Virtual machine running system, method, processor and electronic device

Abstract

This disclosure provides a virtual machine runtime system, method, processor, and electronic device, relating to the field of virtual machine technology. The system includes: a virtual machine monitor, which runs at a first exception level and is used to create virtual machines using a virtualization environment provided by a microkernel, and to handle interrupt events associated with the virtual machines according to notifications from the microkernel; a virtual machine, which runs at a second exception level; and a microkernel, which runs at a third exception level and is used to provide the necessary virtualization environment for the virtual machine monitor to create the virtual machines, and to intercept interrupt events associated with the virtual machines and notify the virtual machine monitor to handle the interrupt events; the privilege levels of the first exception level, the second exception level, and the third exception level increase sequentially. This disclosure aims to solve the problems of centralized privileges and high resource consumption in existing virtual machine runtime systems.

Description

Technical Field

[0001] This disclosure relates to the field of virtual machine technology, specifically to a virtual machine operating system, method, processor, and electronic device. Background Technology

[0002] The Virtual Machine Monitor (VMM), also known as a "hypervisor," is a core component of virtualization technology. It is responsible for managing the resource allocation (such as processor (CPU), memory, and devices), task scheduling, and isolation of the virtual machine (Guest OS), while also handling hardware access requests from the Guest OS.

[0003] The exception levels in the ARM architecture are divided into the following categories according to privileges from low to high: el0 is user mode with the lowest privileges; el1 is kernel mode, where virtual machines usually run; el2 is virtualization extended mode, where microkernels and virtual machine monitors traditionally run. el2 has the highest privileges and can access more physical hardware resources.

[0004] In existing technologies, the Guest OS running at the el1 level and the VMM running at the el2 level directly transmit and intercept messages, which leads to problems of centralized permissions and high resource consumption. Summary of the Invention

[0005] In view of this, the present disclosure provides a virtual machine operating system, method, processor, and electronic device to solve the problems of centralized permissions and high resource consumption in virtual machine operating systems built in the prior art.

[0006] In a first aspect, this disclosure provides a virtual machine runtime system, including: A virtual machine monitor, which runs at a first exception level, is used to create virtual machines using the virtualization environment provided by the microkernel, and to handle interrupt events associated with the virtual machines according to notifications from the microkernel. A virtual machine, which is running at the second exception level; A microkernel, which runs at the third exception level, is used to provide the virtualization environment required for the virtual machine to create the virtual machine for the virtual machine monitor, and to intercept interrupt events associated with the virtual machine and notify the virtual machine monitor to handle the interrupt events; The permission levels of the first exception level, the second exception level, and the third exception level increase sequentially.

[0007] Secondly, this disclosure provides a method for running a virtual machine, including: The microkernel provides the necessary virtualization environment for the virtual machine to be created by the virtual machine monitor; The virtual machine monitor uses the virtualization environment provided by the microkernel to create virtual machines; wherein, the virtual machine monitor runs at a first exception level, the virtual machine runs at a second exception level, the microkernel runs at a third exception level, and the privilege levels of the first exception level, the second exception level, and the third exception level increase sequentially. The microkernel intercepts the interrupt event associated with the virtual machine and notifies the virtual machine monitor to handle the interrupt event. The virtual machine monitor handles the interrupt event associated with the virtual machine according to the notification from the microkernel.

[0008] Thirdly, this disclosure provides a processor in which at least one core of the processor runs the virtual machine runtime system described in the first aspect.

[0009] Fourthly, this disclosure provides an electronic device including the processor described in the third aspect.

[0010] The embodiments provided in this disclosure separate the virtual machine monitor from the microkernel in the virtual machine runtime system. The virtual machine monitor runs at a first exception level, the virtual machine runs at a second exception level, and the microkernel runs at a third exception level. The privilege levels of the first, second, and third exception levels increase sequentially. By having the virtual machine monitor, virtual machines, and microkernel run at different exception levels, the problem of concentrated privileges is avoided. Furthermore, separating the virtual machine monitor, which runs at the lower privilege level (first exception level), from the higher privilege level (microkernel), ensures the security of the virtual machine runtime system. In addition, the microkernel provides the necessary virtualization environment for the virtual machine monitor to create virtual machines, and intercepts interrupt events associated with the virtual machines, notifying the virtual machine monitor to handle these interrupt events. This disperses privileges within the virtual machine runtime system. Through interaction and interception mechanisms, it enables the handling of interrupt events associated with virtual machines, allowing the management functions of the virtual machine controller to be moved to the microkernel. This ensures security while avoiding the high resource consumption caused by direct interaction between the virtual machine monitor and the virtual machines. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0012] Figure 1 The diagram shown is an architectural representation of the virtual machine runtime system in this embodiment of the present disclosure. Figure 1.

[0013] Figure 2 The diagram shown is an architectural representation of the virtual machine runtime system in this embodiment of the present disclosure. Figure 2 .

[0014] Figure 3 The diagram shown is a schematic representation of the process for handling shared peripheral interrupt events in an embodiment of this disclosure.

[0015] Figure 4 The diagram shown is a schematic representation of the process for handling private peripheral interruption events in an embodiment of this disclosure.

[0016] Figure 5 The diagram shown is a schematic representation of the memory access processing procedure in an embodiment of this disclosure.

[0017] Figure 6 The diagram shown is a schematic of the system register processing procedure in an embodiment of this disclosure.

[0018] Figure 7 The diagram shown is a schematic flowchart of the virtual machine operation method in an embodiment of this disclosure. Detailed Implementation

[0019] The technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0020] Where there is no conflict, the various embodiments of this disclosure and the features thereof in the embodiments may be combined with each other.

[0021] As used herein, the term “and / or” includes any and all combinations of one or more related enumerated entries.

[0022] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. As used herein, the singular forms “a” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that when the terms “comprising” and / or “made of” are used in this specification, the presence of the stated feature, integral, step, operation, element, and / or component is specified, but the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof is not excluded. Words such as “connected” or “linked” are not limited to physical or mechanical connections but can include electrical connections, whether direct or indirect.

[0023] Unless otherwise specified, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and this disclosure, and will not be interpreted as having an idealized or overly formal meaning, unless expressly so defined herein.

[0024] In related technologies, the Guest OS running at the el1 level and the VMM running at the el2 level directly transmit and intercept messages, which has the problems of centralized permissions and high resource consumption.

[0025] Example 1: To address this problem, this disclosure provides a virtual machine runtime system, such as... Figure 1 The diagram shows the architecture of a virtual machine runtime system. Figure 1 The virtual machine operating system mainly includes a virtual machine monitor 10, a virtual machine 11, and a microkernel 12.

[0026] The virtual machine monitor 10 runs at a first exception level, used to create a virtual machine 11 using the virtualization environment provided by the microkernel 12, and to handle interrupt events associated with the virtual machine 11 according to notifications from the microkernel 12; the virtual machine 11 runs at a second exception level; the microkernel 12 runs at a third exception level, used to provide the necessary virtualization environment for the virtual machine monitor 10 to create the virtual machine 11, and to intercept interrupt events associated with the virtual machine 11 and notify the virtual machine monitor 10 to handle the interrupt events; the privilege levels of the first exception level, the second exception level, and the third exception level increase sequentially.

[0027] For example, taking the exception levels of the ARM architecture as an example, the first exception level is el0, the second exception level is el1, and the third exception level is el2. el0 is user mode with the lowest privileges; el1 is kernel mode; el2 is virtualization extended mode, with the highest privileges and access to more physical hardware resources. The virtual machine monitor 10 is located in el0 and cannot directly use the microkernel 12 located in el2. The virtual machine monitor 10 can be deployed externally as a sub-server or client, ensuring security and reliability. Furthermore, running the virtual machine monitor 10 in el0 ensures the stability of the virtual machine operating system.

[0028] A microkernel, also known as a micro kernel, is a minimalist kernel design that provides core system services (such as inter-process communication, thread scheduling, and address space management). Other functions (such as device drivers and virtualization) are implemented through user-space services, offering high security and modularity. It is understood that the virtual machine runtime system implemented using a microkernel in this disclosure can also be implemented using a more powerful kernel. Therefore, replacing the microkernel of the virtual machine runtime system provided in this disclosure with a kernel is also within the scope of protection claimed in this disclosure.

[0029] It should be noted that the virtual machine monitor, the virtual machine, and the microkernel can be implemented within the same processor core, reducing the processor resources consumed. It is understood that the virtual machine monitor, the virtual machine, and the microkernel can also be implemented within a multi-processor core.

[0030] The operating system in virtual machine 11 can be Linux, Windows, etc., and it runs on virtual hardware resources provided by the virtual machine monitor.

[0031] In the virtual machine runtime system provided above, the virtual machine monitor (VM) is separated from the microkernel. The VM monitor runs at the first exception level, the virtual machines run at the second exception level, and the microkernel runs at the third exception level. The privilege levels of the first, second, and third exception levels increase sequentially. Running the VM monitor, virtual machines, and microkernel at different exception levels avoids the problem of concentrated privileges. Furthermore, separating the VM monitor, which runs at the lower privilege level (first exception level), from the higher privilege level (microkernel), ensures the security of the virtual machine runtime system. Additionally, the microkernel provides the necessary virtualization environment for the VM monitor to create virtual machines, intercepts interrupt events associated with virtual machines, and notifies the VM monitor to handle these interrupt events. This disperses privileges within the virtual machine runtime system. Through interaction and interception mechanisms, it enables the handling of interrupt events associated with virtual machines, allowing the management functions of the virtual machine controller to be moved to the microkernel. This ensures security while avoiding the high resource consumption caused by direct interaction between the VM monitor and virtual machines. This virtual machine runtime system implements a secure virtualization mode integrating the VM monitor, virtual machines, and microkernel.

[0032] Example 2, as Figure 2 The diagram shows the architecture of a virtual machine runtime system. Figure 2 Based on the virtual machine running system provided in Embodiment 1, the virtual machine monitor 10 is further divided into functional modules. The virtual machine monitor 10 includes a monitor module (loop_handler) 101, a notification module (notified) 102, and an exception module (fault) 103.

[0033] The monitor module 101 is a background non-blocking program that monitors the virtual machine in real time to see if any abnormalities occur. From the perspective of the virtual machine monitor 10, any operations performed by the virtual machine need to be stopped by the monitor module 101 (i.e., an abnormality occurs).

[0034] The notification module 102 is used to provide system-level feedback for information exchange between different virtual machines or responses to external interruptions. When the notification module 102 provides system-level feedback to the virtual machine 11, the virtual machine 11 is suspended from running. After the notification module 102 provides system-level feedback, it determines whether the virtual machine 11 should be allowed to continue running.

[0035] The exception module 103 is used to handle events strongly related to the execution state of the virtual machine, such as memory access exceptions triggered by the virtual machine, system calls, and virtual interrupts that require the virtual machine's awareness. While the exception module 103 is handling events strongly related to the execution state of the virtual machine, the virtual machine 11 is suspended from running. After the exception module 103 has finished handling the events strongly related to the execution state, it determines whether the virtual machine should be allowed to continue execution.

[0036] In addition, to initialize the virtual machine runtime system, the virtual machine runtime system also includes a loader module, which can be located in the virtual machine monitor 10. The virtual machine monitor 10 also includes an initialization module. Before initialization, a memory mapping table is established for operation at the first exception level. The memory mapping table includes the mapping relationship between the virtual address and physical memory address of the corresponding memory region of the virtual machine. The virtual address is the "virtual physical address" in the virtualization scenario, also known as the intermediate physical address (IPA). It is the virtual hardware address allocated by the virtual machine monitor 10 to the virtual machine 11. The virtual machine 11 directly accesses the IPA, and the virtual machine monitor 10 maps the IPA to the real physical memory address (PA). The core function of the memory mapping table is to isolate the address spaces of different virtual machines and avoid conflicts or security issues caused by the virtual machine directly accessing the real physical memory address.

[0037] The memory-mapped table is stored in entries within a Protection Domain (PD). Each PD corresponds to one executable file (.elf file, i.e., one virtual machine). A protection domain is a hardware or software-based "resource isolation unit" whose core function is to isolate the resources (memory, interrupts, devices) of different components (such as different virtual machines), restricting the access permissions of the components. In other words, resources within a protection domain can only be accessed by components within that domain (such as the corresponding virtual machine), preventing unauthorized cross-domain access and ensuring system security.

[0038] The virtual machine runtime system is initialized through the loader module and the initialization module. Specifically, the loader module performs safe-state memory transfer based on the memory mapping table, that is, loads the image of the virtual machine into the memory region to configure the virtual machine in the specified memory region; initializes the microkernel program, the execution monitor module, and the execution initialization module, and starts the virtual machine.

[0039] Example 3: After the virtual machine starts, interrupt events need to be handled. This is based on... Figure 2 The architecture of the virtual machine runtime system is shown, and the way the virtual machine runtime system handles interrupt events is explained.

[0040] Microkernel 12 is used to intercept interrupt events, generate target messages based on the interrupt events, and transmit them to monitor module 101. The target messages include interrupt information and interrupt type indication information. Monitor module 101 is used to acquire the target messages, determine the interrupt type based on the interrupt type indication information in the target messages, and transmit the interrupt information to the target module corresponding to the interrupt type. The target module is either notification module 102 or exception module 103. Microkernel 12 intercepts interrupt events and notifies monitor module 101 in the form of messages. Monitor module 101 then identifies the interrupt type and selects notification module 102 or exception module 103 to handle the interrupt based on the interrupt type. Here, interrupt handling is distributed to different modules, which communicate with each other through a message passing mechanism. Modularization ensures the maintainability and scalability of the system, and the different modules are isolated from each other, preventing the spread of faults in the event of a failure.

[0041] Interrupt events can be shared peripheral interrupt events (SPI) or private interrupt events. Private interrupt events include private peripheral interrupt events (PPI) or interrupt events generated by other virtual machines themselves. SPI interrupts are peripheral interrupts that can be shared by multiple CPUs (such as interrupts triggered by global peripherals such as UART and I2C). PPI interrupts are private interrupts that are bound to a single CPU (such as interrupts triggered by CPU internal timers). The core difference between SPI and PPI is whether they support multi-CPU sharing.

[0042] The following sections explain the handling processes for shared peripheral interrupt events and private interrupt events, respectively.

[0043] (1) Interrupt events include shared peripheral interrupt events initiated by shared peripherals.

[0044] The microkernel 12 is used to intercept shared peripheral interrupt events, generate a first message based on the shared peripheral interrupt event, and transmit it to the monitor module. The first message includes shared peripheral interrupt information and shared peripheral interrupt type indication information. The monitor module 101 is used to obtain the first message, determine that it is a shared peripheral interrupt according to the shared peripheral interrupt type indication information in the first message, and transmit the shared peripheral interrupt information to the notification module 102 for interrupt processing.

[0045] Shared peripheral interrupt information includes information required to execute the interrupt, including but not limited to: interrupt number, interrupt occurrence time, etc. Shared peripheral interrupt type indication information is used to indicate that the interrupt type is a shared peripheral interrupt type.

[0046] The notification module 102 is used to determine the virtual machine routing channel corresponding to the shared peripheral interrupt information based on a memory mapping table; the memory mapping table includes a mapping relationship between interrupt identifiers and virtual machine routing channels; and, after performing interrupt processing based on the shared peripheral interrupt information, transmit the result of the interrupt processing to the corresponding virtual machine 11 through the virtual machine routing channel; or, route the shared peripheral interrupt information to the corresponding virtual machine 11 through the virtual machine routing channel, and have the virtual machine 11 perform interrupt processing based on the shared peripheral interrupt information. A virtual machine routing channel refers to a routing channel between the virtual machine and the virtual machine that needs to handle the shared peripheral interrupt event.

[0047] For example, such as Figure 3 The diagram shows the process of handling shared peripheral interrupt events, which mainly includes: When a peripheral device issues a shared peripheral interrupt event, the microkernel 12 intercepts the shared peripheral interrupt event based on the exception vector table. The exception vector table records the interrupt handler jump channel and interrupt number. The exception vector table acts as a bridge between hardware and software to ensure that when an interrupt occurs, it can jump to the correct handler, such as jumping to the specified virtual machine monitor 10. The microkernel 12 generates a first message including shared peripheral interrupt information and shared peripheral interrupt type indication information, and sends the first message to the monitor module 101 of the specified virtual machine monitor 10 via the application programming interface (API); wherein, the shared peripheral interrupt information includes interrupt identifier (such as interrupt number), interrupt occurrence time, etc. After the monitor module 101 detects the first message, it parses the first message and determines that the interrupt type is a shared peripheral interrupt based on the shared peripheral interrupt type indication information in the first message. Then, it transmits the shared peripheral interrupt information to the notification module 102. The notification module 102 uses the mapping relationship between interrupt identifiers and virtual machine routing channels stored in the memory mapping table (system_file) to find the virtual machine routing channel corresponding to the interrupt identifier in the shared peripheral interrupt information. After the notification module 102 performs interrupt handling using the instructions under the virtual machine routing channel, it routes the interrupt handling result to the corresponding virtual machine through the found virtual machine routing channel. Alternatively, the notification module 102 routes the shared peripheral interrupt information to the corresponding virtual machine through the virtual machine routing channel, and the virtual machine performs interrupt handling.

[0048] (2) Interrupt events include private interrupt events initiated by the virtual machine.

[0049] Microkernel 12 is used to intercept the private interrupt event, generate a second message based on the private interrupt event, and transmit it to the monitor module 101. The second message includes private interrupt information and private interrupt type indication information. The monitor module 101 is used to acquire the second message, determine that it is a private interrupt based on the private interrupt type indication information in the second message, and transmit the private interrupt information and the private interrupt type indication information to the exception module 103 for interrupt handling. The private interrupt information includes information required to execute the interrupt, including but not limited to: interrupt number, interrupt occurrence time, etc. The private interrupt type indication information is used to indicate that the interrupt type is a private interrupt type.

[0050] The exception module 103 is configured to, upon recognizing the private interrupt type indication information, determine the virtual machine routing channel corresponding to the interrupt identifier in the private interrupt information based on a memory mapping table; the memory mapping table includes a mapping relationship between interrupt identifiers and virtual machine routing channels; and, after performing interrupt processing based on the private interrupt information, transmit the result of the interrupt processing to the corresponding virtual machine 11 through the virtual machine routing channel; or, route the private interrupt information to the corresponding virtual machine 11 through the virtual machine routing channel, so that the virtual machine 11 performs interrupt processing based on the private interrupt information. A virtual machine routing channel refers to a routing channel between a virtual machine and a virtual machine that needs to handle private peripheral interrupt events.

[0051] For example, such as Figure 4 The diagram illustrates the process of handling interrupt events from private peripherals, which mainly includes: Virtual machine 11 generates a private peripheral interrupt event; Microkernel 12 intercepts private peripheral interrupt events and generates system-level fault events (such as seL4_Fault_VPPIEvent). These system-level fault events indicate that the interrupt type is a private peripheral interrupt type, thus serving as private interrupt type indication information. The microkernel 12 sends private peripheral interrupt information and system-level fault events to the monitor module 101. The monitor module 101 determines the system-level fault event as a private peripheral interrupt and sends the private peripheral interrupt information and system-level fault events to the exception module 103. The exception module 103 uses the mapping relationship between interrupt identifiers and virtual machine routing channels stored in the memory mapping table to find the virtual machine routing channel corresponding to the interrupt identifier in the private peripheral interrupt information. After the exception module 103 performs interrupt handling using the instructions under the virtual machine routing channel, it routes the interrupt handling result to the corresponding virtual machine through the found virtual machine routing channel. Alternatively, the exception module 103 routes the private peripheral interrupt information to the corresponding virtual machine through the virtual machine routing channel, and the virtual machine performs interrupt handling.

[0052] In Example 4, after the virtual machine starts, in addition to handling interrupt events, it also needs to handle memory access. This is based on... Figure 2 The architecture of the virtual machine runtime system shown is combined with Figure 5 The diagram shown illustrates the memory access process and explains how the virtual machine runtime system handles memory access.

[0053] The monitor module 101 is further configured to capture exception messages triggered by memory access events of the virtual machine and transmit the exception messages to the exception module 103. The exception message includes an exception type identifier and a target virtual address. The target virtual address is the virtual address of the memory region that the virtual machine is currently accessing and that caused the exception. Here, the monitor module 101 captures the memory access operation of the virtual machine 11 and treats the memory access operation as an exception. This exception enters the exception module 103 along with the exception type identifier (such as the Handle_VM_Fault identifier). For example, the target virtual address is the error address in the error status register corresponding to the exception message. For instance, the address (addr) represented by the fsr in an armv8 error can be used to identify the virtual address of the memory region currently being accessed by the virtual machine, which is the target virtual address.

[0054] The exception module 103 is further configured to acquire the exception message, and when a mapping relationship for the target virtual address exists in the memory mapping table, determine the physical memory address requested by the virtual machine's memory access event based on the target virtual address, and perform memory access processing based on the exception type identifier and the physical memory address; the memory mapping table includes the mapping relationship between the virtual address and the physical memory address of the corresponding memory region of the virtual machine. Here, the virtual machine monitor 10 maintains an identifier list, which includes exception type identifiers and the mapping relationship between exception types. The exception module 103 uses the exception type identifier in the exception message to query the identifier list, obtains that the exception type is a memory access type, and then accesses the physical memory address corresponding to the target virtual address.

[0055] For ordinary memory or pass-through device memory already mapped in the memory mapping table, the exception module 103 directly obtains the actual physical memory address through the mapping relationship in the memory mapping table and performs read and write operations on that physical memory address. That is, the virtual machine's memory access operation is directly completed by the exception module 103, which then returns the memory access result to the virtual machine. Ordinary memory refers to a space allocated from physical memory by the virtual machine monitor 10, which provides a "virtual memory space" for the virtual machine through a multi-layered mapping of "physical address → IPA address → Guest virtual address". Pass-through device memory refers to physical hardware devices (such as PCIe network cards and SSDs) "directly allocated" to the virtual machine by the virtual machine monitor 10. Essentially, this is also a mapping, but this part of the memory may have a more stringent read and write mechanism.

[0056] For virtual device memory already mapped in the memory-mapped table, the exception module 103 directly obtains the address of the device register simulated by the data structure through the mapping relationship in the memory-mapped table, which is the simulated physical memory address. This converts memory read / write operations into virtual space read / write operations, and then returns the memory access result to the virtual machine. Virtual device memory refers to a "logical device" simulated by the virtual machine monitor 10 through pure software. The virtual machine considers it real hardware, but there is no corresponding physical device. All device operations are translated by the virtual machine monitor 10 into operations on physical resources.

[0057] In addition to the above memory access processing methods, the exception module 103 is also used to notify the microkernel 12 of the exception message when the memory mapping table does not have a mapping relationship for the target virtual address; the microkernel 12 is also used to perform system exception operations based on the exception message and stop the operation of the virtual machine.

[0058] Example 5: After the virtual machine starts, in addition to handling interrupt events and memory accesses, it also needs to handle system register accesses. This is based on... Figure 2 The architecture of the virtual machine runtime system shown is combined with Figure 6 The diagram shown illustrates the system register processing procedure, explaining how the virtual machine's operating system handles system register access.

[0059] The microkernel 12 is also used to intercept system register access events and perform system register read and write operations based on the system register access events.

[0060] For example, virtual machine 11's access to system registers automatically jumps to the EL2 layer and is intercepted by microkernel 12 based on the exception vector table. The exception vector table records the jump channel of the handler corresponding to the system register access event. The exception vector table acts as a bridge between hardware and software, ensuring that when a system register access event occurs, it can jump to the correct handler.

[0061] For example, microkernel 12 performs access operations on system registers based on the comparison result between the VCPU requesting access and the active VCPU. Specifically, when the VCPU requesting access is an active and activated VCPU, microkernel 12 performs a software image write for critical registers and directly writes to hardware for ordinary registers; when the VCPU requesting access is an active but inactive VCPU, microkernel 12 must perform a software image write for critical registers to avoid hardware state confusion; when the VCPU requesting access is an inactive VCPU, microkernel 12 can only write a software image and waits for subsequent activation to synchronize it to hardware.

[0062] System registers are dedicated registers used to configure CPU core functions, access control, virtualization parameters, and store system-level states such as exception levels, interrupt masking, and memory management configurations. For example, in the ARMv8 architecture, system registers are dedicated registers used to configure CPU core functions, access control, and virtualization parameters.

[0063] Example 6: Based on the virtual machine operating system provided in the above embodiments, this disclosure also provides a virtual machine running method, such as... Figure 7 As shown, the virtual machine running method mainly includes the following steps: Step 701: The microkernel creates the virtualization environment required for the virtual machine to be virtualized by the virtual machine monitor; Step 702: The virtual machine monitor creates a virtual machine using the virtualization environment provided by the microkernel; wherein the virtual machine monitor runs at a first exception level, the virtual machine runs at a second exception level, and the microkernel runs at a third exception level, with the privilege levels of the first exception level, the second exception level, and the third exception level increasing sequentially. Step 703: The microkernel intercepts the interrupt event associated with the virtual machine and notifies the virtual machine monitor to handle the interrupt event. The virtual machine monitor handles the interrupt event associated with the virtual machine according to the notification from the microkernel.

[0064] Example 7, corresponding to Example 3 above, the virtual machine monitor includes a monitor module, a notification module, and an exception module; the microkernel intercepts the interrupt event associated with the virtual machine and notifies the virtual machine monitor to handle the interrupt event. The virtual machine monitor handles the interrupt event associated with the virtual machine according to the notification from the microkernel, including: the microkernel intercepts the interrupt event, generates a target message based on the interrupt event, and transmits it to the monitor module; the target message includes interrupt information and interrupt type indication information; the monitor module obtains the target message, determines the interrupt type according to the interrupt type indication information in the target message, and transmits the interrupt information to the target module corresponding to the interrupt type; the target module is either the notification module or the exception module.

[0065] (1) The interrupt events include shared peripheral interrupt events initiated by shared peripherals.

[0066] The microkernel intercepts the interrupt event associated with the virtual machine and notifies the virtual machine monitor to handle the interrupt event, including: the microkernel intercepts the shared peripheral interrupt event, generates a first message based on the shared peripheral interrupt event and transmits it to the monitor module, the first message including shared peripheral interrupt information and shared peripheral interrupt type indication information; the monitor module obtains the first message, determines it to be a shared peripheral interrupt according to the shared peripheral interrupt type indication information in the first message, and transmits the shared peripheral interrupt information to the notification module.

[0067] The virtual machine monitor processes interrupt events associated with the virtual machine based on notifications from the microkernel, including: the notification module determining the virtual machine routing channel corresponding to the shared peripheral interrupt information based on the memory mapping table; the memory mapping table including the mapping relationship between interrupt identifiers and virtual machine routing channels; after the notification module performs interrupt processing based on the shared peripheral interrupt information, it transmits the result of the interrupt processing to the corresponding virtual machine through the virtual machine routing channel; or, it routes the shared peripheral interrupt information to the corresponding virtual machine through the virtual machine routing channel, and the virtual machine performs interrupt processing based on the shared peripheral interrupt information.

[0068] (2) The interrupt events include private interrupt events initiated by the virtual machine.

[0069] The microkernel intercepts the interrupt event associated with the virtual machine and notifies the virtual machine monitor to handle the interrupt event. The virtual machine monitor handles the interrupt event associated with the virtual machine according to the notification from the microkernel, including: the microkernel intercepts the private interrupt event, generates a second message based on the private interrupt event and transmits it to the monitor module, the second message including private interrupt information and private interrupt type indication information; the monitor module obtains the second message, determines it as a private interrupt according to the private interrupt type indication information in the second message, and transmits the private interrupt information and the private interrupt type indication information to the exception module for interrupt handling.

[0070] The step of transmitting the private interrupt information and the private interrupt type indication information to the exception module for interrupt handling includes: after recognizing the private interrupt type indication information, the exception module determines the virtual machine routing channel corresponding to the interrupt identifier in the private interrupt information based on a memory mapping table; the memory mapping table also includes the mapping relationship between the interrupt identifier and the virtual machine routing channel; after the exception module performs interrupt handling based on the private interrupt information, it transmits the result of the interrupt handling to the corresponding virtual machine through the virtual machine routing channel; or, it routes the private interrupt information to the corresponding virtual machine through the virtual machine routing channel, and the virtual machine performs interrupt handling based on the private interrupt information.

[0071] Example 8, corresponding to Example 4 above, further includes: the monitor module capturing an exception message triggered by a memory access event of the virtual machine, and transmitting the exception message to the exception module; the exception message includes an exception type identifier and a target virtual address; the target virtual address is the virtual address of the memory region that the virtual machine is accessing and that caused the exception; the exception module obtains the exception message, and when a mapping relationship of the target virtual address exists in the memory mapping table, determines the physical memory address requested by the memory access event of the virtual machine based on the target virtual address, and performs memory access processing based on the exception type identifier and the physical memory address; the memory mapping table includes the mapping relationship between the virtual address and the physical memory address of the corresponding memory region of the virtual machine.

[0072] The method further includes: when the exception module does not have a mapping relationship for the target virtual address in the memory mapping table, it notifies the microkernel of the exception message; the microkernel performs a system exception operation based on the exception message and stops the virtual machine from running.

[0073] Example 9, corresponding to Example 5 above, the method further includes: the microkernel intercepting system register access events, and performing system register read / write operations based on the system register access events.

[0074] It is understood that the various method embodiments mentioned above in this disclosure can be combined with each other to form combined embodiments without violating the principle and logic. Due to space limitations, this disclosure will not elaborate further. Those skilled in the art will understand that in the above methods of specific implementation, the specific execution order of each step should be determined by its function and possible internal logic, and the execution order between steps is not limited to implementation according to step number.

[0075] Example 10: In addition, this disclosure also provides a processor in which at least one core of the processor runs the virtual machine operating system described in the above embodiments.

[0076] Example 11: This embodiment of the present disclosure provides an electronic device, which includes: at least one processor as described in Example 10; at least one memory; and one or more I / O interfaces connected between the processor and the memory; wherein the memory stores one or more computer programs that can be executed by at least one processor, and the one or more computer programs are executed by at least one processor to enable at least one processor to implement the virtual machine running system described above.

[0077] The modules in the aforementioned electronic devices can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0078] Example 12: This embodiment of the present disclosure also provides a computer program product, including a computer program that, when run in a processor, implements the above-described virtual machine running method.

[0079] The computer program may be stored on a readable storage medium of a computer device or in the cloud; the processor of the computer device reads the computer program from the readable storage medium or in the cloud.

[0080] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically manifested as a computer storage medium; in another optional embodiment, the computer program product is specifically manifested as a software product, such as a software development kit (SDK), etc.

[0081] Those skilled in the art will understand that all or some of the steps, systems, and apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software can be distributed on a computer-readable storage medium, which may include computer storage media (or non-transitory media) and communication media (or transient media).

[0082] As is known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable program instructions, data structures, program modules, or other data. Computer storage media includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), static random access memory (SRAM), flash memory or other memory technologies, portable compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, it is known to those skilled in the art that communication media typically contain computer-readable program instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0083] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0084] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0085] The computer program product described herein can be implemented specifically through hardware, software, or a combination thereof. In one alternative embodiment, the computer program product is specifically embodied in a computer storage medium; in another alternative embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0086] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0087] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0088] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0089] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0090] The above description is merely a preferred embodiment of this disclosure and is not intended to limit this disclosure. Any modifications or equivalent substitutions made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A virtual machine runtime system, characterized in that, include: A virtual machine monitor, which runs at a first exception level, is used to create virtual machines using the virtualization environment provided by the microkernel, and to handle interrupt events associated with the virtual machines according to notifications from the microkernel. A virtual machine, which is running at the second exception level; A microkernel, which runs at the third exception level, is used to provide the virtualization environment required for the virtual machine to create the virtual machine for the virtual machine monitor, and to intercept interrupt events associated with the virtual machine and notify the virtual machine monitor to handle the interrupt events; The permission levels of the first exception level, the second exception level, and the third exception level increase sequentially.

2. The virtual machine runtime system according to claim 1, characterized in that, The virtual machine monitor includes a monitor module, a notification module, and an exception module; The microkernel is used to intercept interrupt events, generate target messages based on the interrupt events, and transmit them to the monitor module. The target messages include interrupt information and interrupt type indication information. The monitor module is used to acquire the target message, determine the interrupt type according to the interrupt type indication information in the target message, and transmit the interrupt information to the target module corresponding to the interrupt type. The target module is the notification module or the exception module.

3. The virtual machine runtime system according to claim 2, characterized in that, The interrupt events include shared peripheral interrupt events initiated by shared peripherals; The microkernel is used to intercept shared peripheral interrupt events, generate a first message based on the shared peripheral interrupt events, and transmit it to the monitor module. The first message includes shared peripheral interrupt information and shared peripheral interrupt type indication information. The monitor module is configured to acquire the first message, determine that it is a shared peripheral interruption based on the shared peripheral interruption type indication information in the first message, and transmit the shared peripheral interruption information to the notification module for interruption processing.

4. The virtual machine runtime system according to claim 3, characterized in that, The notification module is used to determine the virtual machine routing channel corresponding to the shared peripheral interrupt information based on a memory mapping table; the memory mapping table includes the mapping relationship between interrupt identifiers and virtual machine routing channels. After interruption processing based on the shared peripheral interruption information, the result of the interruption processing is transmitted to the corresponding virtual machine through the virtual machine routing channel; or, the shared peripheral interruption information is routed to the corresponding virtual machine through the virtual machine routing channel, and the virtual machine performs interruption processing based on the shared peripheral interruption information.

5. The virtual machine runtime system according to claim 2, characterized in that, The interrupt events include private interrupt events initiated by the virtual machine; The microkernel is used to intercept the private interrupt event, generate a second message based on the private interrupt event and transmit it to the monitor module. The second message includes private interrupt information and private interrupt type indication information. The monitor module is used to acquire the second message, determine it as a private interrupt based on the private interrupt type indication information in the second message, and transmit the private interrupt information and the private interrupt type indication information to the exception module for interrupt handling.

6. The virtual machine runtime system according to claim 5, characterized in that, The exception module is used to determine the virtual machine routing channel corresponding to the interrupt identifier in the private interrupt information based on the memory mapping table after recognizing the private interrupt type indication information. The memory mapping table includes the mapping relationship between interrupt identifiers and virtual machine routing channels; After interruption processing based on the private interruption information, the result of the interruption processing is transmitted to the corresponding virtual machine through the virtual machine routing channel; or, the private interruption information is routed to the corresponding virtual machine through the virtual machine routing channel, and the virtual machine performs interruption processing based on the private interruption information.

7. The virtual machine runtime system according to claim 2, characterized in that, The monitor module is also used to capture exception messages triggered by memory access events of the virtual machine and transmit the exception messages to the exception module; the exception message includes an exception type identifier and a target virtual address; the target virtual address is the virtual address of the memory region that the virtual machine is accessing and that caused the exception; The exception module is also used to obtain the exception message, and when the target virtual address is mapped in the memory mapping table, determine the physical memory address to be accessed by the virtual machine's memory access event based on the target virtual address, and perform memory access processing based on the exception type identifier and the physical memory address. The memory mapping table includes the mapping relationship between the virtual address and the physical memory address of the corresponding memory region of the virtual machine.

8. The virtual machine runtime system according to claim 7, characterized in that, The exception module is also used to notify the microkernel of the exception message when the memory mapping table does not have a mapping relationship for the target virtual address; The microkernel is also used to perform system error operations based on the error message and stop the virtual machine from running.

9. The virtual machine runtime system according to claim 1, characterized in that, The microkernel is also used to intercept system register access events and perform system register read and write operations based on the system register access events.

10. The virtual machine runtime system according to claim 1, characterized in that, The virtual machine monitor, the virtual machine, and the microkernel are implemented in the same processor core.

11. A method for running a virtual machine, characterized in that, include: The microkernel provides the necessary virtualization environment for the virtual machine to be created by the virtual machine monitor; The virtual machine monitor uses the virtualization environment provided by the microkernel to create virtual machines; wherein, the virtual machine monitor runs at a first exception level, the virtual machine runs at a second exception level, the microkernel runs at a third exception level, and the privilege levels of the first exception level, the second exception level, and the third exception level increase sequentially. The microkernel intercepts the interrupt event associated with the virtual machine and notifies the virtual machine monitor to handle the interrupt event. The virtual machine monitor handles the interrupt event associated with the virtual machine according to the notification from the microkernel.

12. The virtual machine running method according to claim 11, characterized in that, The virtual machine monitor includes a monitor module, a notification module, and an exception module; the microkernel intercepts interrupt events associated with the virtual machine and notifies the virtual machine monitor to handle the interrupt events. The virtual machine monitor handles the interrupt events associated with the virtual machine according to the notification from the microkernel, including: The microkernel intercepts an interrupt event, generates a target message based on the interrupt event, and transmits it to the monitor module. The target message includes interrupt information and interrupt type indication information. The monitor module acquires the target message, determines the interrupt type based on the interrupt type indication information in the target message, and transmits the interrupt information to the target module corresponding to the interrupt type. The target module is either the notification module or the exception module.

13. The virtual machine running method according to claim 12, characterized in that, The interrupt events include shared peripheral interrupt events initiated by shared peripherals; The microkernel intercepts the interrupt event associated with the virtual machine and notifies the virtual machine monitor to handle the interrupt event, including: The microkernel intercepts a shared peripheral interrupt event, generates a first message based on the shared peripheral interrupt event, and transmits it to the monitor module. The first message includes shared peripheral interrupt information and shared peripheral interrupt type indication information. The monitor module acquires the first message, determines it to be a shared peripheral interrupt based on the shared peripheral interrupt type indication information in the first message, and transmits the shared peripheral interrupt information to the notification module.

14. The virtual machine running method according to claim 13, characterized in that, The virtual machine monitor processes the interrupt events associated with the virtual machine based on the notification from the microkernel, including: The notification module determines the virtual machine routing channel corresponding to the shared peripheral interrupt information based on the memory mapping table; the memory mapping table includes the mapping relationship between interrupt identifiers and virtual machine routing channels; After the notification module performs interruption processing based on the shared peripheral interruption information, it transmits the result of the interruption processing to the corresponding virtual machine through the virtual machine routing channel; or, it routes the shared peripheral interruption information to the corresponding virtual machine through the virtual machine routing channel, and the virtual machine performs interruption processing based on the shared peripheral interruption information.

15. The virtual machine running method according to claim 12, characterized in that, The interrupt events include private interrupt events initiated by the virtual machine; The microkernel intercepts the interrupt event associated with the virtual machine and notifies the virtual machine monitor to handle the interrupt event. The virtual machine monitor handles the interrupt event associated with the virtual machine according to the notification from the microkernel, including: The microkernel intercepts the private interrupt event, generates a second message based on the private interrupt event, and transmits it to the monitor module. The second message includes private interrupt information and private interrupt type indication information. The monitor module acquires the second message, determines it to be a private interrupt based on the private interrupt type indication information in the second message, and transmits the private interrupt information and the private interrupt type indication information to the exception module for interrupt handling.

16. The virtual machine running method according to claim 15, characterized in that, The step of transmitting the private interrupt information and the private interrupt type indication information to the exception module for interrupt handling includes: After recognizing the private interrupt type indication information, the exception module determines the virtual machine routing channel corresponding to the interrupt identifier in the private interrupt information based on the memory mapping table; the memory mapping table also includes the mapping relationship between the interrupt identifier and the virtual machine routing channel. After the exception module performs interrupt handling based on the private interrupt information, it transmits the result of the interrupt handling to the corresponding virtual machine through the virtual machine routing channel; or, it routes the private interrupt information to the corresponding virtual machine through the virtual machine routing channel, and the virtual machine performs interrupt handling based on the private interrupt information.

17. The virtual machine running method according to claim 12, characterized in that, The method further includes: The monitor module captures the exception message triggered by the memory access event of the virtual machine and transmits the exception message to the exception module; the exception message includes an exception type identifier and a target virtual address; the target virtual address is the virtual address of the memory region that the virtual machine is accessing and that caused the exception; The exception module obtains the exception message, and when the target virtual address is mapped in the memory mapping table, it determines the physical memory address to be accessed by the virtual machine's memory access event based on the target virtual address, and performs memory access processing based on the exception type identifier and the physical memory address; the memory mapping table includes the mapping relationship between the virtual address and the physical memory address of the corresponding memory region of the virtual machine.

18. The virtual machine running method according to claim 17, characterized in that, The method further includes: When the memory mapping table does not contain a mapping relationship for the target virtual address, the exception module notifies the microkernel of the exception message. The microkernel performs a system error operation based on the error message and stops the virtual machine from running.

19. The virtual machine running method according to claim 11, characterized in that, The method further includes: The microkernel intercepts system register access events and performs system register read / write operations based on these events.

20. A processor, characterized in that, The virtual machine runtime system according to any one of claims 1-10 runs in at least one core of the processor.

21. An electronic device, characterized in that, Includes the processor as described in claim 20.

Images