission cost of a single log.
[0027] During the log operation at the EL2 layer, the event accumulation status of the current buffer is monitored in real time. An aggregation action is triggered when at least one of the following preset aggregation conditions is met. For example, the preset aggregation conditions may include: an event quantity threshold, where the number of newly written fixed-length binary event records in the buffer reaches a preset upper limit, indicating that sufficient data has been accumulated for batch transmission; The load byte threshold ensures that the total number of bytes of valid event data in the buffer reaches the preset load capacity, thus ensuring that the data payload of each transmission fully fills the communication bandwidth. A preset time window is set, and the time interval since the last aggregation export reaches a preset period threshold to ensure that event data can be pushed in a timely manner even if the log generation frequency is low, thus avoiding logs from staying in the cache for too long. Available credit is the remaining capacity of the memory-mapped window area, i.e., EL2 available credit. It is triggered only when it is determined that there is enough write space to accommodate the data to be aggregated, in order to prevent data overflow.
[0028] For example, the step of directly aggregating the valid event data in the cache into the composite event information structure by copying it directly into memory may include: collecting all buffers to be sent, calculating the total data size of the valid event data in all buffers by checking the write pointer of each buffer; calculating the total size of the composite event information structure based on the calculated total data size and the standard header size of the composite event information structure; writing the metadata and verification data of the event information into the header of the composite event information structure, and copying the data from at least one cache into the composite event information structure.
[0029] When the aggregation conditions are met, the EL2 layer first calculates the total length and contiguous memory address range of all valid event data to be sent in the buffer. Since the aforementioned steps allocate physically contiguous memory regions and generate fixed-length binary event records, the valid event data in the buffer is physically contiguous and free of memory fragmentation. Based on this characteristic, the EL2 layer does not need to read and reallocate memory line by line; instead, it directly uses low-level memory block copy instructions to move the entire contiguous block of data from the initial read pointer to the current write pointer in the buffer to the data body area of the composite event information structure in one go. This achieves zero allocation and constant time complexity, greatly reducing the CPU overhead and tail latency of the aggregation process. While copying the event data body into the composite event information structure, the EL2 layer also needs to encapsulate the structure with a standard metadata header. This header information includes, but is not limited to: the number of events contained in this structure, the timestamp of the aggregation, the version number of the log event description metadata, and the integrity check code for the entire data packet. The header metadata, together with the event data body copied from memory, forms a self-describing, verifiable, immutable data packet, which can serve as the basic unit for cross-domain transmission between EL2 and EL1.
[0030] Step 160: EL2 writes the composite event information structure into the memory-mapped window region, which is configured for EL1 read-only access so that EL1 does not need to be trapped in EL2 reading the composite event information structure.
[0031] During the virtualization system initialization phase, the EL2 layer controls the second-stage address translation to allocate a specific region in physical memory as the memory-mapped window region. EL2 configures permissions for the page table entries in this region. For example, within the EL2 side's address space, this region is mapped to have read and write permissions, allowing the Hypervisor to write aggregated log data; while on the EL1 side, i.e., within the host kernel's address space, the region is mapped to strict read-only permissions. This ensures that the host kernel running on EL1 can only directly read the data in this region by executing ordinary load instructions, without any tampering or damage. This ensures the integrity and immutability of cross-domain log data at the hardware level, meeting the reliable requirements for security auditing and fault location. The EL2 layer obtains the available write offset for the current memory-mapped window region and writes the generated composite event information structure as a whole into this window region. Since the composite event information structure is aggregated and generated in contiguous memory, EL2 can use efficient memory copy operations to move it in batches to the mapping window, or directly point the window's mapping pointer to the physical memory where the structure resides through pointer switching, achieving seamless data export.
[0032] In traditional cross-domain log collection schemes, each time EL1 reads log data from EL2, it needs to trigger an exception level switch via an HVC instruction, resulting in significant CPU context switching overhead and tail latency. However, in this embodiment, since the memory-mapped window region is mapped to EL1's address space, the EL1-side reading thread only needs to access the composite event information structure in that window region directly through a pointer, just like accessing local ordinary memory. The entire reading process does not require triggering any exception traps and is completed entirely within the user-mode or kernel-mode local execution flow of EL1. Using this method, the trap overhead of cross-domain communication can be eliminated, reducing the average communication latency of a single log entry from microseconds to nanoseconds of memory access latency, greatly improving system throughput and latency stability in high-concurrency log scenarios.
[0033] Step 170: When the memory-mapped window region changes from empty to non-empty, EL2 sends a notification to EL1 so that EL1 does not incur additional notification overhead during continuous reading.
[0034] If EL2 triggers a notification every time it writes a composite event information structure, EL1 will frequently fall into and wake up, resulting in significant CPU overhead and offsetting the performance gains from zero-allocation writes. Therefore, this embodiment employs a single-edge-triggered notification mechanism based on state inversion. For example, when EL2 writes a composite event information structure to the memory-mapped window region, it simultaneously maintains the fill state of that window region. When EL2 completes the writing of the first composite event information structure, it detects that the data state of the memory-mapped window region has changed from "empty" to "non-empty". Upon detecting this state inversion from empty to non-empty, EL2 sends a single notification signal to EL1. This notification is typically implemented by injecting a specific software interrupt into the virtual interrupt controller. The purpose of this single notification is to activate the log acquisition thread on the EL1 side, which may be in a dormant or suspended state, informing it that data is available. After this moment, as long as the window region remains in a "non-empty" state, EL2 will not send any additional notification signals, regardless of how many more composite event information structures EL2 subsequently writes. Upon receiving this first notification, EL1's acquisition thread is awakened and begins reading data from the memory-mapped window region. Since the window region was previously configured for EL1 read-only access, the EL1 read process is completed entirely within the local execution flow. After reading the existing composite event information structure, if EL1 does not observe an end marker or reach the end of the read pointer, it will continue to attempt to read based on a preset backoff or spin strategy without waiting for subsequent notifications. As long as EL2 continues to write data to keep the window non-empty, EL1 can continue to consume data. When EL1 has completely consumed all the valid data in the memory-mapped window region, it re-marks the window state as "empty" through a preset synchronization mechanism. At this point, if EL2 writes data again, triggering a new "empty to non-empty" flip, the next notification will be triggered. Using the above method, under a steady-state load of continuously generating events, the continuous read process of EL1 completely eliminates the overhead of interrupts and exception traps, achieving true zero-notification-cost reading, maximizing the allocation of CPU resources to business logic and log processing logic, and significantly improving the overall throughput and latency determinism of the system.
[0035] This embodiment allocates a contiguous memory region as a buffer at the EL2 layer and initializes the start timestamp of log recording. When a log event occurs, it captures the current moment and collects event data. Based on the event data, it determines the event type and event description, and determines the mask position in the buffer based on the event type. It directly writes the event type and event description into the event description bitmap of the buffer according to the mask position, writes the relative duration determined based on the start timestamp into a preset duration position, and writes the process and CPU information corresponding to the event at a fixed length to generate a fixed-length binary event record in the buffer. When a preset aggregation condition is met, it directly aggregates the valid event data in the buffer into a composite event information structure via memory copy, forming a data packet to be exported for cross-exception level transmission. EL2 writes the composite event information structure into a memory-mapped window region, which is configured for EL1 read-only access so that EL1 does not need to be trapped in EL2 reading the composite event information structure. When the memory-mapped window region changes from empty to non-empty, EL2 sends a notification to EL1 so that EL1 does not incur additional notification overhead during continuous reading. By directly writing the event description bitmap to the mask position and combining it with fixed-length process and CPU information, log events are compactly compressed into fixed-length binary event records. This eliminates the need for calculating and parsing variable-length data boundaries, allowing the recording process to avoid relying on complex dynamic memory allocation or formatting operations. The fixed-length structure greatly optimizes the utilization of cache memory space, enabling limited memory to accommodate more log events. When preset aggregation conditions are met, valid event data in the cache is directly aggregated into a composite event information structure via memory copy. Since the underlying log records are of fixed length, the aggregation process does not require parsing data boundaries one by one or performing complex serialization operations; batch data encapsulation can be completed directly through memory copy, greatly improving the execution efficiency of log aggregation. The composite event information structure is written to a memory-mapped window area configured for EL1 read-only access. EL1 can obtain log data by directly reading this memory area, completely eliminating the context switching overhead caused by exception level switching on the read path. Spatially decoupling data production and consumption achieves the independence of their execution, ensuring their respective processing performance. When the memory-mapped window region changes from empty to non-empty, EL2 sends a notification to EL1 only once. Afterward, EL1 can autonomously and continuously poll and read data without EL2 repeatedly triggering interrupts or notifications, effectively eliminating the additional notification overhead during log transfer. Especially in high-concurrency, high-throughput scenarios, this significantly saves CPU resources and reduces tail latency, greatly reducing the system overhead of log transmission.
[0036] In a preferred embodiment of this example, before allocating a contiguous memory region as a cache and initializing the start timestamp of the log record at the EL2 layer, the method may further include the following steps: writing the description metadata of the log event into a header file or configuration file, and generating the corresponding encoding / decoding structure using a code generation tool during EL2 and EL1 compilation; or, generating an independent description file using the description metadata of the log event, and loading the independent description file during EL1 and EL2 runtime. To enable the Hypervisor running at the EL2 layer and the host kernel running at the EL1 layer to perform unambiguous encoding and decoding of binary event records and composite event information structures, avoiding parsing errors caused by format table mismatches in the prior art, during the system compilation phase, developers first define the description metadata of the log event. This description metadata includes, but is not limited to, event type identifier, event name, included field names, field data types, whether the field is optional, and the mask position of the field in the event description bitmap. The description metadata is written into a preset header file or configuration file. During the compilation of EL2 and EL1 code, the descriptive metadata in the header files or configuration files is parsed by a code generation tool to automatically generate the encoding structure and functions for EL2, as well as the corresponding decoding structure and functions for EL1. The encoding structure contains logic for serializing heterogeneous event parameters into contiguous memory regions according to bitmap and TLV formats; the decoding structure contains logic for deserializing binary data according to bitmap instructions. Using this method, EL2 and EL1 are forcibly bound to the same version of encoding and decoding logic during compilation, ensuring strict consistency of the binary data stream format. Since the encoding and decoding logic is hard-coded and inlined in the instruction stream, no additional table lookup operations are required at runtime, achieving the highest encoding and decoding execution efficiency and zero additional memory allocation, which perfectly matches pKVM's constraints on low overhead and small size of the Hypervisor. To support flexible updates or extensions of log event definitions without recompiling the EL2 or EL1 images, this embodiment also provides a dynamic loading implementation. In this approach, during the runtime of EL2 and EL1 (e.g., during system startup or module loading), EL2 and EL1 read and load the independent description file from preset storage locations. During loading, the file is parsed to dynamically construct the corresponding encoding / decoding logic dictionary or structure in memory. When a new log event is added or a field definition is modified, only the independent description file needs to be updated and the relevant service restarted; there is no need to replace the entire system firmware, improving the scalability of the logging component. Simultaneously, to ensure the consistency of the description file version loaded at runtime, EL1 can verify whether the version identifier carried by the composite event information structure matches the version of the description file it loaded when parsing. If they do not match, parsing is refused or a degradation process is triggered, thereby ensuring the security of data parsing.
[0037] Furthermore, the method may include the following steps: In the EL1 layer, the composite event information structure is parsed to obtain the version of the start timestamp and the description metadata of the log event, and it is determined whether the version is consistent with its own version. If consistent, each event is parsed cyclically based on the description metadata of the log event; the parsing results are stored in a preset storage area of the EL1 layer. To restore the structured binary data transmitted across domains to readable and analyzable log information, and to ensure the security and accuracy of data parsing, preventing data corruption due to version misalignment, EL1 first parses the standard header area of the composite event information structure, extracting the start timestamp (base_ts) written by the EL2 side and the version identifier of the description metadata of the log event. Subsequently, EL1 performs a consistency comparison between the extracted version identifier and its currently loaded description metadata version. Since the binary event records in the composite event information structure are encoded based on a specific version of the description metadata, if the metadata versions of EL1 and EL2 are inconsistent, the field offsets, type lengths, and bitmap mask meanings of the binary data may be misaligned, and direct parsing will lead to memory overflow or data corruption. Therefore, the subsequent parsing process is only allowed when the versions of the two data packets are completely identical; if they are inconsistent, the current data packet is discarded or a version mismatch alarm is triggered to ensure the security of data parsing. After the version verification is successful, EL1 traverses the fixed-length binary event records in the composite event information structure data body based on the matching description metadata, and performs loop parsing. For each event record, EL1 performs timestamp reconstruction and bitmap parsing and field decoding. For example, it reads the relative duration at the preset duration position in the event record, adds it to the start timestamp extracted from the header, and recovers the precise absolute timestamp when the event occurred; it reads the event description bitmap and determines which description fields actually exist in the current event based on the bitmap mask indication. Subsequently, according to the field order and data type (such as TLV format or fixed-length format) defined in the description metadata, it deserializes the specific values of each field from the contiguous memory area. After each event is parsed, EL1 writes the structured parsing result containing the absolute timestamp, event type, and complete field key-value pairs to the preset storage area of the EL1 layer. This preset storage area can be the kernel's circular log buffer or a user-space accessible area mapped through file system interfaces such as TraceFS. By storing the parsed results in the preset area, log data persistence and presentation to higher layers are achieved. This allows upper-layer operation and maintenance tools, debugging programs, or auditing systems to directly read the formatted structured logs without relying on EL1 for high-frequency real-time string formatting operations, further reducing the processing overhead on the EL1 side.
[0038] Example 2 Figure 2 This is a flowchart illustrating the virtualization log export method provided in Embodiment 2 of the present invention. This embodiment is based on the above embodiment and optimized by directly aggregating the valid event data in the cache into the composite event information structure via memory copy. Specifically, the optimization is as follows: calculate the remaining capacity of the memory-mapped window region based on the available credit of EL2 and the return credit of EL1, and determine the valid event data in the cache region that can be aggregated based on the remaining capacity. Then, directly aggregate the valid event data in the cache region that can be aggregated into the composite event information structure via memory copy. The available credit of EL2 is the maximum number of bytes that EL2 is allowed to write into the memory-mapped window region at the current moment. The return credit of EL1 is a counter maintained by EL1 and monotonically incremented and returned to EL2, representing the total amount of memory-mapped window region space that EL1 has consumed and released.
[0039] See Figure 2 The virtualization log export method includes: Step 210: In the EL2 layer, allocate a contiguous memory region as a buffer and initialize the start timestamp of log recording. When a log event occurs, capture the current moment and collect event data.
[0040] Step 220: Determine the event type and event description based on the event data, and determine the mask position in the cache area based on the event type.
[0041] Step 230: Write the event type and event description directly into the event description bitmap of the cache according to the mask position, write the relative duration determined based on the start timestamp into the preset duration position, and write the process and CPU information corresponding to the event into the cache at a fixed length to generate a fixed-length binary event record.
[0042] Step 240: When the preset aggregation conditions are met, calculate the remaining capacity of the memory-mapped window region based on the available credits of EL2 and the returned credits of EL1, and determine the valid event data in the aggregateable cache area based on the remaining capacity. Then, aggregate the valid event data in the aggregateable cache area directly into the composite event information structure by means of memory copy.
[0043] In the cross-domain data transfer model where EL2 pushes log data unidirectionally to EL1, to prevent the log generation rate of EL2 from far exceeding the consumption rate of EL1, which could lead to overflow of the memory-mapped window area and overwrite log data that EL1 has not yet read, a flow control mechanism based on credit feedback is introduced in this embodiment. This mechanism ensures speed decoupling and data security between the producer (EL2) and the consumer (EL1).
[0044] Before determining the amount of data to aggregate, EL2 needs to dynamically assess the remaining capacity of the memory-mapped window region. The available credit of EL2 is the maximum number of bytes that EL2 is allowed to write to the memory-mapped window region at the current moment; the return credit of EL1 is a counter maintained by EL1 and monotonically incremented and returned to EL2, representing the total amount of memory-mapped window region space that EL1 has consumed and released.
[0045] For example, EL2 calculates the amount of data currently occupied but not yet read by reading its own cumulative write volume and combining it with the EL1 reward credit provided by EL1 through shared memory or a specific backhaul mechanism. The remaining capacity of the memory-mapped window region is equal to the total capacity of the window minus the aforementioned occupied data volume. By introducing EL1 reward credit, EL2 can accurately perceive the consumption progress of EL1, thereby dynamically adjusting its own write quota to prevent data overwriting. After calculating the remaining capacity of the current memory-mapped window region, EL2 needs to constrain the amount of data aggregated this time according to the capacity limit. EL2 first counts the total data size of all valid event data to be sent in the current buffer. If the total data size is less than or equal to the calculated remaining capacity, all valid event data in the buffer is determined as aggregable data; if the total data size is greater than the remaining capacity, a portion of the valid event data is truncated according to the remaining capacity, and the truncated data is determined as aggregable data to ensure that the final generated data packet to be exported does not exceed the receiving capacity of EL1.
[0046] After determining the range of valid event data that can be aggregated, EL2 directly moves the valid event data in this contiguous memory region to the data body area of a pre-built composite event information structure in batches using memory block copies, and completes the data packet encapsulation by combining header metadata. Since the sufficiency of the target write space has been ensured through a credit mechanism before aggregation, this aggregation process does not require additional boundary overflow checks or blocking waits, achieving deterministic zero-allocation memory copying, which greatly improves the throughput and stability of cross-domain data transmission.
[0047] Step 250: EL2 writes the composite event information structure into the memory-mapped window region, which is configured for EL1 read-only access so that EL1 does not need to be trapped in EL2 reading the composite event information structure.
[0048] Step 260: When the memory-mapped window region changes from empty to non-empty, EL2 sends a notification to EL1 so that EL1 does not incur additional notification overhead during continuous reading.
[0049] This embodiment optimizes the aggregation of valid event data from the buffer into a composite event information structure via direct memory copying. Specifically, it calculates the remaining capacity of the memory-mapped window region based on the available EL2 credit and the returned EL1 credit, determines the valid event data in the buffer region that can be aggregated based on this remaining capacity, and aggregates this valid event data directly into the composite event information structure via memory copying. The available EL2 credit is the maximum number of bytes that EL2 is currently allowed to write into the memory-mapped window region. The returned EL1 credit is a counter maintained by EL1 and monotonically incremented and returned to EL2, representing the total amount of memory-mapped window region space that EL1 has consumed and released. This ensures that the final generated data packet to be exported will not exceed the receiving capacity of EL1, achieving deterministic zero-allocation memory copying and greatly improving the throughput and stability of cross-domain data transmission.
[0050] Example 3 Figure 3 This is a schematic diagram of the virtualization log export device provided in Embodiment 3 of the present invention. See also... Figure 3 The virtualization log export device includes: Application module 310 is used to apply for a contiguous memory region as a cache in the EL2 layer and initialize the start timestamp of log recording; The capture module 320 is used to capture the current moment and collect event data when a log event occurs; The determination module 330 is used to determine the event type and event description based on the event data, and to determine the mask position in the buffer based on the event type. The first writing module 340 is used to directly write the event type and event description into the event description bitmap of the cache according to the mask position, write the relative duration determined based on the start timestamp into the preset duration position, and write the process and CPU information corresponding to the event into the cache with a fixed length to generate a fixed-length binary event record in the cache. The aggregation module 350 is used to directly aggregate the valid event data in the cache into the composite event information structure by means of memory copy when the preset aggregation conditions are met, so as to form a data packet to be exported for transmission across the exception level. The second writing module 360 is used to enable EL2 to write the composite event information structure into the memory-mapped window area, which is configured for EL1 read-only access so that EL1 does not need to be trapped in EL2 reading the composite event information structure. The notification module 370 is used to send a notification from EL2 to EL1 when the memory-mapped window area changes from empty to non-empty, so that EL1 will not incur additional notification overhead during continuous reading.
[0051] The virtualized log export device provided in this embodiment allocates a contiguous memory region as a cache at the EL2 layer and initializes the start timestamp of log recording. When a log event occurs, it captures the current moment and collects event data. Based on the event data, it determines the event type and event description, and determines the mask position in the cache based on the event type. It directly writes the event type and event description into the event description bitmap of the cache according to the mask position, writes the relative duration determined based on the start timestamp into a preset duration position, and writes the process and CPU information corresponding to the event at a fixed length to generate a fixed-length cache. The system records binary events. When preset aggregation conditions are met, valid event data in the buffer is directly aggregated into a composite event information structure via memory copy, forming a data packet to be exported for transmission across exception levels. EL2 writes the composite event information structure into a memory-mapped window area, which is configured for read-only access by EL1, so that EL1 does not need to be trapped in EL2 reading the composite event information structure. When the memory-mapped window area changes from empty to non-empty, EL2 sends a notification to EL1, so that EL1 does not incur additional notification overhead during continuous reading. The event description bitmap is directly written through the mask position, and combined with fixed-length process and CPU information, the log events are compactly compressed into fixed-length binary event records. This eliminates the calculation and parsing process for variable-length data boundaries, so that the recording process does not rely on complex dynamic memory allocation or formatting operations. The fixed-length structure greatly optimizes the utilization of buffer memory space, allowing limited memory to accommodate more log events. When preset aggregation conditions are met, valid event data in the buffer is directly aggregated into a composite event information structure via memory copy. Because the underlying log records are of fixed length, the aggregation process does not require parsing data boundaries one by one or performing complex serialization operations. Batch data encapsulation can be completed directly through memory copying, greatly improving the execution efficiency of log aggregation. The composite event information structure is written to a memory-mapped window area configured for read-only access by EL1. EL1 can obtain log data by directly reading this memory area, completely eliminating the context switching overhead caused by exception level switching in the read path. Decoupling data production and consumption spatially achieves independence in their execution, ensuring their respective processing performance. When the memory-mapped window area changes from empty to non-empty, EL2 sends a notification to EL1 only once. Subsequently, during continuous data reading, EL1 can autonomously and continuously poll and read data without EL2 repeatedly triggering interrupts or notifications, effectively eliminating additional notification overhead in the log flow process. Especially in high-concurrency, high-throughput scenarios, this greatly saves CPU resources and reduces tail latency, significantly reducing the system overhead of log transmission.
[0052] Based on the above embodiments, the preset aggregation conditions include: The event count threshold, the payload byte threshold, the preset time window, and / or the available credit limit are reached.
[0053] Based on the above embodiments, the aggregation module includes: The memory copy unit is used to calculate the remaining capacity of the memory-mapped window region based on the available credit of EL2 and the return credit of EL1, and to determine the valid event data in the aggregable buffer based on the remaining capacity. The valid event data in the aggregable buffer is directly aggregated into the composite event information structure by memory copy. The available credit of EL2 is the maximum number of bytes that EL2 is allowed to write to the memory-mapped window region at the current time. The return credit of EL1 is a counter maintained by EL1 and monotonically incremented and returned to EL2, representing the total amount of memory-mapped window region space that EL1 has consumed and released.
[0054] Based on the above embodiments, the device further includes: The third writing module is used to write the description metadata of the log events into the header file or configuration file; The first generation module is used to generate the corresponding encoding / decoding structure using code generation tools during EL2 and EL1 compilation. or, The second generation module is used to generate an independent description file using the description metadata of the log events, and load the independent description file during EL1 and EL2 runtime.
[0055] Based on the above embodiments, the device further includes: The parsing module is used in the EL1 layer to parse the composite event information structure, obtain the start timestamp and the version of the description metadata of the log event, and determine whether the version is consistent with its own version. If they are consistent, it cyclically parses each event based on the description metadata of the log event. The storage module is used to store the parsing results in the preset storage area of the EL1 layer.
[0056] Based on the above embodiments, the first writing module includes: A determining unit is configured to determine the event type based on the event data, and determine the start bit of the event record in the contiguous memory region based on the event type; The writing unit is used to determine the event label according to the event type and write the event label into the start position; A generation unit is configured to generate an event description field based on the event data, and write an event description bitmap into the contiguous memory region based on the description field; The relative duration determination unit is used to determine the relative duration of an event based on a timestamp and write the relative duration into a preset duration position in the contiguous memory region; The copying unit is used to copy the process and CPU information corresponding to the event to a predetermined contiguous memory area according to a fixed type and length.
[0057] Based on the above embodiments, the aggregation module includes: The collection unit is used to collect all buffers to be sent, and calculates the total data size of valid event data in all buffers by checking the write pointer of each buffer; The calculation unit is used to calculate the total size of the composite event information structure based on the calculated total data size and the standard header size of the composite event information structure. The copying unit is used to write metadata and verification data of the event information into the header of the composite event information structure and to copy data from at least one cache area to the composite event information structure.
[0058] The virtualization log export device provided in this embodiment of the invention can execute the virtualization log export method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method.
[0059] Example 4 Figure 4 This is a schematic diagram of the structure of a terminal provided in Embodiment 4 of the present invention. Figure 4 A block diagram is shown of an exemplary terminal 12 suitable for implementing embodiments of the present invention. Figure 4 The terminal 12 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.
[0060] like Figure 4 As shown, terminal 12 is presented in the form of a general-purpose computing terminal. The components of terminal 12 may include, but are not limited to: one or more processors or processing units 16, system memory 28, and bus 18 connecting different system components (including system memory 28 and processing unit 16).
[0061] Bus 18 represents one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of the various bus architectures. For example, these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.
[0062] Terminal 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by terminal 12, including volatile and non-volatile media, removable and non-removable media.
[0063] System memory 28 may include computer system readable media in the form of volatile memory, such as RAM 30 and / or cache 32. Terminal 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 4 Not shown; usually referred to as a "hard drive"). Although Figure 4 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk") and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 18 via one or more data media interfaces. System memory 28 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the embodiments of the present invention.
[0064] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28. Such program modules 42 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 42 typically perform the functions and / or methods described in the embodiments of the present invention.
[0065] Terminal 12 can also communicate with one or more external devices 14 (e.g., keyboard, pointing terminal, display 24, etc.), and with one or more terminals that enable a user to interact with terminal 12, and / or with any terminal (e.g., network card, modem, etc.) that enables terminal 12 to communicate with one or more other computing terminals. This communication can be performed via I / O interface 22. Furthermore, terminal 12 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 20. As shown, network adapter 20 communicates with other modules of terminal 12 via bus 18. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with terminal 12, including but not limited to: microcode, terminal drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.
[0066] The processing unit 16 executes various functional applications and data processing by running programs stored in the system memory 28, such as implementing the virtualization log export method provided in the embodiments of the present invention.
[0067] Example 5 Embodiment 5 of the present invention also provides a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform any of the virtualization log export methods provided in the above embodiments.
[0068] The computer storage medium of this invention can be any combination of one or more computer-readable media. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. For example, a computer-readable storage medium can be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.
[0069] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.
[0070] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including—but not limited to—wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.
[0071] Computer program code for performing the operations of this invention can be written in one or more programming languages or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, and C++, as well as conventional procedural programming languages such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or terminal. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).
[0072] Note that the above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.
Claims
1. A method for exporting virtualization logs, characterized in that, include: In the EL2 layer, a contiguous memory region is allocated as a cache, and the start timestamp for log recording is initialized; When a log event occurs, capture the current moment and collect event data; The event type and description are determined based on the event data, and the mask position in the cache is determined based on the event type. The event type and event description are directly written into the event description bitmap of the cache according to the mask position. The relative duration determined based on the start timestamp is written into the preset duration position. The process and CPU information corresponding to the event are written into the cache at a fixed length to generate a fixed-length binary event record. When the preset aggregation conditions are met, the valid event data in the cache area is directly aggregated into the composite event information structure by memory copying, forming a data packet to be exported for transmission across exception levels; EL2 writes the composite event information structure into the memory-mapped window region, which is configured for EL1 read-only access so that EL1 does not need to be trapped in EL2 reading the composite event information structure. When the memory-mapped window region changes from empty to non-empty, EL2 sends a notification to EL1 so that EL1 does not incur additional notification overhead during continuous reading.
2. The method according to claim 1, characterized in that, The preset aggregation conditions include: The event count threshold, the payload byte threshold, the preset time window, and / or the available credit limit are reached.
3. The method according to claim 2, characterized in that, The step of directly aggregating the valid event data in the cache into the composite event information structure by copying it directly into memory includes: The remaining capacity of the memory-mapped window region is calculated based on the available credits of EL2 and the return credits of EL1. Based on the remaining capacity, the valid event data in the aggregateable buffer is determined. The valid event data in the aggregateable buffer is directly aggregated into the composite event information structure by memory copy. The available credits of EL2 are the maximum number of bytes that EL2 is allowed to write to the memory-mapped window region at the current moment. The return credits of EL1 are counters maintained by EL1 and monotonically incremented and returned to EL2, representing the total amount of memory-mapped window region space that EL1 has consumed and released.
4. The method according to claim 1, characterized in that, Before allocating a contiguous memory region as a cache at the EL2 layer and initializing the start timestamp for log recording, the method further includes: The description metadata of the log events is written into the header file or configuration file, and the corresponding encoding / decoding structure is generated by the code generation tool during EL2 and EL1 compilation. Alternatively, a separate description file can be generated using the description metadata of the log events, and the separate description file can be loaded during EL1 and EL2 runtime.
5. The method according to claim 4, characterized in that, The method further includes: In the EL1 layer, the composite event information structure is parsed to obtain the version of the start timestamp and the description metadata of the log event, and it is determined whether the version is consistent with its own version. If they are consistent, each event is parsed in a loop based on the description metadata of the log event. The parsing results are stored in the preset storage area of EL1 layer.
6. The method according to claim 1, characterized in that, The process of directly writing the event type and event description into the event description bitmap of the cache according to the mask position, writing the relative duration determined based on the start timestamp into the preset duration position, and writing the process and CPU information corresponding to the event into the cache at a fixed length includes: The event type is determined based on the event data, and the starting position of the event record in the contiguous memory region is determined based on the event type. The event label is determined according to the event type, and the event label is written into the start position; An event description field is generated based on the event data, and an event description bitmap is written into the contiguous memory region based on the description field. The relative duration of the event is determined based on the timestamp, and the relative duration is written into the preset duration position of the contiguous memory region; The process and CPU information corresponding to the event are copied to the predetermined contiguous memory area according to a fixed type and length.
7. The method according to claim 1, characterized in that, The step of directly aggregating the valid event data in the cache into the composite event information structure by copying it directly into memory includes: Collect all buffers to be sent, and calculate the total data size of valid event data in all buffers by checking the write pointer of each buffer; The total size of the composite event information structure is calculated based on the calculated total data size and the standard header size of the composite event information structure. Metadata and verification data of the event information are written into the header of the composite event information structure, and data from at least one cache area is copied to the composite event information structure.
8. A virtualized log export device, characterized in that, include: The allocation module is used to allocate a contiguous memory region as a cache in the EL2 layer and initialize the start timestamp of log recording. The capture module is used to capture the current moment and collect event data when a log event occurs; The determination module is used to determine the event type and event description based on the event data, and to determine the mask position in the buffer based on the event type. The first writing module is used to directly write the event type and event description into the event description bitmap of the cache according to the mask position, write the relative duration determined based on the start timestamp into the preset duration position, and write the process and CPU information corresponding to the event into the cache at a fixed length to generate a fixed-length binary event record in the cache. The aggregation module is used to directly aggregate the valid event data in the cache into the composite event information structure by means of memory copy when the preset aggregation conditions are met, so as to form a data packet to be exported for transmission across the exception level. The second writing module is used to enable EL2 to write the composite event information structure into the memory-mapped window area, which is configured for EL1 read-only access so that EL1 does not need to be trapped in EL2 reading the composite event information structure. The notification module is used to send a notification from EL2 to EL1 when the memory-mapped window area changes from empty to non-empty, so that EL1 will not incur additional notification overhead during continuous reading.
9. A terminal, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the virtualization log export method as described in any one of claims 1-7.
10. A storage medium containing computer-executable instructions, characterized in that, The computer-executable instructions, when executed by a computer processor, are used to perform the virtualization log export method as described in any one of claims 1-7.