Method for implementing sub-page function of virtual machine monitor
By registering the subpage space as an MMIO device and establishing a permanent page table mapping in the virtual machine monitor, the virtualization overhead caused by subpage access is resolved, achieving secure isolation and efficient access, and improving the real-time performance of data communication.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- KYLIN CORP
- Filing Date
- 2022-12-22
- Publication Date
- 2026-05-29
AI Technical Summary
In existing technologies, subpage access in a virtualized environment leads to frequent exception traps and the creation of temporary page tables, resulting in significant virtualization overhead and affecting the real-time performance of data communication.
During system initialization, subpage spaces are registered as simulated MMIO devices, and a permanent page table mapping from virtual address to physical address is established for each subpage space. Efficient access is achieved through permission checks and IO interception.
By using permanent page table mapping, virtualization overhead is reduced and the real-time performance of data communication is improved, especially the efficiency of subpage access is improved by 50%.
Smart Images
Figure CN116069444B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to virtualization technology, specifically to a method for implementing subpage functionality in a virtual machine monitor. Background Technology
[0002] To support virtualization, the ARM architecture has undertaken numerous initiatives, the first being the definition of four exception levels (EL). Each exception level is numbered EL0-3, with higher privilege levels corresponding to higher numbers. User programs run at EL0, the operating system at EL1, the hypervisor at EL2, and firmware at EL3.
[0003] For ARMv8, the Hypervisor runs at the EL2 exception level. VA (Virtual Address) is the virtual address, and PA (Physical Address) is the physical address. Without the intervention of the EL2 hypervisor, the operating system (OS) only needs to control a set of address translation tables to map from the virtual address space to what it considers the physical address space (VA->PA) to access the final physical address space. However, if virtualization is enabled, the hypervisor controls the second step of address translation to obtain the actual physical address. The OS-controlled translation is called stage 1 translation, and the hypervisor-controlled translation is called stage 2 translation. The address space that the operating system considers to be physical memory is called the Intermediate Physical Address (IPA) space. Therefore, the address translation process is VA->IPA->PA. Figure 1 As shown.
[0004] Specifically, it can control whether a guest machine can access a specific block of physical memory, and where that memory block appears in the guest's memory space. This capability is crucial for guest machine isolation and sandboxing. This ensures that the guest machine can only see the physical memory allocated to it. To support Stage 2 translation, an additional page table is needed, which we call the Stage 2 page table. The operating system-controlled page table translation is called stage 1 translation, responsible for translating virtual addresses from the guest's perspective to physical addresses from the guest's perspective. The stage 2 page table, controlled by the hypervisor, is responsible for translating the guest's physical address (IPA) to the actual physical address.
[0005] This memory virtualization mechanism uses physical pages as the basic unit (4KB, 2MB, or 1GB, etc.). However, sometimes the memory range to be accessed is smaller than the minimum page size of 4KB. For example, the CAN bus control registers of some SoCs only range from a few hundred bytes; we call this type of memory a subpage.
[0006] Currently, the primary method for subpage access involves generating a page fault exception during client-side subpage access, causing the CPU to enter the hypervisor. The hypervisor calculates the specific address for the subpage access and then performs access control. When the access requirements are met, a temporary page table is created for that address, allowing access to the actual physical address through the hypervisor's virtual address. While this method ensures the security of subpage access, the series of operations required for each access—including exception entry, access control, page table creation, and result return—results in significant virtualization overhead. The creation of the temporary page table is particularly time-consuming. In practical applications, such as data tunneling through a CAN bus, this can severely impact the real-time performance of data communication. Summary of the Invention
[0007] To address the shortcomings of existing technologies, this invention provides a method for implementing subpage functionality in a virtual machine monitor, comprising the following steps:
[0008] Step S1: During the system initialization phase, each subpage space is registered as a simulated MMIO device, and a virtual address space is allocated for each MMIO device;
[0009] Step S2: In the virtual machine monitor, establish a permanent page table under the virtual address space EL2 for each subpage space to create a permanent page table mapping from virtual address to the real physical address of the MMIO device;
[0010] Step S3: When the virtual machine monitor establishes an IPA for each guest machine, it removes the address range of the subpage space, causing a page fault to occur when the guest machine accesses the subpage device, thus entering the virtual machine monitor.
[0011] Step S4: In the virtual machine monitor, intercept the IO of the guest machine and extract the physical address based on the generated page fault. Calculate the corresponding MMIO device number based on the physical address and use the virtual address space EL2 corresponding to the MMIO device to directly access the subpage.
[0012] In step S1, page_alloc is used to call the bitmap virtual address manager to allocate a virtual address space of size 4k for each MMIO device.
[0013] In step S2, page_create is used to create a permanent page table mapping from the virtual address to the real physical address of the MMIO device.
[0014] In step S3, when the client accesses the subpage device, the virtual machine monitor enters the handler program, which intercepts and verifies the access to the MMIO device to determine whether the access is legitimate.
[0015] In step S4, the handler program obtains the page offset address of the subpage of the physical page that encountered the access exception when the client executes the current instruction and accesses the client memory. Based on the page offset address, the handler program finds the address of the subpage that encountered the access exception. Illegal MMIO devices are processed, and MMIO devices that meet the system configuration requirements are allowed to enter the subpage access stage.
[0016] The subpage function implementation method of the virtual machine monitor of this invention ensures the security isolation and sandbox function of the client through permission checks. Efficient access to subpages is achieved by establishing a permanent page table. This ensures the security of the subpage function while significantly reducing virtualization overhead. Taking the CAN bus control register of the subpage as an example, the data penetration loss rate of the CAN bus is reduced by about 50% compared to traditional methods, improving the real-time performance of data communication. Attached Figure Description
[0017] Figure 1 The process of converting a client's virtual address to its actual physical address through a virtual monitor.
[0018] Figure 2 : Implementation logic diagram of the subpage function implementation method of the virtual machine monitor of the present invention.
[0019] Figure 3 : Implementation logic diagram of the existing virtual machine monitor subpage functionality implementation method.
[0020] Figure 4 : Software-level logical framework diagram of the subpage function implementation method of the virtual machine monitor based on the present invention.
[0021] Figure 5 The method for implementing subpage functionality in a virtual machine monitor based on the present invention is based on the logical diagram of page table mapping in a bitmap virtual address manager.
[0022] Figure 6 : A flowchart of the subpage access process for the subpage function implementation method of the virtual machine monitor based on the present invention. Detailed Implementation
[0023] To gain a better understanding of the technical solution and beneficial effects of the present invention, the technical solution of the present invention and its beneficial effects are described in detail below with reference to the accompanying drawings.
[0024] To address the security issues of subpage access in virtualization—namely, ensuring client isolation and sandboxing while improving subpage access efficiency and reducing virtualization overhead—this invention provides a subpage functionality implementation method for a virtual machine monitor. The overall approach is as follows: Figure 2 As shown, during system initialization, the subpage space is registered as a simulated MMIO (Memory-mapped Input / Output) device. When the virtual machine monitor establishes IPAs for each guest machine, the address range of the subpage space is removed. This causes a page fault when a guest machine accesses the subpage device, triggering the hypervisor. The hypervisor then creates a permanent page table under EL2 for this subpage space. Specifically, during MMIO device registration, a virtual address range is first requested from the bitmap virtual address manager. Different devices are assigned different virtual address spaces, i.e., EL2 VA0-VAn in the diagram. A permanent page table mapping from this virtual address to the actual physical address of the MMIO device is created. When a guest machine accesses a subpage, an exception occurs, trapping the hypervisor code. The hypervisor intercepts I / O and extracts the physical address. The corresponding MMIO_device number is calculated based on the physical address, and then the EL2 corresponding to that device is used for access. Since the page table creation for all virtual addresses to physical addresses has been completed during device registration, subpage access can be performed directly without additional overhead.
[0025] Traditional virtualization software (such as jailhouse) also extracts the actual physical address of the subpage access by intercepting I / O instructions and calculates the corresponding MMIO_device number after a page fault occurs, such as... Figure 3 As shown. However, the physical address cannot be directly accessed in the hypervisor (because the hypervisor uses EL2's Virtual Address Variable). At this point, a fixed temporary virtual address, TEMPORARY_MAPPING_BASE, is used to create a temporary page table mapping from the virtual address to the physical address. This temporary page table is then used to access the actual physical address. When a subpage access occurs again, because the accessed physical address is different, the previously created page table cannot be used. Therefore, another temporary page table needs to be created using TEMPORARY_MAPPING_BASE and the latest physical address fetched by the instruction, while the original temporary page table becomes invalid. This repeated page table creation operation is required for every I / O access, leading to increased virtualization overhead.
[0026] Taking the ARMv8 architecture as an example, the above implementation method of this invention can achieve high-efficiency subpage access through software control. The specific implementation logic is as follows:
[0027] 1. Register the subpage as an analog MMIO device
[0028] Client systems use unified address mapping to access the physical peripheral devices they see, including pass-through devices and virtual devices, such as... Figure 4 As shown. This invention manages subpage space pages as virtual devices. A pass-through device is directly assigned to the client and mapped to the IPA address space, allowing software in the client to directly access the real physical hardware. A virtual device, whose stage 2 translation entries are marked as page faults. Although the software in the client appears to be interacting directly with the physical device, this access actually results in a stage 2 translation fault, thus triggering the corresponding exception handler whereby the hypervisor generates a simulated MMIO device.
[0029] 2. Create page table mappings based on the bitmap virtual address manager.
[0030] A bitmap, a collection of bits, is a data structure used to record a large number of 0-1 states. It is used in many places, such as the Linux kernel (e.g., inodes, disk blocks), Bloom Filter algorithm, etc. Its advantage is that it can store a large number of 0-1 states with very high space utilization. This invention uses an unsigned long type array bitmap
[512] . Each bit of the data structure corresponds to a 4K memory space, such as Figure 5 As shown, the corresponding manageable memory size is 512 * 64 * 4 * 1024 = 128M. The corresponding virtual memory space is between 0xFFFC00000000 and 0xFFFC08000000 (the selected virtual address range needs to avoid the virtual address spaces of other page tables in the system). When a subpage is registered, page_alloc is used to request 4K space from the virtual address space, and then page_create is used to create a permanent page table mapping from the virtual address to the physical address of the subpage.
[0031] 3. MMIO device operation process
[0032] MMIO devices all have corresponding MMIO handlers to implement the corresponding virtualization functions, such as... Figure 6As shown. During device operation, once an MMIO access is triggered, the Hypervisor will enter the corresponding handler program. The handler program intercepts and verifies the MMIO access, because the Hypervisor first needs to know whether the MMIO access is legitimate, which is a necessary condition for ensuring secure isolation. The handler obtains the page offset address of the subpage of the physical page where the access exception occurred when the client executes the current instruction and accesses client memory, and then finds the address of the subpage where the access exception occurred (i.e.,...) based on the page offset address. Figure 5 and Figure 6 (The process of intercepting and extracting physical addresses in MMIO). If it is an illegal MMIO, the system will handle it illegally (the specific behavior, whether to panic or emulate the device, depends on the type of Hypervisor). Only when the MMIO verification meets the system configuration requirements will the MMIO subpage access processing flow begin. Since a permanent page table mapping has already been established for the relevant addresses during MMIO device registration via step 2, the subpage address can be directly accessed in the Hypervisor.
[0033] Page table mapping can only be based on physical pages, so the page table created for a subpage must be larger than the actual physical subpage. However, there's no need to worry about out-of-bounds access or security permissions. After MMIO access is intercepted, the handler program first checks the security of the instruction access. Only if the instruction access meets the permission requirements will physical access be performed based on the page table. This ensures that the physical address translated through the permanent page table always meets the permission requirements.
[0034] This invention ensures secure isolation and sandbox functionality for the client machine through permission checks. Efficient access to subpages is achieved by establishing permanent page tables. This not only guarantees the security of subpage functions but also significantly reduces virtualization overhead. Taking the CAN bus control register of a subpage as an example, the data penetration loss rate of the CAN bus is reduced by approximately 50% compared to traditional methods, improving the real-time performance of data communication.
[0035] Although the present invention has been described using the above preferred embodiments, it is not intended to limit the scope of protection of the present invention. Any changes and modifications made by those skilled in the art to the above embodiments without departing from the spirit and scope of the present invention shall still fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be defined by the claims.
Claims
1. A method for implementing subpage functionality in a virtual machine monitor, characterized in that, Includes the following steps: Step S1: During the system initialization phase, each subpage space is registered as an MMIO device, and a virtual address space EL2 is requested for each MMIO device. The subpage space refers to the memory space whose access memory range is smaller than the minimum page size of physical memory. The MMIO device refers to a memory-mapped input / output device simulated by the virtual machine monitor. Step S2: In the virtual machine monitor, establish a permanent page table under the virtual address space EL2 for each subpage space to create a permanent page table mapping from the virtual address space EL2 to the real physical address of the MMIO device; Step S3: When the virtual machine monitor establishes an IPA for each guest machine, it removes the address range of the subpage space, causing a page fault to occur when the guest machine accesses the subpage space, thus triggering the virtual machine monitor. Step S4: In the virtual machine monitor, intercept the IO of the guest machine and extract the physical address based on the generated page fault. Calculate the corresponding MMIO device number based on the physical address and use the virtual address space EL2 corresponding to the MMIO device to directly access the subpage.
2. The method for implementing the subpage function of a virtual machine monitor as described in claim 1, characterized in that, In step S1, page_alloc is used to call the bitmap virtual address manager to allocate a virtual address space of size 4k for each MMIO device.
3. The method for implementing the subpage function of a virtual machine monitor as described in claim 1, characterized in that, In step S2, page_create is used to create a permanent page table mapping from the virtual address space EL2 to the real physical address of the MMIO device.
4. The method for implementing the subpage function of the virtual machine monitor as described in claim 1, characterized in that, In step S3, when the client accesses the subpage space, the virtual machine monitor enters the handler program, which intercepts and verifies the access to the MMIO device to determine whether the access is legitimate.
5. The method for implementing the subpage function of a virtual machine monitor as described in claim 1, characterized in that, In step S4, the handler program obtains the page offset address of the subpage space of the physical page where the access exception occurred when the client executes the current instruction and accesses the client memory. Based on the page offset address, the handler program finds the address of the subpage where the access exception occurred. Illegal MMIO devices are processed, and MMIO devices that meet the system configuration requirements are allowed to enter the subpage access stage.