An inter-domain communication method based on jailhouse SMMU

Abstract

An inter-domain communication method based on jailhouse SMMU includes the following steps: Step S1, creating several virtual PCIe devices in the HostOS and GuestOS configuration files of the jailhouse, for use by the HostOS and GuestOS during system initialization, and performing inter-OS domain communication based on ivshmem technology; Step S2, configuring the virtual machine manager in the GuestOS to allow virtual machines to use SMMU; Step S3, SMMU maps a contiguous virtual address space, enabling virtual machines to access data in the virtual PCIe devices through the virtual address space. This invention solves the problem of jailhouse inter-domain communication not being able to use contiguous memory and improves the security and isolation of GuestOS accessing the system.

Description

Technical Field

[0001] This invention relates to virtualization technology, specifically to an inter-domain communication method based on jailhouse SMMU. Background Technology

[0002] Jailhouse is a lightweight, semi-virtualized virtualization solution led by Siemens. Jailhouse focuses on the partitioning of hardware resources rather than the sharing and virtualization of hardware resources, thus mitigating the overhead and latency. Based on business needs, resources such as CPU, memory, device interfaces, and interrupts are allocated before runtime, ensuring the security and independence of resource allocation during operation. This allows a multi-core CPU to be divided into multiple independent runtime environments, each capable of running different operating systems and deploying different services. Currently, Jailhouse's inter-domain communication function relies on shared memory, with Guest OSs communicating via ivshmem technology. However, this technology has the drawback of being unable to access contiguous addresses, and contiguous memory is rarely reserved in modern systems. If extensive inter-domain communication between Guest OSs is required, SMMU is needed to map non-contiguous physical addresses (PAs) to contiguous virtual addresses (VAs). Summary of the Invention

[0003] To address the aforementioned issues, the present invention aims to provide an inter-domain communication method based on Jailhouse SMMU. This method resolves the problem of Jailhouse inter-domain communication being unable to utilize contiguous memory by configuring the virtual devices required for Jailhouse inter-domain communication and by configuring the virtual machine to use virtual space addresses.

[0004] This invention provides an inter-domain communication method based on jailhouse SMMU, comprising the following steps: Step S1: Create several virtual PCIe devices in the HostOS and GuestOS configuration files of jailhouse. These virtual PCIe devices are used by HostOS and GuestOS during system initialization and are used for inter-OS domain communication based on ivshmem technology. Step S2: Configure the virtual machine manager in the GuestOS to allow virtual machines to use SMMU; In step S3, SMMU enables the virtual machine to access data in the virtual PCIe device through the virtual address space by mapping a continuous virtual address space.

[0005] Preferably, in step S1, the plurality of virtual PCIe devices are used for data sharing between the HostOS and each GuestOS; The GuestOS is configured by jailhouse.

[0006] Preferably, in step S2, the virtual machine manager allocates an ivshmem shared address space for each virtual machine based on several virtual PCIe devices.

[0007] Preferably, step S3 includes: Step S31: Add SMMU configuration information to the jailhouse configuration file; Step S32: Create an SMMU mapping table using the configuration information and specify the mapping method for the SMMU mapping table; Step S33: The smmu mapping table maps the ivshmem shared address space to the virtual address space.

[0008] Preferably, step S3 further includes: Step S34: GuestOS obtains the virtual address space mapped through SMMU; In step S35, the application inside GuestOS accesses data in the ivshmem shared address space through the virtual address space.

[0009] The beneficial effects of this invention are: 1. Address mapping via SMMU resolves the issue of inter-domain communication in jailhouse being unable to use contiguous memory.

[0010] 2. By using virtual machines in GuestOS to access virtual addresses, the security issue of accessing system memory between GuestOS systems is resolved. Attached Figure Description

[0011] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0012] Figure 1 This is a diagram illustrating the steps involved in implementing inter-domain communication via SMMU mapping based on jailhouse. Figure 2 This is a diagram illustrating the internal framework of jailhouse, which uses ivshmem and smmu to map memory space. Detailed Implementation

[0013] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Many specific details are set forth in the following description to provide a thorough understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art can make similar extensions without departing from the spirit of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0014] The current jailhouse's inter-domain communication function works on the principle of shared memory. GuestOS previously used ivshmem technology to achieve inter-domain communication, but this technology cannot access contiguous memory addresses.

[0015] To overcome the above problems, this invention provides an inter-domain communication method based on jailhouse SMMU, which can solve the problem that jailhouse inter-domain communication cannot use contiguous memory addresses.

[0016] This invention is based on the GICV3 version of the ARM architecture, where ARM is a processor architecture that supports a 64-bit instruction set. GICV3 is a version of the GIC that can be used with ARM processors, and it uses an interrupt controller configured by the SOC to reduce the CPU load.

[0017] See Figure 1 As shown in the figure, this application discloses an inter-domain communication method based on jailhouse SMMU, the method comprising: Step S1: Create several virtual PCIe devices in the HostOS and GuestOS configuration files of jailhouse. These virtual PCIe devices are used by HostOS and GuestOS during system initialization and are used for inter-OS domain communication based on ivshmem technology.

[0018] In this embodiment, the plurality of virtual PCIe devices are used for data sharing between the HostOS and each GuestOS. ivshmem is a virtual machine shared memory device designed to share memory regions running between different GuestOS. To enable all GuestOS to access the shared memory region, Jailhouse models ivshmem as a virtual PCIe device. The GuestOS is configured by jailhouse.

[0019] Step S2: Configure the virtual machine manager in the GuestOS to allow virtual machines to use SMMU.

[0020] In this embodiment, the virtual machine manager allocates an ivshmem shared address space to each virtual machine based on the virtual PCIe device, enabling the virtual machine to use the SMMU. The SMMU stands for System Memory Management Unit, a system IP belonging to Arm. The SMMU is used for virtualized memory management and address translation, especially in systems supporting virtualization and security. The SMMU provides address translation and access control for memory access, allowing different devices to access system memory while maintaining system security and isolation.

[0021] It should be noted that the reason why SMMU can handle non-contiguous memory access is because it implements a mapping from virtual addresses to physical addresses, allowing virtual PCIe devices to access virtual addresses of memory without needing to know the actual physical addresses.

[0022] In step S3, SMMU enables the virtual machine to access data in the virtual PCIe device through the virtual address space by mapping a continuous virtual address space.

[0023] In this embodiment, the SMMU implements virtual address mapping, memory paging, and memory access permissions. The virtual address mapping maps virtual addresses requested by the device to actual physical addresses, allowing the device to use virtual addresses without needing the actual physical addresses. Therefore, when accessing memory using virtual addresses, the device does not need to concern itself with the physical layout of the memory.

[0024] SUM supports a memory paging mechanism, which divides the virtual address space into pages. Each page is mapped to a location in physical memory. This allows non-contiguous memory to be mapped into a contiguous virtual address space, and thus, contiguous accesses to virtual addresses in the virtual address space are mapped to non-contiguous physical memory.

[0025] At the same time, SMMU can implement memory access control to ensure that different devices can only access the memory areas they are authorized to access, thereby enhancing system security.

[0026] For details, see Figure 2 As shown, the mapping purpose is achieved by adding SMMU configuration information to the jailhouse and creating an SMMU mapping table. Specifically, step S3 includes: Step S31: Add SMMU configuration information to the jailhouse configuration file; Step S32: Create an SMMU mapping table using the configuration information and specify the mapping method for the SMMU mapping table; Step S33: The smmu mapping table maps the ivshmem shared address space to the virtual address space.

[0027] Step S34: GuestOS obtains the virtual address space mapped through SMMU; In step S35, the application inside GuestOS accesses data in the ivshmem shared address space through the virtual address space.

[0028] In this embodiment, the virtual address mapping and memory management functions of SMMU allow devices to access non-contiguous memory while providing access control and isolation. Furthermore, the ivshmem shared address space is located in the SMMU mapping table, which is crucial for supporting multiple devices to share system memory and ensuring system stability and security.

[0029] The beneficial effects of this invention are as follows: 1. By configuring the virtual PCIe devices and SMMU devices required for jailhouse inter-domain communication, the problem of jailhouse inter-domain communication not being able to use contiguous non-memory can be solved.

[0030] 2. By using SMMU mapping, multiple PCIe spaces are mapped to a contiguous virtual address space. Applications inside the virtual machine can use this contiguous virtual address space to access ivshmem data without needing to know the underlying physical address, thus solving the security and isolation issues of GuestOS accessing system memory.

[0031] Although the present invention has been described using the above preferred embodiments, it is not intended to limit the scope of protection of the present invention. Any changes and modifications made by those skilled in the art to the above embodiments without departing from the spirit and scope of the present invention shall still fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be defined by the claims.

Claims

1. A method for inter-domain communication based on Jailhouse SMMU, characterized in that, Includes the following steps: Step S1: Create several virtual PCIe devices in the HostOS and GuestOS configuration files of jailhouse. These virtual PCIe devices are used by HostOS and GuestOS during system initialization and are used for inter-OS domain communication based on ivshmem technology. Step S2: Configure the virtual machine manager in the GuestOS to allow virtual machines to use SMMU; In step S3, SMMU enables the virtual machine to access data in the virtual PCIe device through the virtual address space by mapping a contiguous virtual address space. SMMU implements virtual address mapping, memory paging, and memory access permissions. The virtual address mapping maps the virtual address requested by the device to the actual physical address, allowing the device to use the virtual address without needing the actual physical address; The memory paging is achieved by dividing the virtual address space into pages, each page being mapped to a location in physical memory. This allows non-contiguous memory to be mapped into a contiguous virtual address space, thus enabling continuous access to virtual addresses in the virtual address space to be mapped to non-contiguous physical memory. The memory access permissions ensure that different devices can only access the memory regions they are authorized to access, thereby enhancing system security.

2. The inter-domain communication method based on Jailhouse SMMU according to claim 1, characterized in that, In step S1, the plurality of virtual PCIe devices are used for sharing data between the HostOS and each GuestOS; The GuestOS is configured by jailhouse.

3. The inter-domain communication method based on Jailhouse SMMU according to claim 1, characterized in that, In step S2, the virtual machine manager allocates an ivshmem shared address space for each virtual machine based on several virtual PCIe devices.

4. The inter-domain communication method based on Jailhouse SMMU according to claim 1, characterized in that, Step S3 includes: Step S31: Add SMMU configuration information to the jailhouse configuration file; Step S32: Create an SMMU mapping table using the configuration information and specify the mapping method for the SMMU mapping table; Step S33: The smmu mapping table maps the ivshmem shared address space to the virtual address space.

5. The inter-domain communication method based on Jailhouse SMMU according to claim 1, characterized in that, Step S3 also includes: Step S34: GuestOS obtains the virtual address space mapped through SMMU; In step S35, the application inside GuestOS accesses data in the ivshmem shared address space through the virtual address space.

Images