Cipher card virtualization method, system, equipment and medium

Abstract

The invention relates to the field of encryption communication technology, and provides a password card virtualization method, system and device and a medium, and the method comprises the steps: responding to starting of a host machine, identifying and initializing SR-IOV through firmware, and starting a privileged domain; a corresponding PF drive is loaded on the host machine; starting a VF drive through the PF drive and distributing the VF drive to a corresponding client; and in response to sending a message between the PF driver and the VF driver, transmitting the message through the mailbox and the doorbell and synchronizing the message through the register. According to the invention, the password card is configured to support SR-IOV and is divided into a plurality of VFs. Each VF has independent interrupt, address space and configuration space and can be directly accessed by an independent virtual machine, the performance bottleneck brought by traditional I / O virtualization is eliminated, and meanwhile higher safety and isolation are provided.

Description

Technical Field

[0001] The present invention relates to the field of encryption communication technology, and in particular to a method, system, device and medium for virtualizing a cryptographic card. Background Art

[0002] Nowadays, in the context of cloud computing and big data, virtualization technology, as its core basic technology support, has played an indispensable role. In the current virtualization technology, the I / O performance between virtual machines is one of the key factors affecting the performance of the cloud platform. In a virtualized environment, multiple virtual machines (VMs) share the resources of a physical server, including CPU, memory, storage, and I / O devices. However, on the road to virtualization, the actual situation of insufficient I / O virtualization performance, high CPU overhead, and low utilization has always been a problem that needs to be solved urgently.

[0003] As an important hardware device for processing encryption and decryption operations, the password card has performance bottlenecks and security risks in a virtualized environment. Traditional I / O virtualization technologies, such as full virtualization and paravirtualization, usually implement the allocation of password card resources through software simulation or sharing. Although they can effectively isolate virtual machines, they usually introduce significant performance losses, especially in I / O intensive applications. This is because all I / O requests need to be converted and scheduled by the virtualization layer, which adds additional latency and CPU burden, increases the overhead of the virtualization layer, and may also introduce security risks. In scenarios with heavy I / O loads, the weakness of the virtual password card seriously affects the user experience. Summary of the invention

[0004] Based on the above purpose, the present invention proposes a method for virtualizing a password card, comprising: In response to the host machine starting, the firmware identifies and initializes SR-IOV and starts the privileged domain; Load the corresponding PF driver on the host; Start the VF driver through the PF driver and distribute it to the corresponding client; In response to the message being sent between the PF driver and the VF driver, the message is delivered through the mailbox and the doorbell and the message is synchronized through the register.

[0005] In some embodiments, in response to sending a message between the PF driver and the VF driver, the steps of delivering the message through the mailbox and the doorbell and synchronizing the message through the register include: In response to the PF driver sending a message to the VF driver, the PF driver issues a request to set a flag bit; Modify the flag bit in the register accordingly and check it; In response to the flag bit check being successful, the PF driver writes the send data in the independent mailbox and generates a mailbox interrupt on the VF driver to be communicated; The VF driver reads the transmission data from the mailbox through the mailbox interrupt and notifies the PF driver.

[0006] In some embodiments, in response to sending a message between the PF driver and the VF driver, the steps of transmitting the message through the mailbox and the doorbell and synchronizing the message through the register further include: In response to the VF driver sending a message to the PF driver, the VF driver issues a request to set a flag bit; Modify the flag bit in the register accordingly and check it; In response to the flag bit check being successful, the VF driver writes the send data in the independent mailbox and generates a mailbox interrupt on the PF driver to be communicated; The PF driver reads the transmission data from the mailbox through the mailbox interrupt and notifies the VF driver.

[0007] In some embodiments, in response to the host machine starting up, the step of identifying and initializing SR-IOV through firmware and starting the privileged domain includes: When the host starts, the BIOS firmware parses the ACPI table to identify whether there is an SR-IOV device on the PCIe bus; In response to the SR-IOV device existing, initializing the root entry table, the context entry table, and the SR-IOV device; Hide specific PCI devices and enable privileged domains.

[0008] In some embodiments, the step of starting the VF driver through the PF driver includes: The PF driver activates the SR-IOV function of the host machine and starts the VF driver; Turn on the VF device through the VF driver; The PF driver abstracts the VF device.

[0009] In some embodiments, the step of the PF driver abstracting the VF device includes: Register the VF device in the device manager and assign a unique device identifier; Create a PCIe configuration space for the VF device and generate a BAR mapping; The bar mapping information is notified to the VMM to create the port translation table, MMIO translation table and io page table.

[0010] In some embodiments, the step of allocating to the corresponding client comprises: Obtain the required port translation table, MMIO translation table and io page table according to the VF device to be allocated and bind them to the client; Allocate corresponding physical resources to the client on the host, where the physical resources include ports, memory, and physical addresses; The client's port I / O requests, MMIO access requests, and physical addresses are mapped to physical resources through the VMM.

[0011] The present invention proposes a system for virtualizing a password card, comprising: A startup unit, configured to respond to a host startup, identify and initialize SR-IOV through firmware, and start the privileged domain; A loading unit, configured to load a corresponding PF driver on a host machine; A distribution unit, configured to start the VF driver through the PF driver and distribute it to the corresponding client; A communication unit is configured to respond to messages sent between the PF driver and the VF driver, deliver messages through a mailbox and a doorbell, and synchronize messages through a register.

[0012] The present invention provides a computer device, comprising: At least one processor; and a memory, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the program, the steps of the method for virtualizing a cryptographic card are performed.

[0013] The present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for virtualizing a cryptographic card are executed.

[0014] The present invention has at least the following beneficial technical effects: The present invention proposes a method, system, device and medium for virtualizing a cryptographic card. The method comprises: in response to a host machine startup, identifying and initializing SR-IOV through firmware, and starting a privileged domain; loading a corresponding PF driver on the host machine; starting a VF driver through the PF driver and distributing it to a corresponding client; in response to a message being sent between the PF driver and the VF driver, delivering the message through a mailbox and a doorbell and synchronizing the message through a register.

[0015] The present invention configures the password card to support SR-IOV and divides it into multiple VFs. Each VF has independent interrupts, address spaces and configuration spaces, and can be directly accessed by a separate virtual machine, eliminating the performance bottleneck caused by traditional I / O virtualization, while providing higher security and isolation. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other embodiments can be obtained based on these drawings without paying creative work.

[0017] Figure 1 A flowchart of a method for virtualizing a password card provided by the present invention; Figure 2 A system module diagram of a cryptographic card virtualization provided by the present invention; Figure 3 A mailbox communication mechanism of an embodiment of a method for virtualizing a password card provided by the present invention; Figure 4 A PF and VF communication flow chart of an embodiment of a method for virtualizing a password card provided by the present invention; Figure 5 A system initialization diagram of an SR-IOV device of an embodiment of a method for virtualizing a cryptographic card provided by the present invention; Figure 6 An abstract VF device flow chart of an embodiment of a method for virtualizing a cryptographic card provided by the present invention; Figure 7 A schematic diagram of the structure of an embodiment of a computer device provided by the present invention; Figure 8 A schematic diagram of the structure of an embodiment of a computer-readable storage medium provided by the present invention. DETAILED DESCRIPTION

[0018] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the embodiments of the present invention are further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0019] It should be noted that all expressions using "first" and "second" in the embodiments of the present invention are for distinguishing two non-identical entities with the same name or non-identical parameters. It can be seen that "first" and "second" are only for the convenience of expression and should not be understood as limitations on the embodiments of the present invention. The subsequent embodiments will not explain this one by one.

[0020] The present invention proposes a method for virtualizing a password card. Figure 1 ,include: S1: In response to the host machine starting up, the firmware identifies and initializes SR-IOV and starts the privileged domain; S2: Load the corresponding PF driver on the host; S3: Start the VF driver through the PF driver and distribute it to the corresponding client; S4: In response to the message being sent between the PF driver and the VF driver, the message is delivered through the mailbox and the doorbell and the message is synchronized through the register.

[0021] The present invention's cryptographic card virtualization method based on SR-IOV (Single Root I / O Virtualization, an IO virtualization technology) technology realizes efficient allocation and secure isolation of cryptographic card resources in a virtualized environment by directly accessing the physical cryptographic card device and utilizing the hardware isolation and performance optimization characteristics of SR-IOV technology. This method not only improves the encryption and decryption performance of the virtualized environment, but also enhances the security and reliability of the system, providing a new solution for the development of cloud computing and virtualization technology.

[0022] In some embodiments, see Figure 1 , Figure 3 and Figure 4 In response to sending a message between the PF driver and the VF driver, the steps of delivering the message through the mailbox and the doorbell and synchronizing the message through the register include: In response to the PF driver sending a message to the VF driver, the PF driver issues a request to set a flag bit; Modify the flag bit in the register accordingly and check it; In response to the flag bit check being successful, the PF driver writes the send data in the independent mailbox and generates a mailbox interrupt on the VF driver to be communicated; The VF driver reads the transmission data from the mailbox through the mailbox interrupt and notifies the PF driver.

[0023] Since PF is not only a device, but also has the task of configuring and managing VF, and configuring relevant data information for VF, the communication between PF driver and VF driver is essential. The communication between PF driver and VF driver is realized in the form of mailbox and doorbell.

[0024] The architecture of the PF and VF mailbox communication mechanism is as follows Figure 3 As shown in the figure, the mailbox and doorbell are essentially event channels of shared memory and VMM. Each VF has an independent mailbox (shared memory), PF Mailbox and VF Mailbox registers. Among them, the independent mailbox is used to store the data that both parties need to send, and the two registers are used to synchronize the message sending between PF and VF.

[0025] The process of PF driver sending messages to VF driver is as follows Figure 4As shown in the figure, in order to ensure the synchronization of PF and VF data transmission, a flag bit is set in both the PF Mailbox and VF Mailbox registers, denoted as FPU. When PF sends a message to the VF driver, the PF driver first sends a request to the hardware to set the FPU bit of the PF Mailbox, and then the PF driver verifies the bit. If the verification is successful, the PF driver writes the data to be sent to the independent mailbox and generates a Mailbox interrupt on the corresponding VF. The VF calls the corresponding interrupt handler, reads the data from the independent mailbox, and finally notifies the PF of the receipt of the message through an interrupt.

[0026] In some embodiments, see Figure 1 and Figure 3 In response to the message being sent between the PF driver and the VF driver, the steps of delivering the message through the mailbox and the doorbell and synchronizing the message through the register also include: In response to the VF driver sending a message to the PF driver, the VF driver issues a request to set a flag bit; Modify the flag bit in the register accordingly and check it; In response to the flag bit check being successful, the VF driver writes the send data in the independent mailbox and generates a mailbox interrupt on the PF driver to be communicated; The PF driver reads the transmission data from the mailbox through the mailbox interrupt and notifies the VF driver.

[0027] When VF sends a message to the PF driver, the VF driver first sends a request to the hardware to set the FvU bit of the VF Mailbox, and then the VF driver verifies the bit. If the verification succeeds, the VF driver writes the data to be sent to the independent mailbox and generates a Mailbox interrupt on the corresponding PF. The PF calls the corresponding interrupt handler, reads the data from the independent mailbox, and finally notifies the VF of the message through the interrupt.

[0028] In some embodiments, see Figure 1 and Figure 5 In response to the host machine starting up, the steps of identifying and initializing SR-IOV through firmware and starting the privileged domain include: When the host starts, the BIOS firmware parses the ACPI table to identify whether there is an SR-IOV device on the PCIe (peripheral component interconnect express, a high-speed serial computer expansion bus standard) bus; In response to the SR-IOV device existing, initializing the root entry table, the context entry table, and the SR-IOV device; Hide specific PCI devices and enable privileged domains.

[0029] SR-IOV hardware initialization and privileged domain startup. The SR-IOV device is essentially an I / O peripheral. During the initialization phase, it is necessary to complete the SR-IOV device detection, initialization of the root entry table, initialization of the context entry table, initialization of the IOTLB, and initialization of the SR-IOV device. At the same time, the startup of the privileged domain will also end at this stage.

[0030] When the host (Hypervisor or physical machine) boots, the BIOS or UEFI firmware identifies and initializes PCIe devices that support SR-IOV. This includes configuring the SR-IOV capabilities of the device, such as enabling SR-IOV, setting the number of VFs, etc. The host operating system loads the corresponding PF driver, which is responsible for further configuring and managing the PCIe device, including setting the resource configuration of the VF (such as memory mapping, interrupts, etc.). In a virtualized environment, a privileged domain is a virtual machine for specific management software. This domain has higher permissions than other clients and can access and configure SR-IOV devices. After the privileged domain is started, the corresponding management tools or services are loaded, which are responsible for initializing SR-IOV devices, configuring PFs and VFs, and managing the allocation of VFs.

[0031] The ACPI table is a data structure defined in the ACPI (Advanced Configuration and Power Interface) protocol that is used to describe the system's hardware configuration and power management information. The ACPI table consists of multiple subtables, each with a different purpose and format. Together, these subtables provide detailed information about the system's hardware and power management. The ACPI table is a set of data structures that contains important information about the computer's hardware and system configuration so that the operating system can identify and manage hardware devices.

[0032] Pciback hide is a configuration option used in a virtualized environment. Its main function is to hide specific PCI (Peripheral Component Interconnect) devices from the host operating system so that they can be assigned to specific guests for exclusive use. Doing so ensures that the performance and resources of PCI devices are not shared by other guests, thereby improving performance and security. In a virtualized environment, by default, all PCI devices can be accessed by all virtual machines. However, in some cases, you may want to reserve certain PCI devices for specific virtual machines so that they can monopolize the performance of these devices.

[0033] PCI devices are usually directly connected to the PCI or PCI-E bus of the host machine, providing specific functions for the host machine or other devices, such as network communication, storage access, etc. PCI devices are directly connected to the PCI or PCI-E bus of the host machine and exchange data through the bus. In a virtualized environment, PCI devices can be directly allocated to virtual machines for use, but this method will cause the physical device to be unable to be shared by multiple virtual machines.

[0034] SR-IOV devices support two modes: physical function (PF) and virtual function (VF). PF is a complete PCIe device with SR-IOV capabilities that can be discovered and configured; VF is a simple PCIe function separated from PF, and each VF can be assigned to a virtual machine for use.

[0035] Initialize the root entry table. The root entry table is a key component in the SR-IOV architecture and is used to store the root entry of each virtual function (VF). During the initialization phase, the system allocates and initializes the root entry table for the SR-IOV device to facilitate the subsequent management of the VF. Initialize the context entry table. The context entry table is used to store the context information of each VF, including the BAR (Base Address Register, the base address register in the PCI device) space of the VF, interrupt information, etc. The system allocates and initializes the corresponding context entry for each VF. Initialize the IOTLB. The IOTLB is a component in the SR-IOV architecture used to cache the results of I / O address translation to improve the efficiency of address translation. During the initialization phase, the system configures and initializes the IOTLB for subsequent efficient I / O address translation. Initialize the SR-IOV device. According to the SR-IOV capability of the device, the system will initialize the device, including setting the initial number of VFs, the BAR space of the VF, the interrupt policy, etc.

[0036] In some embodiments, see Figure 1 and Figure 6 The step of starting the VF driver through the PF driver includes: The PF driver activates the SR-IOV function of the host machine and starts the VF driver; Turn on the VF device through the VF driver; The PF driver abstracts the VF device.

[0037] The host PF driver sets the VF as part of the PF driver. It mainly helps the host activate the SR-IOV function of the device, turn on the VF, and call the system function to complete the hidden function of the device to ensure that the host releases these VF devices and prepare for the subsequent VF device transparent transmission. After that, the host can use the device transparent transmission function to bind the specified VF to a client as its exclusive device. This behavior is based on the device isolation principle of SR-IOV, that is, other clients running on the VMM cannot access the VF. At the same time, all I / O operations of the VF under the entire platform must be converted by the SR-IOV hardware on the host to reach the specified memory.

[0038] The PF driver not only manages direct access to physical devices, but is also responsible for configuring and enabling VFs. This includes allocating resources (such as PCI configuration space, memory windows, interrupts, etc.) to each VF and ensuring that these resources are physically and logically isolated. The PF driver sets the PCIe configuration space of the VF, including the device ID, vendor ID, subsystem ID, etc., to ensure that each VF can be recognized as an independent PCIe device by the client operating system.

[0039] The process of the host PF driver setting up the VF function is as follows: activating the SR-IOV function, the PF driver will first check whether the physical device supports SR-IOV and activate this function; once the SR-IOV function is activated, the PF driver will be responsible for creating and opening the VF according to the configuration or requirements. Each VF is an independent virtual PCIe device with its own resources (such as BAR space, interrupts, etc.); calling the system function to complete the device abstraction. After opening the VF, the PF driver will call the system function to hide or isolate these VF devices to ensure that they are not accessed by other unauthorized components on the host. This is an important manifestation of the SR-IOV device isolation principle; preparing for VF device transparent transmission, the PF driver is ready for the transparent transmission of the VF device. Transparent transmission refers to directly assigning the VF device to a virtual machine (VM) or container, so that it can directly access the VF device like accessing a physical device.

[0040] The device isolation principle of SR-IOV ensures that other clients running on the VMM (virtual machine monitor) cannot access the VF devices that are transparently transmitted to a specific client. This isolation is achieved through a hardware mechanism, providing higher security and stability.

[0041] In some embodiments, see Figure 1 and Figure 6 The step of the PF driver abstracting the VF device includes: Register the VF device in the device manager and assign a unique device identifier; Create a PCIe configuration space for the VF device and generate a BAR mapping; The bar mapping information is notified to the VMM to create the port translation table, MMIO translation table and io page table.

[0042] The role of the VF device of abstract SR-IOV is to abstract the hidden hardware, assign identifiers to such devices, obtain PCIe configuration space information, and generate BAR space mapping. After completing its main functions, it passes the BAR mapping information to the VMM to create the corresponding port I / O (PIO), MMIO (Memory-Mapped I / O) translation table and IO page table. In this way, the corresponding VF device can be seen and accessed in the client.

[0043] According to the hardware information and configuration of the VF device, create a device object instance and register the device instance with the system's device manager for subsequent management and access. The system automatically generates a unique device identifier based on the type, location and other information of the device. Allocate configuration space for the device on the PCIe bus, read the value of the BAR from the configuration space of the PCIe device, which is usually a base address, and map the base address of the BAR to the host's memory or IO address space. Interrupts are a way for hardware to communicate with the CPU, used to notify the CPU that the device needs service, and notifying the VMM is to notify the VMM of device status changes or events.

[0044] In some embodiments, see Figure 1 and Figure 6 , the step of allocating to the corresponding client comprises: Obtain the required port translation table, MMIO translation table and io page table according to the VF device to be allocated and bind them to the client; Allocate corresponding physical resources to the client on the host, where the physical resources include ports, memory, and physical addresses; The client's port I / O requests, MMIO access requests, and physical addresses are mapped to physical resources through the VMM.

[0045] The main purpose of initializing the VF driver of client N is to prepare the corresponding data structures and allocate devices for clients that directly allocate devices. Client N refers to the virtual machine that directly owns the right to use the VF (that is, the VF is directly allocated to client N). Unlike the ordinary client startup process, client N needs a port I / O translation table, MMIO translation table, and I / O page table required for DMA remapping hardware to perform address translation. These data structures must be created before client N is started.

[0046] Determine the required port I / O, MMIO, and DMA resources, and allocate the corresponding physical resources (such as ports, memory areas, etc.) to the client on the host. Fill in the entries of the port I / O translation table, MMIO translation table, and I / O page table according to the allocated resources. Before the client starts, verify and test the translation table and page table to ensure that they can correctly map the client's access requests to the host's resources.

[0047] The present invention proposes a system for virtualizing a password card. Figure 2 ,include: The startup unit 100 is configured to identify and initialize SR-IOV through firmware and start the privileged domain in response to the host startup; A loading unit 200, configured to load a corresponding PF driver on a host machine; The allocation unit 300 is configured to start the VF driver through the PF driver and allocate it to the corresponding client; The communication unit 400 is configured to respond to the message sent between the PF driver and the VF driver, transmit the message through the mailbox and the doorbell, and synchronize the message through the register.

[0048] The present invention configures the password card to support SR-IOV and divides it into multiple VFs. Each VF has independent interrupts, address spaces and configuration spaces, and can be directly accessed by a separate virtual machine, eliminating the performance bottleneck caused by traditional I / O virtualization, while providing higher security and isolation.

[0049] Based on the same inventive concept, according to another aspect of the present invention, Figure 7 As shown, an embodiment of the present invention further provides a computer device 30, which includes a processor 310 and a memory 320. The memory 320 stores a computer program 321 that can be run on the processor. When the processor 310 executes the program, the steps of the above method are performed.

[0050] Based on the same inventive concept, according to another aspect of the present invention, Figure 8 As shown, an embodiment of the present invention further provides a computer-readable storage medium 40, which stores a computer program 410 for executing the above method when executed by a processor.

[0051] The embodiment of the present invention may also include a corresponding computer device. The computer device includes a memory, at least one processor, and a computer program stored in the memory and executable on the processor, and the processor executes any one of the above methods when executing the program.

[0052] The memory, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as program instructions / modules in the embodiments of the present application. The processor executes various functional applications and data processing of the device by running the non-volatile software programs, instructions and modules stored in the memory, that is, implementing the above method.

[0053] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the device, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In an embodiment, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the local module via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0054] Finally, it should be noted that a person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium of the program can be a disk, an optical disk, a read-only storage memory (ROM) or a random access memory (RAM), etc. The above-mentioned computer program embodiments can achieve the same or similar effects as the corresponding above-mentioned arbitrary method embodiments.

[0055] It will also be appreciated by those skilled in the art that various exemplary logic blocks, modules, circuits and algorithm steps described in conjunction with the disclosure herein can be implemented as electronic hardware, computer software or a combination of the two. In order to clearly illustrate this interchangeability of hardware and software, a general description has been given to the functions of various schematic components, blocks, modules, circuits and steps. Whether this function is implemented as software or hardware depends on specific applications and the design constraints imposed on the entire system. Those skilled in the art can implement the function in various ways for each specific application, but this implementation decision should not be interpreted as causing a departure from the disclosed scope of the embodiments of the present invention.

[0056] The above are exemplary embodiments disclosed in the present invention, but it should be noted that various changes and modifications may be made without departing from the scope of the embodiments disclosed in the present invention as defined in the claims. The functions, steps and / or actions of the method claims according to the disclosed embodiments described herein do not need to be performed in any particular order. The serial numbers of the embodiments disclosed in the above embodiments of the present invention are for description only and do not represent the advantages and disadvantages of the embodiments. In addition, although the elements disclosed in the embodiments of the present invention may be described or required in individual form, they may also be understood as multiple unless explicitly limited to the singular.

[0057] It should be understood that, as used herein, the singular forms "a", "an" are intended to include the plural forms as well, unless the context clearly supports an exception. It should also be understood that, as used herein, "and / or" refers to any and all possible combinations including one or more of the associated listed items.

[0058] A person skilled in the art should understand that the discussion of any of the above embodiments is only exemplary and is not intended to imply that the scope of the disclosure of the embodiments of the present invention (including the claims) is limited to these examples; under the concept of the embodiments of the present invention, the technical features in the above embodiments or different embodiments can also be combined, and there are many other changes in different aspects of the above embodiments of the present invention, which are not provided in detail for the sake of simplicity. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present invention should be included in the protection scope of the embodiments of the present invention.

Claims

1. A method for virtualizing a password card, characterized in that: include: In response to the host machine starting, the firmware identifies and initializes SR-IOV and starts the privileged domain; Load the corresponding PF driver on the host; Start the VF driver through the PF driver and distribute it to the corresponding client; In response to the message being sent between the PF driver and the VF driver, the message is delivered through the mailbox and the doorbell and the message is synchronized through the register.

2. A method for virtualizing a password card according to claim 1, characterized in that: The steps of transmitting the message through the mailbox and the doorbell in response to the message being sent between the PF driver and the VF driver and synchronizing the message through the register include: In response to the PF driver sending a message to the VF driver, the PF driver issues a request to set a flag bit; Modify the flag bit in the register accordingly and check it; In response to the flag bit check being successful, the PF driver writes the send data in the independent mailbox and generates a mailbox interrupt on the VF driver to be communicated; The VF driver reads the transmission data from the mailbox through the mailbox interrupt and notifies the PF driver.

3. A method for virtualizing a password card according to claim 1, characterized in that: The steps of transmitting the message through the mailbox and the doorbell in response to the message being sent between the PF driver and the VF driver and synchronizing the message through the register also include: In response to the VF driver sending a message to the PF driver, the VF driver issues a request to set a flag bit; Modify the flag bit in the register accordingly and check it; In response to the flag bit check being successful, the VF driver writes the send data in the independent mailbox and generates a mailbox interrupt on the PF driver to be communicated; The PF driver reads the transmission data from the mailbox through the mailbox interrupt and notifies the VF driver.

4. A method for virtualizing a password card according to claim 1, characterized in that: In response to the host machine starting up, the steps of identifying and initializing SR-IOV through firmware and starting the privileged domain include: When the host starts, the BIOS firmware parses the ACPI table to identify whether there is an SR-IOV device on the PCIe bus; In response to the SR-IOV device existing, initializing the root entry table, the context entry table, and the SR-IOV device; Hide specific PCI devices and enable privileged domains.

5. A method for virtualizing a password card according to claim 1, characterized in that: The step of starting the VF drive through the PF drive includes: The PF driver activates the SR-IOV function of the host machine and starts the VF driver; Turn on the VF device through the VF driver; The PF driver abstracts the VF device.

6. A method for virtualizing a password card according to claim 5, characterized in that: The step of the PF driver abstracting the VF device includes: Register the VF device in the device manager and assign a unique device identifier; Create a PCIe configuration space for the VF device and generate a BAR mapping; The bar mapping information is notified to the VMM to create the port translation table, MMIO translation table and io page table.

7. A method for virtualizing a password card according to claim 6, characterized in that: The steps of allocating to the corresponding client include: Obtain the required port translation table, MMIO translation table and io page table according to the VF device to be allocated and bind them to the client; Allocate corresponding physical resources to the client on the host, where the physical resources include ports, memory, and physical addresses; The client's port I / O requests, MMIO access requests, and physical addresses are mapped to physical resources through the VMM.

8. A system for virtualizing a password card, characterized in that: include: A startup unit, configured to respond to a host startup, identify and initialize SR-IOV through firmware, and start the privileged domain; A loading unit, configured to load a corresponding PF driver on a host machine; A distribution unit, configured to start the VF driver through the PF driver and distribute it to the corresponding client; A communication unit is configured to respond to messages sent between the PF driver and the VF driver, deliver messages through a mailbox and a doorbell, and synchronize messages through a register.

9. A computer device comprising: at least one processor; and a memory storing a computer program executable on the processor, wherein the processor executes the steps of a method for virtualizing a cryptographic card as claimed in any one of claims 1 to 7 when executing the program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method for virtualizing a cryptographic card as claimed in any one of claims 1 to 7 are performed.

Images