Service processing method and related apparatus

1 . A service processing method, applicable to a terminal device comprising a first virtual machine, a second virtual machine, and a hypervisor, wherein the first virtual machine comprises at least one physical processor core, a rich execution environment (REE) is run in the first virtual machine, a first trusted execution environment (TEE) is run in the second virtual machine, an REE operating system (OS) and a plurality of client applications (CAs) are run in the REE, and a first TEE OS and a plurality of trust applications (TAs) are run in the first TEE, wherein the plurality of CAs comprises a first CA, wherein the plurality of TAs comprises a first TA corresponding to the first CA, wherein the hypervisor comprises at least one communication channel, each communication channel corresponding to one virtual processor core in the second virtual machine, and wherein the at least one communication channel comprises a first communication channel, the method comprising:

receiving, by the REE OS, a first operation for starting the first CA;

allocating, by the REE OS, first time slice resources of a first physical processor core to the first CA in response to the first operation;

occupying, by the first CA after starting, the first time slice resources, and generating, by the first CA, a first service processing request for calling the first TA to execute service processing;

sending, by the first CA, the first service processing request to the hypervisor through the first communication channel;

receiving, by the hypervisor, the first service processing request from the first CA, and mapping and scheduling, to the first physical processor core, a first virtual processor core in the second virtual machine corresponding to the first communication channel;

sending, by the hypervisor, the first service processing request to the first TEE OS;

binding, by the first TEE OS after starting on the first virtual processor core according to the first service processing request, the first TA corresponding to the first CA with the first virtual processor core;

yielding, by the first CA, second time slice resources in the first time slice resources to the first TA through the hypervisor, wherein the second time slice resources are currently remaining time slice resources in the first time slice resources; and

executing, by the first TA by using some or all of the second time slice resources yielded by the first CA, a first service requested in the first service processing request.

2 . The service processing method of claim 1 , wherein an execution status of the first CA is a working state when the first TA uses the time slice resources yielded by the first CA, the method further comprising collecting, by the REE OS, statistics on an execution status of each CA in the REE, to determine a current resource load condition of each physical processor core of the terminal device.

3 . The service processing method of claim 1 , wherein the hypervisor comprises at least two communication channels, and each communication channel corresponds to one virtual processor core, wherein different communication channels in the hypervisor are configured to receive service processing requests from different CAs in the plurality of CAs, and wherein the hypervisor maps and schedules the virtual processor core corresponding to each communication channel to a physical processor core occupied by the corresponding CA.

4 . The service processing method of claim 1 , wherein a quantity of the virtual processor cores in the hypervisor is less than or equal to a total quantity of the physical processor cores in the terminal device.

5 . The service processing method of claim 1 , further comprising:

obtaining, by the first TA, a processing result of the first service, and returning the processing result to the first CA through the hypervisor; and

returning, by the first TA, third time slice resources to the first CA after obtaining the processing result of the first service, wherein the third time slice resources refer to time slice resources not used by the first TA in the second time slice resources when the first TA obtains the processing result, and wherein returning third time slice resources to the first CA comprises:

sending, by the first TEE OS, a first request to the hypervisor after the TA obtains the processing result of the service processing request, wherein the first request instructs the hypervisor to release the mapping between the first virtual processor core and the first physical processor core; and

releasing, by the hypervisor, the mapping between the first virtual processor core and the first physical processor core according to the first request.

6 . The service processing method of claim 1 , further comprising:

receiving, by the first CA, a first resource scheduling command initiated by the REE OS in the process of executing, by the first TA by using some or all of the second time slice resources yielded by the first CA, the first service requested in the service processing request, wherein the first resource scheduling command is to schedule fourth time slice resources to another CA, and the fourth time slice resources are currently remaining time slice resources in the second time slice resources;

releasing, by the first CA, the fourth time slice resources according to the first resource scheduling command; and

suspending, by the first TA, the processing on the first service after the fourth time slice resources are released.

7 . The service processing method of claim 6 , wherein after a period of time since the fourth time slice resources are released, the method further comprises:

receiving, by the first CA, a second resource scheduling command initiated by the REE OS, wherein the second resource scheduling command is to allocate fifth time slice resources of the first physical processor core to the first CA;

occupying, by the first CA, the fifth time slice resources, and yielding the fifth time slice resources to the first TA through the hypervisor; and

continuing to execute, by the first TA, the first service by using some or all of the fifth time slice resources yielded by the first CA.

8 . The service processing method of claim 6 , wherein an execution status of the first CA is a working state when the first TA uses the second time slice resources yielded by the first CA, and wherein the execution status of the first CA is an idle state after the first CA releases the fourth time slice resources.

9 . The service processing method of claim 1 , wherein the plurality of CAs further comprise a second CA, wherein the plurality of TAs further comprise a second TA corresponding to the second CA, and wherein the at least one communication channel further comprises a second communication channel, the method further comprising:

receiving, by the REE OS, a second operation for starting the second CA;

allocating, by the REE OS, sixth time slice resources of a second physical processor core to the second CA in response to the second operation;

occupying, by the second CA after starting, the sixth time slice resources, and generating, by the second CA, a second service processing request for calling the second TA to execute service processing;

sending, by the second CA, the second service processing request to the hypervisor through the second communication channel;

receiving, by the hypervisor, the second service processing request from the second CA, and mapping and scheduling, to the second physical processor core, a second virtual processor core in the second virtual machine corresponding to the second communication channel;

sending, by the hypervisor, the second service processing request to the first TEE OS;

binding, by the first TEE OS after starting on the second virtual processor core according to the second service processing request, the second TA corresponding to the second CA with the second virtual processor core;

yielding, by the second CA, seventh time slice resources in the sixth time slice resources to the second TA through the hypervisor, wherein the seventh time slice resources are currently remaining time slice resources in the sixth time slice resources; and

executing, by the second TA by using some or all of the seventh time slice resources yielded by the second CA, a second service requested in the second service processing request.

10 . The service processing method of claim 1 , wherein the terminal device further comprises a trust zone and a secure monitor, wherein a second TEE is run in the trust zone, and a plurality of TAs comprising a third TA are run in the second TEE.

11 . The service processing method of claim 10 , wherein the plurality of CAs further comprise a third CA that corresponds to the third TA, the method further comprising:

receiving, by the REE OS, a third operation for starting the third CA;

generating, by the third CA after starting, a third service processing request for calling the third TA to execute service processing;

sending, by the third CA, the third service processing request to the third TA in the second TEE through the secure monitor;

processing, by the third TA, a third service requested in the third service processing request to obtain a processing result; and

returning, by the third TA, the processing result of the third service to the third CA through the secure monitor.

12 . A terminal device, comprising:

a first virtual machine implemented by at least one physical processor core of the terminal device, wherein the first virtual machine is configured to run a rich execution environment (REE), wherein an REE operating system (OS) and a plurality of client applications (CAs) are run in the REE, wherein the plurality of CAs comprises a first CA;

a second virtual machine configured to run a first trusted execution environment (TEE), wherein a first TEE OS and a plurality of trust applications (TAs) are run in the first TEE, wherein the plurality of TAs comprises a first TA corresponding to the first CA; and

a hypervisor comprising at least one communication channel, wherein each communication channel corresponds to one virtual processor core in the second virtual machine, and wherein the at least one communication channel comprises a first communication channel,

wherein the REE OS is configured to:

receive a first operation for starting the first CA; and

allocate first time slice resources of a first physical processor core to the first CA in response to the first operation, wherein the first CA is configured to:

occupy, after starting, the first time slice resources;

generate a first service processing request for calling the first TA to execute service processing; and

send the first service processing request to the hypervisor through the first communication channel,

wherein the hypervisor is configured to:

receive the first service processing request from the first CA;

map and schedule, to the first physical processor core, a first virtual processor core in the second virtual machine corresponding to the first communication channel; and

send the first service processing request to the first TEE OS,

wherein the first TEE OS, after starting on the first virtual processor core according to the first service processing request, is configured to bind the first TA corresponding to the first CA with the first virtual processor core,

wherein the first CA is configured to yield second time slice resources in the first time slice resources to the first TA through the hypervisor, wherein the second time slice resources are currently remaining time slice resources in the first time slice resources, and

wherein the first TA is configured to execute a first service requested in the first service processing request by using some or all of the second time slice resources yielded by the first CA.

13 . The terminal device of claim 12 , wherein an execution status of the first CA is a working state when the first TA uses the time slice resources yielded by the first CA, wherein the REE OS is configured to collect statistics on an execution status of each CA in the REE, to determine a current resource load condition of each physical processor core of the terminal device.

14 . The terminal device of claim 12 , wherein the hypervisor comprises at least two communication channels, and each communication channel corresponds to one virtual processor core, wherein different communication channels in the hypervisor are configured to receive service processing requests from different CAs in the plurality of CAs, and wherein the hypervisor maps and schedules the virtual processor core corresponding to each communication channel to a physical processor core occupied by the corresponding CA.

15 . The terminal device of claim 12 , wherein a quantity of the virtual processor cores in the hypervisor is less than or equal to a total quantity of the physical processor cores in the terminal device.

16 . The terminal device of claim 12 , wherein the first TA is configured to:

obtain a processing result of the first service;

return the processing result to the first CA through the hypervisor; and

return third time slice resources to the first CA after obtaining the processing result of the first service, wherein the third time slice resources refer to time slice resources not used by the first TA in the second time slice resources when the first TA obtains the processing result, and wherein returning third time slice resources to the first CA comprises:

sending, by the first TEE OS, a first request to the hypervisor after the TA obtains the processing result of the service processing request, wherein the first request instructs the hypervisor to release the mapping between the first virtual processor core and the first physical processor core; and

releasing, by the hypervisor, the mapping between the first virtual processor core and the first physical processor core according to the first request.

17 . The terminal device of claim 12 , wherein the first CA is configured to:

receive a first resource scheduling command initiated by the REE OS in the process of executing, by the first TA by using some or all of the second time slice resources yielded by the first CA, the first service requested in the service processing request, wherein the first resource scheduling command is to schedule fourth time slice resources to another CA, and the fourth time slice resources are currently remaining time slice resources in the second time slice resources; and

release the fourth time slice resources according to the first resource scheduling command,

wherein the first TA is configured to suspend the processing on the first service after the fourth time slice resources are released.

18 . The terminal device of claim 17 , wherein after a period of time since the fourth time slice resources are released, the first CA is further configured to:

receive a second resource scheduling command initiated by the REE OS, wherein the second resource scheduling command is to allocate fifth time slice resources of the first physical processor core to the first CA;

occupy the fifth time slice resources; and

yield the fifth time slice resources to the first TA through the hypervisor,

wherein the first TA is configured to continue to execute the first service by using some or all of the fifth time slice resources yielded by the first CA.

19 . The terminal device of claim 17 , wherein an execution status of the first CA is a working state when the first TA uses the second time slice resources yielded by the first CA, and wherein the execution status of the first CA is an idle state after the first CA releases the fourth time slice resources.

20 . A non-transitory computer-readable storage medium storing instructions that are executable by a processor of a terminal device, wherein the terminal device comprises a first virtual machine, a second virtual machine, and a hypervisor, wherein the first virtual machine comprises at least one physical processor core, a rich execution environment (REE) is run in the first virtual machine, a first trusted execution environment (TEE) is run in the second virtual machine, an REE operating system (OS) and a plurality of client applications (CAs) are run in the REE, and a first TEE OS and a plurality of trust applications (TAs) are run in the first TEE, wherein the plurality of CAs comprises a first CA, wherein the plurality of TAs comprises a first TA corresponding to the first CA, wherein the hypervisor comprises at least one communication channel, each communication channel corresponding to one virtual processor core in the second virtual machine, wherein the at least one communication channel comprises a first communication channel, and wherein the instructions, when executed by the processor, cause the terminal device to be configured to:

receive, by the REE OS, a first operation for starting the first CA;

allocate, by the REE OS, first time slice resources of a first physical processor core to the first CA in response to the first operation;

occupy, by the first CA after starting, the first time slice resources, and generate, by the first CA, a first service processing request for calling the first TA to execute service processing;

send, by the first CA, the first service processing request to the hypervisor through the first communication channel;

receive, by the hypervisor, the first service processing request from the first CA, and map and schedule, to the first physical processor core, a first virtual processor core in the second virtual machine corresponding to the first communication channel;

send, by the hypervisor, the first service processing request to the first TEE OS;

bind, by the first TEE OS after starting on the first virtual processor core according to the first service processing request, the first TA corresponding to the first CA with the first virtual processor core;

yield, by the first CA, second time slice resources in the first time slice resources to the first TA through the hypervisor, wherein the second time slice resources are currently remaining time slice resources in the first time slice resources; and

execute, by the first TA by using some or all of the second time slice resources yielded by the first CA, a first service requested in the first service processing request.