Method for configuring address translation relationship, and computer system
Methods and systems for configuring an address translation relationship is disclosed. In an implementation, a method comprises: transferring, by a virtual machine manager (VMM) deployed in a rich execution environment (REE) of a computer system, a first address translation relationship to a secure partition manager (SPM) deployed in a trusted execution environment (TEE) of the computer system, wherein the first address translation relationship comprises an address translation relationship from an intermediate physical address (IPA) allocated to a virtual machine (VM) deployed in the REE to a physical address (PA) for the SPM to perform IPA-to-PA address translation based on the first address translation relationship when transmitting data from the SP to the VM, wherein the PA is a memory address.
1. A method for configuring an address translation relationship, the method comprises:
transferring, by a virtual machine manager (VMM) deployed in a rich execution environment (REE) of a computer system, a first address translation relationship to a secure partition manager (SPM) deployed in a trusted execution environment (TEE) of the computer system, wherein the first address translation relationship comprises an address translation relationship from an intermediate physical address (IPA) allocated to a virtual machine (VM) deployed in the REE to a physical address (PA) for the SPM to perform IPA-to-PA address translation based on the first address translation relationship when transmitting data from the SP to the VM, wherein the PA is a memory address.
2. The method according to claim 1 , wherein the IPA allocated to the VM is a contiguous address, and the PA is a discrete address obtained by performing, based on the first address translation relationship, address translation on the IPA.
3. The method according to claim 1 , wherein a first virtualization translation table base address register (vttbr_el2) and a first control register (vtcr_el2) are deployed in the REE, and the first address translation relationship comprises: a base address of a page table configured in the first vttbr_el2 and used for performing stage-2 memory address translation (stage 2 translation) on a REE side, an address translation attribute configured in the first vtcr_el2 and used for performing the stage-2 memory address translation on the REE side, and the IPA, wherein the IPA is translated into the PA based on the base address and a memory translation rule expressed by the address translation attribute.
4. The method according to claim 3 , wherein the method further comprises:
transferring, by the SPM, the IPA allocated to the VM to the SP, wherein the SP is configured to establish a second address mapping relationship based on the IPA allocated to the VM, and a second address translation relationship comprises an address translation relationship from a virtual address (VA) to an IPA for the SP to perform VA-to-IPA address translation based on the second address mapping relationship when transmitting the data to the VM.
5. The method according to claim 3 , wherein a second vttbr_el2 and a second vtcr_el2 are deployed in the TEE, and the method further comprises:
writing, by the SPM, the base address to the second vttbr_el2; and
writing the address translation attribute to the second vtcr_el2 for the SPM to perform the IPA-to-PA address translation based on the base address stored in the second vttbr_el2 and the address translation attribute stored in the second vtcr_el2 when transmitting the data from the SP to the VM.
6. The method according to claim 5 , wherein before the writing, by the SPM, the base address to the second vttbr_el2, and writing the address translation attribute to the second vtcr_el2, the method further comprises:
receiving, by the SPM, a start request sent by the VMM, wherein the start request indicates the SPM to start the SP; and
writing the base address to the second vttbr_el2 and writing the address translation attribute to the second vtcr_el2 when starting the SP.
7. The method according to claim 3 , wherein the transferring, by the VMM, a first address translation relationship to the SPM comprises:
writing, by the VMM, the first address translation relationship to a general-purpose register; and
triggering, based on an SMC instruction, the SPM to obtain the first address translation relationship from the general-purpose register.
8. A computer system comprising: a rich execution environment (REE) and a trusted execution environment (TEE), wherein a virtual machine (VM) and a virtual machine manager (VMM) are deployed in the REE, and a secure partition (SP) and a secure partition manager (SPM) are deployed in the TEE; and wherein
the VMM is configured to transfer a first address translation relationship to the SPM, wherein the first address translation relationship comprises an address translation relationship from an intermediate physical address (IPA) allocated to the VM to a physical address (PA) for the SPM to perform IPA-to-PA address translation based on the first address translation relationship when transmitting data from the SP to the VM, wherein the PA is a memory address.
9. The computer system according to claim 8 , wherein the IPA allocated to the VM is a contiguous address, and the PA is a discrete address obtained by performing, based on the first address translation relationship, address translation on the IPA.
10. The computer system according to claim 8 , wherein a first virtualization translation table base address register (vttbr_el2) and a first control register (vtcr_el2) are deployed in the REE, and the first address translation relationship comprises: a base address of a page table configured in the first vttbr_el2 and used for performing stage-2 memory address translation (stage 2 translation) on a REE side, an address translation attribute configured in the first vtcr_el2 and used for performing the stage-2 memory address translation on the REE side, and the IPA, wherein the IPA is translated into the PA based on the base address and a memory translation rule expressed by the address translation attribute.
11. The computer system according to claim 10 , wherein the SPM is configured to transfer the IPA allocated to the VM to the SP, the SP is configured to establish a second address mapping relationship based on the IPA allocated to the VM, and a second address translation relationship comprises an address translation relationship from a virtual address VA to an IPA for the SP to perform VA-to-IPA address translation based on the second address mapping relationship when transmitting the data to the VM.
12. The computer system according to claim 10 , wherein a second vttbr_el2 and a second vtcr_el2 are deployed in the TEE; and the SPM is configured to write the base address to the second vttbr_el2, and write the address translation attribute to the vtcr_el2 for the SPM to perform the IPA-to-PA address translation based on the base address stored in the second vttbr_el2 and the address translation attribute stored in the second vtcr_el2 when transmitting the data from the SP to the VM.
13. The computer system according to claim 12 , wherein the SPM is configured to:
receive a start request sent by the VMM, wherein the start request indicates the SPM to start the SP; and
write the base address to the second vttbr_el2 and write the address translation attribute to the second vtcr_el2 when starting the SP.
14. The computer system according to claim 10 , wherein the VMM is configured to:
write the first address translation relationship to a general-purpose register; and
trigger, based on an SMC instruction, the SPM to obtain the first address translation relationship from the general-purpose register.