A virtual machine full passthrough method and system for embedded virtualization

Abstract

This invention provides a method and system for full passthrough of virtual machines in embedded virtualization, belonging to the fields of virtualization technology and computer systems. The system includes a virtual machine management module, a virtual machine monitor, high-privilege firmware, and a hardware access inspection module, implemented on the Arm platform. The virtual machine monitor runs on EL2, managing passthrough virtual machines and ordinary virtual machines. The high-privilege firmware runs on EL3, implementing private GPT reverse isolation. This method disables second-level address translation for performance-critical virtual machines. The virtual machine monitor allocates exclusive processor cores, physical memory, devices, and interrupt resources to passthrough virtual machines. The high-privilege firmware builds a private GPT for passthrough virtual machines, and physical memory access is checked via GPC. This invention maintains virtual machine space isolation while reducing memory virtualization overhead, requires no modification to the guest operating system, and supports the coexistence of ordinary virtual machines and passthrough virtual machines.

Description

Technical Field

[0001] This invention belongs to the field of virtualization technology and computer system technology, specifically relating to a virtual machine full pass-through method and system for embedded virtualization. Background Technology

[0002] Virtualization technology enables the unified management, abstraction, and allocation of physical hardware resources to build isolated virtual machine runtime environments, thereby supporting the parallel operation of multiple operating systems or functional partitions on the same computing platform. This technology is widely used in cloud computing, edge computing, embedded control, automotive systems, industrial control, avionics, and other hybrid critical systems.

[0003] In hybrid mission-critical systems, tasks of different mission criticalities typically need to run on the same hardware platform. On the one hand, the system needs to improve hardware utilization and reduce deployment costs through resource sharing; on the other hand, strict spatial and fault isolation must be maintained between different tasks to prevent lower-critical tasks from affecting the security, real-time performance, and stability of higher-critical tasks. Therefore, virtualization systems not only need to provide basic resource management capabilities but also need to minimize the runtime overhead and execution jitter introduced by virtualization mechanisms.

[0004] In existing virtualization technologies, the guest operating system running within a virtual machine typically maintains its own address translation structure, used to translate guest virtual addresses into guest physical addresses, i.e., intermediate physical addresses. The hypervisor then uses a second-stage address translation mechanism to further map the guest physical addresses to actual physical addresses. Through this two-stage address translation process, the virtualization system can establish independent physical address views for different virtual machines and achieve memory isolation between virtual machines based on address mapping relationships.

[0005] However, while second-stage address translation provides address remapping and isolation protection, it also introduces a significant performance overhead. When a TLB miss occurs, the hardware may need to nestedly traverse both the first-stage address translation structure maintained by the guest operating system and the second-stage address translation structure maintained by the virtual machine monitor. For memory-intensive, random-access, and large working-set applications, this nested address translation process significantly increases memory access latency and may further amplify tail latency and execution thrashing, thereby impacting the performance and predictability of performance-critical tasks.

[0006] Static partitioning virtualization is a virtualization scheme for embedded systems, real-time systems, and hybrid critical systems. Static partitioning virtualization typically determines the processor cores, memory regions, devices, and interrupt resources of each virtual machine during system startup or virtual machine creation. In static partitioning virtualization scenarios, virtual machine resource boundaries are pre-defined, and performance-critical virtual machines do not need to rely on second-stage address translation for flexible address remapping. Continuing to use the traditional two-stage address translation mechanism will introduce additional memory access overhead in scenarios with relatively fixed resource allocation. Summary of the Invention

[0007] To address the issue that in existing static partitioned virtualization systems, performance-critical virtual machines still bear the overhead of the second-stage address translation, while directly eliminating the second-stage address translation would compromise virtual machine space isolation, this invention proposes a virtual machine full passthrough method and system for embedded virtualization. This method decouples virtual machine isolation from the second-stage address translation, achieving machine-level passthrough while maintaining virtual machine space isolation.

[0008] To achieve the above objectives, this invention provides a fully pass-through virtual machine system for embedded virtualization, comprising a management virtual machine, a virtual machine monitor, high-privilege firmware, and a hardware access inspection module; wherein the virtual machine monitor manages pass-through virtual machines and ordinary virtual machines. The pass-through virtual machines are used to run performance-critical tasks and directly access allocated physical resources; the ordinary virtual machines run using traditional virtualization methods, with resource management and isolation handled by the virtual machine monitor. This invention's system is implemented based on the layered privileged structure of the Arm platform. Wherein:

[0009] The managed virtual machine runs on Arm EL1 or EL0 and is used to submit static configurations for passthrough virtual machines to the virtual machine monitor. The static configurations include the guest operating system image, boot entry address, guest hardware description information, requested processor cores, physical memory range, passthrough device, device address range, and interrupt resources.

[0010] The virtual machine monitor runs on Arm EL2 and is deployed on physical hardware. It manages ordinary virtual machines and pass-through virtual machines. Based on the static configuration, it allocates exclusive resources, including processor cores, physical memory, devices, and interrupt resources, to the pass-through virtual machines and disables the second-stage address translation of the pass-through virtual machines. The guest physical address of the pass-through virtual machine is set to be consistent with the actual physical address. It uses its own first-stage page table to translate the guest virtual address and the actual physical address, enabling direct access to the allocated physical resources.

[0011] The high-privilege firmware runs on Arm EL3 and is used to configure the hardware protection state according to the physical memory range of the passthrough virtual machine, that is, to configure the GPT / GPC protection state for the passthrough virtual machine; the high-privilege firmware is equipped with a hardware access check module, which restricts the passthrough virtual machine to only access the authorized physical memory area through GPT / GPC.

[0012] The hardware access check module includes a granularity protection table (GPT) and a granularity protection check (GPC). The hardware access check module is used to check the physical memory access of the virtual machine during the execution of the passthrough virtual machine through the GPC, and to prevent the access when it goes out of bounds.

[0013] Furthermore, the virtual machine monitor generates or revises guest hardware description information based on the exclusive resources of the passthrough virtual machine, enabling the guest operating system in the passthrough virtual machine to identify and use the exclusive resources without modifying the kernel and applications, and only aware of the allocated processor cores, memory, devices and interrupt resources.

[0014] Furthermore, the virtual machine monitor adds the address range of the passthrough device requested by the passthrough virtual machine to the client hardware description information of the passthrough virtual machine according to the static configuration of the passthrough virtual machine; before the passthrough virtual machine starts, the general interrupt controller (GIC) is configured so that when the passthrough device is interrupted, the terminal is directly delivered to the processor core exclusively used by the passthrough virtual machine.

[0015] Furthermore, the virtual machine monitor submits the physical memory range, boot entry address, and customer hardware description information address of the passthrough virtual machine to the high-privilege firmware through the security monitor call. The high-privilege firmware running on EL3 establishes a hardware protection state before the passthrough virtual machine runs.

[0016] Furthermore, the high-privilege firmware constructs a template GPT when the system starts up, and all shared memory regions in the template GPT are marked as Root state; when creating a passthrough virtual machine, the high-privilege firmware establishes an independent private GPT for the passthrough virtual machine, in which the physical memory regions allocated to the passthrough virtual machine are set to an accessible state, and the physical memory regions not allocated to the passthrough virtual machine are set to Root state or high-privilege inaccessible state.

[0017] Furthermore, the hardware protection status is configured using a reverse isolation method, that is, GPT / GPC restricts the passthrough virtual machine itself from accessing physical addresses outside its resource boundaries; when the passthrough virtual machine accesses an unauthorized physical memory region, GPC blocks the access and triggers a protection exception.

[0018] Based on the above system, the virtual machine full pass-through method for embedded virtualization of the present invention includes the following steps:

[0019] Step 1: After the system starts up, the high-privilege firmware initializes and builds a template GPT; all shared memory regions in the template GPT are marked as root state or high-privilege inaccessible state.

[0020] Step 2: Manage the virtual machine and submit the static configuration for the passthrough virtual machine to the virtual machine monitor;

[0021] Step 3: The virtual machine monitor parses the static configuration and verifies the validity of the requested resources;

[0022] Step 4: After the verification is passed, the virtual machine monitor allocates exclusive processor cores, physical memory, devices and interrupt resources to the pass-through virtual machine, and removes the allocated exclusive resources from the system shared resource pool.

[0023] Step 5: The virtual machine monitor generates or updates the client hardware description information for the pass-through virtual machine based on the exclusive resources.

[0024] Step 6: The virtual machine monitor builds an address layout relationship between the guest physical address and the actual physical address for the pass-through virtual machine, and disables the second-stage address translation for the pass-through virtual machine.

[0025] Step 7: The virtual machine monitor submits the startup information of the passthrough virtual machine to the passthrough virtual machine through the security monitor call; the startup information includes the physical memory range, the startup entry address, and the address of the client hardware description information;

[0026] Step 8: The high-privilege firmware builds a private GPT for the passthrough virtual machine based on the template GPT, and sets the physical memory region allocated to the passthrough virtual machine in the private GPT to a private hardware protection state.

[0027] Step 9: The high-privilege firmware enables GPC, allowing the passthrough virtual machine to access only authorized physical memory regions; and constructs the initial execution context of the passthrough virtual machine, so that after the passthrough virtual machine starts, it directly jumps to the guest operating system entry point for execution;

[0028] Step 10: The passthrough virtual machine starts running. During the run, the guest operating system maintains the first-stage page table and directly accesses the actual physical address. The hardware access check module GPC performs access permission checks before physical memory access is submitted. When the access exceeds the authorized physical memory boundary, the access is blocked and a protection exception is triggered.

[0029] The advantages and positive effects of this invention are as follows:

[0030] 1) The system and method of this invention are designed for static partition virtualization scenarios, providing a machine-level pass-through running model for performance-critical virtual machines, enabling them to directly use statically allocated processor cores, physical memory, devices and interrupt resources, reducing the intervention of the virtual machine monitor in critical execution paths, thereby reducing virtualization runtime overhead.

[0031] 2) The system and method of this invention eliminate or bypass the second-stage address translation of traditional virtualization technology, reduce memory access latency caused by nested address translation and page table traversal, and are especially suitable for memory-intensive, random access and large working set applications.

[0032] 3) The system and method of the present invention decouple virtual machine isolation from the address translation mechanism, and constrain the physical memory access range of the pass-through virtual machine by configuring the GPT / GPC hardware protection mechanism through the EL3 high privilege level firmware, so that the pass-through virtual machine can still maintain spatial isolation without relying on the second stage address translation.

[0033] 4) The method and system of the present invention can start and run the pass-through virtual machine without modifying the guest operating system kernel, so that both general-purpose operating systems and real-time operating systems can run directly in the pass-through virtual machine, reducing the system deployment, migration and adaptation costs.

[0034] 5) The method and system of this invention support the coexistence of ordinary virtual machines and pass-through virtual machines on the same platform. Ordinary virtual machines continue to run using traditional virtualization mechanisms, while pass-through virtual machines run using full-machine pass-through and GPT / GPC hardware protection mechanisms, thereby taking into account the system's flexibility, resource reuse capabilities, and low-overhead execution requirements for performance-critical tasks.

[0035] 6) The method and system of this invention adopt a templated GPT construction method, which only performs partial updates on the physical memory area allocated to the virtual machine when creating the passthrough virtual machine, thereby reducing protection configuration overhead and improving the startup efficiency of the passthrough virtual machine and the usability of the system. Attached Figure Description

[0036] Figure 1 This is an overall implementation architecture diagram of a virtual machine full pass-through system for embedded virtualization according to an embodiment of the present invention;

[0037] Figure 2 This is a flowchart of the direct virtual machine creation and startup process in this invention;

[0038] Figure 3 This is a comparison diagram of memory access paths between a regular virtual machine and a passthrough virtual machine in this invention;

[0039] Figure 4 This is a schematic diagram of the templated construction and reverse isolation of the private GPT table in this invention. Detailed Implementation

[0040] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the following embodiments are for illustrative purposes only and are not intended to limit the scope of protection of the present invention. Those skilled in the art can make equivalent substitutions, modifications, or combinations to the following embodiments without departing from the concept of the present invention, and such substitutions, modifications, or combinations should all fall within the scope of protection of the present invention.

[0041] This invention provides a virtual machine full pass-through method and system for embedded virtualization. The core idea is that for performance-critical virtual machines, the virtual machine monitor no longer undertakes address remapping and memory isolation functions simultaneously through second-level address translation. Instead, after statically allocating processor cores, physical memory, devices, and interrupt resources, the virtual machine directly accesses its allocated physical resources. At the same time, the high-privilege firmware configures hardware protection status to check and constrain the physical memory access boundaries of the virtual machine.

[0042] The following embodiments use the Arm architecture platform as an example. The Arm architecture defines four hierarchical privilege structures, from EL0 to EL3, each with different privilege levels, with EL0 having the lowest privilege and EL3 having the highest. The system of this invention mainly includes a management virtual machine, a virtual machine monitor, high-privilege firmware, a pass-through virtual machine, a regular virtual machine, and a hardware access inspection module. The virtual machine monitor runs at EL2, the high-privilege firmware runs at EL3, the hardware protection table uses a granular protection table (GPT), and the hardware access inspection mechanism uses a granular protection check (GPC). The virtual machine monitor allocates exclusive processor cores, physical memory, devices, and interrupt resources to the pass-through virtual machine and disables the second-stage address translation for that pass-through virtual machine. Simultaneously, the high-privilege firmware configures the hardware protection state according to the physical memory boundaries of the pass-through virtual machine, and checks the physical memory access of the pass-through virtual machine through the granular protection table (GPT) and the granular protection check (GPC), ensuring that the pass-through virtual machine can only access its authorized physical memory regions. It should be noted that this invention is not limited to the specific implementation described above.

[0043] Example 1:

[0044] like Figure 1 As shown, a virtual machine pass-through system for embedded virtualization according to the present invention includes a management virtual machine, a regular virtual machine, a pass-through virtual machine, a virtual machine monitor, high-privilege firmware, a hardware access inspection module, and physical hardware resources.

[0045] The management virtual machine runs at the virtual machine layer and is used to submit static configurations for passthrough virtual machines to the virtual machine monitor. These static configurations include information such as the guest operating system image, boot entry address, requested processor cores, physical memory range, passthrough device, device address range, and interrupt resources.

[0046] Ordinary virtual machines still operate using traditional virtualization methods. Their guest operating system completes the translation from guest virtual addresses to intermediate physical addresses through a one-stage page table, while the virtual machine monitor completes the translation from intermediate physical addresses to actual physical addresses through a two-stage page table. Based on this two-stage address translation, the ordinary virtual machine achieves address remapping and space isolation.

[0047] Passthrough virtual machines are used to run performance-critical tasks. For a passthrough virtual machine, the virtual machine monitor exclusively allocates processor cores, physical memory, devices, and interrupt resources, and disables or bypasses its two-stage address translation to ensure that its intermediate physical address matches the actual physical address. The passthrough virtual machine still uses its own one-stage page table, so the guest operating system can run without modification.

[0048] The virtual machine monitor includes functions such as resource partitioning, exclusive resource allocation, passthrough virtual machine initialization, and interrupt routing. It is responsible for verifying the passthrough virtual machine configuration, removing shared attributes of allocated resources, and building a client hardware view for the passthrough virtual machine that is consistent with its resource boundaries.

[0049] High-privilege firmware includes private GPT management and template-based reverse isolation configuration capabilities. It configures a private GPT based on the physical memory boundaries of the passthrough virtual machine and enables GPC to check physical access to the passthrough virtual machine at runtime. High-privilege firmware is... Figure 1 Secure World firmware in the system.

[0050] The hardware layer includes physical memory, physical devices, and processor cores. Physical memory is statically divided into hypervisor memory, dynamically allocated memory, and passthrough memory; passthrough memory is only authorized for access by passthrough virtual machines. Processor cores and physical devices are also divided into shared resources and exclusive resources; ordinary virtual machines use shared resources, while passthrough virtual machines use exclusive resources.

[0051] Example 2:

[0052] like Figure 2 As shown in the figure, this embodiment provides a virtual machine full pass-through method for embedded virtualization. The method is completed collaboratively by managing the virtual machine, virtual machine monitor extension, and high-privilege firmware extension, and specifically includes the following steps.

[0053] Step 1: After the system powers on and starts up, the high-privilege firmware completes platform initialization and pre-builds a template GPT for quickly generating the private protection state corresponding to the pass-through virtual machine.

[0054] Step 2: The virtual machine management system submits the static configuration list of the passthrough virtual machine to the virtual machine monitor. The static configuration list includes information such as the guest operating system image, boot entry address, processor cores to be allocated, physical memory range, passthrough device, device address range, and interrupt resources.

[0055] Step 3: The virtual machine monitor parses the static configuration list and performs a validity check on the requested resources. This validity check includes checking processor core occupancy status, physical memory region conflicts, and device and interrupt resource exclusivity.

[0056] Step 4: The virtual machine monitor (VM) allocates the verified processor cores, physical memory, devices, and interrupt resources as dedicated resources for pass-through virtual machines (NFMs) and removes them from the system's shared resource pool. This prevents ordinary virtual machines and the VM monitor from scheduling or reusing these resources. Initially, all hardware-level devices, processor cores, and memory, except for the VM monitor's memory, are shared resources.

[0057] Step 5: The virtual machine monitor builds a guest hardware view for the passthrough virtual machine based on the exclusive resources, generates a corresponding device tree, and obtains guest hardware description information, so that the guest operating system in the passthrough virtual machine is only aware of the allocated processor cores, memory, devices, and interrupt resources.

[0058] Step 6: The virtual machine monitor builds an address layout relationship between the guest physical address and the actual physical address for the pass-through virtual machine, and disables the second-stage address translation for the pass-through virtual machine.

[0059] Step 7: The virtual machine monitor submits the physical memory boundary, boot entry address, and customer hardware description information address of the pass-through virtual machine to the high-privilege firmware through the privileged call interface SMC (Security Monitor Call).

[0060] Step 8: The high-privilege firmware generates a corresponding private hardware protection state based on the physical memory boundary, and performs a partial update on the authorized physical memory region of the pass-through virtual machine based on the template protection table to form the corresponding private GPT.

[0061] Step 9: The high-privilege firmware activates the private hardware protection state and constructs the initial execution context for the passthrough virtual machine, then directly jumps to the guest operating system entry point for execution. Therefore, there is no need to return to the virtual machine monitor during the passthrough virtual machine startup process.

[0062] Step 10: The passthrough virtual machine begins operation. During operation, the guest operating system maintains the first-stage page table, directly accessing the actual physical addresses. The Hardware Access Control (GPC) module performs access permission checks before physical memory access is committed. When an access exceeds the authorized physical memory boundary, the access is blocked and a protection exception is triggered.

[0063] Example 3:

[0064] like Figure 3 As shown, ordinary virtual machines and passthrough virtual machines use different memory access paths.

[0065] For ordinary virtual machines, the guest operating system translates the guest virtual address into an intermediate physical address using a one-stage page table. This intermediate physical address still needs to be translated into an actual physical address using a two-stage page table maintained by the virtual machine monitor. Therefore, ordinary virtual machines rely on two-stage address translation to achieve address remapping and space isolation.

[0066] For pass-through virtual machines, the guest operating system still translates the guest virtual address into an intermediate physical address through a one-stage page table, but this intermediate physical address remains consistent with the actual physical address, and no second-stage address translation is required. Isolation of pass-through virtual machines no longer relies on address translation, but is achieved by hardware protection mechanisms provided by proprietary GPT and GPC.

[0067] Specifically, when a passthrough virtual machine accesses its authorized passthrough physical memory, the GPC determines the access is legitimate and allows it based on its private GPT. When a passthrough virtual machine attempts to access the virtual machine monitor memory, ordinary virtual machine memory, or other unauthorized areas, the GPC rejects the access based on its private GPT and triggers a granular protection fault (GPF). Thus, this invention eliminates two-stage address translation while maintaining spatial isolation for passthrough virtual machines.

[0068] Example 4:

[0069] like Figure 4 As shown, this invention implements physical access constraints for pass-through virtual machines through template GPT, private GPT, and reverse isolation mechanisms.

[0070] During system startup, the high-privilege firmware pre-builds a template GPT. In this template GPT, all memory regions within the physical address space are conservatively marked as being in Root state, i.e., a high-privilege protected state. This template GPT serves as the basis for subsequent private GPTs. For example... Figure 4 As shown, the template GPT sets all types of memory regions, including allocatable memory, firmware memory, and virtual machine monitor memory, to the root state.

[0071] When creating a passthrough virtual machine, the high-privilege firmware derives a private GPT based on the template GPT. This process employs a partial cutout approach: except for the physical memory region allocated to the passthrough virtual machine, other regions continue to maintain a high-privilege protection state; only the memory region of the passthrough virtual machine is remarked as accessible. Therefore, the construction of the private GPT does not require traversing the entire physical address space; it only requires partial updates to the memory already allocated to the passthrough virtual machine, thereby reducing the protection configuration overhead during the startup phase.

[0072] After the private GPT takes effect, GPC checks physical access requests from passthrough virtual machines. If the target address belongs to the passthrough virtual machine's memory, access is allowed; if the target address belongs to the virtual machine monitor's memory, ordinary virtual machine memory, or secure memory, access is prohibited and a protection exception is triggered.

[0073] The above mechanism is a form of reverse isolation. Its primary purpose is not to protect the passthrough virtual machine from external access, but rather to restrict the passthrough virtual machine itself from accessing physical addresses outside its boundary. Even if the guest operating system in the passthrough virtual machine is controlled by an attacker and attempts to access other memory regions by modifying its own phase one page table, GPC will still prevent the out-of-bounds access before the physical access is committed.

[0074] Example 5:

[0075] This embodiment provides a method for activating high-privilege firmware protection state and directly booting a passthrough virtual machine. This embodiment follows the private GPT and reverse isolation mechanism described in Embodiment 4, installing the private GPT corresponding to the passthrough virtual machine on the EL3 side, enabling GPC protection state, and directly entering the passthrough virtual machine for execution after the protection state takes effect.

[0076] After the processor cores, physical memory, devices, and interrupt resources of the passthrough virtual machine are allocated, the virtual machine monitor submits the boot information of the passthrough virtual machine to the high-privilege firmware through the SMC. The boot information includes the guest operating system boot entry address, the guest hardware description information address, initial boot parameters, target running status, and the private GPT configuration information corresponding to the passthrough virtual machine.

[0077] After receiving the startup information, the high-privilege firmware determines the private GPT corresponding to the pass-through virtual machine according to the method described in Example 4, and enters the protection state switching process.

[0078] Before installing the private GPT, the high-privilege firmware disables GPC via GPCCR_EL3 (granular protection check control register) to prevent the hardware from using incomplete or inconsistent protection states during GPT switching. Subsequently, the high-privilege firmware writes the physical base address of the private GPT to GPTBR_EL3 (granular protection table base address register), making the private GPT the protection table used for subsequent GPC checks.

[0079] After the private GPT is installed, the high-privilege firmware refreshes the modified GPT entries to the consistency point and performs a TLBI (TLB invalidation instruction) operation to clear any remaining old protection states. Subsequently, the high-privilege firmware executes the DSB (Data Synchronization Barrier) and ISB (Instruction Synchronization Barrier) in sequence to ensure the sequential relationship between GPT updates, TLB (Translation Bypass Buffer) invalidation, and subsequent instruction execution.

[0080] After the above synchronization is completed, the high-privilege firmware re-enables GPC via GPCCR_EL3. At this point, all subsequent physical memory accesses issued by the passthrough virtual machine are checked by GPC according to the private GPT, and the processor core where the passthrough virtual machine resides is constrained to its authorized physical memory range.

[0081] Since the processor core hosting the passthrough virtual machine no longer has access to the virtual machine monitor's memory after the private GPT takes effect, a protection exception may be triggered if the high-privilege firmware continues to return to EL2. Therefore, this embodiment adopts the EL3 direct boot method. After the protection state takes effect, the high-privilege firmware directly constructs the initial execution context of the passthrough virtual machine, and starts the passthrough virtual machine after the protection state takes effect.

[0082] Specifically, the high-privilege firmware sets the general-purpose registers according to the guest operating system's boot conventions, writing the guest hardware description information address and boot parameters into the corresponding registers; it writes the guest operating system's entry address into ELR_EL3 (Exception Link Register); and it writes the target running state into SPSR_EL3 (Saved Program Status Register), causing the processor to return to the Non-secure EL1 state. Both SPSR_EL3 and ELR_EL3 are accessible only by EL3.

[0083] Finally, the high-privilege firmware executes the ERET instruction, causing the processor to directly enter the guest operating system entry point of the passthrough virtual machine from EL3. Thus, the passthrough virtual machine starts and runs under the condition that the private GPT and GPC protection states are already in effect, and the boot path does not need to pass through the virtual machine monitor again. The ERET instruction stands for Exception Return instruction.

[0084] The advantage of this embodiment is that the high-privilege firmware can complete the private GPT installation, GPC activation and execution context construction before the passthrough virtual machine runs, so that the passthrough virtual machine is subject to hardware protection constraints before entering the guest operating system; at the same time, the EL3 direct boot method avoids the access conflict caused by returning to EL2 after the protection status takes effect.

[0085] Example 6:

[0086] This invention also supports direct routing between passthrough devices and interrupts. The memory-mapped I / O region and interrupt resources of the passthrough device are provided to the passthrough virtual machine, and physical interrupt routing is configured so that device interrupts are delivered directly to the processor core exclusively used by the passthrough virtual machine.

[0087] For devices assigned to passthrough virtual machines, the virtual machine monitor adds the address range to the guest hardware description information of the passthrough virtual machine, enabling the guest operating system to discover and access the device using native device drivers. Since the device is exclusively used by the passthrough virtual machine, the device access process does not require simulation or forwarding by the virtual machine monitor.

[0088] For interrupt resources, the virtual machine monitor configures the Physical Generic Interrupt Controller (GIC) before the passthrough virtual machine starts, routing interrupts from the allocated devices to the physical processor cores exclusively used by the passthrough virtual machine. Thus, when an interrupt occurs from a passthrough device, it is directly delivered to the processor core where the passthrough virtual machine is running and handled by the guest operating system's native interrupt handling logic. This approach avoids the trapping and re-injection processes found in traditional virtual interrupt controllers, reducing the virtual machine monitor's intervention in the interrupt path.

[0089] Example 7:

[0090] This invention supports the coexistence of ordinary virtual machines and passthrough virtual machines on the same physical platform.

[0091] For regular virtual machines, the virtual machine monitor continues to operate using traditional virtualization methods. Regular virtual machines still use second-level address translation to map guest physical addresses to actual physical addresses, and the virtual machine monitor performs resource reuse and isolation.

[0092] For passthrough virtual machines, the virtual machine monitor disables second-stage address translation and delegates isolation responsibilities to the hardware protection mechanisms configured in the high-privilege firmware. Passthrough virtual machines directly use their statically allocated processor cores, physical memory, devices, and interrupt resources.

[0093] The above describes the implementation of the virtual machine pass-through system and method for embedded virtualization proposed in this invention. Addressing the issue that performance-critical virtual machines in static partitioned virtualization are still affected by the second-stage address translation overhead, this invention utilizes system-wide resource pass-through, consistent configuration of guest physical addresses and actual physical addresses, private GPT reverse isolation, and EL3 direct boot mechanism. This approach retains the flexible resource management capabilities of ordinary virtual machines while providing a low-overhead, highly isolated system-wide pass-through execution environment for performance-critical virtual machines. This invention maintains virtual machine space isolation while reducing memory virtualization overhead, requires no modification to the guest operating system, supports the coexistence of ordinary virtual machines and pass-through virtual machines, and is suitable for embedded systems, real-time systems, automotive systems, industrial control systems, and hybrid critical systems.

[0094] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A fully pass-through virtual machine system for embedded virtualization, deployed on an Arm architecture platform, characterized in that, The system includes: Manage virtual machines, running on Arm EL1 or EL0, for submitting static configurations for passthrough virtual machines to the virtual machine monitor; the static configurations include the guest operating system image, boot entry address, guest hardware description information, requested processor cores, physical memory range, passthrough device, device address range, and interrupt resources; A virtual machine monitor, running on Arm EL2, manages ordinary virtual machines and passthrough virtual machines. Ordinary virtual machines use two-stage address translation for address remapping, with resource allocation and space isolation handled by the virtual machine monitor. The virtual machine monitor allocates exclusive processor cores, physical memory, devices, and interrupt resources to passthrough virtual machines based on the static configuration, disables the second-stage address translation for the passthrough virtual machine, and sets the guest physical address of the passthrough virtual machine to match the actual physical address. The virtual machine monitor submits the physical memory range, boot entry address, and guest hardware description information address of the passthrough virtual machine to the high-privilege firmware. The passthrough virtual machine uses its own one-stage page table to translate the guest virtual address and the actual physical address. The high-privilege firmware, running on Arm EL3, is used to configure hardware protection status based on the physical memory range of the passthrough virtual machine; the high-privilege firmware has a hardware access check module that uses GPT / GPC to constrain the passthrough virtual machine to only access authorized physical memory regions; The hardware access inspection module, including the granular protection table GPT and the granular protection inspection GPC, is used to check the physical memory access of the passthrough virtual machine during its operation via the GPC and to block the access when it goes out of bounds. Among them, EL0~EL3 are the four hierarchical privileged structures of the Arm architecture platform.

2. The virtual machine full pass-through system for embedded virtualization according to claim 1, characterized in that, The virtual machine monitor parses the static configuration, verifies the validity of the requested resources, classifies the verified resources as exclusive to the pass-through virtual machine, and removes them from the system shared resource pool.

3. The virtual machine full pass-through system for embedded virtualization according to claim 1 or 2, characterized in that, The virtual machine monitor generates or revises guest hardware description information based on the exclusive resources allocated to the passthrough virtual machine, so that the guest operating system in the passthrough virtual machine is only aware of the allocated processor cores, physical memory, devices, and interrupt resources.

4. The virtual machine full pass-through system for embedded virtualization according to claim 1, characterized in that, The aforementioned high-privilege firmware establishes a private GPT for the passthrough virtual machine; in the private GPT, the physical memory regions authorized for access by the passthrough virtual machine are set to an allowed access state, while the unauthorized physical memory regions are set to a root state or a high-privilege inaccessible state.

5. The virtual machine full pass-through system for embedded virtualization according to claim 1 or 4, characterized in that, The GPC performs access permission checks before physical access to the entire virtual machine is committed. When the access points to an unauthorized physical memory region, the GPC blocks the access and triggers a protection exception.

6. The virtual machine full pass-through system for embedded virtualization according to claim 1, characterized in that, The high-privilege firmware constructs a template GPT during system startup, in which all shared memory regions are marked as Root. When a passthrough virtual machine is created, the high-privilege firmware derives a private GPT for the passthrough virtual machine based on the template GPT, marks the physical memory regions allocated to the passthrough virtual machine in the private GPT as allowed access, and other regions remain in Root state.

7. The virtual machine full pass-through system for embedded virtualization according to claim 1 or 6, characterized in that, After receiving the information submitted by the virtual machine monitor, the high-privilege firmware generates a private GPT for passing through the virtual machine and installs it on the Arm EL3 side; GPC is disabled during the installation of the private GPT, and GPT is enabled again after the installation is completed, so that the installed private GPT takes effect. Then, the high-privilege firmware constructs the initial execution context of the passthrough virtual machine, including: setting general-purpose registers according to the guest operating system's boot conventions, writing the guest hardware description information address and boot parameters to the corresponding registers, writing the guest operating system entry address to ELR_EL3, writing the target running state to SPSR_EL3, and causing the processor to return to the EL1 state; finally, the passthrough virtual machine starts running under the condition that the private GPT and GPC protection states are in effect, and the high-privilege firmware executes the ERET instruction, causing the processor to directly enter the guest operating system entry point of the passthrough virtual machine from EL3 for execution; where ELR_EL3 is the exception link register, accessible only by EL3; SPSR_EL3 is the saved program status register, accessible only by EL3; and the ERET instruction is an exception return instruction.

8. The virtual machine full pass-through system for embedded virtualization according to claim 1, characterized in that, The virtual machine monitor adds the address range of the passthrough device requested by the passthrough virtual machine to the client hardware description information of the passthrough virtual machine; before the passthrough virtual machine starts, it configures a general interrupt controller (GIC) so that when the passthrough device is interrupted, the terminal is directly delivered to the processor core exclusively used by the passthrough virtual machine.

9. A virtual machine full passthrough method for embedded virtualization, based on the virtual machine full passthrough system for embedded virtualization as described in claim 1, comprising the following steps: Step 1: After the system starts up, the high-privilege firmware initializes and builds the template GPT; Step 2: Manage the virtual machine and submit the static configuration for the passthrough virtual machine to the virtual machine monitor; Step 3: The virtual machine monitor parses the static configuration and verifies the validity of the requested resources; Step 4: The virtual machine monitor will classify the verified processor cores, physical memory, devices and interrupt resources into pass-through virtual machine exclusive resources and remove them from the system shared resource pool. Step 5: The virtual machine monitor generates or updates the client hardware description information for the pass-through virtual machine based on the exclusive resources. Step 6: The virtual machine monitor builds an address layout relationship between the guest physical address and the actual physical address for the pass-through virtual machine, and disables the second-stage address translation for the pass-through virtual machine. Step 7: The virtual machine monitor submits the boot information of the pass-through virtual machine to the high-privilege firmware through the security monitor call. The boot information includes the physical memory range, the boot entry address and the address of the customer hardware description information. Step 8: The high-privilege firmware configures a private GPT for the passthrough virtual machine based on the template GPT, and sets the physical memory region allocated to the passthrough virtual machine in the private GPT to a private hardware protection state. Step 9: The high-privilege firmware enables GPC, which allows the passthrough virtual machine to access only the authorized physical memory area and builds the initial execution context of the passthrough virtual machine, so that the passthrough virtual machine can directly jump to the guest operating system entry point for execution after startup. Step 10: The passthrough virtual machine starts running. During the run, the guest operating system maintains the first-stage page table and directly accesses the actual physical address. The hardware access check module GPC performs access permission checks before physical memory access is submitted. When the access exceeds the authorized physical memory boundary, the access is blocked and a protection exception is triggered.

10. The virtual machine full pass-through method for embedded virtualization according to claim 9, characterized in that, Step 9 includes: the high-privilege firmware constructs the initial execution context of the passthrough virtual machine, including: setting general-purpose registers according to the boot conventions of the guest operating system, writing the guest hardware description information address and boot parameters into the corresponding registers, writing the guest operating system entry address into ELR_EL3, writing the target running state into SPSR_EL3, and causing the processor to return to the EL1 state; wherein, ELR_EL3 is the exception link register, which can only be accessed by EL3; SPSR_EL3 is the saved program status register, which can only be accessed by EL3; the passthrough virtual machine starts running under the condition that the private GPT and GPC protection states are in effect, the high-privilege firmware executes the ERET instruction, causing the processor to directly enter the guest operating system entry point of the passthrough virtual machine from EL3 for execution, wherein the ERET instruction is an exception return instruction.

Images