System calling method and apparatus

Abstract

A system calling method and apparatus. The method comprises: a kernel of a first virtual machine receiving an interrupt instruction of a first process, the first process running in a user space of a second virtual machine, the kernel of the first virtual machine running in a kernel space of the second virtual machine, the second virtual machine being configured for providing an operating environment of the first virtual machine, whereupon a CPU switches from a user mode to a kernel mode; the kernel of the first virtual machine mapping a first address associated with the interrupt instruction to a second address, the kernel of the first virtual machine executing the interrupt instruction on the basis of the second address to obtain an interrupt processing result, and then sending the interrupt processing result to the first process, whereupon the CPU switches from the kernel mode to the user mode. Therefore, during a system call invocation, the first virtual machine of the present application only requires two CPU transitions between kernel mode and user mode, thereby reducing CPU privilege level overhead and context switching overhead, and reducing CPU resource consumption.

Description

A system call method and apparatus

[0001] Cross-references to related applications

[0002] This application claims priority to Chinese Patent Application No. 202510114507.8, filed on January 23, 2025, entitled "A System Call Method and Apparatus", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of information technology (IT), and more particularly to a system call method and apparatus. Background Technology

[0004] Virtualization technology is a technique that transforms physical resources into logically manageable virtualized resources. It is typically implemented through a Virtual Machine Monitor (VMM). The VMM runs a hypervisor, allowing it to completely emulate a computer hardware environment and run a full operating system (OS) on each virtual machine (VM). Based on this, each VM can run an independent OS and applications, breaking down the barriers between physical infrastructures.

[0005] In one virtualization scenario, a host virtual machine manager (HVMM) runs a guest virtual machine manager (Guest VMM), and multiple virtual machines (VMs) run on the guest VMM. In this scenario, the host hypervisor running on the host VMM is generally represented as L0, the guest hypervisor running on the guest VMM is generally represented as L1, and the VMs running on the guest VMM are generally represented as L2.

[0006] In paravirtualization technology, L2 system calls rely on L1 user-mode and kernel-mode switching (i.e., CPU privilege level switching), requiring the CPU to perform multiple privilege level switches and increasing CPU privilege level switching overhead. Therefore, how to better perform system calls and reduce CPU resource overhead remains to be studied. Summary of the Invention

[0007] This application provides a system call method and apparatus to reduce CPU resource overhead.

[0008] Firstly, embodiments of this application provide a system call method. This method can be applied to a device, a module of the device (such as a chip), or a system corresponding to the device. The device can be a network device (such as a server), and a first process, a first virtual machine, and a second virtual machine are running on the device. Based on this, the method can include the following steps: The kernel of the first virtual machine receives an interrupt instruction from the first process, wherein the first process runs in the user space of the second virtual machine, the kernel of the first virtual machine runs in the kernel space of the second virtual machine, and the second virtual machine is used to provide the runtime environment for the first virtual machine. At this time, the CPU switches from user mode to kernel mode. Then, the kernel of the first virtual machine maps the first address associated with the interrupt instruction to a second address, executes the interrupt instruction based on the second address, obtains the interrupt handling result, and sends the interrupt handling result to the first process. At this time, the CPU switches from kernel mode to user mode. The first address is the virtual address of the first virtual machine, and the second address is the physical address of the second virtual machine.

[0009] In the above method, because the kernel of the first virtual machine (corresponding to L2) runs in the kernel space of the second virtual machine (corresponding to L1), the interrupt instruction initiated by the first process can be directly sent to the kernel of the first virtual machine. Since the kernel of the first virtual machine runs in the kernel space of the second virtual machine, the CPU switches from user mode to kernel mode, or in other words, the CPU switches from user mode of the second virtual machine to kernel mode of the second virtual machine. Then, the first virtual machine running in the kernel space of the second virtual machine can perform operations such as address mapping and interrupt instruction handling. Because these operations all run in the kernel space of the second virtual machine, there is no CPU privilege level switching. Finally, when the kernel of the first virtual machine sends the interrupt handling result to the first process, the CPU switches from kernel mode to user mode, or in other words, the CPU switches from kernel mode of the second virtual machine to user mode of the second virtual machine. It can be seen that during the system call process of the first virtual machine, this embodiment only requires two CPU privilege level switches, thereby reducing the number of CPU privilege level switches and lowering the CPU privilege level switching overhead.

[0010] In one possible implementation, the kernel of the first virtual machine maps the first address associated with the interrupt instruction to the second address, including: the kernel of the first virtual machine accesses the page table of the first process and maps the first address to the second address, wherein the page table of the first process is used to indicate the mapping relationship between the virtual address of the first virtual machine and the physical address of the second virtual machine.

[0011] In the address mapping process of related technologies, the L1 kernel is generally required, meaning the CPU needs to maintain a page table for the L1 kernel, thus incurring CPU overhead for maintaining the L1 kernel's page table. Furthermore, the L2 kernel and L2 processes each have their own page table (the kernel page table for the L2 kernel and the process page table for the L2 process, respectively), resulting in CPU overhead for page table switching and context switching during L2 system calls.

[0012] In this address mapping implementation, the kernel of the first virtual machine maps the memory space containing the page table of the first process. This means the kernel of the first virtual machine can access the page table of the first process. Thus, the kernel of the first virtual machine and the first process no longer each have their own page table; the kernel can implement address mapping based on the page table of the first process, rather than its own kernel page table. This reduces the CPU's page table switching overhead during system calls from the first virtual machine, lowering CPU resource consumption. Furthermore, the kernel of the second virtual machine is no longer required, eliminating the need for the CPU to maintain a page table for the second virtual machine's kernel, reducing CPU page table maintenance overhead and simplifying page table update operations.

[0013] In one possible implementation, an interrupt instruction is used to instruct a write operation on the first page table entry. For this interrupt instruction, the first address is the address associated with the first page table entry. The kernel of the first virtual machine executes the interrupt instruction, including: the kernel of the first virtual machine calls the kernel security monitor to obtain the verification result of the kernel security monitor's validation of the first page table entry; the kernel security monitor runs in the kernel space of the second virtual machine. If the verification result indicates that the first page table entry is valid, then a write operation is performed on the first page table entry.

[0014] In this implementation, to prevent attacks on the kernel of the first virtual machine, a kernel security monitor is used for verification to ensure the security and legitimacy of the virtualization technology.

[0015] In one possible implementation, the page table includes at least two page table pages of different levels. Each page table page includes a declaration label indicating the level of the page table page. The page table page to which the first page table entry belongs is a non-last-level page table page. The page table entry of the non-last-level page table page includes an index of the next-level page table page. An interrupt instruction is used to instruct the first index to be used as the next-level page table index in the first page table entry. Based on this, the kernel security monitor verifies the validity of the first page table entry, including: determining that the first page table entry is valid when a first condition is met; wherein the first condition includes:

[0016] The virtual address in the first page table entry is within the virtual address space of the first virtual machine; and

[0017] The level indicated by the declaration label of the page table page to which the first index belongs is the next level below the level indicated by the declaration label of the page table page to which the first page table entry belongs.

[0018] In this implementation, the first condition prevents attackers from using privileged instructions to use the x-level page table as the y-level page table for attack purposes, thereby ensuring the security of virtualization technology.

[0019] In one possible implementation, the page table includes at least two page table pages of different levels. Each page table page includes a declaration label indicating the level of the page table page. The page table page to which the first page table entry belongs is the last-level page table page. The page table entry of the last-level page table page includes the base address of the physical address of the second virtual machine. The base address in the first page table entry points to the page table page with the declaration label. Alternatively, an interrupt instruction is used to instruct the first base address to be used as the base address in the first page table entry, and the first base address points to the page table page with the declaration label. Based on this, the kernel security monitor verifies the validity of the first page table entry, including: determining that the first page table entry is valid when a second condition is met, wherein the second condition includes:

[0020] The virtual address in the first page entry is within the virtual address space of the first virtual machine; and,

[0021] The base address in the first page entry is within the physical address space of the second virtual machine; and,

[0022] The permissions for the entries on the first page are read-only.

[0023] This implementation ensures that the page table of the first process has read-only permissions, thereby preventing attackers from modifying the page table of the first process and ensuring the security of virtualization technology.

[0024] In one possible implementation, before the kernel of the first virtual machine performs a write operation on the first page table entry, the kernel's permissions are changed from read-only to write-only by the kernel security monitor; correspondingly, after the kernel of the first virtual machine performs a write operation on the first page table entry, the implementation further includes: changing the kernel's permissions from write-only to read-only.

[0025] In one possible implementation, the kernel permissions of the first virtual machine are modified from read-only permissions to write permissions by the kernel security monitor, including: the value of the first register is modified from a first value to a second value by the kernel security monitor, where the first value indicates that the kernel permissions of the first virtual machine are read-only and the second value indicates that the kernel permissions of the first virtual machine are write permissions; correspondingly, modifying the kernel permissions of the first virtual machine from write permissions to read-only permissions includes: modifying the value of the first register from a second value to a first value.

[0026] In this implementation, the kernel of the first virtual machine is isolated from the kernel security monitor through the first register, ensuring that interrupt instructions are validated by the kernel security monitor, thereby guaranteeing the security of virtualization technology.

[0027] Secondly, an apparatus is provided, comprising a transceiver module and a processing module; wherein the transceiver module is used to receive an interrupt instruction from a first process, the first process running in the user space of a second virtual machine, the kernel of the first virtual machine running in the kernel space of the second virtual machine, and the second virtual machine providing the runtime environment for the first virtual machine. The processing module is used to map a first address associated with the interrupt instruction to a second address, the first address being a virtual address of the first virtual machine and the second address being a physical address of the second virtual machine; and to execute the interrupt instruction based on the second address to obtain an interrupt handling result. The transceiver module is also used to send the interrupt handling result to the first process.

[0028] In one possible implementation, the processing module is specifically used to: access the page table of the first process and map the first address to the second address. The page table of the first process is used to indicate the mapping relationship between the virtual address of the first virtual machine and the physical address of the second virtual machine.

[0029] In one possible implementation, the interrupt instruction is used to instruct a write operation on the first page table entry, where the first address is the address associated with the first page table entry. The processing module is specifically used to: call the kernel security monitor to obtain the verification result of the kernel security monitor's validation of the first page table entry; the kernel security monitor runs in the kernel space of the second virtual machine; if the verification result indicates that the first page table entry is valid, then a write operation is performed on the first page table entry.

[0030] In one possible implementation, the page table includes at least two page table pages of different levels. Each page table page includes a declaration label indicating the level of the page table page. The page table page to which the first page table entry belongs is a non-last-level page table page. The page table entry of the non-last-level page table page includes an index of the next-level page table page. An interrupt instruction is used to instruct that the first index be used as the next-level page table index in the first page table entry. The processing module is further configured to: determine that the first page table entry is valid when the first condition is met;

[0031] The first condition includes:

[0032] The virtual address in the first page entry is within the virtual address space of the first virtual machine; and,

[0033] The level indicated by the declaration label of the page table page to which the first index belongs is the next level below the level indicated by the declaration label of the page table page to which the first page table entry belongs.

[0034] In one possible implementation, the page table includes at least two page table pages of different levels. Each page table page includes a declaration label indicating the level of the page table page. The page table page to which the first page table entry belongs is the last-level page table page. The page table entry of the last-level page table page includes the base address of the physical address of the second virtual machine. The base address in the first page table entry points to the page table page with the declaration label. Alternatively, an interrupt instruction is used to instruct the first base address to be used as the base address in the first page table entry, and the first base address points to the page table page with the declaration label. The processing module is further configured to: determine that the first page table entry is valid when the second condition is met.

[0035] The second condition includes:

[0036] The virtual address in the first page entry is within the virtual address space of the first virtual machine; and,

[0037] The base address in the first page entry is within the physical address space of the second virtual machine; and,

[0038] The permissions for the entries on the first page are read-only.

[0039] In one possible implementation, before the kernel of the first virtual machine performs a write operation on the first page table entry, the kernel's permissions are changed from read-only to write-only by the kernel security monitor. The processing module is further configured to: after performing a write operation on the first page table entry, change the kernel's permissions from write-only to read-only.

[0040] In one possible implementation, the kernel permissions of the first virtual machine are modified from read-only to write permissions by the kernel security monitor. This includes: the value of a first register is modified from a first value to a second value by the kernel security monitor. The first value indicates that the kernel permissions of the first virtual machine are read-only, and the second value indicates that the kernel permissions of the first virtual machine are write. Specifically, the processing module is used to: after performing a write operation on the first page table entry, modify the value of the first register from the second value back to the first value.

[0041] Thirdly, a computer device is provided, including a processor, a memory, a communication interface, and a bus. The processor, memory, and communication interface are connected to each other via the bus and communicate with each other. The memory is used to store computer execution instructions. When the computer device is running, the processor executes the computer execution instructions in the memory to perform the operation steps of the method in the first aspect or any possible implementation of the first aspect using the hardware resources in the computer device.

[0042] Fourthly, an apparatus is provided, comprising: one or more processors configured to perform the method described in the first aspect or any possible implementation thereof.

[0043] In one possible implementation, the communication device further includes one or more memories; wherein the one or more memories store one or more programs that, when executed by the one or more processors, cause the communication device to perform the method described in the first aspect or any possible implementation thereof.

[0044] Fifthly, a chip system is provided, the chip system comprising at least one chip and a memory, the at least one chip being used to read and execute a program stored in the memory to implement the operational steps of the method described in the first aspect or any possible implementation of the first aspect.

[0045] A sixth aspect provides a non-volatile computer-readable storage medium comprising a program that, when executed on a device, causes the device to perform the operational steps of the method described in the first aspect or any possible implementation thereof.

[0046] In a seventh aspect, a computer program product is provided, which, when run on a device, causes the device to perform the operational steps of the method described in the first aspect or any possible implementation thereof.

[0047] Based on the implementation methods provided in the above aspects, this application can be further combined to provide more implementation methods. Attached Figure Description

[0048] Figure 1 is a schematic diagram of a system architecture for virtualization technology provided in an embodiment of this application;

[0049] Figure 2 is a schematic diagram of a system architecture for nested virtualization technology provided in an embodiment of this application;

[0050] Figure 3 is a schematic diagram of a system architecture in which the L2 kernel runs in the L1 user space according to an embodiment of this application;

[0051] Figure 4 is a schematic diagram of another system architecture provided in this application embodiment, in which the L2 kernel runs in the L1 user space;

[0052] Figure 5 is a schematic diagram of a system architecture in which an L2 kernel runs in an L1 kernel space, according to an embodiment of this application.

[0053] Figure 6 is a schematic diagram of a system architecture provided in this application embodiment, in which the L2 kernel runs in the L1 kernel space;

[0054] Figure 7 is a flowchart illustrating a system call method provided in an embodiment of this application;

[0055] Figure 8 is a schematic diagram of a page table for a first process provided in an embodiment of this application;

[0056] Figure 9A is a flowchart illustrating another system call method provided in an embodiment of this application;

[0057] Figure 9B is a schematic diagram of a KSM operation process provided in an embodiment of this application;

[0058] Figure 10 is a schematic diagram of the page fault exception interruption processing delay provided in an embodiment of this application;

[0059] Figure 11 is a schematic diagram of a simple system call latency provided in an embodiment of this application;

[0060] Figure 12 is a schematic diagram of latency based on lmbench test provided in an embodiment of this application;

[0061] Figure 13 is a latency diagram of a memory-intensive application provided in an embodiment of this application;

[0062] Figure 14 is a schematic diagram of the operational throughput and system call frequency of a test case provided in an embodiment of this application;

[0063] Figure 15 is a schematic diagram of an operational throughput provided in an embodiment of this application;

[0064] Figure 16 is a schematic diagram of the structure of a device provided in an embodiment of this application;

[0065] Figure 17 is a schematic diagram of the structure of a device provided in an embodiment of this application. Detailed Implementation

[0066] To better illustrate the system call method provided in the embodiments of this application, the concepts and terms involved in the embodiments of this application will be briefly explained first.

[0067] (1) Privilege Level of Central Processing Unit (CPU)

[0068] CPU privilege level represents the privilege level the CPU operates in when accessing computer resources; it is also known as Current Privilege Level (CPL). Different privilege levels allow the CPU to access different ranges of computer resources, including but not limited to memory segments (such as code, data, and stack segments), input / output (I / O) devices, and kernel data structures. There are four CPU privilege levels: Ring 0 (representing kernel mode), Ring 1, Ring 2, and Ring 3 (representing user mode).

[0069] Ring 0 has the highest privileges and can use all CPU instructions (including privileged and non-privileged instructions), such as controlling interrupts, modifying page tables, and accessing devices. Ring 1 has lower privileges than Ring 0, Ring 2 has lower privileges than Ring 1, and Ring 3 has the lowest privileges. Generally, Ring 1, Ring 2, and Ring 3 can only use regular CPU instructions (or non-privileged instructions). Ring 3 cannot use instructions that access hardware resources, such as I / O read / write, network card access, or memory allocation.

[0070] For example, CPU instruction types can include privileged instructions and ordinary instructions (or non-privileged instructions). Privileged instructions run on Ring 0 and have the highest privilege level. Privileged instructions can directly access and control the computer's hardware and core resources (such as memory and peripherals). Non-privileged instructions run on Ring 3 and Ring 2, and some non-privileged instructions run on Ring 1.

[0071] In related technologies, applications (Apps) run in user mode, or in other words, at the CPU privilege level corresponding to Ring 3. For operations that are not permitted at the Ring 3 privilege level (such as I / O read / write, network card access, memory allocation, and disk access), system calls are needed to execute these operations. A system call can be understood as invoking the kernel / privileged instructions, allowing the kernel to execute these privileged instructions to complete the operations that Ring 3 does not have permission to perform. When a system call is executed, the CPU's privilege level switches from Ring 3 to Ring 0. The CPU executes the kernel code corresponding to Ring 0, allowing the CPU kernel to complete these operations for the application. After completion, the CPU returns from Ring 0 to Ring 3. This process is also known as the switch between user mode and kernel mode.

[0072] (2) User Space, Kernel Space

[0073] Memory addresses can use either virtual addresses or physical addresses, and there is a mapping relationship between virtual and physical addresses; a virtual address can be mapped to a physical address. The virtual address space is generally further divided into two segments: user space and kernel space. User space is the space where processes have full operational privileges, while kernel space is the space created for privileged instructions. Therefore, user mode can be understood as the state of a process running in user space, and kernel mode can be understood as the state of a process running in kernel space.

[0074] In related technologies, processes cannot directly access system resources. If access to system resources is involved, the CPU must switch to kernel mode through the kernel space to complete the access. Examples of scenarios where user mode switches to kernel mode include, but are not limited to, the following three: system calls, exceptions (such as page faults), and peripheral device interrupts.

[0075] (3) Virtualization Technology (VT)

[0076] Virtualization technology is a technique that combines or partitions existing physical computer hardware resources (which can be simply referred to as physical resources or hardware resources, such as memory and disk space) to make these physical resources appear as one or more operating environments, thereby providing access methods superior to the original resource configuration. In other words, virtualization technology transforms physical resources into logically manageable virtualized resources. It can divide a physical computer into multiple virtual machines (VMs), each of which can run an independent operating system (OS) and applications, thus breaking down the barriers between physical structures.

[0077] A VM (or virtual machine, or guest computer) is a computer program or system that simulates the hardware environment of a physical computer, allowing multiple VMs to run simultaneously on the same physical computer. In other words, one or more VMs can be simulated on a single physical computer, and these VMs function like real physical computers, such as installing operating systems, applications, and accessing network resources. The physical computer running the VMs is called the host machine.

[0078] Virtualization technology is generally implemented through a Virtual Machine Monitor (VMM). The VMM runs a hypervisor, enabling it to completely emulate a computer hardware environment and run a complete operating system (which can be called a Guest OS) for the virtual machines. In other words, the virtual machines run in the computer hardware environment emulated by the VMM. Based on this, the access of these virtual machines to the physical hardware can be managed through the hypervisor. For example, Figure 1 is a schematic diagram of a virtualization technology system architecture provided in an embodiment of this application, in which the physical computer manages multiple virtual machines through a Host Hypervisor running on the VMM.

[0079] In related technologies, virtualization technology can include full virtualization, paravirtualization, and hardware-assisted virtualization. See the following description for details:

[0080] Full virtualization technology works as follows: The Virtual Machine Monitor (VMM) runs on Ring 0, allowing it to collect and identify all instructions from the virtual machine (including instructions from Ring 3, Ring 2, Ring 1, and Ring 0). Ring 3 instructions for the VM run normally without being intercepted by the VMM. However, Ring 0 instructions are intercepted, translated, and replaced to obtain virtual privilege instructions that only apply to the VM. These virtual privilege instructions are then executed by the CPU within the Ring 0 environment. This technology results in a heavy workload for the VMM, consuming significant CPU and memory resources, leading to high resource overhead.

[0081] Paravirtual Machine (PVM): Also known as software virtualization, it modifies the Guest OS of the VM to change some privileged instructions executed on the Host OS into a way that can directly interact with the VMM. That is, it changes the VM's calls to privileged instructions into direct calls to the VMM. This calling method is called Hypercall, which allows the VMM to directly pass privileged instructions to the host machine. This eliminates the need for the VMM to translate and replace the VM's Ring 0 instructions with virtual privileged instructions.

[0082] Hardware-assisted virtualization (HVM) technology utilizes CPUs with virtualization capabilities to achieve virtualization, such as Intel-TV and AMD-V technologies. In this technology, the CPU has two operating modes: root mode and non-root mode. Both modes have corresponding instruction levels: Ring0, Ring1, Ring2, and Ring3. The VMM runs in Ring0 of root mode, the guest OS kernel runs in Ring0 of non-root mode, and guest OS applications run in Ring3 of non-root mode.

[0083] The switching between the two operating modes of the CPU is called VMX operation. In VMX operation, the transition from Root mode to non-Root mode is called VMX entry (VM Entry); the transition from non-Root mode to Root mode is called VMX exit (VM Exit). The factors that trigger VM Exit can include exceptions, interrupts, and instructions, which are not limited to here.

[0084] For example, the CPU switches from root mode to non-root mode, running the VM to operate on system instructions. If the CPU executes sensitive instructions or experiences an interrupt in non-root mode, it will perform a VM Exit operation, switching back to root mode to run the VMM. Based on this, the VM runs in a non-root kernel state and can directly call privileged instructions. These privileged instructions are then routed to the root-based VMM through the hardware virtualization mechanism, where the VMM performs unified hardware management. This technology allows for complete isolation between the VMM and the Guest OS.

[0085] In summary, in virtualization technology, the privileged instructions of the VM are all handed over to the VMM, which in turn hands them over to the underlying hardware for execution.

[0086] (4) Nested virtualization technology

[0087] Nested virtualization technology refers to virtualizing one hypervisor (or host hypervisor) on top of another hypervisor (or guest hypervisor). This makes the format of the virtual machine (VM) only related to the format of the guest hypervisor, improving the flexibility of the virtualization architecture. Figure 2 is a schematic diagram of a system architecture for nested virtualization technology provided in an embodiment of this application. As shown in Figure 2, the host virtual machine manager (Host VMM) runs the host hypervisor (L0 in the figure), which is used to virtualize the physical computer; the guest virtual machine manager (Guest VMM) runs the guest hypervisor, which is used to virtualize the host VMM. That is, the guest hypervisor can be regarded as a virtual machine (L1 in the figure) relative to the host machine. The guest VMM can simulate the environment of the host VMM, allowing multiple virtual machines (L2 in the figure) to run in the environment simulated by the guest VMM. Therefore, L1 is the host machine relative to L2.

[0088] It is understood that Figure 2 is merely an illustrative example of a Guest VMM. In some scenarios, multiple Guest VMMs can run on top of a Host VMM. That is, an L0 kernel can run at least one virtual machine with an L1 kernel, and each L1 kernel further isolates multiple L2 kernels. Because each L2 kernel has its own kernel, L2 can also be referred to as a secure container.

[0089] (5) Memory virtualization

[0090] Memory virtualization can be divided into software-based memory virtualization and hardware-assisted memory virtualization. Software-based memory virtualization technologies include shadow page table technology, while hardware-assisted memory virtualization technologies include extended page table (EPT) technology. See the following description for details:

[0091] Both the guest and host machines have their corresponding virtual and physical address spaces. Specifically, the guest machine has its own virtual address space (the virtual machine's address space) and its physical address space (the VMM's address space). The host machine also has its own virtual and physical address spaces. When a virtual machine accesses memory, the following address translation is required: Guest Virtual Address (GVA) -> Guest Physical Address (GPA) -> Host Virtual Address (HVA) -> Host Physical Address (HPA).

[0092] In a software-based memory virtualization implementation, the GVA to GPA conversion is performed by the virtual machine based on its corresponding page table. The page table maps virtual addresses to physical addresses; that is, it includes the mapping relationship between virtual and physical addresses. Furthermore, the page table includes information such as "hits" and U (User) / K (Kernel) permissions. Essentially, the virtual machine's page table maps GVA to GPA. The GPA to HVA conversion is performed by the VMM based on its defined mapping table (such as the table recorded by the data structure `kvm_memory_slot`), which maps GPA to HVA. The HVA to HPA conversion is performed by the host machine based on its corresponding page table. Essentially, the host machine's page table maps HVA to HPA.

[0093] The shadow page table is a page table that combines the virtual machine's page table, the VMM's mapping table, and the host machine's page table. This allows the VMM to directly translate from the GVA to the HPA based on the shadow page table.

[0094] The virtual machine's page tables and shadow page tables can be associated using a hash table (or other association methods). When the virtual machine loads the base address of the page table into the Page-Directory Base address Register (PDBR), the VMM intercepts this privileged instruction. Based on the association between the virtual machine's page tables and shadow page tables, it determines the corresponding shadow page table and then loads the base address of that shadow page table into the virtual machine's PDBR. When the virtual machine resumes runtime, the PDBR actually points to that shadow page table. In this way, L2 can achieve physical memory access through this shadow page table.

[0095] In one implementation of hardware-assisted memory virtualization, an Extend Page Table Pointer (EPTP) register is introduced at the hardware level to point to the base address of the EPT. In other words, the EPT is added to the CPU hardware as a CPU feature. For example, when the virtual machine accesses memory, it performs the GVA->GPA translation based on its corresponding page table. The VMM queries the EPT based on the EPTP register to complete the GPA->HPA translation. It should be noted that the EPT is managed and maintained by the VMM. The EPT is also called the second-stage page table.

[0096] In nested virtualization scenarios, virtual machines (L2) typically run in the user space of the Guest VMM (L1). Referring to Figure 3, which is a schematic diagram of a system architecture where the L2 kernel runs in the user space of L1 according to an embodiment of this application, all virtual machines (L2) running on L1 run in the user space of L1, while L1 runs in the user space of L0. It is understood that Figure 3 is merely an illustrative representation of L1, L2, and the applications (or processes) running on L2. For example, in Figure 3, L2 runs APP1 and APP2. This application does not limit the number of L1 instances, the number of L2 instances, or the number of applications running on L2. This implementation is an example of hardware-assisted virtualization technology.

[0097] In this implementation, the L1 kernel relies on the L0 kernel to manage the L2 kernel. For example, APP1 running on L2 initiates an interrupt instruction, assuming this interrupt instruction instructs modification of the page table. Then, the L2 kernel sends instruction A to L0, which instructs the L0 kernel to implement address mapping between L0 and L2 (this can be called first-stage address mapping). In other words, the interrupt instruction is trapped in L0 (at this time, the CPU switches from non-root mode to root mode). Next, L0 sends instruction B to L1, which instructs the L1 kernel to implement address mapping between L0 and L1 (this can be called second-stage address mapping). In other words, L0 traps this interrupt instruction into the L1 kernel (at this time, the CPU switches from root mode to non-root mode). After responding to instruction B, the L1 kernel feeds back the corresponding processing result B (e.g., indicating successful address mapping) to the L0 kernel (at this time, the CPU switches from non-root mode to root mode again). Similarly, the L0 kernel feeds back the processing result A to the L2 kernel (at this time, the CPU switches from root mode to non-root mode again). Finally, the L2 kernel executes the corresponding interrupt handler to modify the page table and feeds back the interrupt handling result (such as a result indicating successful page table modification) to APP1. It can be seen that during the L2 implementation of system calls, the CPU switches operating modes multiple times, resulting in significant CPU overhead.

[0098] Furthermore, since L2 runs in L1's user space (meaning the L2 kernel is in user space relative to L1), it's impossible to isolate user mode and kernel mode using U / K permissions in the page table. Therefore, the L2 kernel and APP1 must each manage a separate page table: the L2 kernel manages the kernel page table, and APP1 manages its corresponding process page table. Each APP manages its own process page table, which isolates different APPs, while the kernel page table isolates user mode from kernel mode. Thus, during the first-stage address mapping, the L2 kernel needs to switch from the process page table to the kernel page table, incurring page table switching overhead. Moreover, since the second-stage address mapping involves the L1 kernel, it needs to maintain a page table (shadow page table or EPT, used for the second-stage address mapping) for each L2 kernel. During the second-stage address mapping, the L1 kernel needs to switch to this page table, resulting in multiple page table switches during system calls, leading to page table maintenance and context switching overhead for the CPU.

[0099] Figure 4 is a schematic diagram of a system architecture provided in this application embodiment where the L2 kernel runs in the user space of L1. This implementation is an example of semi-virtualization technology. Based on the characteristics of semi-virtualization technology, when L2 makes system calls, it no longer depends on L0, that is, the system call can be realized only through the interaction between L2 and L1. As shown in Figure 4, in this implementation, since L2 runs in the user space of L1, the interrupt instruction initiated by APP1 of L2 (assuming that the interrupt instruction indicates modification of page table entries) is directly pushed down to the L1 kernel (at this time, the CPU switches from L1 user mode to L1 kernel mode). Then, the L1 kernel sends instruction C to the L2 kernel. Instruction C is used to instruct the L2 kernel to implement the mapping from L2 virtual address to L2 physical address (which can be called the first-stage address mapping, and the L2 physical address can also be said to be the L1 virtual address) (at this time, the CPU switches from L1 kernel mode to L1 user mode). Then, after L2 responds to instruction C, it feeds back the corresponding processing result C (such as indicating that the address mapping is successful) to the L1 kernel (at this time, the CPU switches from L1 user mode to L1 kernel mode). After receiving the result C, the L1 kernel performs the mapping from L2 physical address to L1 physical address (which can be called second-stage address mapping) and executes the interrupt handler to modify the page table. Then, the L1 kernel sends an instruction to the L2 kernel (at this time, the CPU switches from L1 kernel mode to L1 user mode), indicating that the page table modification is complete. Finally, the L2 kernel sends instruction D to the L1 kernel (at this time, the CPU switches from L1 user mode to L1 kernel mode), instructing the L1 kernel to feed back the interrupt handling result to APP1. L1 then responds to instruction D, feeding back the interrupt handling result to APP1 (at this time, the CPU switches from L1 kernel mode to L1 user mode). It can be seen that this implementation relies on switching between L1's user mode and kernel mode. Specifically, when L2 makes a system call, the CPU performs six switches between kernel mode and user mode (or CPU privilege levels), resulting in significant privilege level switching overhead.

[0100] Furthermore, referring to Figure 3 above, since L2 runs in L1's user space, the L2 kernel needs to manage the kernel page table, and APP1 needs to manage its corresponding process page table. Therefore, when implementing the first-stage address mapping, the L2 kernel needs to switch from the process page table to the kernel page table, resulting in page table switching overhead. Moreover, since the second-stage address mapping, in which the L1 kernel participates, requires the L1 kernel to maintain a page table (shadow page table or EPT, used to implement the second-stage address mapping) for each L2 kernel. The L1 kernel needs to switch to this page table when implementing the second-stage address mapping, and vice versa. This leads to multiple page table switches during L2 system calls, resulting in page table maintenance overhead and context switching overhead for the CPU.

[0101] Therefore, this application provides a system architecture where the L2 kernel runs in the L1 kernel space. Referring to Figure 5, in each virtual machine (L2) running on L1, the processes (or applications) running on L2 run in the user space of L1, while the L2 kernel runs in the kernel space of L1. The L1 kernel can schedule the virtual central processing unit (vCPU) of L2 and allocate memory for L2. The L1 kernel can simulate virtual devices (such as disks and network cards) for the L2 kernel. It should be noted that this application does not limit the number of L1s, the number of L2s, or the number of applications running on L2; L2 and APP1 and APP2 in Figure 5 are merely examples.

[0102] Referring to Figure 5, since the L2 kernel runs in the L1 kernel space, interrupt instructions initiated by applications running on L2 can directly sink to the L2 kernel (at which point the CPU switches from L1 user mode to L1 kernel mode), instead of sinking to L1 as shown in Figure 4. It should be noted that the interrupt instructions (or privileged instructions used for system calls) proposed in this embodiment refer to internal interrupt instructions (such as system call interrupts and page faults), not external interrupt instructions (such as clock interrupt instructions and I / O interrupt instructions).

[0103] Based on the system architecture shown in Figure 5, after the L2 kernel receives an interrupt instruction sent by the application (taking APP1 as an example), the CPU switches from L1 user mode to L1 kernel mode and performs address mapping in L1 kernel mode. In this embodiment, address mapping can be implemented in the following three ways:

[0104] Method 1: Address mapping is completed jointly by the L2 kernel and the L1 kernel.

[0105] This method requires two stages of address mapping. The first stage involves the L2 kernel mapping L2 virtual addresses to L2 physical addresses, and the second stage involves the L1 kernel mapping L2 physical addresses to L1 physical addresses. In this method, the L2 kernel maintains the kernel page table, and APP1 maintains its corresponding process page table. It's understandable that the L2 kernel cannot access the process page table, and APP1 cannot access the kernel page table. Therefore, when the CPU switches from L1 user mode to L1 kernel mode, the L2 kernel needs to switch from the process page table used by APP1 to the kernel page table.

[0106] In the first stage of address mapping, the L2 kernel maps L2 virtual addresses to L2 physical addresses based on the mapping relationship between L2 virtual addresses and L2 physical addresses in the kernel page table, thus completing the first stage of address mapping. In the second stage of address mapping, the L2 kernel sends an instruction to the L1 kernel, instructing it to complete the second stage of address mapping. Upon receiving this instruction, the L1 kernel maps L2 physical addresses to L1 physical addresses based on the mapping relationship between L2 physical addresses and L1 physical addresses maintained by the L1 kernel in its page table, thus completing the second stage of address mapping.

[0107] It should be noted that since the L2 kernel runs in the L1 kernel space, after the L1 kernel receives an instruction, the CPU remains in L1 kernel mode, and there is no CPU privilege level switch. Therefore, there is no CPU privilege level switch during the address mapping process in the two stages mentioned above, thus reducing the CPU's privilege level switching overhead.

[0108] Method 2: Address mapping is jointly performed by the L2 kernel and the L1 kernel. The L2 kernel maps the memory space where the application's page tables reside, or in other words, the L2 kernel maps the application's page tables, meaning the L2 kernel can access the application's page tables (i.e., there is no longer a distinction between process page tables and kernel page tables). For ease of distinction, this page table is called the first page table, which indicates the mapping relationship between L2 virtual addresses and L2 physical addresses.

[0109] This method requires two stages of address mapping, the contents of which can be referred to in Method 1 above, and will not be repeated here in this embodiment. In this method, since the L2 kernel runs in the L1 kernel space, the L2 kernel and APP1 correspond to different privilege levels relative to L1. Therefore, the U / K permission bits in the page table can be used to isolate the L2 kernel mode and user mode. That is, some page table entries in the first process's page table have user permissions, while other page table entries have kernel permissions, thereby ensuring the security of data access and realizing the mapping of the L2 kernel to the application's page table. Therefore, when the CPU switches from L1 user mode to L1 kernel mode, the L2 kernel does not need to switch the process page table to the kernel page table, reducing the page table switching overhead.

[0110] During the first stage of address mapping, the L2 kernel maps L2 virtual addresses to L2 physical addresses based on the mapping relationship between L2 virtual addresses and L2 physical addresses in the first page table, thus completing the first stage of address mapping. During the second stage of address mapping, the L2 kernel sends an instruction to the L1 kernel, instructing it to complete the second stage of address mapping. Upon receiving this instruction, the L1 kernel maps L2 physical addresses to L1 physical addresses based on the mapping relationship between L2 physical addresses and L1 physical addresses maintained by the L1 kernel in its page table, thus completing the second stage of address mapping.

[0111] Method 3: Address mapping is performed by the L2 kernel. Furthermore, the L2 kernel can access the application's page table (i.e., there is no longer a distinction between process page tables and kernel page tables). For ease of distinction, this page table can be called the second page table, which indicates the mapping relationship between L2 virtual addresses and L1 physical addresses.

[0112] In this approach, a segment of physical addresses in the L1 kernel (which can be understood as being associated with the L2 kernel) is delegated to the L2 kernel for management. For example, the L1 kernel provides each L2 kernel with a contiguous GPA(L1) segment. This GPA(L1) segment is a physical address allocated by the L1 kernel to that L2 kernel; that is, this GPA(L1) segment is associated with that L2 kernel and is directly managed by the L2 kernel's memory manager. Based on this, referring to the content of Method 2 above, the L2 kernel can map the L2 physical addresses in the first page table to L1 physical addresses, thereby obtaining the second page table. This second page table includes the mapping relationship between the L2 virtual addresses and the L1 physical addresses.

[0113] Based on this second page table, this method only requires one stage of address mapping. Specifically, the L2 kernel obtains the mapping relationship between L2 virtual addresses and L1 physical addresses by accessing the second page table, and then directly maps the L2 virtual addresses to L1 physical addresses, thus completing the address mapping. It can be seen that since the address mapping process does not require the L1 kernel's involvement, system overhead is further reduced. Furthermore, the L1 kernel no longer needs to maintain page tables, thus avoiding the CPU's page table maintenance overhead for the L1 kernel and simplifying page table update operations. Additionally, referring to the content of method 2 above, in this method 3, when the CPU switches from L1 user mode to L1 kernel mode, the L2 kernel does not need to switch from process page tables to kernel page tables, reducing page table switching overhead.

[0114] After completing the address mapping, the L2 kernel executes the interrupt handler based on the physical address obtained from the address mapping to perform interrupt processing and obtain the interrupt processing result. Finally, the L2 kernel feeds back the interrupt processing result to the application (at this time, the CPU switches from L1 kernel mode to L1 user mode).

[0115] Based on the content of Figure 5 above, compared to the system architecture of Figure 3, the system call process provided in this embodiment no longer relies on L0, thereby reducing the number of times the CPU switches operating modes and reducing CPU overhead. Compared to the system architecture of Figure 4, this embodiment can implement system calls through the L2 kernel, reducing the number of CPU privilege level switches and reducing CPU privilege level switching overhead.

[0116] In some embodiments, since the L2 kernel can perform address mapping by accessing the application process's page table (i.e., the second page table mentioned above), it can achieve the translation from L2 virtual address to L1 physical address without relying on the L1 kernel, thus eliminating the need for L1 kernel address mapping processing. In other words, the L1 kernel no longer needs to maintain a shadow page table or EPT, thereby reducing CPU page table switching overhead, context switching overhead, and avoiding the CPU's page table maintenance overhead for the L1 kernel. Compared to the system architectures shown in Figures 3 and 4, eliminating the need for multiple address mappings improves interrupt instruction processing efficiency, reduces interrupt instruction processing latency, and also reduces CPU resource overhead.

[0117] Because the L2 kernel runs in the L1 kernel space, there is no isolation between the L1 and L2 kernels. This means that an L2 kernel acting as an attacker could maliciously obtain private data and attack other L2 kernels by forging page tables or modifying page table entries (PTEs). Therefore, to prevent attacks by L2 kernels acting as attackers and to ensure the security of virtualization technology, some embodiments of this application set permissions for each L2 kernel, as detailed in Figure 6 below.

[0118] Figure 6 is a schematic diagram of a system architecture provided in this application embodiment, in which the L2 kernel runs in the L1 kernel space. Referring to Figure 6, each L2 kernel corresponds to a Kernel Security Monitor (KSM). The KSM runs in the same virtual address space as the L2 kernel, that is, the KSM runs in the L1 kernel space. Based on this, when the L2 kernel processes specific privileged instructions (i.e., interrupt instructions), it needs to call the KSM for legality verification, thereby ensuring the legality and security of the L2 kernel's processing of privileged instructions.

[0119] Optionally, the specific privileged instruction can be a privileged instruction for write operations on page table entries (such as privileged instructions for modifying page table entries, adding page table entries, and deleting page table entries). The L2 kernel needs to call KSM to perform a validity check on this privileged instruction. The KSM validity check process is illustrated in the flowchart shown in Figure 7 below. Optionally, in this embodiment, the L2 kernel can call KSM through a call gate instead of through VM Exit, which improves the efficiency of calling KSM.

[0120] An attacker's L2 kernel might use instructions within the L2 kernel in kernel mode to compromise the isolation between the L2 kernel and the KSM (Knowledge Management System), allowing the L2 kernel to process all privileged instructions and rendering the KSM ineffective for legitimacy verification. To address this, and to further ensure the security of virtualization technology, in some embodiments of this application, under instruction-aligned architectures (such as ARM architecture), the aforementioned specific privileged instructions can be removed from the L2 kernel binary, and memory protection can restrict the L2 kernel from adding new privileged instructions. This prevents the L2 kernel from directly processing these specific privileged instructions and forces it to call the KSM (i.e., it cannot skip the KSM), thus ensuring the security of the isolation between the L2 kernel and the KSM. Under instruction-unaligned architectures (such as x86 architecture), a coarse-grained CFI (Common Function Index) can be added, allowing the L2 kernel to determine if an address is a marked legitimate target when making indirect jumps. This prevents the attacker's L2 kernel from jumping to an instruction-unaligned address (i.e., prevents the L2 kernel from jumping to an address in the KSM), thus ensuring the security of the isolation between the L2 kernel and the KSM.

[0121] In one possible implementation, isolation between the L2 kernel and the KSM is achieved by setting the value of a first register (such as the PKRS register). For example, in response to an interrupt instruction (e.g., an instruction to write to a page table entry), the L2 kernel calls the KSM to change the value of the first register from a first value to a second value, and the KSM performs a validity check on the interrupt instruction. After the KSM call returns, assuming the validity check of the interrupt instruction passes, the L2 kernel first checks the value of the first register and then decides whether to execute the interrupt instruction. Here, the first value indicates that the kernel of the first virtual machine has read-only permissions, and the second value indicates that the kernel of the first virtual machine has write permissions, thus changing the kernel's permissions from read-only to write.

[0122] For example, if the L2 kernel determines that the value of the first register is the first value (e.g., 0), it means that the KSM was not invoked in this system call, and the L2 kernel will not execute the interrupt instruction. Conversely, if the L2 kernel determines that the value of the first register is the second value (e.g., 1), it means that the KSM was invoked in this system call, and the L2 kernel will execute the interrupt instruction, thus ensuring that the interrupt instruction is executed when the KSM is invoked, and guaranteeing the security of virtualization technology.

[0123] In one possible implementation, privileged instructions other than the specific privileged instructions mentioned above can be processed directly by the L2 kernel without calling the KSM. Optionally, privileged instructions that do not require calling the KSM include, but are not limited to, the `sysret` and `swapgs` instructions. The `swapgs` instruction is an instruction in the x86 architecture used to switch the contents of the GS segment register and the IA32_GS_BASE MSR in 64-bit mode. The `sysret` instruction is used to return the CPU from kernel mode to user mode. For example, the `sysret` and `swapgs` instructions can be executed without calling the KSM. For instance, even when the L2 kernel determines that the value of the aforementioned PKRS register is the first value, it can still execute the `sysret` and `swapgs` instructions. This reduces the call latency of these non-aggressive instructions, thereby improving the efficiency of system calls.

[0124] In summary, KSM can be understood as an interrupt instruction validity checker, used to verify the validity of interrupt instructions related to page table entry write operations.

[0125] Based on the system architecture shown in Figure 6, Figure 7 is a flowchart illustrating a system call method provided in an embodiment of this application. In Figure 7, the first virtual machine refers to L2, the second virtual machine refers to L1, the first process refers to a process (or APP) running on the first virtual machine, the first process runs in the user space of the second virtual machine, the kernel of the first virtual machine runs in the kernel space of the second virtual machine, and the second virtual machine provides the runtime environment for the first virtual machine. Paravirtualization technology is implemented between the first and second virtual machines. Therefore, based on the characteristics of paravirtualization technology, when the first virtual machine makes a system call, it can achieve the system call only through the interaction between the first and second virtual machines.

[0126] As shown in Figure 7, the method includes:

[0127] Step 701: The kernel of the first virtual machine receives the interrupt instruction from the first process.

[0128] In this process, the interrupt instruction is initiated by the first process when making a system call. That is, the interrupt instruction refers to a privileged instruction that requires a system call, and it must be an internal interrupt instruction, such as a system call interrupt instruction or a page fault interrupt instruction.

[0129] Because the first process runs in the user space of the second virtual machine, when the kernel of the first virtual machine receives an interrupt instruction, the CPU switches from the user mode of the second virtual machine to the kernel mode of the second virtual machine. In other words, the CPU performs the first switch between user mode and kernel mode in response to this interrupt instruction.

[0130] In one possible implementation, each process has its own page table, which contains multiple page table entries. Each page table entry refers to an entry (or a row of data) in the page table. Each page table entry includes a page frame number and a page number. A page frame refers to a partition of equal size within the physical memory space (i.e., hardware memory space), and each partition is a page frame. Each page frame has a unique number, typically starting from 0. A page number refers to the number of a page within a process. A page refers to a block of equal size within the process's logical address space (i.e., virtual address space), and each block is called a "page." Each page has a unique number, typically starting from 0. In memory management, a page is the smallest unit of address space; each page corresponds to a virtual address of a process. Similarly, each page frame corresponds to a physical address.

[0131] Generally, a page table entry also includes the following elements: valid bit, access bit, modified bit, and protection bit. The valid bit indicates whether the page corresponding to the page table entry has been read into memory (or whether the page has a corresponding page frame); the access bit indicates whether the page corresponding to the page table entry has been accessed; the modified bit indicates whether the page corresponding to the page table entry has been modified; and the protection bit indicates whether the page corresponding to the page table entry has read / write permissions. For example, the protection bits include R (Read), W (Write), and X (Execute) permissions, as well as U / K permissions. Here, R indicates that the page table entry allows reading, W indicates that the page table entry allows writing, X indicates that the page table entry allows execution, U indicates that the page table entry allows the CPU to process in user mode, and K indicates that the page table entry allows the CPU to process in kernel mode.

[0132] Based on the paging mechanism, the page table of the first process can include at least two page tables of different levels. Referring to Figure 8, which is a schematic diagram of a page table of a first process according to an embodiment of this application, the page table of the first process includes a first-level page table (also called a directory page table) and a second-level page table (also called the last-level page table). It can be understood that, depending on the memory resource consumption of the first process, the page table of the first process can also include more levels of page tables (such as a third-level page table, a fourth-level page table, an n-level page table, where n is an integer greater than 0). Figure 8 is only an example, and this application does not limit the page table of the first process.

[0133] In the first-level page table, each entry includes the first part of the virtual address (e.g., the first 10 bits of the virtual address) and an index to the second-level page table (which can be the address or name of the second-level page table). In the second-level page table, each entry includes the second part of the virtual address (e.g., bits 11-20 of the virtual address) and the base address of the physical address. The third part of the virtual address (i.e., the remaining part of the virtual address excluding the first and second parts, such as bits 21-32 of the virtual address) is used as an offset. Thus, the physical address corresponding to the virtual address can be determined using the base address and the offset of the physical address.

[0134] Based on the above description, optionally, the interrupt instruction can be used to indicate that a page in a page table entry is missing a corresponding page frame (or that the page number is missing a corresponding page frame number). That is, the interrupt instruction is a page fault exception instruction, requiring the first virtual machine kernel to allocate the corresponding physical page for the virtual page. Optionally, the interrupt instruction can be used to indicate access to a page table entry (or access to data within the page frame of that page table entry). Optionally, the interrupt instruction can be used to indicate a write operation to a page table entry (or an add / delete / modify operation on the data within the page frame of that page table entry).

[0135] Step 702: The kernel of the first virtual machine maps the first address associated with the interrupt instruction to the second address. The first address is the virtual address of the first virtual machine, and the second address is the physical address of the second virtual machine.

[0136] In this process, the kernel of the first virtual machine can use the three methods described in Figure 5 above to map the first address associated with the interrupt instruction to the second address, thereby realizing address mapping. This application will not elaborate on this further.

[0137] Taking method 3 above as an example, for any page table entry in the page table of the first process, the virtual address in that page table entry refers to the virtual address of the first virtual machine, and the base address in the page table entry of the last-level page table refers to the base address of the physical address of the second virtual machine. Based on this, the kernel of the first virtual machine can directly map the first address to the second address based on the page table of the first process. The first address is associated with interrupt instructions; for example, if an interrupt instruction is used to indicate access to the first page table entry, then the first address is the virtual address of the page in that first page table entry corresponding to the virtual address in the first virtual machine. Therefore, the second address is the physical address (or hardware physical address) of the page frame in that first page table entry corresponding to the physical address in the second virtual machine.

[0138] As can be seen, the kernel of the first virtual machine manages the physical address of the second virtual machine. In this way, the conversion between the virtual address of the first virtual machine and the physical address of the second virtual machine no longer needs to go through the kernel of the second virtual machine. This reduces the page table switching overhead during address mapping, and also eliminates the need to maintain a page table for the second virtual machine, thereby reducing the CPU's page table maintenance overhead and simplifying page table update operations.

[0139] Step 703: The kernel of the first virtual machine executes the interrupt instruction based on the second address and obtains the interrupt handling result.

[0140] In one possible implementation, the interrupt instruction is used to indicate that a page in the first page table entry lacks a corresponding page frame, or in other words, the interrupt instruction is a page fault instruction. Here, the first page table entry is any page table entry in the page table of the first process. Based on this, the first address is the address associated with the first page table entry, that is, the first address is the virtual address in the first virtual machine corresponding to the page in the first page table entry. In this implementation, the kernel of the first virtual machine does not need to call the kernel security monitor to handle the interrupt instruction. The kernel of the first virtual machine can directly allocate a second address (or physical address, page frame) for the page and add the page frame number to the first page table entry, thus obtaining the interrupt handling result, which is used to indicate that the interrupt instruction was handled successfully. Conversely, if the kernel of the first virtual machine fails to allocate a page frame for the page, the interrupt handling result is used to indicate that the interrupt instruction failed.

[0141] In one possible implementation, the interrupt instruction can be used to indicate access to the first page table entry. In this implementation, the kernel of the first virtual machine does not need to call the kernel security monitor to handle the interrupt instruction. The kernel of the first virtual machine can directly find the second address corresponding to the first address in the first page table entry, and then access the data at the second address to obtain the interrupt handling result, which includes the accessed data. Conversely, if the kernel of the first virtual machine fails to access the data at the second address, the interrupt handling result is used to indicate that the interrupt instruction processing failed.

[0142] In one possible implementation, the interrupt instruction can be used to instruct a write operation on the first page table entry. Optionally, the interrupt instruction can be used to instruct the deletion of the page-to-page-frame mapping in the first page table entry (or, in other words, to delete the page frame number corresponding to the page number). Optionally, the interrupt instruction can be used to instruct the modification of the R permission entry in the first page table entry to W permission. In this implementation, the kernel of the first virtual machine needs to call the kernel security monitor to handle the interrupt instruction. For example, the kernel of the first virtual machine calls the kernel security monitor to obtain the verification result of the kernel security monitor's validation of the first page table entry. It should be noted that the kernel security monitor runs in the kernel space of the second virtual machine. That is, the kernel security monitor is used to perform validation of the first page table entry, and its validation can include the following two types.

[0143] The first scenario: The page table entry belongs to a page table page that is not the last level page table page in the page table of the first process. For example, the page table page to which the first page table entry belongs is a first-level page table page of the first process. Based on the above description, it can be seen that a non-last-level page table page includes the page index of the next-level page table page. Therefore, an interrupt instruction can be used to instruct the modification of the next-level page table page index in the first page table entry. For example, an interrupt instruction can be used to instruct the first index to be used as the next-level page table index in the first page table entry. This interrupt instruction can change the level of the page table page, thereby achieving the purpose of the attack. To ensure the security of virtualization technology, the kernel security monitor determines that the first page table entry is valid when the first condition is met. The first condition includes the following:

[0144] The virtual address in the first page table entry is within the virtual address space of the first virtual machine (i.e., it must be ensured that the first page table entry is the page table entry of the first process); and,

[0145] The level indicated by the declaration label of the page table page pointed to by the first index is the next level below the level indicated by the declaration label of the page table page to which the first page table entry belongs (i.e., it is necessary to ensure the accuracy of the page table page used). The declaration label is used to indicate the level of the page table page.

[0146] As can be seen, the first condition prevents attackers from using privileged instructions to manipulate the x-level page table as the y-level page table for attack purposes, thus ensuring the security of virtualization technology. It is understandable that if any one of the first conditions is not met, the first page table entry is deemed invalid.

[0147] The second scenario: The page table page to which the first page table entry belongs is the last-level page table page in the page table of the first process. For example, the page table page to which the first page table entry belongs is the second-level page table of the first process. Based on the above description, it can be seen that the page table entry of the last-level page table page includes the base address of the physical address of the second virtual machine.

[0148] Therefore, interrupt instructions can instruct the modification of the base address in the first page table entry, or modify the permission bits in the first page table entry (such as changing read-only permission to write permission). For example, an interrupt instruction can be used to instruct the first base address to be used as the base address in the first page table entry, or an interrupt instruction can be used to instruct the modification of the permission bits in the first page table entry to write permission. Such interrupt instructions can achieve the purpose of modifying the page table, for example, the first base address pointing to a page table page with a declaration label (indicating that the first base address points to the page table of the first process, such as pointing to the second-level page table of the first process). To ensure the security of virtualization technology, the kernel security monitor determines the validity of the first page table entry when the second condition is met. The second condition includes the following:

[0149] The virtual address in the first page entry is within the virtual address space of the first virtual machine; and,

[0150] The base address in the first page entry is within the physical address space of the second virtual machine (which can be understood as being associated with the first process); and,

[0151] The permissions for the entries on the first page are read-only.

[0152] As can be seen, the second condition ensures that the page table permissions of the first process are read-only, thus preventing attackers from modifying the page table of the first process and ensuring the security of virtualization technology. It can be understood that if any of the second conditions is not met, the first page table entry is determined to be invalid.

[0153] In one possible implementation, the declaration label in this step could be added by the kernel security monitor for each page of the first process when the page table is created, by invoking the kernel security monitor. For example, the kernel security monitor creates a copy of the first process's page table in the CR3 register and adds a kernel security monitor memory map to that copy, thus mapping the kernel security monitor to the virtual address corresponding to the CR3 register. When the kernel security monitor is invoked, it verifies the target value of the CR3 register, which is used for the page table page with the declaration label.

[0154] In summary, after the kernel security monitor performs a validity check on the first page table entry, it feeds back the verification result to the kernel of the first virtual machine. This verification result is used to indicate whether the first page table entry is valid or invalid.

[0155] In this process, after the kernel of the first virtual machine calls the kernel security monitor, the kernel security monitor also modifies the permissions of the kernel of the first virtual machine. Specifically, the kernel security monitor changes the permissions of the kernel of the first virtual machine from read-only to write-only, thereby enabling the kernel of the first virtual machine to have write operation rights to the first page table entry.

[0156] In one possible implementation, the kernel security monitor modifies the kernel permissions of the first virtual machine by changing the value of a first register. Specifically, the kernel security monitor changes the value of the first register from a first value to a second value, where the first value indicates that the kernel permissions of the first virtual machine are read-only, and the second value indicates that the kernel permissions of the first virtual machine are write-only, thereby changing the kernel permissions of the first virtual machine from read-only to write-only.

[0157] In one possible implementation, if the kernel of the first virtual machine determines that it has write access permission, or in other words, if the kernel kernel determines that its own permissions have been changed from read-only to write access by the kernel security monitor, then it performs a write operation on the first page table entry when the verification result indicates that the first page table entry is valid. It can be understood that the data in the first page table entry needs to be obtained through the aforementioned second address; that is, the kernel of the first virtual machine needs to find the first page table entry through the second address. For example, suppose an interrupt instruction is used to instruct that the first index be used as the next-level page table index in the first page table entry. Therefore, the kernel of the first virtual machine can write the first index into the next-level page table index bit of the first page table entry based on the second address (e.g., changing the original index value "4" to the value "7" of the first index). It can be understood that after performing a write operation on the first page table entry, the kernel of the first virtual machine obtains an interrupt handling result (or a write operation result), which indicates whether the interrupt instruction was executed successfully.

[0158] Step 704: The kernel of the first virtual machine sends the interrupt handling result to the first process.

[0159] In this process, before sending the interrupt handling result to the first process, the kernel of the first virtual machine can perform routine checks on the stack, such as verifying that the IF bit in the EFLAGS register is set to be associated with user mode and that the segment register value indicates user mode. After the checks pass, the IRET instruction is called to send the interrupt handling result back to the first process. Because the first process is running in the user space of the second virtual machine, when sending the interrupt handling result back to the first process, the CPU switches from the user mode of the second virtual machine to the kernel mode of the second virtual machine. In other words, for this interrupt instruction, the CPU performs a second switch between user mode and kernel mode.

[0160] Additionally, the IRET instruction is also used to change the kernel permissions of the first virtual machine from write access to read-only access. In one possible implementation, the IRET instruction modifies the kernel permissions of the first virtual machine by changing the value of a first register. Specifically, the IRET instruction changes the value of the first register from a second value to a first value, thereby changing the kernel permissions of the first virtual machine from write access to read-only access.

[0161] In summary, it can be seen that during system calls, the first virtual machine in this embodiment only requires two CPU switches between kernel mode and user mode, reducing CPU privilege level overhead. Furthermore, when the kernel of the first virtual machine performs address mapping, it does not need to switch between process page tables and kernel page tables, nor does it need to use the second virtual machine to implement address mapping. This not only reduces the page table switching overhead during address mapping but also eliminates the need for the CPU to maintain a page table for the second virtual machine, thereby reducing CPU page table maintenance overhead and minimizing CPU resource consumption.

[0162] In one possible implementation, this application can also be used in non-nested virtualization technology. For example, in the scenario shown in Figure 1, the virtual machine kernel can run in the CPU's kernel space, and the processes on the virtual machine can run in the CPU's user space. A kernel security monitor is set up for each virtual machine, which can reduce the CPU's privilege level overhead. For details, please refer to the above description; this application will not repeat them here.

[0163] To better illustrate the technical solutions of the embodiments of this application, Figure 9A is a flowchart illustrating another system call method provided by this application. In Figure 9A, APP1 is a process running on L2. APP1 runs in the user space of L1, and the L2 kernel runs in the kernel space of L1. L1 provides the runtime environment for L2. Paravirtualization technology is implemented between L1 and L2. Therefore, based on the characteristics of paravirtualization technology, L2 can implement system calls only through interaction with L1.

[0164] As shown in Figure 9A, the process includes:

[0165] Step 910: APP1, running in L1 user space, sends an interrupt instruction to the L2 kernel. The interrupt instruction is used to write to the first page table entry in APP1's page table. The L2 kernel runs in the L1 kernel space.

[0166] In this process, interrupt instructions are those that require validity checks. For example, this interrupt instruction could be used to instruct the modification of the data in the first page table entry of APP1 (e.g., changing the R permission entry to W permission). Because APP1 runs in L1 user space, at this time, the CPU switches from L1 user mode to L1 kernel mode (the first switch between user mode and kernel mode by the CPU).

[0167] In one possible implementation, APP1 can look up the L2 kernel entry point (which indicates the corresponding interrupt handler) for the interrupt instruction from the Interrupt Descriptor Table (IDT) or the IA32_STAR register based on the interrupt descriptor of the interrupt instruction. This allows APP1 to send the interrupt instruction to the L2 kernel based on the entry point. The IA32_STAR register records the mapping between interrupt instruction types and L2 kernel interrupt handlers, while the IDT contains the mapping between interrupt instruction types and L2 kernel interrupt handlers.

[0168] Step 920: The L2 kernel saves the current value of the stack register on the security stack.

[0169] This step is used to record the current interruption status so that APP1 can continue to run (or so that user mode can be restored).

[0170] Step 930: The L2 kernel obtains the parameters required to execute the interrupt instruction.

[0171] In this step, when APP1 initiates an interrupt instruction, the interrupt instruction-related parameters may be stored in the parameter register. For example, the first address associated with the interrupt instruction may be stored in the parameter register, so the L2 kernel needs to read the first address from the input parameter register. This first address can be referred to in Figure 7 above, and will not be elaborated here.

[0172] Step 940: The L2 kernel maps the first address to the second address based on the page table of APP1. The page table of APP1 is used to indicate the mapping relationship between the virtual address of L2 and the physical address of L1.

[0173] This step is the same as step 702 above, and will not be repeated here.

[0174] Step 950: The L2 kernel calls KSM, which is used to verify the validity of interrupt instructions.

[0175] In this step, KSM refers to the kernel security monitor in the process described in Figure 7. Figure 9B is a schematic diagram of the KSM operation process provided in an embodiment of this application. Referring to Figure 9B, the process is as follows:

[0176] Step 9501: KSM changes the value of the pkrs register from the first value to the second value. The first value indicates that the L2 kernel has read-only permissions, and the second value indicates that the L2 kernel has write permissions.

[0177] In this step, the pkrs register refers to the first register in the process shown in Figure 7.

[0178] Step 9502: KSM determines whether the virtual address in the first page table entry is within the L2 virtual address space. If so, proceed to step 9503; otherwise, determine that the interrupt instruction security check has failed.

[0179] This step is used to ensure that the first page table entry is the page table entry of APP1.

[0180] Step 9503: KSM determines whether the first page entry belongs to a page that is not the last level page. If it is, proceed to step 9504; otherwise, proceed to step 9505.

[0181] Step 9504: KSM determines whether the level of the next-level page table indicated in the first page table entry is correct. If yes, proceed to step 9506; otherwise, determine that the interrupt instruction security check has failed.

[0182] This step ensures the accuracy of page table usage and prevents attackers from using privileged instructions to use a level x page table as a level y page table. For example, an interrupt instruction is used to instruct the first index to be used as the next-level page table index in the first page table entry. Therefore, KSM determines the correct level of the next-level page table by determining whether the level indicated by the declaration label of the page table corresponding to the first index (e.g., level two) is the next level after the level indicated by the declaration label of the page table corresponding to the first page table entry (e.g., level one).

[0183] Step 9505: KSM determines whether the base address in the first page table entry is within the L1 physical address space. If so, proceed to step 9507; otherwise, determine that the interrupt instruction security check has failed.

[0184] This step is used to ensure that the first page table entry is the page table entry of APP1.

[0185] Step 9506: KSM sends the verification result back to the L2 kernel. This verification result is used to indicate that the interrupt instruction security verification has passed.

[0186] Step 9507: KSM determines whether the permission of the first page entry is read-only. If yes, proceed to step 9506; otherwise, determine that the security check of the interrupt instruction has failed.

[0187] This step ensures that the page table permissions of the first process are read-only, thereby preventing attackers from modifying the page table of APP1. For example, the interrupt instruction instructs the first base address to be used as the base address in the first page table entry. Assuming that this first base address points to a page table page with a declaration label (or, in other words, to APP1's page table), KSM needs to ensure that the first page table entry is read-only to prevent subsequent modification of APP1's page table.

[0188] Step 960: The L2 kernel determines whether the value of the pkrs register is the second value. If it is, then proceed to step 970. Otherwise, it determines that the L2 kernel does not allow the execution of the interrupt instruction and sends the interrupt handling result to APP1 to indicate that the interrupt instruction processing failed.

[0189] Step 970: The L2 kernel executes the interrupt instruction based on the second address and obtains the interrupt handling result.

[0190] Steps 960-970 can refer to the content of step 704 above, and will not be repeated here.

[0191] Step 980: The L2 kernel restores the values ​​saved on the security stack to the stack registers.

[0192] This step is used to restore the running state of APP1 so that APP1 can continue to run.

[0193] Step 990: The L2 kernel calls the IRET instruction to send the interrupt handling result to APP1 and sets the value of the pkrs register from the second value to the first value.

[0194] In this step, the interrupt handling instruction is used to indicate that the interrupt instruction was successfully processed. One possible implementation is that the IRET instruction can set the value of the pkrs register from the second value to the first value to verify the validity of an interrupt instruction. At this point, the CPU switches from L1 user mode to L1 kernel mode. It can be seen that the CPU performs a second user-mode / kernel-mode switch in this process.

[0195] Based on the description in Figures 5 to 9B above, the following are exemplary test data provided in the embodiments of this application.

[0196] Figure 10 is a schematic diagram of the page fault interrupt handling latency provided in an embodiment of this application. Figure 10 does not record the latency from the process initiating an interrupt instruction to the L2 responding to the interrupt instruction. This interrupt instruction is used to indicate a page fault. The technology in the embodiment of this application in Figure 10 is based on the CKI system. For HVM technology, switching between the L0, L1, and L2 kernels is required, i.e., the CPU triggers a VM Exit, causing the CPU to switch operating modes multiple times, resulting in a page fault interrupt handling latency of 30,881 ns. For PVM technology, the CPU triggers a VM Exit, causing the CPU to perform multiple privilege level switches, resulting in a VM Exit processing latency of 1532 ns. In addition, PVM technology requires shadow page table emulation technology, which requires a latency of 1828 ns. For CKI (i.e., the technology in the embodiment of this application), the L2 kernel does not require page table switching and only needs to perform two CPU privilege level switches. Furthermore, the L2 kernel only needs to perform one address mapping, reducing CPU resource overhead. Therefore, the page fault interrupt handling latency in the embodiment of this application is 77 ns.

[0197] Figure 11 is a schematic diagram of a simple system call latency provided by an embodiment of this application. The technology in Figure 11 is based on the CKI system. The interrupt instruction for the simple system call can be an interrupt instruction with privacy-permitted data access. Referring to Figure 11, for HVM technology, the system call latency is 90ns. For PVM technology, the system call latency is 336ns. For CKI (i.e., the technology of this embodiment), because it reduces CPU privilege level switching overhead, eliminates page table switching overhead, and allows the sysret privilege instruction and swapgs privilege instruction to be executed directly by the L2 kernel, the system call latency of this embodiment is 90ns.

[0198] Furthermore, the embodiments of this application and PVM technology support direct VM Exit from L2 to the L1 kernel without the intervention of the L0 kernel. The latency for executing a hypercall (referring to operations requiring higher privileges, such as page table updates or physical resource access) in this application is 390ns, while the latency for PVM technology is 486ns. For HVM technology, due to the need for L0 kernel intervention, the latency for executing a hypercall is 6746ns.

[0199] Figure 12 is a latency diagram based on lmbench testing provided by an embodiment of this application. The technology in Figure 12 is based on the CKI system. System calls with short execution times include, but are not limited to: read, write, stat, prot fault, page fault, fork, exit, fork / execve, ctxsw 2p / 0k, pipe, and AF_UNIX instructions. As can be seen from Figure 12, PVM technology has higher latency for such system calls, i.e., higher CPU overhead. Specifically, in PVM technology, because the kernel needs to call a hypercall to switch process page tables, the overhead for memory management operations (such as page faults and new process creation) is high, and the latency for context switching and inter-process communication is long. In contrast, this application has lower overhead and lower latency in the paths of memory management operations, context switching, and inter-process communication. Furthermore, because this type of system call does not involve VM Exit, HVM technology also has the characteristics of low overhead and low latency in the paths of memory management operations, context switching, and inter-process communication.

[0200] Figure 13 is a latency diagram of a memory-intensive application provided in an embodiment of this application. The technology in Figure 13 is based on the CKI system. The memory-intensive applications include, but are not limited to: btree applications, xsbench applications, canneal applications, dedup applications, fluidanimate applications, and freqmine applications. Referring to Figure 13, compared with HVM and PVM technologies, the latency consumed by this application (CKI) is reduced by 20%–70% and 3.7%–44%, respectively. Therefore, this application is more effective for short-cycle applications or applications with frequently updated datasets.

[0201] Figure 14 is a schematic diagram illustrating the operational throughput and system call frequency of a test case provided in an embodiment of this application. The technology in Figure 14 is based on the CKI system. The test case is sqlite-bench, and the operations include, but are not limited to: fillseq, fillseqbatch, fillrandom, fillrandbatch, overwritebatch, readseq, and readrandom. It can be seen that, in terms of database reading, the overhead of PVM technology is minimal due to the low system call frequency. This application (CKI) and HVM technology achieve similar throughput because neither of them has system call simulation overhead.

[0202] Figure 15 is a schematic diagram of the operational throughput provided by an embodiment of this application. The technology in Figure 15 is based on the CKI system, and the horizontal axis represents the number of virtual machines. Specifically, Figure 15(a) illustrates the operational throughput of the distributed high-speed caching system (memcached) under different numbers of virtual machines, and Figure 15(b) illustrates the operational throughput of the remote dictionary server (Redis) under different numbers of virtual machines. It can be seen that compared with PVM / HVM technologies, this application (CKI) has higher throughput for both memcached and Redis.

[0203] The system call method provided in this application has been described in detail above with reference to Figures 5 to 9B. The apparatus provided in this application for performing the above method is described below.

[0204] Figure 16 is a schematic diagram of the structure of a device provided in this application. This device 1600 can be used to implement the above-described system call method, and therefore can also achieve the beneficial effects of the above-described method embodiments.

[0205] As shown in Figure 16, the device 1600 includes a transceiver module 1610 and a processing module 1620. The transceiver module 1610 receives interrupt instructions from a first process running in the user space of a second virtual machine. The kernel of the first virtual machine runs in the kernel space of the second virtual machine, which provides the runtime environment for the first virtual machine. The processing module 1620 maps the first address associated with the interrupt instruction to a second address, where the first address is the virtual address of the first virtual machine and the second address is the physical address of the second virtual machine. It executes the interrupt instruction based on the second address to obtain the interrupt handling result. The transceiver module 1610 also sends the interrupt handling result to the first process.

[0206] In one possible implementation, both the transceiver module 1610 and the processing module 1620 can be implemented in software or in hardware. For example, the implementation of the transceiver module 1610 will be described below. Similarly, the implementation of the processing module 1620 can refer to the implementation of the transceiver module 1610.

[0207] As an example of a software functional unit, the transceiver module 1610 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, or a container. Further, the aforementioned computing instance may be one or more. For example, the transceiver module 1610 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Further, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one or more geographically proximate data centers. Typically, a region may include multiple AZs.

[0208] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same Virtual Private Cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Communication between two VPCs within the same region, as well as between VPCs in different regions, requires a communication gateway to be set up within each VPC to enable interconnection between VPCs.

[0209] As an example of a hardware functional unit, the transceiver module 1610 may include at least one computing device, such as a server. Alternatively, the transceiver module 1610 may be implemented using a central processing unit (CPU), an application-specific integrated circuit (ASIC), or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), a data processing unit (DPU), a neural network processing unit (NPU), a system-on-chip (SoC), an offload card, an accelerator card, or any combination thereof.

[0210] The transceiver module 1610 includes multiple computing devices that can be distributed within the same region or in different regions. Similarly, the transceiver module 1610 can be distributed within the same Availability Zone (AZ) or in different AZs. Likewise, the transceiver module 1610 can be distributed within the same Virtual Private Cloud (VPC) or in multiple VPCs. These multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, GALs, DPUs, NPUs, SoCs, offloading cards, and accelerator cards.

[0211] It should be noted that, in other embodiments, the transceiver module 1610 and the processing module 1620 can be used for any step in the above system call method.

[0212] In one possible implementation, the processing module 1620 is specifically used to: access the page table of the first process and map the first address to the second address, wherein the page table of the first process is used to indicate the mapping relationship between the virtual address of the first virtual machine and the physical address of the second virtual machine.

[0213] In one possible implementation, the interrupt instruction is used to instruct a write operation on the first page table entry, where the first address is the address associated with the first page table entry; the processing module 1620 is specifically used to: call the kernel security monitor, obtain the verification result of the kernel security monitor's validation of the first page table entry, the kernel security monitor running in the kernel space of the second virtual machine; if the verification result indicates that the first page table entry is valid, then a write operation is performed on the first page table entry.

[0214] In one possible implementation, the page table includes at least two page table pages of different levels. Each page table page includes a declaration label indicating the level of the page table page. The page table page to which the first page table entry belongs is a non-last-level page table page. The page table entry of the non-last-level page table page includes an index of the next-level page table page. An interrupt instruction is used to indicate that the first index is used as the next-level page table index in the first page table entry. The processing module 1620 is further configured to: determine that the first page table entry is valid when the first condition is met.

[0215] The first condition includes:

[0216] The virtual address in the first page entry is within the virtual address space of the first virtual machine; and,

[0217] The level indicated by the declaration label of the page table page to which the first index belongs is the next level below the level indicated by the declaration label of the page table page to which the first page table entry belongs.

[0218] In one possible implementation, the page table includes at least two page table pages of different levels. Each page table page includes a declaration label indicating the level of the page table page. The page table page to which the first page table entry belongs is the last-level page table page. The page table entry of the last-level page table page includes the base address of the physical address of the second virtual machine. The base address in the first page table entry points to the page table page with the declaration label. Alternatively, an interrupt instruction is used to indicate that the first base address is used as the base address in the first page table entry, and the first base address points to the page table page with the declaration label. The processing module 1620 is further configured to: determine that the first page table entry is valid when the second condition is met.

[0219] The second condition includes:

[0220] The virtual address in the first page entry is within the virtual address space of the first virtual machine; and,

[0221] The base address in the first page entry is within the physical address space of the second virtual machine; and,

[0222] The permissions for the entries on the first page are read-only.

[0223] In one possible implementation, before the kernel of the first virtual machine performs a write operation on the first page table entry, the kernel's permissions are changed from read-only to write-only by the kernel security monitor; the processing module 1620 is further configured to: after performing a write operation on the first page table entry, change the kernel's permissions from write-only to read-only.

[0224] In one possible implementation, the kernel permissions of the first virtual machine are modified from read-only permissions to write permissions by the kernel security monitor, including: the value of the first register is modified from a first value to a second value by the kernel security monitor, where the first value indicates that the kernel permissions of the first virtual machine are read-only and the second value indicates that the kernel permissions of the first virtual machine are write permissions; the processing module 1620 is specifically used to: after performing a write operation on the first page table entry, modify the value of the first register from the second value to the first value.

[0225] It should be noted that the module division in the embodiments of this application is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, exist as separate physical entities, or have two or more units integrated into one unit. The integrated units described above can be implemented in hardware or as software functional units.

[0226] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0227] Based on the above embodiments, this application also provides a device that can implement the methods in the above embodiments and has the functions of device 1600. Referring to FIG17, the device 1700 includes: a transceiver 1701, a processor 1702, and a memory 1703. The transceiver 1701, the processor 1702, and the memory 1703 are interconnected.

[0228] Optionally, the transceiver 1701, the processor 1702, and the memory 1703 are interconnected via a bus 1704. The bus 1704 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used in Figure 17, but this does not indicate that there is only one bus or one type of bus.

[0229] The transceiver 1701 is used to receive and send signals to enable communication with other devices.

[0230] The function of the processor 1702 can be referred to the description in the above embodiments, and will not be repeated here.

[0231] The processor 1702 can be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP, etc. The processor 1702 may further include hardware chips. These hardware chips can be application-specific integrated circuits (ASICs), programmable logic devices (PLDs), or combinations thereof. The PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. When implementing the above functions, the processor 1702 can be implemented in hardware, or it can be implemented by hardware executing corresponding software. The steps of the method disclosed in the above embodiments of this application can be directly reflected as the processor 1702 completing the execution, or as the hardware and software modules in the processor 1702 combining to complete the execution.

[0232] The memory 1703 is used to store program instructions and data. Specifically, the program instructions may include program code, which includes computer operation instructions. The memory 1703 may include volatile memory, such as random access memory (RAM); it may also include non-volatile memory, such as at least one disk storage device, hard disk drive (HDD), or solid state drive (SSD). The memory 1703 may also be any other medium capable of carrying or storing program code in the form of instructions or data structures and accessible by a computer; this application does not limit this. The processor 1702 executes the program instructions stored in the memory 1703 to implement the above functions, thereby implementing the method provided in the above embodiments.

[0233] Based on the above embodiments, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a computer, causes the computer to perform the methods provided in the above embodiments.

[0234] Optionally, the aforementioned computer may include, but is not limited to, communication devices such as terminal devices and network devices.

[0235] The storage medium can be any available medium that a computer can access. For example, but not limited to, a computer-readable medium can include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer.

[0236] Based on the above embodiments, this application also provides a chip for reading a computer program stored in a memory to implement the method provided in the above embodiments. Optionally, the chip may include a processor coupled to the memory for reading the computer program stored in the memory to implement the method provided in the above embodiments. Optionally, the chip may also include components such as a memory, a communication interface, and a power supply module. The memory is used to store the computer program; the communication interface is used to receive and send data; and the power supply module is used to supply power to the processor.

[0237] Based on the above embodiments, this application provides a chip system including a processor for supporting a computer device in implementing the above embodiments. In one possible design, the chip system further includes a memory for storing necessary programs and data of the computer device. This chip system may be composed of chips or may include chips and other discrete components.

[0238] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, optical storage, etc.) containing computer-usable program code.

[0239] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more blocks of the flowchart illustrations and / or one or more blocks of the block diagrams.

[0240] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0241] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0242] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A system call method, characterized in that, The method includes: The kernel of the first virtual machine receives the interrupt instruction of the first process. The first process runs in the user space of the second virtual machine, and the kernel of the first virtual machine runs in the kernel space of the second virtual machine. The second virtual machine is used to provide the running environment for the first virtual machine. The kernel of the first virtual machine maps the first address associated with the interrupt instruction to a second address, where the first address is the virtual address of the first virtual machine and the second address is the physical address of the second virtual machine. The kernel of the first virtual machine executes the interrupt instruction based on the second address to obtain the interrupt handling result; The kernel of the first virtual machine sends the interrupt handling result to the first process.

2. The method as described in claim 1, characterized in that, The kernel of the first virtual machine maps the first address associated with the interrupt instruction to the second address, including: The kernel of the first virtual machine accesses the page table of the first process and maps the first address to the second address. The page table of the first process is used to indicate the mapping relationship between the virtual address of the first virtual machine and the physical address of the second virtual machine.

3. The method as described in claim 1 or 2, characterized in that, The interrupt instruction is used to instruct a write operation on the first page table entry in the page table; The kernel of the first virtual machine executes the interrupt instruction, including: The kernel of the first virtual machine calls the kernel security monitor to obtain the verification result of the kernel security monitor's validation of the first page table entry. The kernel security monitor runs in the kernel space of the second virtual machine. If the verification result indicates that the first page table entry is valid, then a write operation is performed on the first page table entry.

4. The method as described in claim 3, characterized in that, The page table includes at least two page table pages of different levels. Each page table page includes a declaration tag, which is used to indicate the level of the page table page. The page table page to which the first page table entry belongs is a non-last-level page table page. The page table entry of the non-last-level page table page includes an index of the next-level page table page. The interrupt instruction is used to indicate that the first index is used as the next-level page table index in the first page table entry. The kernel security monitor verifies the validity of the first page table entry, including: If the first condition is met, the entry on the first page is determined to be valid; The first condition includes: The virtual address in the first page table entry is within the virtual address space of the first virtual machine; and, The level indicated by the declaration label of the page table page to which the first index is located is the next level below the level indicated by the declaration label of the page table page to which the first page table entry belongs.

5. The method as described in claim 3, characterized in that, The page table includes at least two page table pages of different levels. Each page table page includes a declaration tag, which is used to indicate the level of the page table page. The page table page to which the first page table entry belongs is the last level page table page. The page table entry of the last level page table page includes the base address of the physical address of the second virtual machine. The base address in the first page table entry points to the page table page with the declaration label, or the interrupt instruction is used to indicate that the first base address is used as the base address in the first page table entry, and the first base address points to the page table page with the declaration label; The kernel security monitor verifies the validity of the first page table entry, including: If the second condition is met, the entry on the first page is determined to be valid; The second condition includes: The virtual address in the first page table entry is within the virtual address space of the first virtual machine; and, The base address in the first page table entry is within the physical address space of the second virtual machine; and, The permissions for the first page table entry are read-only.

6. The method according to any one of claims 3-5, characterized in that, Before the kernel of the first virtual machine performs a write operation on the first page table entry, the kernel permissions of the first virtual machine are changed from read-only permissions to write operation permissions by the kernel security monitor. After the kernel of the first virtual machine performs a write operation on the first page table entry, the method further includes: changing the kernel permission of the first virtual machine from write operation permission to read-only permission.

7. The method as described in claim 6, characterized in that, The kernel permissions of the first virtual machine are changed from read-only permissions to write permissions by the kernel security monitor, including: the value of the first register is changed from a first value to a second value by the kernel security monitor, where the first value indicates that the kernel permissions of the first virtual machine are read-only permissions and the second value indicates that the kernel permissions of the first virtual machine are write permissions. The step of changing the kernel permissions of the first virtual machine from write operation permissions to read-only permissions includes: changing the value of the first register from a second value to a first value.

8. An apparatus, characterized in that, include: The transceiver module is used to receive interrupt instructions from the first process, which runs in the user space of the second virtual machine. The kernel of the first virtual machine runs in the kernel space of the second virtual machine, and the second virtual machine is used to provide the runtime environment for the first virtual machine. The processing module is used to map the first address associated with the interrupt instruction to a second address, where the first address is the virtual address of the first virtual machine and the second address is the physical address of the second virtual machine; and to execute the interrupt instruction based on the second address to obtain the interrupt processing result. The transceiver module is also used to send the interrupt handling result to the first process.

9. The apparatus as claimed in claim 8, characterized in that, The processing module is specifically used to: access the page table of the first process and map the first address to the second address, wherein the page table of the first process is used to indicate the mapping relationship between the virtual address of the first virtual machine and the physical address of the second virtual machine.

10. The apparatus as claimed in claim 8 or 9, characterized in that, The interrupt instruction is used to instruct a write operation on the first page table entry in the page table; The processing module is specifically used to: invoke the kernel security monitor to obtain the verification result of the kernel security monitor's validation of the first page table entry, wherein the kernel security monitor runs in the kernel space of the second virtual machine; if the verification result indicates that the first page table entry is valid, then perform a write operation on the first page table entry.

11. The apparatus as claimed in claim 10, characterized in that, The page table includes at least two page table pages of different levels. Each page table page includes a declaration tag, which is used to indicate the level of the page table page. The page table page to which the first page table entry belongs is a non-last-level page table page. The page table entry of the non-last-level page table page includes an index of the next-level page table page. The interrupt instruction is used to indicate that the first index is used as the next-level page table index in the first page table entry. The processing module is further configured to: determine that the first page table entry is valid when the first condition is met; The first condition includes: The virtual address in the first page table entry is within the virtual address space of the first virtual machine; and, The level indicated by the declaration label of the page table page to which the first index is located is the next level below the level indicated by the declaration label of the page table page to which the first page table entry belongs.

12. The apparatus as claimed in claim 10, characterized in that, The page table includes at least two page table pages of different levels. Each page table page includes a declaration tag, which is used to indicate the level of the page table page. The page table page to which the first page table entry belongs is the last level page table page. The page table entry of the last level page table page includes the base address of the physical address of the second virtual machine. The base address in the first page table entry points to the page table page with the declaration label, or the interrupt instruction is used to indicate that the first base address is used as the base address in the first page table entry, and the first base address points to the page table page with the declaration label; The processing module is further configured to: determine that the first page table entry is valid when the second condition is met; The second condition includes: The virtual address in the first page table entry is within the virtual address space of the first virtual machine; and, The base address in the first page table entry is within the physical address space of the second virtual machine; and, The permissions for the first page table entry are read-only.

13. The apparatus according to any one of claims 10-12, characterized in that, Before the kernel of the first virtual machine performs a write operation on the first page table entry, the kernel permissions of the first virtual machine are changed from read-only permissions to write operation permissions by the kernel security monitor. The processing module is further configured to: after performing a write operation on the first page table entry, change the kernel permissions of the first virtual machine from write operation permissions to read-only permissions.

14. The apparatus as claimed in claim 13, characterized in that, The kernel permissions of the first virtual machine are changed from read-only permissions to write permissions by the kernel security monitor, including: the value of the first register is changed from a first value to a second value by the kernel security monitor, where the first value indicates that the kernel permissions of the first virtual machine are read-only permissions and the second value indicates that the kernel permissions of the first virtual machine are write permissions. The processing module is specifically used to: after performing a write operation on the first page table entry, modify the value of the first register from the second value to the first value.

15. A non-volatile computer-readable storage medium, characterized in that, The non-volatile computer-readable storage medium includes a program that, when run on the device, causes the device to perform the operational steps of the method of any one of claims 1 to 7.

16. A chip system, characterized in that, The chip system includes at least one chip and a memory, wherein the at least one chip is used to read and execute program instructions stored in the memory to implement the operation steps of any of the methods described in claims 1 to 7.

17. A computing device, characterized in that, The computing device includes a processor and a memory, the memory being used to store computer execution instructions. When the computing device is in operation, the processor executes the computer execution instructions in the memory to perform the operation steps of any of the methods described in claims 1 to 7 using the hardware resources in the computing device.

18. A computer program product, characterized in that, When the computer program product is run on the device, the device causes the device to perform the operational steps of any one of the methods described in claims 1 to 7.

Images