A method, device, computer device and storage medium for hot plugging of a device

Abstract

The present disclosure provides a method, apparatus, computer device, and storage medium for hot plugging of devices. The method includes: in response to a virtual machine monitor receiving a hot plugging request for a virtual target device in a virtual machine, using the virtual machine monitor to determine operation resource information corresponding to the hot plugging request; the operation resource information includes resource information required for hot plugging the virtual target device; storing the operation resource information in an operation queue of a preset hot plugging device, and sending an interrupt trigger signal to a sub-operating system of the virtual machine; the preset hot plugging device is an information transmission channel between the virtual machine monitor and the sub-operating system, and is used for transmitting information related to the hot plugging request; in the case where the sub-operating system detects the interrupt trigger signal, using the sub-operating system to obtain the operation resource information from the operation queue, and performing a hot plugging operation on the virtual target device according to the operation resource information.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technologies, and in particular, to a method and apparatus for hot plugging devices, a computer device, and a storage medium. Background Art

[0002] To address the security issues of Platform as a Service (PaaS), a security container solution based on virtualization technology is usually adopted. Security containers can utilize underlying hardware-assisted virtualization technology to achieve isolation between containers, thereby ensuring that virtual machines in each container can operate independently.

[0003] In the PaaS scenario, hot plugging of devices for virtual machines in security containers is a common virtual machine processing requirement. The conventional hot plugging method of devices is implemented based on the Advanced Configuration Power Interface (ACPI) mechanism and the Peripheral Component Interconnect (PCI) mechanism by using the Virtual Machine Monitor (VMM) and the sub-operating system in the security container. However, the hot plugging method of devices using the ACPI and PCI mechanisms not only slows down the startup speed of the virtual machine but also increases the security risks of the virtual machine, with significant drawbacks. Summary of the Invention

[0004] Embodiments of the present disclosure at least provide a method and apparatus for hot plugging devices, a computer device, and a storage medium.

[0005] In a first aspect, an embodiment of the present disclosure provides a method for hot plugging devices, including:

[0006] In response to the virtual machine monitor receiving a hot plugging request for a virtual target device in a virtual machine, determining, by the virtual machine monitor, operation resource information corresponding to the hot plugging request; the operation resource information includes resource information required for hot plugging the virtual target device;

[0007] Storing the operation resource information in an operation queue of a preset hot plugging device, and sending an interrupt trigger signal to the sub-operating system of the virtual machine; the preset hot plugging device is an information transfer channel between the virtual machine monitor and the sub-operating system, and is used to transfer information related to the hot plugging request;

[0008] In the case where the sub - operating system detects the interrupt trigger signal, use the sub - operating system to obtain the operation resource information from the operation queue, and perform a hot - plug operation on the virtual target device according to the operation resource information.

[0009] In a possible implementation manner, receiving a hot - plug request for a virtual target device in a virtual machine includes:

[0010] Receiving a container request for a secure container, where the container request is used to indicate performing a hot - plug operation on the virtual target device in the virtual machine within the secure container;

[0011] Converting the container request into the hot - plug request that matches the hypervisor;

[0012] Determine a target interface related to the virtual target device from multiple application programming interfaces developed for the hypervisor, and send the hot - plug request to the hypervisor by invoking the target interface.

[0013] In a possible implementation manner, using the hypervisor to determine the operation resource information corresponding to the hot - plug request includes:

[0014] Establish a communication connection with the virtual target device, and use the communication connection to determine the resource feature structure supported by the virtual target device;

[0015] Configure the operation resource information for the virtual target device according to the hot - plug request and in accordance with the resource feature structure.

[0016] In a possible implementation manner, before using the hypervisor to determine the operation resource information corresponding to the hot - plug request, it further includes:

[0017] In response to a container startup request, start the secure container, and initialize the hypervisor and the sub - operating system;

[0018] During the process of initializing the hypervisor, start the preset hot - plug device deployed in the hypervisor.

[0019] In a possible implementation manner, initializing the sub - operating system includes:

[0020] Start the hot - plug thread of the sub - operating system and set the hot - plug thread to a dormant state;

[0021] Set a trigger mechanism for the hot-plug thread, where the trigger mechanism is used to wake up the hot-plug thread in the sleep state when the interrupt trigger signal is detected, and the hot-plug thread is used to perform a hot-plug operation on the virtual target device according to the operation resource information.

[0022] In a possible implementation, when the virtual target device includes a virtual central processing unit in a virtual machine, the operation resource information includes the number of virtual central processing units and the operation type of the hot-plug operation;

[0023] When the virtual target device includes any virtual device in the virtual machine, the operation resource information includes the address information of the virtual device, the length information corresponding to the virtual device, the interrupt information corresponding to the virtual device, and the operation type of the hot-plug operation.

[0024] In a possible implementation, performing a hot-plug operation on the virtual target device according to the operation resource information includes:

[0025] Determine the operation logic according to the operation type indicated by the operation resource information and the device type of the virtual target device;

[0026] According to the operation logic, perform the hot-plug operation corresponding to the operation type on the virtual target device according to the operation resource information.

[0027] In a second aspect, an embodiment of the present disclosure further provides a device hot-plugging apparatus, including:

[0028] A determination module, configured to, in response to the virtual machine monitor receiving a hot-plug request for a virtual target device in a virtual machine, use the virtual machine monitor to determine the operation resource information corresponding to the hot-plug request; the operation resource information includes the resource information required for performing a hot-plug operation on the virtual target device;

[0029] A storage module, configured to store the operation resource information in an operation queue of a preset hot-plug device, and send an interrupt trigger signal to a sub-operating system of the virtual machine; the preset hot-plug device is an information transfer channel between the virtual machine monitor and the sub-operating system, and is used to transfer information related to the hot-plug request;

[0030] An execution module, configured to, when the sub-operating system detects the interrupt trigger signal, use the sub-operating system to obtain the operation resource information from the operation queue, and perform a hot-plug operation on the virtual target device according to the operation resource information.

[0031] In a third aspect, an alternative implementation of the present disclosure also provides a computer device, including a processor and a memory. The memory stores machine-readable instructions executable by the processor. The processor is configured to execute the machine-readable instructions stored in the memory. When the machine-readable instructions are executed by the processor, the machine-readable instructions are executed to perform the steps in the first aspect or any possible implementation manner in the first aspect.

[0032] In a fourth aspect, an alternative implementation of the present disclosure also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is run, it executes the steps in the first aspect or any possible implementation manner in the first aspect.

[0033] For the effect description of the above device hot plugging device, computer device, and computer-readable storage medium, refer to the description of the above device hot plugging method, which will not be elaborated here.

[0034] The device hot plugging method, device, computer device, and storage medium provided by the embodiments of the present disclosure can accurately determine the operation resource information required by the hot plugging request by using a virtual machine monitor (hereinafter referred to as VMM) after receiving the hot plugging request. By sending the operation resource information to the operation queue corresponding to the developed preset hot plugging device and then sending an interrupt trigger signal, it is possible to notify the sub-operating system in a timely manner. Then, the sub-operating system can obtain the operation resource information from the operation queue and implement the hot plugging of the virtual target device in the virtual machine according to the operation resource information. The entire hot plugging process can be implemented by using VMM and the sub-operating system based on the preset hot plugging device and the operation queue without relying on the ACPI mechanism and the PCI mechanism. Since the implementation of the preset hot plugging device is lighter than the ACPI mechanism and the PCI mechanism, hot plugging through the preset hot plugging device can effectively reduce the number of lines of code implementation. The reduction of the number of lines of code can not only effectively avoid the problem of slowing down the startup speed of the virtual machine, but also greatly reduce the possibility of intrusion into VMM and the sub-operating system, thereby reducing the running risk of the virtual machine and improving the running security of the virtual machine.

[0035] To make the above objects, features, and advantages of the present disclosure more obvious and understandable, the following specific embodiments are given and described in detail in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] To more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following will briefly introduce the accompanying drawings required for the embodiments. The accompanying drawings here are incorporated into the specification and form a part of this specification. These accompanying drawings show embodiments consistent with the present disclosure and are used together with the specification to illustrate the technical solutions of the present disclosure. It should be understood that the following accompanying drawings only show some embodiments of the present disclosure and should not be regarded as limiting the scope. For those of ordinary skill in the art, without creative efforts, other related accompanying drawings can also be obtained based on these accompanying drawings.

[0037] Figure 1 It shows a schematic structural diagram of a PaaS provided by an embodiment of the present disclosure;

[0038] Figure 2 It shows a flowchart of a method for hot plugging a device provided by an embodiment of the present disclosure;

[0039] Figure 3 It shows a schematic diagram of the execution process of a Guest OS provided by an embodiment of the present disclosure;

[0040] Figure 4 It shows a schematic diagram of the process of performing a hot plugging operation using a preset hot pluggable device provided by an embodiment of the present disclosure;

[0041] Figure 5 It shows a schematic diagram of a device hot plugging device provided by an embodiment of the present disclosure;

[0042] Figure 6 It shows a schematic structural diagram of a computer device provided by an embodiment of the present disclosure. Detailed implementation manners

[0043] To make the objectives, technical solutions, and advantages of the embodiments of the present disclosure clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present disclosure with reference to the accompanying drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only some, rather than all, of the embodiments of the present disclosure. The components of the embodiments of the present disclosure described and illustrated here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure is not intended to limit the scope of the present disclosure claimed, but merely represents the selected embodiments of the present disclosure. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present disclosure without creative efforts fall within the scope of protection of the present disclosure.

[0044] In addition, in the description, claims, and the above-mentioned drawings of the embodiments of the present disclosure, terms such as "first" and "second" are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments described here can be implemented in an order other than that illustrated or described here.

[0045] As used herein, "a plurality of" or "several" means two or more. "And / or" describes the relationship between associated objects and indicates that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0046] Through research, it is found that as Figure 1 shown, it is a schematic structural diagram of a PaaS provided by an embodiment of the present disclosure, which includes a K8s component, a container runtime (containerd) component, and a secure container. The secure container includes a shim-v2 component, a VMM, and a guest operating system (Guest OS). The Guest OS includes an agent and a plurality of containers. K8s, whose full name is kubernetes, is an open-source system used to manage containerized applications on multiple hosts in a cloud platform. The container runtime (containerd) is used to receive requests from K8s and convert them into requests that the shim-v2 in the secure container can receive. The shim-v2 can convert the received requests into a format that the VMM can receive, and can also communicate with the agent in the guest operating system (Guest OS) based on the socket vsock. The VMM sends the received requests to the Guest OS, thereby realizing the response to the requests. The containers in the Guest OS are used to run applications. As a very complex subsystem, ACPI can not only be responsible for describing various configuration information of the system, such as the topology of the central processing unit, the non-uniform memory access (NUMA) topology, and the advanced programmable interrupt controller (APIC), but also define the call interface between the operating system and the firmware (such as the basic input output system (BIOS)). Regarding Figure 1The hot-plug solution for the PaaS security container shown requires the introduction of the ACPI subsystem in both the VMM and the sub-operating system. However, introducing this subsystem will result in problems such as a large amount of information, a large number of lines of code implementation that are complex, which not only slows down the startup speed of the VMM and the sub-operating system, affecting the startup speed of the virtual machine, but also greatly increases the amount of code in the VMM and the sub-operating system, increasing the risk of intrusion into the VMM and the sub-operating system, and affecting the running security of the virtual machine.

[0047] Based on the above research, the present disclosure provides a device hot-plug method, device, computer device, and storage medium. After receiving a hot-plug request, the VMM can accurately determine the operation resource information required for the hot-plug request. By sending the operation resource information to the operation queue corresponding to the developed preset hot-plug device and then sending an interrupt trigger signal, it is possible to notify the sub-operating system in a timely manner. Then, the sub-operating system can obtain the operation resource information from the operation queue and implement the hot-plug of the virtual target device in the virtual machine according to the operation resource information. The entire hot-plug process can be implemented by the VMM and the sub-operating system based on the preset hot-plug device and the operation queue without relying on the ACPI mechanism and the PCI mechanism. Since the implementation of the preset hot-plug device is lighter than the ACPI mechanism and the PCI mechanism, hot-plugging through the preset hot-plug device can effectively reduce the number of lines of code implementation. The reduction in the number of code lines can not only effectively avoid the problem of slowing down the startup speed of the virtual machine, but also greatly reduce the possibility of intrusion into the VMM and the sub-operating system, thereby reducing the running risk of the virtual machine and improving the running security of the virtual machine.

[0048] Regarding the defects existing in the above solutions, they are all the results obtained by the inventors after practice and careful research. Therefore, the process of discovering the above problems and the solutions proposed by the present disclosure for the above problems in the following text should all be the contributions made by the inventors to the present disclosure during the process of the present disclosure.

[0049] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0050] It can be understood that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, usage scopes, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to users and user authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0051] It should be noted that the specific terms mentioned in the embodiments of the present disclosure include:

[0052] MMIO: Memory-mapped I / O, that is, memory-mapped I / O;

[0053] Rust: A systems programming language that focuses on security, especially concurrent security, and is a multi-paradigm language that supports programming paradigms such as functional, imperative, and generic programming;

[0054] used ring: An instruction used to indicate the completion of information storage in the operation queue;

[0055] available ring: An instruction used to read information from the operation queue corresponding to the VMM.

[0056] For ease of understanding this embodiment, first, a device hot-plug method disclosed in this disclosure embodiment will be introduced in detail. The execution subject of the device hot-plug method provided in this disclosure embodiment is generally a terminal device or other processing device with certain computing capabilities. The terminal device can be a user equipment (UE), a mobile device, a user terminal, a terminal, a personal digital assistant device (PDA), a handheld device, a computer device, etc.; in some possible implementation manners, the device hot-plug method can be implemented by a processor invoking computer-readable instructions stored in a memory.

[0057] Next, the device hot-plug method provided in this disclosure embodiment will be described by taking the execution subject as the server as an example.

[0058] As Figure 2 shown, it is a flowchart of a device hot-plug method provided in this disclosure embodiment, which may include the following steps:

[0059] S201: In response to the virtual machine monitor receiving a hot-plug request for a virtual target device in the virtual machine, use the virtual machine monitor to determine the operation resource information corresponding to the hot-plug request; the operation resource information includes the resource information required when performing hot-plug on the virtual target device.

[0060] Here, the virtual target device can be a virtualized device running in the virtual machine, and specifically can include a virtual central processing unit (vcpu) and various virtualized mapped I / O devices (virtio mmio device). Among them, the virtio mmio device can include, for example, virtual partitions (virtio-blk), virtual user partitions (virtio-user-blk), virtual networks (virtio-net), and virtual user networks (virtio-user-net), etc.

[0061] A hot plug request is a request for hot plugging any virtual target device in a virtual machine. Hot plugging can be understood as plugging or unplugging a virtual target device in a virtual machine without affecting the normal operation of the virtual machine. The hot plug request may include the virtual target device to be hot plugged and the operation type of the hot plug operation to be performed. Among them, the operation type may include a hot plug operation type and a hot unplug operation type.

[0062] The operation resource information is the resource information related to the virtual target device prepared by the VMM, including all the resource information required for hot plugging the virtual target device, which can be used during the execution of the hot plug operation to complete the hot plugging of the device; the operation resource information may include, for example, interrupt resources, address resources of the virtual target device, the number of virtual target devices, the length of the virtual target device, and other resources.

[0063] The VMM can be used to handle all functions of the virtual machine in the secure container. The most core one is to ensure the secure operation of the virtual machine. Specifically, in implementation, the virtual machine monitor VMM provided in the embodiments of the present disclosure is a VMM developed using the Rust language, represented by a rust-vmm based VMM. On the basis of having all the functions of a traditional VMM, this VMM can also implement the backend operations of preset hot pluggable devices, and the preset hot pluggable devices will be introduced in detail later.

[0064] Specifically, in implementation, after the rust-vmm based VMM receives a hot plug request for a virtual target device in a virtual machine, in response to the hot plug request, the rust-vmm based VMM can dynamically prepare the operation resource information related to the hot plug request according to the virtual target device and the operation type indicated by the hot plug request.

[0065] In one embodiment, the hot plug request for the virtual target device in the virtual machine can be received according to the following steps:

[0066] Step 1: Receive a container request for the secure container. The container request is used to indicate performing a hot plug operation on a virtual target device in a virtual machine within the secure container.

[0067] Here, the container request manages requests initiated by the management users of each container in K8s and is used to indicate performing a hot plug operation or a hot unplug operation on the virtual target device running in the virtual machine within the secure container. Exemplarily, the container request can be a request initiated by the Figure 1 K8s component shown.

[0068] In specific implementation, when there is a hot plugging requirement for a certain virtual target device in a virtual machine, the management user can initiate a container request for a security container using the K8s component, and then the server can receive the container request.

[0069] Step 2: Convert the container request into a hot plugging request that matches the virtual machine monitor.

[0070] In specific implementation, the containerd component can be used to first convert the container request into a pending request that the shim-v2 component can handle and send it to the shim-v2 component. Then, the shim-v2 component can be used to perform format conversion on the pending request to obtain a hot plugging request that can be recognized and processed by the rust-vmm based VMM.

[0071] Step 3: Determine the target interface related to the virtual target device from multiple application programming interfaces developed for the virtual machine monitor, and send the hot plugging request to the virtual machine monitor by calling the target interface.

[0072] Here, corresponding application programming interfaces (APIs) can be developed in advance in the rust-vmm based VMM for various types of virtualized devices. For example, corresponding APIs can be developed in the rust-vmm based VMM for virtio-blk, virtio-user-blk, virtio-net, virtual CPU, and virtio-user-net respectively. Different APIs are used to configure the hot plugging requests and operation resource information of the corresponding virtualized devices.

[0073] In specific implementation, the target API related to the virtual target device can be determined from multiple APIs developed for the rust-vmm based VMM, and then the hot plugging request can be sent to the rust-vmm based VMM by calling the target API.

[0074] Further, after sending the hot plugging request to the rust-vmm based VMM using the target API, the rust-vmm based VMM can determine the operation resource information according to the following steps:

[0075] S1: Establish a communication connection with the virtual target device, and use the communication connection to determine the resource feature structure supported by the virtual target device.

[0076] Here, the communication connection can be a socket connection, and the resource feature structure is used to represent the virtualization feature structure (virtio features) supported by both the virtual target device and the rust-vmm based VMM.

[0077] In specific implementation, the rust-vmm based VMM can be used to call the target API, and the functions provided by the target API can be used to establish a communication connection with the virtual target device. After that, the resource feature structure supported by both the rust-vmm based VMM and the virtual target device can be negotiated using the communication connection.

[0078] S2: According to the hot-plug request, configure the operation resource information for the virtual target device according to the resource feature structure.

[0079] In specific implementation, after the resource feature structure is negotiated, the operation resource information with this resource feature structure can be configured according to the virtual target device and operation type in the hot-plug request according to the resource feature structure.

[0080] Exemplarily, taking the virtual target device as virtio-user-blk as an example, the API for hot-plugging virtio-user-blk can be used to prepare the operation resource information. Specifically, the information format of the API can be

[0081] pub fn hotplug_in_vhu_blk_device( / / Hot-plug the virtio-user-blk device

[0082] &self,

[0083] id:String, / / Device identifier, in string format

[0084] socket_path:String, / / Socket path, in string format

[0085] num_queues:u32, / / Queue serial number, 32-bit unsigned integer

[0086] queue_size:u16, / / Queue size, 16-bit unsigned integer

[0087] ).

[0088] After calling the API using the rust-vmm based VMM, a socket connection with the virtio-user-blk device can be established. After that, virtio features supported by both the virtio-user-blk device and the rust-vmm based VMM can be negotiated using the socket connection. Then, the operation resource information related to the virtio-user-blk device can be configured according to the virtio features and the information format of the API. Among them, the operation resource information can include, for example, interrupt irq resources, device address and length (mmio device base address and len) resources, input / output events (ioevent), etc.

[0089] In one embodiment, before using the rust-vmm based VMM to determine the operation resource information corresponding to the hot plug request, the following steps may further be included:

[0090] In response to the container startup request, start the secure container and initialize the virtual machine monitor and the guest operating system.

[0091] Here, the guest operating system can be represented by Guest OS, which refers to the operating system running in the virtual machine and is used to ensure that the various functions of the virtual machine can run normally. The container startup request can be a request to use the container. For example, the container request can be a request initiated after the user triggers a control related to any function provided by the container.

[0092] In specific implementation, in response to the container startup request, the secure container related to the virtual machine can be started. At the same time, the rust-vmm based VMM and the Guest OS in the secure container can be initialized to ensure that the rust-vmm based VMM and the Guest OS can run normally.

[0093] During the process of initializing the virtual machine monitor, start the preset hot plug device deployed in the virtual machine monitor.

[0094] Here, the preset hot-pluggable device is a device dedicated to hot-plugging virtualized devices in a virtual machine, serving as an information transfer channel between the virtual machine monitor and the sub-operating system, and is used to transfer information related to hot-plug requests. The preset hot-pluggable device can achieve the transfer of information related to hot-plug requests in a rust-vmm based VMM and a Guest OS without relying on ACPI and PCI, playing the role of an information transfer channel. Among them, the backend of the preset hot-pluggable device is implemented in the rust-vmm based VMM, and the front-end driver is implemented in the Guest OS.

[0095] During specific implementation, during the initialization of the rust-vmm based VMM, the preset hot-pluggable device can be enabled to achieve the startup of the preset hot-pluggable device. At the same time, during the initialization process, the rust-vmm based VMM can provide various APIs based on the preset hot-pluggable device for the rust-vmm based VMM to call these APIs during operation to prepare the operation resource information. For example, when the rust-vmm based VMM receives a hot-plug request from shim-v2 during operation, it can call the target API related to the virtual target device to achieve resource allocation for the virtual target device and obtain the operation resource information.

[0096] S202: Store the operation resource information in the operation queue of the preset hot-pluggable device and send an interrupt trigger signal to the sub-operating system of the virtual machine; the preset hot-pluggable device is an information transfer channel between the virtual machine monitor and the sub-operating system, and is used to transfer information related to hot-plug requests.

[0097] Here, the interrupt trigger signal is used to notify the Guest OS that there is a current hot-plug request, and it is necessary to obtain the operation resource information from the operation queue in an interrupt manner for hot-plugging operations. The operation queue is a message queue provided by the preset hot-pluggable device and is used to store operation resource information related to each hot-plug request.

[0098] During specific implementation, after the rust-vmm based VMM prepares the operation resource information, it can use the API related to the virtual target device that is called to store the operation resource information in the operation queue. After storing the operation resource information in the operation queue, the rust-vmm based VMM can indicate the completion of storage by writing to the used ring.

[0099] Optionally, to ensure that the Guest OS can recognize and understand the operation resource information after obtaining it, when storing the operation resource information into the operation queue, it can also be stored in a preset element format. As shown below, it is a schematic diagram of the element format in an operation queue provided by an embodiment of the present disclosure:

[0100] Element format in the operation queue:

[0101] struct HpInfo / / Structured hotplug information

[0102] type:hotplug for cpu or device or mem / / Type of hotplug device (i.e., virtual target device), including virtual CPU or virtio mmio device or virtual memory

[0103] plug_in_out:true for plug in,false for plug out / / Operation type, whether it is a hot plug operation or a hot unplug operation

[0104] base:device mmio base addr / / Address information of the hotplug device

[0105] size:device mmio len / / Length information of the hotplug device

[0106] irq:device irq / / Interrupt information of the hotplug device.

[0107] Among them, when the virtual target device is a virtual CPU, the information indicated by the element format may further include the quantity information of the device.

[0108] In one embodiment, for virtual target devices of different device types, the information types of the corresponding operation resource information are different. Specifically, when the virtual target device includes a virtual central processing unit in a virtual machine, the operation resource information may include the quantity count of the virtual central processing unit and the operation type of the hotplug operation; when the virtual target device includes any virtual device in a virtual machine (i.e., various virtualized mapped I / O devices (virtio mmio device)), the operation resource information includes the address information of the virtual device, the length information corresponding to the virtual device, the interrupt information corresponding to the virtual device, and the operation type of the hotplug operation.

[0109] After storing the operation resource information into the operation queue, an interrupt trigger signal or an interrupt request can be sent to the Guest OS through a preset hotplug device to notify the Guest OS that the current hotplug request is stored.

[0110] Before sending an interrupt trigger signal or an interrupt request to the Guest OS, it is also necessary to initialize the hot-pluggable device. Specifically, the timing of initializing the hot-pluggable device can be the same as the timing of initializing the rust-vmm based VMM. Specifically, the Guest OS can be initialized according to the following steps:

[0111] Start the hot-plug thread of the sub-operating system and set the hot-plug thread to the sleep state.

[0112] Here, the hot-plug thread is a thread used for hot-plugging virtual devices in the virtual machine. It runs in the Guest OS and is a pre-developed linux kernel thread.

[0113] In specific implementation, when responding to a container startup request, the Guest OS can be started, and the mmio subsystem can be used to detect whether there is a preset hot-pluggable device that has been started, that is, to detect whether there is a channel for transmitting information related to the hot-plug request. If not, it means that there is no preset hot-pluggable device currently, and an exception message can be fed back. If so, it can be ensured that when an interrupt trigger signal or an interrupt request is detected, the driver corresponding to the preset hot-pluggable device can be used to obtain the operation resource information in the operation queue. At the same time, when there is a preset hot-pluggable device that has been started, the hot-plug thread in the Guest OS can also be started, and when the hot-plug thread has been started, the hot-plug thread can be set to the sleep state. By setting the hot-plug thread to the sleep state, the resource consumption of the hot-plug thread can be reduced when there is no hot-plug request.

[0114] At the same time, a trigger mechanism for the hot-plug thread can be set. The trigger mechanism is used to wake up the hot-plug thread in the sleep state when an interrupt trigger signal or an interrupt request is detected. The hot-plug thread is used to perform hot-plug operations on the virtual target device according to the operation resource information.

[0115] In specific implementation, the trigger mechanism can be implemented by using an interrupt callback function set for the hot-plug thread. Specifically, while setting the hot-plug thread to the sleep state, an interrupt callback function related to the hot-plug thread can also be set. By setting this interrupt callback function, when an interrupt trigger signal or an interrupt request from the rust-vmm based VMM is detected, the hot-plug thread in the sleep state can be woken up, and the hot-plug thread can be used to perform specific hot-plug operations according to the operation resource information.

[0116] S203: When the sub - operating system detects an interrupt trigger signal, use the sub - operating system to obtain operation resource information from the operation queue, and perform a hot - plug operation on the virtual target device according to the operation resource information.

[0117] Specifically, when implementing, an interrupt listening thread can be set in the Guest OS. When this thread listens to an interrupt trigger signal or an interrupt request from the ust - vmm based VMM, that is, it can be determined that the Guest detects an interrupt trigger signal or an interrupt request. Then, the driver corresponding to the preset hot - plug device can be used to obtain operation resource information from the operation queue. For example, the driver can obtain operation resource information related to the hot - plug request from the operation queue by reading the available ring.

[0118] Meanwhile, when detecting an interrupt trigger signal or an interrupt request, in response to triggering a trigger mechanism for the hot - plug thread, wake up the hot - plug thread in the dormant state. After obtaining the operation resource information, the hot - plug thread can be used to parse the operation resource information and perform a hot - plug operation on the virtual target device according to the parsing result, so as to achieve the hot - plug of the virtual target device in the virtual machine.

[0119] In one embodiment, for the step of "performing a hot - plug operation on the virtual target device according to the operation resource information", it can be implemented according to the following steps:

[0120] Determine the operation logic according to the operation type indicated by the operation resource information and the device type of the virtual target device; according to the operation logic, perform a hot - plug operation corresponding to the operation type on the virtual target device according to the operation resource information.

[0121] Here, the operation type is a hot - plug operation type or a hot - unplug operation type, and the device type can be a CPU type or an mmio device type. Different operation types correspond to different operation logics, and different device types also correspond to different operation logics. Various operation logics can be set in advance.

[0122] Specifically, when implementing, the hot - plug thread can be used to determine the device type of the virtual target device and the operation type of the hot - plug operation to be performed according to the operation resource information. Then, according to the determined operation type and device type, determine the operation logic of the target operation corresponding to the operation type.

[0123] Then, according to the operation logic and based on the operation resource information, a hot plug operation or a hot unplug operation can be performed on the virtual target device. For example, when the virtual target device is a vcpu, the hot plug operation or the hot unplug operation can be performed on the vcpu according to the operation logic corresponding to the vcpu and based on the quantity in the operation resource information. When the virtual target device is a virtio mmiodevice, the hot plug operation or the hot unplug operation can be performed on the virtio mmio device according to the operation logic corresponding to the virtio mmio device and based on the length information, interrupt information, address information, etc. in the operation resource information.

[0124] As Figure 3 shown, it is a schematic diagram of the execution process of a Guest OS provided by an embodiment of the present disclosure. Among them, after detecting an interrupt trigger signal from a preset hot pluggable device (virtio-hotplug device), it can be indicated that the rust-vmm based VMM has initiated a hot plug request, and then the hot plug thread (mmio_hp_thread) can be awakened for processing. Among them, after awakening the hot plug thread, the driver corresponding to the preset hot pluggable device can be used to obtain the operation resource information from the operation queue (virtio queue). Then, if the hot plug is requested for the virtual central processing unit, the hot plug thread in the Guest OS can be used to execute the specific virtual central processing unit hot plug logic according to the obtained operation resource information; if the hot plug is requested for the virtual device, the hot plug thread in the Guest OS can be used to execute the specific virtual device hot plug logic according to the obtained operation resource information.

[0125] As Figure 4 shown, it is a schematic diagram of the process of performing a hot plug operation using a preset hot pluggable device provided by an embodiment of the present disclosure. Among them, API Caller represents an API call. The specific hot plug process can include: 1. Shim-v2 can, in the way of API Caller, call any one of multiple application programming interfaces developed based on the preset hot pluggable device (virtio-hotplug device) (i.e., Figure 4The hotplug API in it sends the hotplug request to the rust-vmm based VMM. 2. The rust-vmm based VMM can utilize the called hotplug API to prepare the operation resource information through the virtio-hotplug device. 3. The rust-vmm based VMM can send the operation resource information to the operation queue (virtio queue), where the operation resource information can be stored in accordance with a preset element format. In Figure 4 two hotplug information tables are shown. The operation resource information stored in accordance with a preset element format is shown in the hotplug information tables, and other operation resource information is not shown one by one, and is identified by ellipsis in Figure 4 In one hotplug information table corresponds to the operation resource information of one hotplug request. When the virtual target device to be hotplugged is of the cpu type, the table may only include the type information and the count information; when the virtual target device to be hotplugged is of the mmio device type, the table may only include the type information, the address information, the size information, and the interrupt information. Among them, the type is the device type, which may include the cpu type, the device type (i.e., the mmio device type), and the memory (i.e., mem) type. 4. After storing the operation resource information into the operation queue, an interrupt trigger signal can be sent to the Guest OS (i.e., Figure 4 the virtio-hotplug interrupt in it). 5. In response to detecting the interrupt trigger signal, the hotplug thread is awakened (i.e., Figure 4 the virtio-hotplug kernel thread in it). 6. The hotplug thread is utilized to perform the hotplug operation on the virtual target device according to the operation resource information obtained from the operation queue. In step 6, it respectively points to the vcpu and the virtual device in the virtual machine (i.e., Figure 4 the device in it). In specific implementation, the vcpu and the virtual device can be hotplugged according to a specific hotplug request.

[0126] In this way, based on the above embodiments, it is possible to achieve hot plugging for virtual machines without relying on the ACPI mechanism and the PCI mechanism. By using the rust-vmm based VMM and the sub-operating system based on lightweight preset hot-pluggable devices and operation queues, hot plugging can be realized. Since the implementation of the preset hot-pluggable devices is lighter than the ACPI mechanism and the PCI mechanism, hot plugging through the preset hot-pluggable devices can effectively reduce the number of lines of code implementation. The reduction in the number of lines of code can not only effectively avoid the problem of slowing down the virtual machine startup speed, but also greatly reduce the possibility of intrusion into the rust-vmm based VMM and the sub-operating system, thereby reducing the running risk of the virtual machine and improving the running security of the virtual machine.

[0127] Those skilled in the art can understand that in the above method of the specific implementation manner, the writing order of each step does not mean a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined according to its function and possible internal logic.

[0128] Based on the same inventive concept, an apparatus for device hot plugging corresponding to the device hot plugging method is also provided in the embodiments of the present disclosure. Since the principle of solving problems by the apparatus in the embodiments of the present disclosure is similar to that of the above device hot plugging method in the embodiments of the present disclosure, the implementation of the apparatus can refer to the implementation of the method, and the repeated parts will not be described again.

[0129] As Figure 5 shown, it is a schematic diagram of an apparatus for device hot plugging provided by an embodiment of the present disclosure, including:

[0130] A determination module 501, configured to, in response to a virtual machine monitor receiving a hot plugging request for a virtual target device in a virtual machine, use the virtual machine monitor to determine operation resource information corresponding to the hot plugging request; the operation resource information includes resource information required for hot plugging the virtual target device;

[0131] A storage module 502, configured to store the operation resource information into an operation queue of a preset hot-pluggable device, and send an interrupt trigger signal to a sub-operating system of the virtual machine; the preset hot-pluggable device is an information transmission channel between the virtual machine monitor and the sub-operating system, and is used to transmit information related to the hot plugging request;

[0132] An execution module 503, configured to, when the sub-operating system detects the interrupt trigger signal, use the sub-operating system to obtain the operation resource information from the operation queue, and perform a hot plugging operation on the virtual target device according to the operation resource information.

[0133] In a possible implementation manner, the apparatus further includes:

[0134] A receiving module 504, configured to receive a hot plug request for a virtual target device in a virtual machine according to the following steps:

[0135] Receive a container request for a security container, where the container request is used to indicate to perform a hot plug operation on the virtual target device in the virtual machine within the security container;

[0136] Convert the container request into the hot plug request that matches the hypervisor;

[0137] Determine a target interface related to the virtual target device from multiple application programming interfaces developed for the hypervisor, and send the hot plug request to the hypervisor by invoking the target interface.

[0138] In a possible implementation manner, when the determining module 501 determines operation resource information corresponding to the hot plug request by using the hypervisor, it is configured to:

[0139] Establish a communication connection with the virtual target device, and use the communication connection to determine a resource feature structure supported by the virtual target device;

[0140] Configure the operation resource information for the virtual target device according to the hot plug request and in accordance with the resource feature structure.

[0141] In a possible implementation manner, the device further includes:

[0142] An initialization module 505, before determining operation resource information corresponding to the hot plug request by using the hypervisor, is configured to:

[0143] In response to a container start request, start the security container, and initialize the hypervisor and the sub-operating system;

[0144] During the process of initializing the hypervisor, start the preset hot plug device deployed in the hypervisor.

[0145] In a possible implementation manner, when the initialization module 505 initializes the sub-operating system, it is configured to:

[0146] Start a hot plug thread of the sub-operating system, and set the hot plug thread to a sleep state;

[0147] Set a triggering mechanism for the hot-plug thread, where the triggering mechanism is used to wake up the hot-plug thread in the sleep state when the interrupt trigger signal is detected, and the hot-plug thread is used to perform a hot-plug operation on the virtual target device according to the operation resource information.

[0148] In a possible implementation manner, when the virtual target device includes a virtual central processing unit in a virtual machine, the operation resource information includes the number of the virtual central processing units and the operation type of the hot-plug operation;

[0149] When the virtual target device includes any virtual device in the virtual machine, the operation resource information includes the address information of the virtual device, the length information corresponding to the virtual device, the interrupt information corresponding to the virtual device, and the operation type of the hot-plug operation.

[0150] In a possible implementation manner, when the execution module 503 performs a hot-plug operation on the virtual target device according to the operation resource information, it is used to:

[0151] Determine an operation logic according to the operation type indicated by the operation resource information and the device type of the virtual target device;

[0152] According to the operation logic, perform the hot-plug operation corresponding to the operation type on the virtual target device according to the operation resource information.

[0153] For the description of the processing flow of each module in the device and the interaction flow between modules, reference can be made to the relevant description in the above method embodiments, which will not be elaborated here.

[0154] Based on the same technical concept, an embodiment of the present application further provides a computer device. Refer to Figure 6 As shown, it is a schematic structural diagram of a computer device provided by an embodiment of the present application, including:

[0155] A processor 601, a memory 602, and a bus 603. Among them, the memory 602 stores machine-readable instructions executable by the processor 601. The processor 601 is configured to execute the machine-readable instructions stored in the memory 602. When the machine-readable instructions are executed by the processor 601, the processor 601 performs the following steps: In response to the virtual machine monitor receiving a hot plug request for a virtual target device in the virtual machine, use the virtual machine monitor to determine the operation resource information corresponding to the hot plug request; the operation resource information includes the resource information required for hot plugging the virtual target device; S202: Store the operation resource information into the operation queue of a preset hot plug device, and send an interrupt trigger signal to the sub-operating system of the virtual machine; the preset hot plug device is an information transfer channel between the virtual machine monitor and the sub-operating system, and is used to transfer information related to the hot plug request and S203: In the case where the sub-operating system detects the interrupt trigger signal, use the sub-operating system to obtain the operation resource information from the operation queue, and perform a hot plug operation on the virtual target device according to the operation resource information.

[0156] The above-mentioned memory 602 includes a memory 6021 and an external memory 6022; the memory 6021 here is also called the internal memory, and is used to temporarily store the operation data in the processor 601, as well as the data exchanged with the external memory 6022 such as the hard disk. The processor 601 exchanges data with the external memory 6022 through the memory 6021. When the computer device is running, the processor 601 communicates with the memory 602 through the bus 603, so that the processor 601 executes the execution instructions mentioned in the above method embodiments.

[0157] The embodiments of the present disclosure also provide a computer-readable storage medium, on which a computer program is stored. When the computer program is run by a processor, it executes the steps of the device hot plug method described in the above method embodiments. Among them, the storage medium can be a volatile or non-volatile computer-readable storage medium.

[0158] The computer program product of the device hot plug method provided by the embodiments of the present disclosure includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the steps of the device hot plug method described in the above method embodiments. For details, please refer to the above method embodiments, and will not be repeated here.

[0159] The computer program product can be specifically implemented in a manner of hardware, software, or a combination thereof. In an alternative embodiment, the computer program product is specifically embodied as a computer storage medium. In another alternative embodiment, the computer program product is specifically embodied as a software product, such as a Software Development Kit (SDK), etc.

[0160] Those skilled in the art can clearly understand that for the convenience and conciseness of description, the specific working processes of the systems and devices described above can refer to the corresponding processes in the foregoing method embodiments and will not be elaborated here. In several embodiments provided in the present disclosure, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division, and there can be other division methods in actual implementation. For another example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the couplings or direct couplings or communication connections shown or discussed with each other can be through some communication interfaces, and the indirect couplings or communication connections of the devices or units can be in electrical, mechanical, or other forms.

[0161] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0162] In addition, in each embodiment of the present disclosure, the functional units can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit.

[0163] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium executable by a processor. Based on such an understanding, the technical solution of the present disclosure, in essence, or the part that contributes to the prior art or a part of this technical solution can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in each embodiment of the present disclosure. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks, or optical discs that can store program codes.

[0164] If the technical solution of this application involves personal information, before the product applying the technical solution of this application processes personal information, it has clearly informed the personal information processing rules and obtained the individual's independent consent. If the technical solution of this application involves sensitive personal information, before the product applying the technical solution of this application processes sensitive personal information, it has obtained the individual's separate consent and at the same time meets the requirements of "express consent". For example, at personal information collection devices such as cameras, a clear and prominent sign is set to inform that the personal information collection scope has been entered and personal information will be collected. If an individual voluntarily enters the collection scope, it is regarded as consenting to the collection of their personal information; or on the personal information processing device, when the personal information processing rules are informed by obvious signs / information, personal authorization is obtained through pop-up messages or asking the individual to upload their personal information by themselves, etc.; among them, the personal information processing rules may include information such as the personal information processor, the purpose of personal information processing, the processing method, and the types of personal information processed.

[0165] Finally, it should be noted that: The above-mentioned embodiments are only specific implementation manners of the present disclosure, used to illustrate the technical solutions of the present disclosure, rather than limiting them. The protection scope of the present disclosure is not limited thereto. Although the present disclosure has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: Any person skilled in the art within the technical scope disclosed by the present disclosure can still modify the technical solutions recorded in the foregoing embodiments or can easily think of changes, or perform equivalent replacements on some of the technical features; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should all be covered within the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the protection scope of the claims.

Claims

1. A method for hot plugging a device, characterized in that, Including: In response to the hypervisor receiving a hot plug request for a virtual target device in a virtual machine, determining, by the hypervisor, operation resource information corresponding to the hot plug request; The operation resource information includes resource information required for performing hot plug on the virtual target device; Storing the operation resource information into an operation queue of a preset hot plug device, and sending an interrupt trigger signal to a guest operating system of the virtual machine; the preset hot plug device is an information transmission channel between the hypervisor and the guest operating system, and is used for transmitting information related to the hot plug request; When the guest operating system detects the interrupt trigger signal, obtaining, by the guest operating system, the operation resource information from the operation queue, and performing a hot plug operation on the virtual target device according to the operation resource information.

2. The method according to claim 1, characterized in that, Receiving a hot plug request for a virtual target device in a virtual machine includes: Receiving a container request for a secure container, where the container request is used to indicate performing a hot plug operation on the virtual target device in the virtual machine in the secure container; Converting the container request into the hot plug request that matches the hypervisor; Determining a target interface related to the virtual target device from multiple application programming interfaces developed for the hypervisor, and sending the hot plug request to the hypervisor by invoking the target interface.

3. The method according to claim 1, wherein Determining, by the hypervisor, operation resource information corresponding to the hot plug request includes: Establishing a communication connection with the virtual target device, and determining, by using the communication connection, a resource feature structure supported by the virtual target device; Configuring, according to the hot plug request and in accordance with the resource feature structure, the operation resource information for the virtual target device.

4. The method according to claim 1, wherein Before determining, by the hypervisor, operation resource information corresponding to the hot plug request, further including: In response to a container startup request, starting a secure container, and initializing the hypervisor and the guest operating system; During the process of initializing the hypervisor, starting the preset hot plug device deployed in the hypervisor.

5. The method according to claim 4, wherein Initializing the guest operating system includes: Starting a hot plug thread of the guest operating system, and setting the hot plug thread to a dormant state; Setting a trigger mechanism for the hot plug thread, where the trigger mechanism is used to wake up the hot plug thread in the dormant state when detecting the interrupt trigger signal, and the hot plug thread is used to perform a hot plug operation on the virtual target device according to the operation resource information.

6. The method according to claim 1, wherein When the virtual target device includes a virtual central processing unit in a virtual machine, the operation resource information includes the number of the virtual central processing units and the operation type of the hot plug operation. In the case that the virtual target device includes any virtual device in the virtual machine, the operation resource information includes the address information of the virtual device, the length information corresponding to the virtual device, the interrupt information corresponding to the virtual device, and the operation type of the hot-plug operation.

7. The method according to claim 1, wherein Performing a hot-plug operation on the virtual target device according to the operation resource information includes: Determining an operation logic according to the operation type of the hot-plug operation indicated by the operation resource information and the device type of the virtual target device; Performing, according to the operation logic and the operation resource information, a hot-plug operation corresponding to the operation type on the virtual target device.

8. A device hot plugging and unplugging device, characterized in that, Including: A determining module, configured to, in response to the virtual machine monitor receiving a hot-plug request for a virtual target device in a virtual machine, use the virtual machine monitor to determine operation resource information corresponding to the hot-plug request; the operation resource information includes resource information required for performing a hot-plug operation on the virtual target device; A storage module, configured to store the operation resource information into an operation queue of a preset hot-plug device, and send an interrupt trigger signal to a sub-operating system of the virtual machine; The preset hot-plug device is an information transmission channel between the virtual machine monitor and the sub-operating system, and is used for transmitting information related to the hot-plug request; An execution module, configured to, in the case that the sub-operating system detects the interrupt trigger signal, use the sub-operating system to obtain the operation resource information from the operation queue, and perform a hot-plug operation on the virtual target device according to the operation resource information.

9. A computer device, characterized in that, Including: A processor and a memory, where the memory stores machine-readable instructions executable by the processor, and the processor is configured to execute the machine-readable instructions stored in the memory. When the machine-readable instructions are executed by the processor, the processor executes the steps of the device hot-plug method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium. When the computer program is run by a computer device, the computer device executes the steps of the device hot-plug method according to any one of claims 1 to 7.

Images