Direct storage access method, device and equipment of virtual machine and storage medium

Abstract

The invention provides a direct storage access method, device and equipment of a virtual machine and a storage medium, the virtual machine is deployed in target equipment, and the method comprises the following steps: receiving a direct storage access request sent by the virtual machine through a target device in the target equipment; the direct storage access request comprises a first physical address for direct storage access operation; determining a second physical address matched with the first physical address according to an address mapping relationship between a pre-configured physical address of a first address range and a physical address of a second address range; the first address range comprises an address range which is not allocated to the virtual machine for use; the second address range is an address range allocated to the virtual machine; and through the target device, performing direct storage access operation on the memory according to the second physical address, and sending a direct storage access result to the virtual machine. According to the process of the invention, the direct storage access operation can be limited, and the isolation of the virtual machine in the target equipment is ensured.

Description

Technical Field

[0001] The present application relates to the field of virtual machine technology, and in particular to a method, device, electronic device and computer-readable storage medium for direct storage access of a virtual machine. Background Art

[0002] In order to improve the utilization of the central processing unit (CPU) of the system, direct memory access (DMA) devices are becoming increasingly popular.

[0003] The DMA device can directly access the physical memory resources of the computer system. For example, the data stored in the DMA device can be directly transferred to the physical memory of the computer system without passing through the CPU. In a computer system including a virtual machine, the DMA device corresponding to the virtual machine will execute the request of the virtual machine and perform DMA operations.

[0004] However, in theory, the DMA device can access any physical memory, and the virtual machine does not send requests according to the address of the actual allocated physical memory, so the virtual machine can use the DMA device to access physical memory resources that do not belong to the virtual machine, that is, illegally access physical memory resources, causing security risks. Summary of the invention

[0005] The embodiments of the present application provide a method, device, electronic device and computer-readable storage medium for direct storage access of a virtual machine, so as to at least solve the problem in the related art that a virtual machine illegally accesses physical memory resources through a DMA device.

[0006] In a first aspect, an embodiment of the present application provides a method for direct storage access of a virtual machine, wherein the virtual machine is deployed on a target device, and the method includes: receiving a direct storage access request issued by the virtual machine through a target device in the target apparatus; the direct storage access request includes a first physical address for a direct storage access operation; the target device is a device having a direct storage access function, the first physical address belongs to a first address range; the first address range includes an address range not allocated to the virtual machine for use; Determine a second physical address matching the first physical address according to a preconfigured address mapping relationship between a physical address in a first address range and a physical address in a second address range; the second address range is an address range allocated to the virtual machine for use; A direct storage access operation is performed on the memory according to the second physical address through the target device, and a result of the direct storage access is sent to the virtual machine.

[0007] In a second aspect, an embodiment of the present application provides a direct storage access device for a virtual machine, wherein the virtual machine is deployed on a target device, and the device includes: A receiving module: used for receiving a direct storage access request issued by the virtual machine through a target device in the target equipment; the direct storage access request includes a first physical address for a direct storage access operation; the target device is a device with a direct storage access function, the first physical address belongs to a first address range; the first address range includes an address range that is not allocated to the virtual machine for use; A mapping module: used to determine a second physical address matching the first physical address according to a pre-configured address mapping relationship between a physical address in a first address range and a physical address in a second address range; the second address range is an address range allocated to the virtual machine for use; An execution module is used to perform a direct storage access operation on the memory according to the second physical address through the target device, and send the result of the direct storage access to the virtual machine.

[0008] In a third aspect, an embodiment of the present application further provides an electronic device, including a processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the method of the first aspect.

[0009] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, which, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to execute the method of the first aspect.

[0010] In an embodiment of the present application, by mapping a first physical address in a direct storage access request issued by a virtual machine to a direct storage access device to a second physical address actually allocated to the virtual machine, and making the direct storage access device perform a direct storage access operation according to the second physical address, the physical memory accessible to the direct storage access device is restricted to the physical memory allocated to the virtual machine, thereby limiting the direct storage access and preventing the virtual machine from using the direct storage access device to access memory resources that do not belong to the virtual machine; by preventing the virtual machine from using the direct storage access device to access the physical memory occupied by other virtual machines, the isolation between virtual machines is guaranteed, thereby improving the security of the target device.

[0011] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0013] Figure 1 It is a step flow chart of a method for direct storage access of a virtual machine provided in an embodiment of the present application; Figure 2 is another step flow chart of the direct storage access method of a virtual machine provided in an embodiment of the present application; Figure 3 It is a block diagram of a direct storage access device for a virtual machine provided in an embodiment of the present application; Figure 4 is a block diagram of an electronic device provided by an embodiment of the present invention; Figure 5 is a block diagram of another electronic device according to another embodiment of the present invention. DETAILED DESCRIPTION

[0014] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0015] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally a class, and the number of objects is not limited. For example, the first object can be one or more. In addition, the term "and / or" in the specification and claims is used to describe the association relationship of associated objects, indicating that three kinds of relationships can exist, for example, A and / or B can be represented: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the front and back associated objects are a kind of "or" relationship. In the embodiment of the present application, the term "multiple" refers to two or more, and other quantifiers are similar.

[0016] Figure 1, is a flowchart of the steps of a direct storage access method of a virtual machine provided in an embodiment of the present application, wherein the virtual machine is deployed on a target device, such as Figure 1 As shown, the method may include: Step 101: receiving a direct storage access request issued by the virtual machine through a target device in the target equipment; the direct storage access request includes a first physical address for a direct storage access operation; the target device is a device with a direct storage access function, and the first physical address belongs to a first address range; the first address range includes an address range that is not allocated to the virtual machine for use.

[0017] The embodiments of the present application may be based on the fifth-generation Reduced Instruction Set Computer – V (RISC-V) architecture. The RISC-V architecture is an open source architecture that can be used to build a computer system including a virtual machine. The target device may be an embedded system based on RISC-V. In the target device, multiple virtual computer systems, i.e., multiple virtual machines, may be deployed. Exemplarily, the virtual computer system may be Linux.

[0018] The target device also includes a target device, and the target device has a direct storage access function, that is, the target device includes a DMA device. Exemplarily, the DMA device may include peripheral devices such as a hard disk drive and a network adapter, and may also include a serial peripheral interface (Serial Peripheral Interface, SPI), an integrated circuit bus (Inter-Integrated Circuit, IIC), an asynchronous receiver / transmitter (Universal Asynchronous Receiver / Transmitter, UART), an analog-to-digital converter (Analog-to-Digital Converter, ADC) and other peripheral interfaces that support DMA functions; the virtual machine will use the DMA device to perform DMA operations during operation.

[0019] Since the physical address range recognized by the virtual machine, that is, the first address range and the physical address range actually allocated to the virtual machine and the second address range are not the same, the virtual machine does not send a request instruction to the DMA device according to the physical address range actually allocated to the virtual machine. In addition, because the DMA device can theoretically directly access any physical memory of the target device, this results in the virtual machine being able to access physical memory not allocated to itself through the DMA device. The virtual machine cannot be fully isolated from the actual physical computer system, causing security risks. For a target device with multiple virtual machines deployed, the virtual machine can access the physical memory owned by other virtual machines through the DMA device, affecting the security of the target device.

[0020] Exemplarily, the available physical address range in the memory is 0x001fffff-0x00600000; the second address range allocated to the virtual machine is 0x00400000-0x00600000, the first address range recognized by the virtual machine is 0x001fffff-0x003ffffff, and the virtual machine will send a request instruction to the DMA device according to 0x001fffff-0x003ffffff.

[0021] Exemplarily, the electronic and electrical architecture of automobiles has evolved from distributed to centralized, which is manifested in the integration of multiple scattered electronic components into one controller. The target device in the embodiment of the present application can be used as the controller of the automobile, and multiple virtual machines can be deployed on the controller to respectively perform different types of tasks on the automobile. If a virtual machine related to automobile safety, such as a virtual machine that performs chassis control tasks, and a virtual machine for general operation feedback, such as a virtual machine that performs seat adjustment tasks, are running on the controller at the same time, in the above case, it is necessary to ensure that the virtual machine that performs the seat adjustment task cannot access the physical memory resources of the virtual machine that performs the chassis control task, for example, the data in the memory allocated to the virtual machine that performs the chassis control task cannot be rewritten; for scenarios such as automobiles that have high safety requirements, the isolation of the virtual machines in the target device must be ensured, otherwise it will cause safety hazards to the target device and the vehicle in which it is located.

[0022] Furthermore, the method for direct storage access of a virtual machine provided in the embodiment of the present application is implemented by the Rust language; the Rust language is a system programming language focused on security and has a memory safety mechanism. Rust ensures the security of memory and threads through the ownership model and type system, enabling it to eliminate memory-related errors at compile time and having performance close to that of C or C++; implementing the direct storage access method of a virtual machine by Rust can reduce the memory safety issues of the virtual machine and the target device where it is located, and further improve the isolation of the virtual machine in the target device.

[0023] Step 102: determine a second physical address that matches the first physical address according to a pre-configured address mapping relationship between physical addresses in a first address range and physical addresses in a second address range; the second address range is an address range allocated to the virtual machine for use.

[0024] According to the address mapping relationship between the physical address of the first address range and the physical address of the second address range, the first physical address is mapped to the second physical address one by one, the second physical address belongs to the second address range, and the second address range is the address range actually allocated to the virtual machine for use; by mapping the first physical address to the second physical address, the physical memory accessed by the DMA device is limited to the second address. Each virtual machine uses the physical memory allocated to itself as a new physical memory, so the virtual machine will not send a request instruction to the DMA device according to the second address range. Through the pre-configured address mapping relationship, the first physical address in the request instruction sent by the virtual machine to the DMA device can be converted into a second physical address included in the second address range. For a virtual machine that implements static partitioning, its second address range is fixed and allocated to the virtual machine when the virtual machine is created. Therefore, after the address mapping relationship is configured, it will not change dynamically, and there is no need for continuous maintenance. It is ready for use, which is convenient for the target device to operate continuously and stably; for the DMA device, the address mapping relationship limits the address range of the physical memory it accesses, avoiding the virtual machine from illegally accessing the physical memory through the DMA device.

[0025] Exemplarily, the first physical address is 0x001fffff. According to the address mapping relationship between the first address range 0x001fffff-0x003ffffff and the second address range 0x00400000-0x00600000, the second physical address obtained by mapping is 0x00400000.

[0026] Exemplarily, the conversion between the first physical address and the second physical address according to the address mapping relationship can be performed by software, such as a virtual machine monitor. The virtual machine runs on the virtual machine monitor, and its behavior is managed and controlled by the virtual machine monitor. Software constraints on DMA device access to physical addresses can be implemented through the virtual machine monitor.

[0027] Step 103: Perform a direct storage access operation on the memory according to the second physical address through the target device, and send the result of the direct storage access to the virtual machine.

[0028] After mapping the first physical address to the second physical address, the target device, i.e., the DMA device, performs DMA operations on the memory according to the second physical address. Since the second physical address belongs to the second address range, which is the physical address range allocated to the virtual machine, the DMA device will perform DMA operations within the physical address range allocated to the virtual machine. On the one hand, direct storage access of the virtual machine is realized, and on the other hand, it is ensured that the behavior of the virtual machine will not exceed the physical memory resources allocated to the virtual machine.

[0029] Exemplarily, DMA operations may include directly copying data from a DMA device to a memory, directly moving and copying data from a memory to a DMA device, copying data from a certain address in the memory to an address at the other end of the memory, etc. It can be understood that directly copying data from a DMA device to a memory is equivalent to completing a data read operation in the DMA device; data copied from a DMA device to a memory is modified in the memory and copied back from the memory to the DMA device, which is equivalent to completing a data overwrite operation in the DMA device.

[0030] After the copy task in the DMA operation is completed, the DMA device executing the DMA operation returns an interrupt signal to the virtual machine. The virtual machine responds to the interrupt signal and handles the end of the DMA operation, including returning the result of the direct storage access to the virtual machine.

[0031] For example, the first physical address in the DMA request is 0x001fffff, the mapped second physical address is 0x00400000, and the DMA operation is a read operation of the c file in the DMA device, that is, the DMA device will copy the data of the c file directly to the area corresponding to 0x00400000 in the physical memory to realize the reading of the c file.

[0032] In an embodiment of the present application, by mapping a first physical address in a direct storage access request issued by a virtual machine to a direct storage access device to a second physical address actually allocated to the virtual machine, and making the direct storage access device perform a direct storage access operation according to the second physical address, the physical memory accessible to the direct storage access device is restricted to the physical memory allocated to the virtual machine, thereby limiting direct storage access and preventing the virtual machine from maliciously using the direct storage access device to access memory resources that do not belong to the virtual machine; by making it impossible for a virtual machine to use the direct storage access device to access the physical memory occupied by other virtual machines, isolation between virtual machines is ensured, thereby improving the security of the target device.

[0033] Figure 2 , is another step flow chart of direct storage access of a virtual machine provided in an embodiment of the present application, wherein the virtual machine is deployed on a target device, such as Figure 2 As shown, the method may include: Step 201. When creating the virtual machine, a page table is saved in the memory through the virtual machine monitor; the page table is used to save the address mapping relationship between the physical address of the first address range and the physical address of the second address range, the first address range includes an address range that is not allocated to the virtual machine for use, and the second address range is an address range allocated to the virtual machine for use.

[0034] When the target device creates and deploys a virtual machine, the page table is stored in the memory of the target device through the virtual machine monitor; the address mapping relationship between the physical address in the first address range and the physical address in the second address range is saved in the page table. The page table data structure is stored in the memory of the target device when the virtual machine is created. When the virtual machine is ready to perform a DMA operation on the first physical address in the first address range through a DMA device, the address mapping relationship is read from the page table in the memory to complete the conversion from the first physical address to the second physical address.

[0035] Exemplarily, for a RISC-V based target device, the virtual machine monitor may include an hvisor, BaoHypervisor.

[0036] Optionally, the page table is the same page table as the page table used in the process of mapping the virtual physical address of the virtual machine to the actual physical address of the virtual machine.

[0037] When a virtual machine is running, in order to prevent the virtual machine from directly accessing the actual physical memory, it is necessary to first convert the virtual address of the virtual machine into the virtual physical address of the virtual machine (i.e., the guest physical address, GPA), and then convert the virtual physical address of the virtual machine into the actual physical address of the virtual machine (i.e., the host physical address, HPA). The actual physical address of the virtual machine is the physical address actually assigned to the virtual machine. The virtual physical address of the virtual machine is converted into the actual physical address of the virtual machine through one-to-one mapping. It can be understood that the process of mapping the virtual physical address of the virtual machine to the actual physical address of the virtual machine is the same as the process of mapping the first physical address to the second physical address. The first address range is the same as the range of the virtual physical address of the virtual machine, and the second address range is the same as the range of the actual physical address of the virtual machine. Therefore, the virtual physical address of the virtual machine is equivalent to the first physical address, and the actual physical address of the virtual machine is equivalent to the second physical address; thus, the same page table can be shared between the DMA device and the virtual machine. On the one hand, through the address mapping relationship in the page table, the physical memory accessible to the DMA device can be limited to the physical memory assigned to the virtual machine to ensure the isolation of the virtual machine. On the other hand, the above two mapping processes use the same page table to avoid duplication of page tables, which is not only easy to implement and manage, but also saves physical memory.

[0038] Step 202: Receive a direct storage access request issued by the virtual machine through a target device in the target equipment; the direct storage access request includes a first physical address for a direct storage access operation; the target device is a device with a direct storage access function, and the first physical address belongs to a first address range.

[0039] This step has been described in the above step 101 and will not be repeated here.

[0040] Step 203: Obtain the address mapping relationship stored in the page table from the memory through the input / output memory management unit; the target device includes the input / output memory management unit, and the input / output memory management unit is arranged between the target device and the memory of the target device.

[0041] In an embodiment of the present application, an input / output memory management unit (IOMMU) can be set between the DMA device and the memory to execute the entire process of obtaining the address mapping relationship and converting the first physical address to the second physical address according to the address mapping relationship; in some embodiments, the above process can be handed over to the virtual machine monitor for execution, but frequent trapping into the virtual machine monitor will bring a certain amount of time overhead, that is, obtaining the address mapping relationship in the form of software and executing the change from the first physical address to the second physical address according to the address mapping relationship will affect the real-time performance of the target device; directly obtaining the address mapping relationship and executing the address mapping change through the hardware of IOMMU has a faster execution speed than the pure software implementation method, which can keep the time consumption of the above process at a low level; for target devices such as embedded systems, the real-time performance of the target device can be guaranteed by setting IOMMU.

[0042] IOMMU is a memory management unit (MMU) that connects the Direct Memory Access-capable Input / Output Bus (DMA-capable I / O BUS) to the main memory. In some computer systems, IOMMU is also called the System Memory Management Unit (SMMU). Since IOMMU is connected to the DMA-capable I / O BUS, IOMMU can aggregate the scattered first physical addresses in multiple DMA requests into a continuous first physical address, thereby realizing the conversion from the first physical address to the second physical address more quickly.

[0043] Furthermore, the IOMMU hardware driver is implemented in Rust, which has a memory safety mechanism that can improve the security of the computer system where the IOMMU is located.

[0044] Optionally, there is at least one target device; step 202 may include: Sub-step 2031: according to the device identifier of the target device, control the input / output memory management unit to obtain the device context of the target device in the device directory table; the device directory table is used to store the device context of each device, each target device has a unique device identifier, and the device context is used to store the device parameters related to the address mapping relationship; the device directory table includes a single-level device directory table; Since there may be more than one target device on a target device, and different target devices may access different physical memory areas, in order to ensure that the first physical address in the DMA operation of different target devices can be correctly mapped to the respective matching second physical address, each target device has a data structure called Device Context (DC). DC can be used to store device parameters related to the operation of the target device, including device parameters related to the address mapping relationship. Through DC, the page table to be used can be specified for the target device; the DCs of multiple target devices are stored in a data structure called the device directory table. The device directory table is stored in the memory of the target device when the target device is started. When the virtual machine is created, the device context of the target device related to the virtual machine is stored in the device directory table by the virtual machine monitor.

[0045] Through the unique device identifier of each device, the IOMMU can find the DC of the target device that is performing the DMA operation in the device directory table, obtain the device parameters related to the address mapping relationship in the DC, and obtain the page table through at least part of these device parameters.

[0046] Optionally, the target device includes a platform device and a PCI device / PCIe device; the device identifier of the platform device is specified when the platform device is connected to the target device, and the device identifier of the PCI device / PCIe device is specified by the BDF number of the PCI device / PCIe device; the platform device includes a non-PCI device / PCIe device equipped with the target device when it leaves the factory, and the PCI device / PCIe device includes a device that complies with the PCI / PCIe standard.

[0047] The device identifier is used to uniquely specify a device. In the embodiment of the present application, the target device includes a platform device and a PCI device / PCIe device. For these two types of devices, the device identifier can be specified in different ways.

[0048] For platform devices, that is, non-PCI devices / PCIe devices equipped with the target device when leaving the factory, such as SPI, IIC, UART, ADC and other interfaces, they are assigned fixed device identifiers when they are connected to the target device at the factory. Platform devices generally cannot be separated from the target device after leaving the factory, so a fixed device identifier can be configured for them.

[0049] For PCI devices / PCIe devices, that is, devices that comply with the peripheral component interconnect express / peripheral componentinterconnect express (PCI / PCIe) standards, such as network adapters, hard drives, etc., these devices connected to the target device have unique bus, device, function (Bus, Device, Function, BDF) numbers, that is, the BDF number includes the bus number, device number, and function number respectively. The combination of these three numbers can identify a specific PCI / PCIe device, and therefore can be used as a device identifier.

[0050] Sub-step 2032: Obtain the starting physical address of the page table in the device context.

[0051] Sub-step 2033: reading the address mapping relationship stored in the page table in the memory according to the starting physical address.

[0052] Sub-steps 2032 and 2033 describe the process of obtaining the address mapping relationship according to the device context. The device context includes the page table base address of the target device, that is, the starting physical address of the page table in the memory. When the virtual machine is created, the page table is saved into the memory, and its position in the memory no longer changes dynamically. Therefore, once the starting physical address of the page table is determined, the complete page table can be read from the starting physical address in the memory of the target device to further obtain the complete address mapping relationship.

[0053] Step 204: Acquire the first physical address through the input / output memory management unit.

[0054] Step 205: Determine, by the input / output memory management unit, a second physical address that matches the first physical address according to a pre-configured address mapping relationship between physical addresses in the first address range and physical addresses in the second address range.

[0055] Step 204-Step 205 describes the process of converting the first physical address into the second physical address through the IOMMU. By using the IOMMU hardware to perform the conversion from the first physical address to the second physical address, the direct storage access operation of the DMA device is limited, so that the DMA device accesses only the physical memory resources allocated to the virtual machine. Compared with a pure software implementation such as a virtual machine monitor, the conversion process from the first physical address to the second physical address can be completed faster, thereby ensuring the isolation of the virtual machine in the target device and the real-time performance of the target device.

[0056] When the target device is an embedded system, limiting the direct storage access operation of the DMA device through the IOMMU is a preferred solution that takes into account both isolation and real-time performance.

[0057] For example, for the application scenario of a car, the car has a controller, which is equivalent to the target device in the embodiments of the present application. If a virtual machine related to car safety is running on the controller at the same time, such as a virtual machine that performs chassis control tasks, and a virtual machine for general operation feedback, such as a virtual machine that performs seat adjustment tasks, in the above case, it is not enough to simply ensure the isolation between the two virtual machines; although the conversion of the virtual physical address of the virtual machine to the actual physical address of the virtual machine can ensure that the virtual machine will not directly access illegal memory, it cannot ensure that the virtual machine indirectly accesses illegal memory through the DMA device on the controller, thereby destroying the stability of the system. Although the virtual machine monitor can prevent the virtual machine from indirectly accessing illegal memory through the DMA device on the controller, it will introduce longer time overhead. For scenarios such as cars that have high real-time requirements, longer time overhead means higher security risks, which is unacceptable.

[0058] By introducing the hardware of IOMMU and the method provided by the embodiment of the present application, when the target device on the controller performs DMA operation, the target device can only access the physical memory allocated to the corresponding virtual machine, thereby ensuring the isolation between the virtual machines on the controller. At the same time, IOMMU does not introduce obvious time overhead, so that the controller of the car can complete related tasks within an acceptable time, thereby ensuring the real-time performance of the controller. For the application scenario of the car, the conversion from the first physical address to the second physical address is performed through IOMMU, thereby ensuring the real-time performance of the controller on the car and the isolation between the virtual machines in the controller, thereby further ensuring the safety of the car.

[0059] Step 206: Perform a direct storage access operation on the memory according to the second physical address through the target device, and send the result of the direct storage access to the virtual machine.

[0060] This step has been described in step 103 above and will not be repeated here.

[0061] Optionally, after step 205, the following steps may also be included: Step 207: When the first physical address cannot be mapped one-to-one to the second physical address according to the address mapping relationship, a page fault exception alarm is issued, and the virtual machine monitor is controlled to take over the direct storage access operation.

[0062] Since the process of mapping the first physical address to the second physical address and the process of mapping the virtual physical address to the actual physical address of the virtual machine in the embodiment of the present application can share the same page table, the exception in the process of mapping the first physical address to the second physical address in the example of the present application can be captured and processed according to the process of mapping the virtual physical address to the actual physical address of the virtual machine, including, when the first physical address is not mapped to the second physical address by the page table, that is, the first physical address cannot be mapped one by one to the second physical address according to the address mapping relationship, a page fault exception (Guest Page Fault) is triggered, a corresponding alarm is issued, and the virtual machine monitor is notified to take over the DMA operation of the DMA device, that is, the virtual machine monitor is trapped in the exception processing.

[0063] Optionally, step 207 may include: Sub-step 2071: Control the virtual machine monitor to end the operation of the virtual machine.

[0064] After creating a virtual machine and configuring the page table, the page table no longer changes dynamically, and the address mapping relationship is pre-configured. If a page fault exception is triggered due to DMA during the subsequent operation of the virtual machine, it indicates that there is a malicious program in the virtual machine. In this regard, in order to ensure the security of the target device, the operation of the corresponding virtual machine can be directly terminated through the virtual machine monitor.

[0065] In an embodiment of the present application, by mapping a first physical address in a direct storage access request issued by a virtual machine to a direct storage access device to a second physical address actually allocated to the virtual machine, and making the direct storage access device perform a direct storage access operation according to the second physical address, the physical memory accessible to the direct storage access device is restricted to the physical memory allocated to the virtual machine, thereby limiting direct storage access and preventing the virtual machine from maliciously using the direct storage access device to access memory resources that do not belong to the virtual machine; by making it impossible for a virtual machine to use the direct storage access device to access the physical memory occupied by other virtual machines, isolation between virtual machines is ensured, thereby improving the security of the target device.

[0066] Figure 3: is a block diagram of a direct storage access device 30 of a virtual machine provided in an embodiment of the present application, wherein the virtual machine is deployed on a target device, and the device 30 includes: Receiving module 301: used for receiving a direct storage access request issued by the virtual machine through a target device in the target equipment; the direct storage access request includes a first physical address for a direct storage access operation; the target device is a device with a direct storage access function, the first physical address belongs to a first address range; the first address range includes an address range allocated for use by the virtual machine; Mapping module 302: used to determine a second physical address matching the first physical address according to a pre-configured address mapping relationship between physical addresses in a first address range and physical addresses in a second address range; the second address range is an address range allocated to the virtual machine for use; Execution module 303: used to perform a direct storage access operation on the memory according to the second physical address through the target device, and send the result of the direct storage access to the virtual machine.

[0067] Optionally, the address mapping relationship is stored in a page table, and the page table is the same as the page table used in the process of mapping the virtual physical address of the virtual machine to the actual physical address of the virtual machine.

[0068] Optionally, the target device includes an input / output memory management unit, and the input / output memory management unit is arranged between the target device and the memory. The mapping module 302 may include: An acquisition submodule: configured to acquire the first physical address through the input / output memory management unit; A mapping execution submodule is used to determine, through the input / output memory management unit, a second physical address that matches the first physical address according to a pre-configured address mapping relationship between physical addresses in the first address range and physical addresses in the second address range.

[0069] Optionally, the target device includes an input / output memory management unit, and the input / output memory management unit is arranged between the target device and the memory. The device 30 further includes: A page table initialization module: used for saving the page table in the memory through the virtual machine monitor when creating the virtual machine; Mapping acquisition module: used to acquire the address mapping relationship stored in the page table from the memory through the input / output memory management unit.

[0070] Optionally, the mapping acquisition module may include: A device context acquisition unit: used for controlling the input / output memory management unit to acquire the device context of the target device in the device directory table according to the device identifier of the target device; the device directory table is used to store the device context of each device, each target device has a unique device identifier, and the device context is used to store device parameters related to the address mapping relationship; the device directory table includes a single-level device directory table; A starting physical address obtaining unit is used to obtain the starting physical address of the page table in the device context.

[0071] A mapping acquisition unit is used to read the address mapping relationship stored in the page table in the memory according to the starting physical address.

[0072] Optionally, the target device includes a platform device and a PCI device / PCIe device; the device identifier of the platform device is specified when the platform device is connected to the target device, and the device identifier of the PCI device / PCIe device is specified by the BDF number of the PCI device / PCIe device; the platform device includes a non-PCI device / PCIe device equipped with the target device when it leaves the factory, and the PCI device / PCIe device includes a device that complies with the PCI / PCIe standard.

[0073] Optionally, the device 30 may further include: Exception module: used for issuing a page fault exception alarm when the first physical address cannot be mapped one-to-one to the second physical address according to the address mapping relationship, and controlling the virtual machine monitor to take over the direct storage access operation.

[0074] Optionally, the exception module may include: Stop submodule: used to control the virtual machine monitor to end the operation of the virtual machine.

[0075] In an embodiment of the present application, by mapping a first physical address in a direct storage access request issued by a virtual machine to a direct storage access device to a second physical address actually allocated to the virtual machine, and making the direct storage access device perform a direct storage access operation according to the second physical address, the physical memory accessible to the direct storage access device is restricted to the physical memory allocated to the virtual machine, thereby limiting direct storage access and preventing the virtual machine from maliciously using the direct storage access device to access memory resources that do not belong to the virtual machine; by making it impossible for a virtual machine to use the direct storage access device to access the physical memory occupied by other virtual machines, isolation between virtual machines is ensured, thereby improving the security of the target device.

[0076] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0077] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0078] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0079] An embodiment of the present application provides a direct storage access device for a virtual machine, including a memory and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by one or more processors to include methods for performing one or more of the methods described in the above-mentioned embodiments.

[0080] Figure 4 4 is a block diagram of an electronic device 400 according to an exemplary embodiment. For example, the electronic device 400 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0081] Reference Figure 4 , the electronic device 400 may include one or more of the following components: a processing component 402 , a memory 404 , a power component 406 , a multimedia component 408 , an audio component 410 , an input / output (I / O) interface 412 , a sensor component 414 , and a communication component 416 .

[0082] The processing component 402 generally controls the overall operation of the electronic device 400, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 402 may include one or more processors 420 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 402 may include one or more modules to facilitate the interaction between the processing component 402 and other components. For example, the processing component 402 may include a multimedia module to facilitate the interaction between the multimedia component 408 and the processing component 402.

[0083] The memory 404 is used to store various types of data to support the operation of the electronic device 400. Examples of such data include instructions for any application or method operating on the electronic device 400, contact data, phone book data, messages, pictures, multimedia, etc. The memory 404 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0084] The power supply component 406 provides power to the various components of the electronic device 400. The power supply component 406 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 400.

[0085] The multimedia component 408 includes a screen that provides an output interface between the electronic device 400 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 408 includes a front camera and / or a rear camera. When the electronic device 400 is in an operating mode, such as a shooting mode or a multimedia mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0086] The audio component 410 is used to output and / or input audio signals. For example, the audio component 410 includes a microphone (MIC), and when the electronic device 400 is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is used to receive an external audio signal. The received audio signal can be further stored in the memory 404 or sent via the communication component 416. In some embodiments, the audio component 410 also includes a speaker for outputting audio signals.

[0087] I / O interface 412 provides an interface between processing component 402 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0088] The sensor assembly 414 includes one or more sensors for providing various aspects of status assessment for the electronic device 400. For example, the sensor assembly 414 can detect the open / closed state of the electronic device 400, the relative positioning of the components, such as the display and keypad of the electronic device 400, and the sensor assembly 414 can also detect the position change of the electronic device 400 or a component of the electronic device 400, the presence or absence of contact between the user and the electronic device 400, the orientation or acceleration / deceleration of the electronic device 400, and the temperature change of the electronic device 400. The sensor assembly 414 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 414 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 414 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0089] The communication component 416 is used to facilitate wired or wireless communication between the electronic device 400 and other devices. The electronic device 400 can access a wireless network based on a communication standard, such as WiFi, a carrier network (such as 2G, 3G, 4G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 416 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 416 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0090] In an exemplary embodiment, the electronic device 400 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to implement the methods provided in the embodiments of the present application.

[0091] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 404 including instructions, and the instructions can be executed by a processor 420 of an electronic device 400 to perform the above method. For example, the non-transitory storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0092] Figure 5is a block diagram of an electronic device 500 according to an exemplary embodiment. For example, the electronic device 500 may be provided as a server. Figure 5 , the electronic device 500 includes a processing component 522, which further includes one or more processors, and a memory resource represented by a memory 532, for storing instructions that can be executed by the processing component 522, such as an application. The application stored in the memory 532 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 522 is configured to execute instructions to perform the method provided in the embodiment of the present application.

[0093] The electronic device 500 may also include a power supply component 526 configured to perform power management of the electronic device 500, a wired or wireless network interface 550 configured to connect the electronic device 500 to a network, and an input / output (I / O) interface 558. The electronic device 500 may operate based on an operating system stored in the memory 532, such as Windows Server TM, Mac OS X TM, Unix TM, Linux TM, FreeBSD TM or the like.

[0094] An embodiment of the present application further provides a computer program product, including a computer program, which implements the method described in the above embodiment when executed by a processor.

[0095] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the application disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0096] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for direct storage access of a virtual machine, characterized in that: The virtual machine is deployed on a target device, and the method includes: receiving a direct storage access request issued by the virtual machine through a target device in the target apparatus; the direct storage access request includes a first physical address for a direct storage access operation; the target device is a device having a direct storage access function, the first physical address belongs to a first address range; the first address range includes an address range not allocated to the virtual machine for use; Determine a second physical address matching the first physical address according to a preconfigured address mapping relationship between a physical address in a first address range and a physical address in a second address range; the second address range is an address range allocated to the virtual machine for use; A direct storage access operation is performed on the memory according to the second physical address through the target device, and a result of the direct storage access is sent to the virtual machine.

2. The method according to claim 1, characterized in that The address mapping relationship is stored in a page table, and the page table is the same as the page table used in the process of mapping the virtual physical address of the virtual machine to the actual physical address of the virtual machine.

3. The method according to claim 1, characterized in that: The target device includes an input / output memory management unit, and the input / output memory management unit is arranged between the target device and the memory; according to a pre-configured one-to-one address mapping relationship between physical addresses in a first address range and physical addresses in a second address range, determining a second physical address matching the first physical address includes: Acquire the first physical address through the input / output memory management unit; The input / output memory management unit determines a second physical address that matches the first physical address according to a preconfigured address mapping relationship between physical addresses in the first address range and physical addresses in the second address range.

4. The method according to claim 1, characterized in that: The target device includes an input / output memory management unit, and the input / output memory management unit is arranged between the target device and the memory; The address mapping relationship is stored in a page table; The method further comprises: When creating the virtual machine, storing the page table in the memory through a virtual machine monitor; Before the step of mapping the first physical addresses to matching second physical addresses one by one according to the pre-configured address mapping relationship, the method further comprises: The address mapping relationship stored in the page table is obtained from the memory through the input / output memory management unit.

5. The method according to claim 4, characterized in that The target device has at least one; the step of obtaining the address mapping relationship stored in the page table from the memory through the input / output memory management unit includes: According to the device identifier of the target device, the input / output memory management unit is controlled to obtain the device context of the target device in the device directory table; the device directory table is used to store the device context of each device, each target device has a unique device identifier, and the device context is used to store device parameters related to the address mapping relationship; the device directory table includes a single-level device directory table; Obtaining a starting physical address of the page table in the device context; The address mapping relationship stored in the page table is read in the memory according to the starting physical address.

6. The method according to claim 5, characterized in that The target device includes a platform device and a PCI device / PCIe device; the device identifier of the platform device is specified when the platform device is connected to the target device, and the device identifier of the PCI device / PCIe device is specified by the BDF number of the PCI device / PCIe device; the platform device includes a non-PCI device / PCIe device equipped with the target device when it leaves the factory, and the PCI device / PCIe device includes a device that complies with the PCI / PCIe standard.

7. The method according to claim 1, characterized in that The method further comprises: In the case where the first physical address cannot be mapped one-to-one to the second physical address according to the address mapping relationship, a page fault exception alarm is issued, and the virtual machine monitor is controlled to take over the direct storage access operation.

8. The method according to claim 7, characterized in that The controlling the virtual machine monitor to take over the direct storage access operation includes: The virtual machine monitor is controlled to terminate the operation of the virtual machine.

9. A direct storage access device for a virtual machine, characterized in that: The virtual machine is deployed on a target device, and the apparatus comprises: A receiving module: used for receiving a direct storage access request issued by the virtual machine through a target device in the target equipment; the direct storage access request includes a first physical address for a direct storage access operation; the target device is a device with a direct storage access function, the first physical address belongs to a first address range; the first address range includes an address range that is not allocated to the virtual machine for use; A mapping module: used to determine a second physical address matching the first physical address according to a pre-configured address mapping relationship between a physical address in a first address range and a physical address in a second address range; the second address range is an address range allocated to the virtual machine for use; An execution module is used to perform a direct storage access operation on the memory according to the second physical address through the target device, and send the result of the direct storage access to the virtual machine.

10. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: When the instructions in the computer storable medium are executed by a processor of an electronic device, the electronic device is enabled to perform the method as claimed in any one of claims 1 to 8.

Images