Method and device for enabling PCIE equipment to directly communicate with virtual machine and related equipment

Abstract

A method, apparatus and related device for enabling a PCIE device to directly communicate with a virtual machine, applicable to a computing device whose hardware resources are divided into REE and TEE sides, the computing device (300) comprising a first PCIE device, the TEE side comprising a virtual machine, the method comprising the following steps: a processor of the computing device (300) obtaining a first instruction at the REE side, the first instruction instructing to configure the first PCIE device to directly communicate with the virtual machine at the TEE side, and then the processor configures the first PCIE device to directly communicate with the virtual machine on the TEE side according to the first instruction. According to the method, the direct connection data security between the virtual machine and the PCIE equipment in the direct connection virtual field scene of the PCIE equipment can be protected, the security of the PCIE equipment is protected, and the security requirements of a user on the direct connection data and the PCIE equipment are met.

Description

Method, device and related equipment for PCIE device to directly connect to virtual machine

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on June 28, 2023, with application number 202310784740.8, and priority to the Chinese patent application entitled “Method, device and related equipment for direct connection of PCIE device to virtual machine”, all contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of virtualization technology, and in particular to a method, apparatus, and related equipment for directly connecting a high-speed serial computer expansion bus standard (Peripheral Component Interconnect Express, PCIE) device to a virtual machine (VM). Background Art

[0003] Device passthrough is a virtualization technology that allows PCIe devices on the host (such as graphics cards, network cards, graphics processing units (GPUs), and embedded neural network processing units (NPUs)) to be directly assigned to virtual machines, enabling virtual machines to directly access PCIe devices without the need for virtualization through the host operating system.

[0004] However, the PCIE device implemented in the current computing device is directly connected to the virtual machine, and the virtual machine is managed by the virtual machine monitor (VMM) in the host operating system kernel. Once the host operating system kernel is compromised by an attacker, the attacker will be able to manipulate the virtual machine monitor running in the host operating system kernel to manage the virtual machine, such as stealing data stored in the virtual machine's memory to be sent to the directly connected PCIE device, or stealing data stored in the virtual machine's memory received by the virtual machine from the directly connected PCIE device. For example, the attacker can access the directly connected PCIE device through the virtual machine, posing a security threat to the directly connected data between the virtual machine and the PCIE device and the PCIE device.

[0005] Summary of the Invention

[0006] The present application provides a method, apparatus, and related equipment for PCIE device direct communication with a virtual machine, which can protect the security of direct communication data between the virtual machine and the PCIE device in a scenario where the PCIE device directly communicates with the virtual machine, as well as protect the security of the PCIE device, thereby meeting the user's security requirements for direct communication data and PCIE devices.

[0007] In a first aspect, a method for directly connecting a PCIE device to a virtual machine is provided, which is applied to a computing device, wherein the hardware resources of the computing device are divided into a rich execution environment (REE) side and a trusted execution environment (TEE) side. The computing device includes a first PCIE device, and the above-mentioned TEE side includes a virtual machine. The method specifically includes the following steps: a processor of the computing device obtains a first instruction on the REE side, and the first instruction indicates the configuration of the first PCIE device to directly connect to the virtual machine on the above-mentioned TEE side, and then the processor configures the first PCIE device on the TEE side according to the first instruction to directly connect to the virtual machine on the above-mentioned TEE side.

[0008] In the above scheme, the processor of the computing device obtains a first instruction on the REE side that instructs the configuration of the virtual machine on the TEE side to be directly connected to the first PCIE device, and performs configuration on the TEE side according to the first instruction, thereby realizing the direct connection of the first PCIE device to the virtual machine on the TEE side. Since the virtual machine directly connected to the first PCIE device is located on the TEE side, the virtual machine is protected by the hardware security features of the TEE and is prohibited from being accessed by the host operating system kernel on the REE side. Therefore, even if an attacker breaks into the host operating system kernel, the attacker cannot manage the virtual machine on the TEE side through the virtual machine manager in the host operating system kernel, such as being unable to steal data stored in the memory of the virtual machine on the TEE side to be sent to the first PCIE device, unable to steal data received by the virtual machine from the first PCIE device stored in the memory of the virtual machine, and unable to access the first PCIE device through the virtual machine, thereby meeting the user's requirements for direct data between the virtual machine and the first PCIE device and for the security of the first PCIE device.

[0009] In one possible implementation, the above-mentioned processor can specifically configure the first PCIE device to pass through the virtual machine on the TEE side in the following manner: the processor configures the base address register (BAR) of the first PCIE device on the TEE side, and then establishes a first mapping relationship and a second mapping relationship on the TEE side, wherein the first mapping relationship is a mapping relationship between the first memory and the second memory, and the second mapping relationship is a mapping relationship between the third memory and the fourth memory, the first memory is a memory in the virtual machine's memory used for the virtual machine to access the first PCIE device, the second memory is a memory in the BAR of the first PCIE device used for the virtual machine to access the first PCIE device, the third memory is a memory in the virtual machine's memory used for the first PCIE device to access the virtual machine, and the fourth memory is a memory in the BAR of the first PCIE device used for the first PCIE device to access the virtual machine.

[0010] In the above scheme, the processor configures the BAR of the first PCIE device on the TEE side and establishes a mapping relationship between the memory of the virtual machine and the memory of the first PCIE device (i.e., the above-mentioned first mapping relationship and the second mapping relationship). This allows the virtual machine to access the first PCIE device by accessing the first memory, and then according to the mapping relationship between the first memory and the second memory (i.e., the above-mentioned first mapping relationship), it can access the second memory, that is, access the first PCIE device. When the first PCIE device needs to access the virtual machine, it accesses the fourth memory, and then according to the mapping relationship between the fourth memory and the third memory (i.e., the above-mentioned second mapping relationship), it can access the third memory, that is, access the virtual machine. It can be seen that this scheme can realize mutual access between the virtual machine and the first PCIE device, that is, realize direct communication between the two. In addition, it can also be seen that the above scheme can realize that the virtual machine and the first PCIE device access each other as if they were accessing their own memory.

[0011] In a possible implementation, the computing device includes a root complex (RC), and the method further includes: when the processor is on the REE side, the root complex does not allow the processor to access the first PCIE device.

[0012] In the above solution, when the processor is on the REE side, the root complex does not allow the processor to access the first PCIE device. In this way, when the software on the REE side (such as the host operating system kernel, such as the virtual machine manager in the host operating kernel) is compromised by an attacker, the attacker can access the first PCIE device by operating the software on the REE side, such as configuring or reading and writing the BAR of the first PCIE device, thereby posing a security risk to the first PCIE device.

[0013] In a possible implementation, the method further includes the following steps: the processor obtains a second instruction on the REE side (the second instruction indicates that the first PCIE device is marked as a security device, and the second instruction carries an identifier of the first PCIE device), and then the processor sends the second instruction to the root complex. After receiving the second instruction sent by the processor, the root complex marks the first PCIE device as a security device according to the identifier of the first PCIE device in the second instruction. After marking the first PCIE device as a security device, when the root complex receives a first message related to the virtual machine from the first PCIE device (the first message carries a first identifier, and the first identifier indicates that the first PCIE device is a security device), it can determine that the first PCIE device is a security device based on the first identifier carried by the first message, and then send the first message to the virtual machine.

[0014] That is, if the root complex determines that the first PCIE device is not a security device, it refuses to send the first message to the virtual machine.

[0015] In the above solution, the processor sends a second instruction to the root complex, instructing the root complex to mark the first PCIE device as a secure device. After the root complex marks the first PCIE device as a secure device, upon receiving a message from the first PCIE device to a virtual machine, the root complex can determine whether the first PCIE device is a secure device based on the first identifier carried in the message and then send the message to the virtual machine. Otherwise, the root complex refuses to send the message to the virtual machine. This prevents the virtual machine from being accessed by untrusted PCIE devices that are not marked as secure devices, thereby protecting the security of the virtual machine.

[0016] In a possible implementation, the above-mentioned first identifier is the identifier of the first PCIE device, and the root complex identifies the first PCIE device as a security device according to the identifier of the first PCIE device in the second instruction, including: the root complex identifies the first PCIE device as a security device in the root complex according to the identifier of the first PCIE device in the second instruction.

[0017] In the above solution, by marking the first PCIE device as a secure device in the root complex based on its identifier, the root complex can determine whether the PCIE device is a secure device based on the identifier of the first PCIE device or the identifier of the other PCIE device carried in the message when receiving a message related to a virtual machine from the first PCIE device or another PCIE device. Because the existing message already carries the identifier of the PCIE device, there is no need to modify the message, making the implementation of the solution relatively simple.

[0018] In order to improve the flexibility of the solution, in one possible implementation, the root complex identifies the first PCIE device as a security device according to the identifier of the first PCIE device in the second instruction, including: the root complex marks the first PCIE device as a security device in the first PCIE device according to the identifier of the first PCIE device in the second instruction.

[0019] In this method, when a PCIE device marked as a security device sends a message to a virtual machine, the message will carry a first identifier indicating that the PCIE device is a security device. When a PCIE device not marked as a security device sends a message to a virtual machine, the message does not carry the first identifier, or the message carries the second identifier.

[0020] For example, in a specific implementation, when a PCIE device sends a message to a virtual machine, the message sent includes a security ID field. If the PCIE device is marked as a security device, the security ID field in the message carries a first ID such as 0. If the PCIE device is not marked as a security device, the security ID field in the message is empty or a second ID such as 1.

[0021] In one possible implementation, a virtual function input / output (VFIO) driver is deployed on the REE side, and a virtual machine manager for managing the virtual machines on the TEE side is deployed on the TEE side. The operations performed by the processor on the REE side are executed by the processor running the VIFO driver, and the operations performed by the processor on the TEE side are executed by the processor running the virtual machine manager.

[0022] In one possible implementation, the root complex may send the first message to the virtual machine through the virtual machine manager on the TEE side. The method further includes: the processor may run the virtual machine manager on the TEE side to send the second message related to the first PCIE device received from the virtual machine to the first PCIE device.

[0023] In the above solution, since the communication data between the first PCIE device and the virtual machine is forwarded through the TEE side virtual machine manager, the communication data does not pass through the REE side. In this way, the communication data can be prevented from being accessed by the software on the REE side (such as the host operating system kernel) during the transmission process. Even if the software on the REE side is hacked by an attacker, the communication data between the first PCIE and the virtual machine cannot be stolen, thereby ensuring the security of the communication data during transmission.

[0024] In a possible implementation, before the processor obtains the first instruction on the REE side, the method further includes the following steps: the processor obtains configuration information of the virtual machine to be created on the REE side, and then creates the virtual machine based on the configuration information on the TEE side.

[0025] By implementing the above implementation method, a virtual machine can be created on the TEE side, which facilitates the subsequent direct connection between the first PCIE device and the virtual machine on the TEE side, thereby meeting the user's requirements for direct data between the virtual machine and the first PCIE device and the security of the first PCIE device.

[0026] In a possible implementation, the first PCIE device includes any one or more of the following: a GPU, an NPU, a network card, a graphics card, and a sound card.

[0027] It should be understood that the above-mentioned first PCIE device is merely an example and should not be regarded as a specific limitation on the first PCIE device.

[0028] It can be understood that when the first PCIE device includes a GPU and / or an NPU, the above solution can implement secure heterogeneous computing.

[0029] In a second aspect, a configuration device for a PCIE device to directly connect to a virtual machine is provided, which is applied to a computing device, wherein the hardware resources of the computing device are divided into an REE side and a TEE side, the computing device includes a first PCIE device, and the TEE side includes a virtual machine. The device specifically includes an acquisition module and a processing module;

[0030] The acquisition module is used to acquire a first instruction on the REE side, where the first instruction instructs to configure a first PCIE device to directly connect to the virtual machine on the TEE side;

[0031] The processing module is used to configure the first PCIE device to directly connect to the virtual machine on the TEE side according to the first instruction.

[0032] In one possible implementation, the processing module is used to configure the first PCIE device to directly connect to the virtual machine on the TEE side in the following manner: the processing module configures the BAR of the first PCIE device on the TEE side, and then establishes a first mapping relationship and a second mapping relationship, wherein the first mapping relationship is a mapping relationship between the first memory and the second memory, the first memory is the memory in the virtual machine's memory used for the virtual machine to access the first PCIE device, the second memory is the memory in the BAR of the first PCIE device used for the virtual machine to access the first PCIE device, the second mapping relationship is a mapping relationship between the third memory and the fourth memory, the third memory is the memory in the virtual machine's memory used for the first PCIE device to access the virtual machine, and the fourth memory is the memory in the BAR of the first PCIE device used for the first PCIE device to access the virtual machine.

[0033] In a possible implementation, the apparatus further includes an access control module configured to, when the acquisition module / processing module is on the REE side, not allow the acquisition module / processing module to access the first PCIE device.

[0034] In a possible implementation, the apparatus further includes a sending module;

[0035] The acquisition module is further configured to acquire a second instruction on the REE side, the second instruction indicating that the first PCIE device is marked as a security device, and the second instruction carries an identifier of the first PCIE device;

[0036] The sending module is used to send a second instruction to the access control module;

[0037] The access control module is further configured to mark the first PCIE device as a secure device according to the identifier of the first PCIE device in the second instruction;

[0038] The access control module is further configured to receive a first message related to a virtual machine from a first PCIE device, where the first message carries a first identifier, and the first identifier indicates that the first PCIE device is a security device;

[0039] The access control module is further configured to determine, based on the first identifier carried in the first message, that the first PCIE device is a security device, and then send the first message to the virtual machine.

[0040] In a possible implementation, the first identifier is an identifier of a first PCIE device, and the access control module is configured to mark the first PCIE device as a secure device in the root complex of the computing device according to the identifier of the first PCIE device in the second instruction.

[0041] In a possible implementation, the access control module is configured to mark the first PCIE device as a secure device in the first PCIE device according to the identifier of the first PCIE device in the second instruction.

[0042] In one possible implementation, a VFIO driver is deployed on the REE side, a virtual machine manager for managing virtual machines is deployed on the TEE side, the acquisition module and the sending module are deployed in the VFIO driver, the processing module is deployed in the virtual machine manager on the TEE side, and the access control module is deployed in the root complex of the computing device.

[0043] In a possible implementation, the access control module is configured to send the first message to the virtual machine through the virtual machine manager on the TEE side.

[0044] In a possible implementation, the virtual machine manager on the TEE side is further configured to send the second message related to the first PCIE device received from the virtual machine to the first PCIE device.

[0045] In a possible implementation, before being used to obtain the first instruction, the acquisition module is also used to obtain configuration information of the virtual machine to be created on the REE side, and the processing module is also used to create the virtual machine on the TEE side according to the configuration information.

[0046] In one possible implementation, the first PCIE device includes any one or more of the following: a GPU, an NPU, a network card, a graphics card, and a sound card. It should be understood that the first PCIE device is merely an example and should not be considered as a specific limitation on the first PCIE device.

[0047] Regarding the configuration device for the PCIE device directly connected to the virtual machine provided by the second aspect and the relevant beneficial effects and descriptions of any implementation method of the second aspect, please refer to the relevant beneficial effects and descriptions of the aforementioned first aspect and any implementation method of the first aspect, and will not be repeated here.

[0048] In a third aspect, a method for directly connecting an external device to a virtual machine is provided, the method comprising the following steps:

[0049] The secure virtual machine management program receives a device direct connection request, where the device direct connection request is used to configure the first external device to directly connect to the first confidential virtual machine, and the device direct connection request carries a device identifier of the first external device and an identifier of the first confidential virtual machine;

[0050] The secure virtual machine management program configures the first external device to directly connect to the first confidential virtual machine according to the device direct connection request.

[0051] In the above solution, the secure virtual machine hypervisor configures the first confidential virtual machine on the TEE side to enable the first external device to directly connect to the TEE according to the device direct connection request. Since the first confidential virtual machine is located in the secure world, it is protected by the hardware security features of the secure world and is prohibited from being accessed by the host operating system kernel in the non-secure world. Therefore, even if an attacker breaks into the host operating system kernel in the non-secure world, the attacker cannot manage the first confidential virtual machine through the ordinary virtual machine hypervisor in the host operating system kernel. For example, the attacker cannot steal data stored in the memory of the first confidential virtual machine to be sent to the first external device, cannot steal data received from the first external device stored in the memory of the first confidential virtual machine, and cannot access the first external device through the first confidential virtual machine. This meets the user's requirements for direct data between the virtual machine and the first external device and for the security of the first external device.

[0052] In a possible implementation, the process of the secure virtual machine hypervisor receiving the device direct communication request may be as follows: the secure virtual machine hypervisor receives the device direct communication request sent by the device direct communication management module, the device direct communication management module running in the non-secure world;

[0053] After the secure virtual machine hypervisor configures the first external device to directly communicate with the first confidential virtual machine, the secure virtual machine hypervisor may send a notification message to the device direct communication management module to notify that the direct communication configuration between the first external device and the first confidential virtual machine is completed.

[0054] In a possible implementation, configuring the secure virtual machine hypervisor to directly connect the first external device to the first confidential virtual machine may include the following steps:

[0055] The secure virtual machine hypervisor establishes a first mapping relationship in the MMU and a second mapping relationship in the IOMMU, wherein the first mapping relationship is a mapping relationship between the virtual address space of the first confidential virtual machine and the MMIO address space of the first external device, and the second mapping relationship is a mapping relationship between the IO virtual address space of the first external device and the DMA address space of the first external device, and both the MMIO address space and the DMA address space belong to the physical address space of the first confidential virtual machine;

[0056] The secure virtual machine hypervisor sends a security mark instruction to the IO hardware module, instructing the IO hardware module to add a security mark to the message received from the first external device, or the secure virtual machine hypervisor sends a security mark instruction to the first external device, instructing the first external device to add a security mark to the generated message, and the security mark indicates that the first external device has access rights to the secure memory.

[0057] In implementing the above implementation, the secure virtual machine hypervisor establishes a first mapping relationship in the MMU, so that when the first confidential virtual machine needs to access the first external device (such as when it needs to send instructions or data to the first external device), the MMU, after receiving a message from the first confidential virtual machine, determines that the first confidential virtual machine can access the first external device through the first mapping relationship, and then forwards the message of the first confidential virtual machine to the first external device, thereby enabling the first confidential virtual machine to access the first external device. The secure virtual machine hypervisor establishes a second mapping relationship in the IOMMU and sends a security tag instruction to the IO hardware module, instructing the IO hardware module to add a security flag to a first message received from the first external device, or sends a security tag instruction to the first external device, instructing the first external device to add a security flag to a generated first message. This allows the first external device to access the first confidential virtual machine (such as when it needs to return data to the first confidential virtual machine) after receiving a first message from the first external device, the IOMMU, after receiving the first message from the first external device, determines that the first external device can access the first confidential virtual machine through the second mapping relationship and the security flag in the first message, and then forwards the message of the first external device to the first confidential virtual machine, thereby enabling the first external device to access the first confidential virtual machine.

[0058] In a possible implementation, when the computing device to which the first confidential virtual machine belongs includes an RC, the IO hardware module is integrated into the RC.

[0059] In a possible implementation, the device identifier of the first external device is a BDF number.

[0060] In a possible implementation, the secure virtual machine hypervisor includes a secure IO management module, and operations performed by the secure virtual machine hypervisor are executed by the secure IO management module.

[0061] In a possible implementation, the first external device is a GPU, an NPU, a TPU, a network card, or a hard disk.

[0062] In one possible implementation, the above method is applied to a computing device whose hardware resources are divided into a REE side and a TEE side, and the first confidential virtual machine is located on the TEE side.

[0063] In a fourth aspect, a device for directly connecting an external device to a virtual machine is provided, the device comprising:

[0064] A receiving module, configured to receive a device direct connection request, the device direct connection request being used to configure a first external device to directly connect to the first confidential virtual machine, the device direct connection request carrying a device identifier of the first external device and an identifier of the first confidential virtual machine;

[0065] The configuration module is used to configure the first external device to directly connect to the first confidential virtual machine according to the device direct connection request.

[0066] In a possible implementation, the apparatus further includes a sending module;

[0067] A receiving module, configured to receive a device direct access request sent by a device direct access management module, wherein the device direct access management module runs in a non-secure world;

[0068] The sending module is configured to send a notification message to the device direct communication management module, notifying that the direct communication configuration between the first external device and the first confidential virtual machine has been completed.

[0069] In a possible implementation, the configuration module is specifically configured to:

[0070] Establishing a first mapping relationship in the MMU and a second mapping relationship in the IOMMU, wherein the first mapping relationship is a mapping relationship between the virtual address space of the first confidential virtual machine and the MMIO address space of the first external device, and the second mapping relationship is a mapping relationship between the IO virtual address space of the first external device and the DMA address space of the first external device, and both the MMIO address space and the DMA address space belong to the physical address space of the first confidential virtual machine;

[0071] A security mark instruction is sent to the IO hardware module, instructing the IO hardware module to add a security mark to a message received from the first external device, or the secure virtual machine hypervisor sends a security mark instruction to the first external device, instructing the first external device to add a security mark to a generated message, wherein the security mark indicates that the first external device has access rights to the secure memory.

[0072] In a possible implementation, when the computing device to which the first confidential virtual machine belongs includes an RC, the IO hardware module is integrated into the RC.

[0073] In a possible implementation, the device identifier of the first external device is a BDF number.

[0074] In a possible implementation, the apparatus further includes a secure IO management module, and the operations performed by the apparatus are performed by the secure IO management module.

[0075] In a possible implementation, the first external device is a GPU, an NPU, a TPU, a network card, or a hard disk.

[0076] In one possible implementation, the apparatus is applied to a computing device whose hardware resources are divided into a REE side and a TEE side, and the first confidential virtual machine is located on the TEE side.

[0077] In a fifth aspect, a method for directly connecting an external device to a virtual machine is provided, the method comprising the following steps:

[0078] The device direct communication management module sends a device direct communication request to the secure virtual machine hypervisor, the device direct communication management module runs in the non-secure world, the device direct communication request is used to configure the first external device to directly communicate with the first confidential virtual machine, and the device direct communication request carries a device identifier of the first external device and an identifier of the first confidential virtual machine;

[0079] The device direct communication management module receives a notification message sent by the secure virtual machine hypervisor, where the notification message indicates that direct communication configuration between the first external device and the first confidential virtual machine has been completed.

[0080] In a possible implementation, the device identifier of the first external device is a BDF number.

[0081] In a possible implementation, the first external device is a GPU, an NPU, a TPU, a network card, or a hard disk.

[0082] In one possible implementation, the above method is applied to a computing device whose hardware resources are divided into a REE side and a TEE side, and the first confidential virtual machine is located on the TEE side.

[0083] Regarding the method of connecting an external device to a virtual machine provided in the fifth aspect and the relevant beneficial effects and descriptions of any implementation method of the fifth aspect, please refer to the relevant beneficial effects and descriptions of the aforementioned third aspect and any implementation method of the third aspect, and will not be repeated here.

[0084] In a sixth aspect, a device for directly connecting an external device to a virtual machine is provided, the device comprising:

[0085] a sending module, configured to send a device direct access request to the secure virtual machine hypervisor, the device direct access management module running in the non-secure world, the device direct access request being used to configure a first external device to directly access the first confidential virtual machine, the device direct access request carrying a device identifier of the first external device and an identifier of the first confidential virtual machine;

[0086] The receiving module is configured to receive a notification message sent by the secure virtual machine manager, where the notification message indicates that the direct connection configuration between the first external device and the first confidential virtual machine has been completed.

[0087] In a possible implementation, the device identifier of the first external device is a BDF number.

[0088] In a possible implementation, the first external device is a GPU, an NPU, a TPU, a network card, or a hard disk.

[0089] In one possible implementation, the apparatus is applied to a computing device whose hardware resources are divided into a REE side and a TEE side, and the first confidential virtual machine is located on the TEE side.

[0090] In the seventh aspect, a computing device is provided, which includes a processor and a memory; the processor is used to execute instructions stored in the memory, so that the computing device implements the method provided by the first aspect, the third aspect, the fifth aspect or any possible implementation of the first aspect, the third aspect, and the fifth aspect.

[0091] In an eighth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores instructions, and the instructions are used to implement the method provided by the first aspect, the third aspect, the fifth aspect or any possible implementation of the first aspect, the third aspect, and the fifth aspect.

[0092] In the ninth aspect, a computer program product is provided, comprising a computer program. When the computer program is read and executed by a computing device, the computing device executes the method provided in the first, third, or fifth aspects or any possible implementation of the first, third, or fifth aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0093] FIG1 is a schematic diagram of a scenario in which an external device is directly connected to a virtual machine involved in this application;

[0094] FIG2 is a schematic diagram of an ARM hardware architecture provided by this application;

[0095] FIG3 is a schematic diagram of the structure of a computing device provided by the present application;

[0096] FIG4 is a flow chart of a method for directly connecting an external device to a virtual machine provided by the present application;

[0097] FIG5 is a schematic diagram of the structure of another computing device provided by the present application;

[0098] FIG6 is a flow chart of configuring a computing device to connect an external device to a virtual machine provided by the present application;

[0099] FIG7A is a flow chart of another method for directly connecting an external device to a virtual machine provided by the present application;

[0100] FIG7B is a schematic diagram of a process for configuring a first external device to directly connect to a first confidential virtual machine provided by the present application;

[0101] FIG8A is a schematic diagram of the structure of another computing device provided by the present application;

[0102] FIG8B is a schematic diagram of the structure of another computing device provided by the present application;

[0103] FIG9A is a schematic diagram of a process in which a secure virtual machine hypervisor instructs an IO hardware module to perform security marking provided by the present application;

[0104] FIG9B is a schematic diagram of a process in which a secure virtual machine hypervisor instructs a first external device to perform security marking provided by the present application;

[0105] FIG10A is a schematic diagram of a configuration apparatus for directly connecting an external device to a virtual machine, exemplarily shown in the present application;

[0106] FIG10B is a schematic structural diagram of another configuration device for directly connecting an external device to a virtual machine exemplarily shown in the present application;

[0107] FIG10C is a schematic structural diagram of another configuration apparatus for directly connecting an external device to a virtual machine exemplarily shown in the present application;

[0108] FIG11 is a schematic diagram of the structure of another computing device provided in this application. DETAILED DESCRIPTION

[0109] The technical solution provided in this application will be described below in conjunction with the accompanying drawings.

[0110] In order to make the technical solution provided by this application clearer, the relevant terms are first explained.

[0111] (1) Virtual machine: refers to a complete computer system with complete hardware system functions that is simulated by software and runs in a completely isolated environment. The work that can be done in the server can also be done in the virtual machine. Each virtual machine has an independent hard disk and operating system, and the user of the virtual machine can operate the virtual machine like using a server. (2) External device: It can also be called an acceleration device or a heterogeneous device, which usually refers to a hardware device used to accelerate computing, process data or perform specific tasks. These devices are usually designed to speed up specific types of computing (such as confidential computing) or processing, improve computing efficiency and processing performance, such as GPU, NPU, TPU, network card, sound card and hard disk. Among external devices, devices that communicate through the PCIE protocol are usually called PCIE devices, or end devices (endpoints). They are at the end of the PCIE bus system topology and generally serve as the initiator or terminator of bus operations. The PCIE bus architecture can contain multiple PCIE devices. In actual scenarios, external devices can also communicate with the host through high-speed serial (compute express link, CXL), NVLink and other protocols. This application does not limit the communication protocol between external devices and the host.

[0112] (3) Device passthrough is a virtualization technology that allows external devices on the host (such as graphics cards, network cards, GPUs, and NPUs) to be directly assigned to virtual machines, enabling virtual machines to directly access external devices without the need for virtualization through the host operating system.

[0113] (4) Direct memory access (DMA): It is an interface technology that allows external devices to exchange data directly with system memory without going through the processor (also called the central processing unit (CPU)). External devices can use DMA to transfer data in batches to the memory, and then send an interrupt to notify the processor to retrieve it. The transfer process does not go through the processor, which reduces the burden on the processor.

[0114] (5) System memory management unit (SMMU): Also known as the input / output memory management unit (IOMMU), it is located between external devices and the bus and serves as an address translation bridge between the external devices and the bus. It has similar functions to the memory management unit (MMU) and can implement functions such as address translation (mapping), memory attribute translation, and permission checking. Among them, the address translation can be stage 1 translation (i.e., virtual address (VA) -> physical address (PA), or stage 2 translation (i.e., intermediate physical address (IPA) -> PA), or stage 1+stage 2 translation (i.e., VA -> IPA -> PA).

[0115] The main function of SMMU is DMA remapping, which enables external devices to access host memory through DMA technology.

[0116] (6) VFIO: It is a user-mode driver framework provided by the Linux kernel for IOMMU. It uses IOMMU to directly connect I / O devices to user mode and supports DMA remapping.

[0117] (7) Memory-mapped I / O (MMIO): This is part of the PCI specification. I / O devices are placed in memory space rather than I / O space. From the processor's perspective, memory-mapped I / O allows the processor to access I / O devices as if they were memory. The memory space where external devices are placed is often called the MMIO address space.

[0118] (8) BAR: BAR stores the base address of the address space used by the PCIE device. The base address stores the address of the PCIE device in the PCIE bus domain (ie, the bus address).

[0119] (9) Root Complex: This refers to the device that connects the processor, host memory, and PCIE bus. It manages all buses and all nodes (such as switches and end devices) in the PCIE system and serves as a bridge for communication between nodes in the PCIE system. In a PCIE system, only the root complex and the node itself have permission to access (including configuration and reading and writing) the node's BAR.

[0120] Next, we will introduce the application scenarios involved in this application.

[0121] The present application relates to a scenario where an external device is directly connected to a virtual machine. Please refer to Figure 1, which is a schematic diagram of a scenario where an external device is directly connected to a virtual machine involved in the present application. As shown in Figure 1, a computing device 100 (such as a server) includes a hardware layer and a software layer. The hardware layer is a conventional configuration of the computing device 100, wherein the external device may be, for example, a network card, a GPU, an NPU, an offload card, or other device that can be inserted into a slot on the server. The software layer includes a host operating system kernel (also referred to as a host kernel) installed and running on the computing device 100. A virtual machine hypervisor (also referred to as a virtual machine manager) is provided in the host operating system kernel. The role of the virtual machine hypervisor is to realize computing virtualization, network virtualization, and storage virtualization of the virtual machine, and is responsible for managing the virtual machine.

[0122] Computing virtualization refers to providing part of the processor and memory of the computing device 100 to the virtual machine, network virtualization refers to providing part of the functions of the network card (such as bandwidth) to the virtual machine, and storage virtualization refers to providing part of the disk to the virtual machine.

[0123] The virtual machine hypervisor can also achieve logical isolation between different virtual machines and manage virtual machines, such as creating virtual machines, simulating virtual hardware for virtual machines based on the hardware layer (hardware simulation function), deleting virtual machines, forwarding and / or processing network packets between all virtual machines running on the computing device 100 (such as virtual machine 1 and virtual machine 2) or forwarding network packets between the virtual machines on the computing device 100 and the external network (virtual switching function), processing I / O generated by virtual machines, etc.

[0124] The operating environments (such as virtual machine applications, operating systems, and virtual hardware) in different virtual machines are completely isolated. Communication between virtual machine 1 and virtual machine 2 requires forwarding network packets through the virtual machine hypervisor.

[0125] Tenants can remotely log in to the virtual machine and operate the virtual machine to install, configure, and uninstall applications in the virtual machine operating system environment.

[0126] In Figure 1, as shown by the dotted arrow, the external device can be directly connected to the virtual machine (taking virtual machine 1 as an example), so that the virtual machine can directly access the external device without virtualization through the host operating system, thereby saving the computing power and memory of the computing device 100.

[0127] However, the virtual machine is managed by the hypervisor in the host operating system kernel. Once the host operating system kernel is compromised by an attacker, the attacker will be able to manipulate the hypervisor to manage the virtual machine, such as stealing data stored in the virtual machine's memory that the virtual machine is about to send to a directly connected external device, or stealing data stored in the virtual machine's memory that the virtual machine receives from a directly connected external device. For example, accessing an external device through the virtual machine poses a security threat to the directly connected data between the virtual machine and the external device and to the external device.

[0128] Therefore, how to protect the direct data between the external device and the virtual machine and the security of the external device in the scenario of direct communication between the external device and the virtual machine, and meet the user's security requirements for direct data and external devices, has become an urgent problem to be solved in this field.

[0129] To solve the above problems, the present application provides a method for a computing device and an external device to directly connect to a virtual machine. To facilitate understanding of the method provided by the present application for a computing device and an external device to directly connect to a virtual machine, the TrustZone technology involved in the present application is first introduced below.

[0130] As the performance of advanced RISC (ARM) processors continues to improve, computing devices running ARM processors, such as servers and smart devices, have brought significant convenience to people's lives. At the same time, computing devices carry increasing amounts of user data, and users are increasingly concerned about the security of their computing devices. TrustZone technology is currently the mainstream system-level solution for ARM processors.

[0131] TrustZone technology, first introduced as a security extension in ARMv6, divides a computing device's hardware resources into two worlds: the REE side (also known as the non-secure world) and the TEE side (also known as the secure world). As a hardware security feature, TrustZone operates on the TEE side.

[0132] The REE side doesn't necessarily mean that the operating system (OS) or software running on it is malicious, but rather that the security environment it inhabits is less secure than the TEE side. When the processor operates on the REE side, access to TEE resources (such as registers, memory, cache, and peripherals) is prohibited. Any attempt by the processor to access these resources will result in a system crash. For example, TrustZone can configure the trustzone address space controller (TZASC) and trustzone memory adapter (TZMA) registers to set sensitive memory as secure memory, preventing access from the REE side. When the processor operates on the TEE side, it can access resources on both the TEE and REE sides. Because the TEE side has higher privileges than the REE operating system, TrustZone can serve as a root of trust, providing a higher level of security protection for the REE operating system.

[0133] Taking ARMv8.4 as an example, Figure 2 depicts the ARM hardware architecture. The left side shows the REE architecture, and the right side shows the TEE architecture. The REE includes four levels of privilege: exception level 0 (EL0), EL1, EL2, and EL3. The TEE includes four levels of privilege: secure exception level 0 (SEL0), SEL1, SEL2, and EL3. EL0 is also known as the user mode layer, EL1 as the kernel mode layer, EL2 as the hypervisor layer, and EL3 as the secure monitor layer. Levels with larger numerical values ​​have higher privileges, while levels with smaller numerical values ​​have lower privileges.

[0134] Operating systems closely connected to users, such as virtual machine operating systems, run in the EL0 and EL1 layers on the REE side. Hypervisors run in the EL2 layer. ARM trusted firmware runs in the EL3 layer. ARM trusted firmware (ATF) is the first component that runs when the processor boots. It is the low-level firmware officially provided by ARM and standardizes ARM low-level interface standards, such as the power status control interface (PSCI), trusted board boot requirements (TBBR), and secure monitor call (SMC) operations for switching between secure and normal world states.

[0135] Next, we will continue to introduce the computing device provided by this application. The computing device provided by this application is mainly a computing device whose hardware resources are divided into REE side and TEE side, such as the computing device running the above-mentioned ARM processor. It can also be a computing device that divides hardware resources into REE side and TEE side through other technologies. This application does not make specific limitations.

[0136] Referring to FIG. 3 , which exemplifies a computing device 300 provided in the present application, the hardware resources of the computing device 300 are divided into a REE side and a TEE side, and the host operating system kernel is located on the REE side.

[0137] As shown in FIG3 , in a computing device 300 , a virtual machine is deployed on the TEE side, which is different from the host operating system kernel.

[0138] In order to distinguish the virtual machine on the TEE side from the virtual machine in the computing device 100 that is not divided into the REE side and the TEE side as shown in Figure 1, and from the virtual machine on the REE side as shown in Figure 3, in the following embodiments, the virtual machine on the TEE side is referred to as a confidential virtual machine, and the virtual machine shown in Figure 1 and the virtual machine on the REE side shown in Figure 3 are referred to as ordinary virtual machines.

[0139] As shown in FIG3 , the TEE side of the computing device 300 may include one or more confidential virtual machines, and the REE side may include one or more common virtual machines. In FIG3 , it is taken as an example that the TEE side and the REE side each include two virtual machines.

[0140] A confidential virtual machine, similar to a common virtual machine, may include an operating system kernel and one or more application programs (APPs) (not shown in FIG3 ). The operating system kernel in the confidential virtual machine and the common virtual machine may be a powerful general-purpose operating system kernel such as Linux, and this application does not specifically limit this.

[0141] It should be noted that the virtual machine hypervisor in the above-mentioned host operating system kernel (in order to distinguish it from the virtual machine hypervisor on the TEE side described below, the virtual machine hypervisor in the host operating system kernel will be referred to as the ordinary virtual machine hypervisor below) is mainly used to manage ordinary virtual machines. When managing confidential virtual machines, it needs to perform management operations through the relevant modules on the TEE side (the secure virtual machine hypervisor on the TEE side as shown in Figure 5). In other words, the ordinary virtual machine hypervisor does not have access rights to confidential virtual machines to protect the security of confidential virtual machines.

[0142] As shown in FIG3 , the computing device 300 is similar to the computing device 100 and also includes a hardware layer. For details of the hardware layer, please refer to the relevant description in FIG1 . For the sake of brevity of the specification, it will not be described in detail here.

[0143] It should be understood that the computing device 300 is only one example provided in the present application, and the computing device 300 may have more or fewer components than those shown in FIG. 3 , or may have different configurations of components.

[0144] In a specific embodiment of the present application, when the user has low requirements for the security of the data and external devices when the external device is connected directly to the virtual machine, an ordinary virtual machine can be created according to user needs, and the external device can be configured to connect directly to the ordinary virtual machine.

[0145] When the user has high security requirements for direct data and external devices, a confidential virtual machine can be created according to user needs, and external devices can be configured to directly connect to the confidential virtual machine. As shown in Figure 3, the external device directly connects to the confidential virtual machine 2. Since the confidential virtual machine is on the TEE side, the confidential virtual machine is protected by the hardware security features of the TEE. Even if the host operating system kernel is compromised by an attacker, the attacker cannot manage the confidential virtual machine through the ordinary virtual machine hypervisor in the host operating system kernel. For example, the attacker cannot steal the data stored in the memory of the confidential virtual machine to be sent to the direct external device, and the attacker cannot steal the data stored in the memory of the confidential virtual machine received by the confidential virtual machine from the direct external device. In addition, the attacker cannot access the external device through the confidential virtual machine, which meets the user's security requirements for direct data between virtual machines and external devices and for external devices.

[0146] Below, in combination with the two method flow charts of the present application shown in Figures 4 and 7A, the process of configuring the confidential virtual machine on the TEE side for the computing device 300 shown in Figure 3 to connect an external device directly to the virtual machine is described in detail.

[0147] (1) The first method of connecting an external device directly to a virtual machine:

[0148] As shown in FIG4 , the method includes steps S401 and S402 .

[0149] S401: The processor of the computing device 300 obtains a first instruction on the REE side, where the first instruction instructs to configure a first external device to directly connect to a first confidential virtual machine.

[0150] S402: The processor configures the first external device to directly connect to the first confidential virtual machine on the TEE side according to the first instruction.

[0151] The first confidential virtual machine can be any confidential virtual machine on the TEE side.

[0152] The first instruction may carry configuration parameters for configuring the first external device to directly connect to the first confidential virtual machine, such as the device identifier of the first external device (such as the stream identifier (stream ID) of the first external device, the identifier of the first confidential virtual machine (such as the ID of the first confidential virtual machine), etc., wherein the device identifier of the first external device is used by the processor to locate the first external device, and the identifier of the first confidential virtual machine is used by the processor to locate the first confidential virtual machine. The first external device may be one or more external devices such as GPU, NPU, TPU, network card, graphics card, sound card, etc. This application does not specifically limit the first external device.

[0153] In a possible embodiment, the first instruction may be input to the computing device 300 by the user through the interface of the computing device 300. After obtaining the first instruction, the computing device 300 stores the first instruction in the memory on the REE side. The subsequent processor reads the first instruction from the memory on the REE side and executes the first instruction on the TEE side.

[0154] In a possible embodiment, the process of configuring the first external device to directly connect to the first confidential virtual machine on the TEE side may include S4021 to S4023 shown in FIG4 :

[0155] S4021: The processor configures the BAR of the first external device on the TEE side.

[0156] The BAR of the first external device can be understood as the address of the first external device in the PCIE bus domain, that is, the bus address of the first external device.

[0157] S4022: The processor establishes a first mapping relationship on the TEE side. The first mapping relationship is a mapping relationship between a first memory and a second memory. The first memory is a memory in the memory of the first confidential virtual machine used for the first confidential virtual machine to access the first external device. The second memory is a memory in the BAR of the first external device used for the first confidential virtual machine to access the first external device.

[0158] It can be understood that the memory of the first confidential virtual machine belongs to the TEE side.

[0159] S4023: The processor establishes a second mapping relationship on the TEE side. The second mapping relationship is a mapping relationship between the third memory and the fourth memory. The third memory is the memory in the memory of the first confidential virtual machine used for the first external device to access the first confidential virtual machine. The fourth memory is the memory in the BAR of the first external device used for the first external device to access the first confidential virtual machine.

[0160] The first mapping relationship and the second mapping relationship may be a mapping relationship between memory addresses. For example, the first mapping relationship is a mapping relationship between an address of a first memory and an address of a second memory.

[0161] It can be understood that the first external device directly connects to the first confidential virtual machine, which mainly involves the following two types of memory access: 1. The first confidential virtual machine accesses (such as configures, reads and writes) the memory of the first external device (i.e., the above-mentioned BAR), the initiator is the first confidential virtual machine (it can also be said to be the processor running the first confidential virtual machine), and the responder is the first external device; 2. The first external device DMA reads and writes the memory of the first confidential virtual machine (also called DMA memory, belonging to the host memory). Taking the first external device as a network card as an example, after the network card receives a message whose destination address is the first confidential virtual machine, it needs to send the message to the first confidential virtual machine. The initiator is the network card, and the responder is the DMA memory in the first confidential virtual machine used for network card DMA reading and writing, and no CPU participation is required.

[0162] In this application, the processor establishes a first mapping relationship on the TEE side, so that when the first confidential virtual machine needs to access the first external device, the first confidential virtual machine can access the second memory by accessing the first memory, and accessing the second memory means accessing the first external device. The processor establishes a second mapping relationship on the TEE side, so that when the first external device needs to access the first confidential virtual machine, the first external device can access the third memory by accessing the fourth memory, and accessing the third memory means accessing the first confidential virtual machine. It can be seen that through the first mapping relationship and the second mapping relationship, the first confidential virtual machine and the first external device can access each other as if they were accessing their own memory.

[0163] In a specific implementation, the first mapping relationship can be established by the processor using MMIO technology. In this case, the first memory is generally referred to as MMIO memory. The second mapping relationship can be established by the processor using SMMU. In this case, the third memory is generally referred to as DMA memory. Regarding the process of the processor establishing the first mapping relationship using MMIO technology and establishing the second mapping relationship using SMMU, please refer to the relevant description of MMIO and SMMU in the prior art. For the sake of brevity of the specification, it will not be elaborated here.

[0164] In a possible embodiment, as shown in FIG5 , the PCIE topology of the hardware layer of the computing device 300 includes a root complex, which is a bridge for communication between the processor of the computing device 300 and external devices. That is, when the processor communicates with the external device, the communication data is forwarded through the root complex. For example, in the process of configuring the first external device to directly connect to the first confidential virtual machine on the TEE side, the processor needs to configure the BAR of the first external device on the TEE side, then the communication data in the configuration process are all forwarded by the root complex. For another example, after the processor configures the first external device to directly connect to the first confidential virtual machine, the processor will run the first confidential virtual machine to communicate with the first external device, then the direct data between the first confidential virtual machine and the first external device will also be forwarded by the root complex.

[0165] In order to prevent the host operating system kernel on the REE side from being compromised by an attacker, where the attacker can manipulate the host operating system kernel to access (configure or read and write) the first external device (such as accessing the BAR of the first external device), thereby posing a security risk to the first external device, in a specific embodiment of the present application, in addition to being responsible for forwarding communication data between the processor and the first external device, the root complex also has the following function: when the processor is on the REE side, the root complex does not allow the processor to access the first external device.

[0166] In a specific implementation, the root complex can receive a third instruction sent by the processor (instructing that the processor is not allowed to access the first external device when the processor is on the REE side) and execute the third instruction to perform the configuration. Subsequently, when the root complex receives an access request for the first external device sent by the processor, it can determine whether the processor is accessing the first external device in a secure manner (such as when the processor is on the TEE side or the basic input and output system (BIOS)). If it is determined that the processor is accessing the first external device in a secure manner, the processor is allowed to access the first external device; otherwise, the processor is denied access to the first external device.

[0167] In order to prevent the first confidential virtual machine from being accessed by other untrusted external devices other than the first external device and to protect the security of the first confidential virtual machine, in a specific embodiment of the present application, the root complex may also have the following functions: the root complex may mark the first external device as a secure device, and unmarked external devices are defaulted to non-secure devices. After marking the first external device as a secure device, if the root complex receives a message related to the first confidential virtual machine from an external device (such as the first external device), it may determine whether the external device is a secure device based on the marking information. If it is determined that the external device is a secure device, the message is sent to the first confidential virtual machine; otherwise, the message is refused to be sent to the first confidential virtual machine.

[0168] In a specific implementation, the root complex may receive a second instruction (instructing to mark the first external device as a secure device) sent by the processor, and execute the second instruction to mark the first external device.

[0169] Furthermore, the root complex may mark the first external device as a secure device based on a second instruction and perform a security device determination upon receiving a message from the external device. The implementation method may be as follows: the second instruction sent by the processor carries a device identifier of the first external device (e.g., a stream ID of the first external device). Upon receiving the second instruction, the root complex may mark the first external device as a secure device based on the device identifier of the first external device in the second instruction. Subsequently, upon receiving a first message related to the first confidential virtual machine from the first external device (carrying a first identifier, indicating that the first external device is a secure device), the root complex may determine that the first external device is a secure device based on the first identifier carried in the first message, and then send the first message to the first confidential virtual machine. Upon receiving a message related to the first confidential virtual machine from another external device (an external device not marked as a secure device by the root complex) (not carrying the first identifier or carrying the second identifier, indicating that the external device is a non-secure device), the root complex may determine that the external device is a non-secure device based on the fact that the message does not carry the first identifier or carries the second identifier, and then refuse to send the message to the first confidential virtual machine.

[0170] Furthermore, the root complex may mark the first external device as a secure device according to the device identifier of the first external device in the second instruction in the following manner ① or ②:

[0171] Method ①: After receiving the second instruction, the root complex saves the device identification of the first external device. In this method, external devices for which the root complex saves the corresponding identification are considered to be marked as secure devices by the root complex, while external devices for which the root complex does not save the corresponding identification are considered to be marked as non-secure devices by the root complex.

[0172] Subsequently, when the root complex receives a first message related to the first confidential virtual machine from the first external device (carrying a first identifier, where the first identifier is the device identifier of the first external device), it can determine that the first external device is a secure device based on the device identifier of the first external device carried in the first message and the device identifier of the first external device stored in the root complex, and then send the first message to the first confidential virtual machine. When the root complex receives a message related to the first confidential virtual machine from other external devices (external devices that are not marked as secure devices by the root complex) (carrying the device identifier of other external devices), it can determine that the external device is a non-secure device based on the device identifier of the other external devices carried in the message, and then refuse to send the message to the first confidential virtual machine.

[0173] In method 2, after receiving the second instruction, the root complex locates the first external device based on its device identifier. It then sends a marking instruction to the first external device, instructing it to mark itself as a secure device in its local register. In this method, when an external device that has marked itself as a secure device in its local register sends a message to the first confidential virtual machine, the message carries the first identifier indicating that the external device is a secure device. When an external device that has not marked itself as a secure device in its local register sends a message to the first confidential virtual machine, the message does not carry the first identifier, or the message carries the second identifier.

[0174] Subsequently, when the root complex receives a first message related to the first confidential virtual machine from the first external device, it can determine that the first external device is a secure device based on the first identifier carried in the first message, and then send the first message to the first confidential virtual machine. When other external devices that are not marked as secure devices send messages to the first confidential virtual machine, they do not carry the first identifier or carry the second identifier. When the root complex receives a message related to the first confidential virtual machine from the external device, it can determine that the external device is a non-secure device based on the fact that the message does not carry the first identifier or based on the second identifier carried in the message, and then refuse to send the message to the first confidential virtual machine.

[0175] For example, in a specific implementation, when an external device sends a message to the first confidential virtual machine, the sent message includes a security ID field. If the external device is marked as a security device, the security ID field in the message carries a first ID such as 0. If the external device is not marked as a security device, the security ID field in the message is empty or a second ID such as 1.

[0176] It should be understood that the above-mentioned methods ① and ② are merely examples and should not be regarded as specific limitations on the implementation of the root complex marking the first external device as a secure device and performing a secure device determination upon receiving a message sent by the external device.

[0177] In a more specific embodiment, as shown in FIG5 , the root complex includes a protection controller, and the operations performed by the root complex can be implemented by the protection controller in the root complex.

[0178] In a possible embodiment, as shown in FIG5 , the TEE side of the computing device 300 may include, in addition to the first confidential virtual machine, a secure virtual machine hypervisor for managing the first confidential virtual machine. The secure virtual machine hypervisor may run at the SEL2 layer of the TEE side.

[0179] In the computing device 300 shown in Figure 5, the operations performed by the processor of the computing device 300 described in this article on the TEE side can be implemented by the processor running a secure virtual machine hypervisor, such as the operation of the processor configuring the first external device to directly connect to the first confidential virtual machine on the TEE side as described above and the operation of the processor creating the first confidential virtual machine on the TEE side as described below, both can be implemented by the processor running a secure virtual machine hypervisor.

[0180] In a possible embodiment, as shown in FIG5 , the REE side of the computing device 300 may further include a VFIO driver. The operations performed by the processor of the computing device 300 on the REE side may be implemented by the processor running the VFIO driver on the REE side.

[0181] In a possible embodiment, as shown in FIG5 , the VFIO driver includes a vifo_iommu module and a vfio_pci module, the secure virtual machine hypervisor includes a trust input / output management module, and the trust IO management module includes an MMIO module and an SMMU module.

[0182] The vifo_iommu module is an encapsulation of the IOMMU driver, and is used to provide IOMMU functions for the first confidential virtual machine, that is, to provide the first external device with the ability to access the first confidential virtual machine, such as the ability to perform DMA reading and writing on the first confidential virtual machine.

[0183] Specifically, the vifo_iommu module may send an instruction to the SMMU module, so that the SMMU module executes the instruction, thereby providing the first external device with the ability to access the first confidential virtual machine.

[0184] The vfio_pci module is an encapsulation of a device driver, and is used to provide the first confidential virtual machine with the ability to access a first external device, such as the ability to read and write to the first external device.

[0185] Specifically, the vfio_pci module may send an instruction to the MMIO module, so that the MMIO module executes the instruction, thereby providing the first confidential virtual machine with the ability to access the first external device.

[0186] In a specific implementation, the vfio_pci module may further send the second instruction and the third instruction to the MMIO module, so that the MMIO module performs corresponding configuration according to the second instruction and the third instruction.

[0187] It should be noted that the above-mentioned secure IO management module can also be called other modules, such as a management module, a first module, etc., the above-mentioned MMIO module can also be called other modules, such as a first sub-module, etc., and the above-mentioned SMMU module can also be called other modules, such as an IOMMU module, a second sub-module, etc. This application does not specifically limit the names of the above-mentioned modules.

[0188] The following describes in detail the process of configuring the external device to directly connect to the first confidential virtual machine by the computing device 300 shown in FIG5 , in conjunction with the flowchart shown in FIG6 .

[0189] S601: The processor runs the VFIO driver on the REE side to obtain the first instruction, the second instruction, and the third instruction. The first instruction indicates that the first external device is configured to directly connect to the first confidential virtual machine. The second instruction indicates that the first external device is marked as a secure device. The third instruction indicates that when the processor is on the REE side, the processor is not allowed to access the BAR of the first external device.

[0190] S602: The processor runs the VFIO driver to send the first instruction, the second instruction, and the third instruction to the secure virtual machine hypervisor on the TEE side.

[0191] S603: The processor runs an MMIO module in a secure virtual machine hypervisor on the TEE side, accesses the root complex according to the first instruction to configure a BAR of the first external device, marks the first external device as a secure device according to the second instruction, and configures, according to the third instruction, not to allow the processor to access the BAR of the first external device when the processor is on the REE side.

[0192] Specifically, the security controller in the root complex may execute a second instruction to mark the first external device as a secure device, and execute a third instruction to configure the processor not to access the BAR of the first external device when the processor is on the REE side.

[0193] S604: The processor runs the MMIO module in the secure virtual machine hypervisor on the TEE side to establish a first mapping relationship through MMIO technology according to the first instruction. The first mapping relationship is a mapping relationship between the MMIO memory and the second memory. The MMIO memory is the memory in the memory of the first confidential virtual machine used for the first confidential virtual machine to access the first external device. The second memory is the memory in the BAR of the first external device used for the first confidential virtual machine to access the first external device.

[0194] S605: The processor runs the SMMU module in the secure virtual machine hypervisor on the TEE side to establish a second mapping relationship through the SMMU according to the first instruction. The second mapping relationship is a mapping relationship between the DMA memory and the fourth memory. The DMA memory is the memory in the memory of the first confidential virtual machine used for the first external device to access the first confidential virtual machine, and the fourth memory is the memory in the BAR of the first external device used for the first external device to access the first confidential virtual machine.

[0195] Through the above steps S601 to S605, the first external device is directly connected to the first confidential virtual machine, and subsequently the first external device and the first confidential virtual machine can communicate securely based on the above first mapping relationship and the second mapping relationship.

[0196] In a specific implementation, the communication data between the first external device and the first confidential virtual machine can be forwarded by the secure virtual machine hypervisor on the TEE side without passing through the REE side. In this way, the communication data can be prevented from being accessed by software on the REE side, such as the host operating system kernel, during transmission. Even if the software on the REE side is hacked by an attacker, the communication data between the first PCIE and the first confidential virtual machine cannot be stolen, thereby ensuring the security of the communication data during transmission.

[0197] It can be understood that before the computing device 300 executes the method of directly connecting an external device to a virtual machine shown in Figure 4, it is necessary to first create a first confidential virtual machine on the TEE side. In the present application, the processor of the computing device 300 can obtain the configuration information of the first confidential virtual machine to be created on the REE side, and then create the first confidential virtual machine based on the configuration information of the first confidential virtual machine on the TEE side. Among them, the configuration information includes the specifications of the first confidential virtual machine to be created, such as the size of the memory, the type of memory, the size of the memory, the type of memory, the type of processor core, the number of processor cores, the computing speed of the processor core, the number of cores of the processor core, the network bandwidth, the operating system kernel and the file system, etc. When creating the first confidential virtual machine, the processor can provide the first confidential virtual machine with virtual hardware resources that match the configuration information based on the configuration information. For example, based on the memory information included in the configuration information, the processor can divide the secure memory that matches the memory information and is used by the first confidential virtual machine in the memory resources on the TEE side; based on the processor core information included in the configuration information, the processor can simulate a virtual processor core that matches the processor core information and is used by the first confidential virtual machine; and the operating system kernel and file system included in the configuration information can be loaded into the secure memory corresponding to the first confidential virtual machine, etc., thereby realizing the creation of the first confidential virtual machine.

[0198] In a possible embodiment, the processor of the computing device 300 can run a normal virtual machine hypervisor on the REE side to obtain configuration information of the first confidential virtual machine to be created, and then run a secure virtual machine hypervisor on the TEE side to create the first confidential virtual machine according to the configuration information of the first confidential virtual machine.

[0199] It should be noted that in addition to performing the above operations, the processor of the computing device 300 can also perform other operations, such as creating, modifying or destroying the secondary page table on the REE side and / or TEE side. This application does not specifically limit the operations that the processor of the computing device 300 can perform.

[0200] (2) The second method of connecting external devices to virtual machines:

[0201] As shown in FIG. 7A , the method includes steps S701 - S704 .

[0202] S701: The secure virtual machine hypervisor receives a device direct connection request sent by the device direct connection management module of the non-secure world. The device direct connection request is used to configure a first external device to directly connect to the first confidential virtual machine. The device direct connection request carries the device identifier of the first external device and the identifier of the first confidential virtual machine.

[0203] The first confidential virtual machine can be any confidential virtual machine on the TEE side.

[0204] The identifier of the first confidential virtual machine may be an ID of the first confidential virtual machine, etc., and is used to locate the first confidential virtual machine.

[0205] The first external device may be one or more external devices such as a GPU, an NPU, a TPU, a network card, a graphics card, a sound card, etc. This application does not specifically limit the first external device.

[0206] The device identifier of the first external device may be a bus device function (BDF) number of the first external device, etc., which is used to locate the first external device.

[0207] Regarding the secure virtual machine hypervisor and the device pass-through management module, an introduction is given below in conjunction with another computing device 800 provided by the present application as exemplified in FIG8A .

[0208] In combination with the computing device 300 shown in Figure 3, it can be seen that the only difference between the computing device 800 shown in Figure 8A and the computing device 300 shown in Figure 3 is that the REE side of the computing device 800 includes a device direct management module and the TEE side includes a secure virtual machine hypervisor. The following only introduces the differences between the computing device 800 and the computing device 300 shown in Figure 3. For the similarities between the two, please refer to the relevant description of Figure 3. For the sake of brevity of the specification, no further details will be given here.

[0209] The secure virtual machine hypervisor has been introduced in Figure 3. Please refer to the relevant description of Figure 3.

[0210] The device direct management module can run in the EL2 layer on the REE side. In one possible embodiment, as shown in Figure 8A, the device direct management module is deployed in the host operating system kernel running in the EL2 layer. It should be noted that the device direct management module can also be referred to as a direct management module, a direct module, a device direct module, etc. This application does not specifically limit the name of this module.

[0211] The device pass-through management module is a bridge for the secure virtual machine hypervisor to interact with the user. In S701, the process of the secure virtual machine hypervisor receiving the device pass-through request sent by the device pass-through management module can be: the device pass-through management module reads the device pass-through request input by the user to the computing device 800 from the non-secure memory on the REE side and sends it to the secure virtual machine hypervisor.

[0212] In a specific implementation, the user may input a device direct connection request to the computing device 800 in the following ways, including but not limited to:

[0213] Method (1): The user may input a device direct connection request through a command-line interface (CLI) provided by the computing device 800 .

[0214] Method (2): The user may input a device direct request through an application programming interface (API) provided by the computing device 800 .

[0215] Method (3): The computing device 800 provides a graphical user interface (GUI) to the user, which can display the device identification of the external device, the identification input interface of the confidential virtual machine, and the configuration direct control. The user can input the device identification of the first external device and the identification of the first confidential virtual machine through the input interface, and then click the configuration direct control to realize the input of the device direct request.

[0216] S702: The secure virtual machine hypervisor configures the first external device to directly connect to the first confidential virtual machine according to the device direct connection request.

[0217] It can be understood that the first external device directly connecting to the first confidential virtual machine may involve communication in the following two directions: Direction 1, the first confidential virtual machine accesses the first external device, the initiator is the first confidential virtual machine, and the responder is the first external device; Direction 2, the first external device accesses the first confidential virtual machine, the initiator is the first external device, and the responder is the first confidential virtual machine. Therefore, the secure virtual machine hypervisor configures the first external device to directly connect to the first confidential virtual machine, and it is necessary to configure the first external device and the first confidential virtual machine to be able to communicate.

[0218] Specifically, S702 can configure the first external device to communicate with the first confidential virtual machine through steps S7021 to S7023 shown in Figure 7B.

[0219] S7021: The secure virtual machine hypervisor establishes a first mapping relationship in the MMU. The first mapping relationship is a mapping relationship between the virtual address space of the first confidential virtual machine and the MMIO address space of the first external device. The MMIO address space of the first external device belongs to the physical address space of the first confidential virtual machine.

[0220] The MMIO address space of the first external device may be carried by the device direct request.

[0221] The physical address space of the first confidential virtual machine refers to the memory space occupied by the first confidential virtual machine, which belongs to the secure memory.

[0222] By establishing the first mapping relationship in the MMU, when the first confidential virtual machine needs to access the first external device, the first confidential virtual machine can access the first external device through the first mapping relationship.

[0223] S7022: The secure virtual machine hypervisor establishes a second mapping relationship in the IOMMU. The second mapping relationship is a mapping relationship between the IO virtual address space of the first external device and the DMA address space of the first external device. The DMA address space of the first external device belongs to the physical address space of the first confidential virtual machine.

[0224] The DMA address space of the first external device may be carried by the device direct request.

[0225] By establishing the second mapping relationship in the IOMMU, when the first external device needs to access the first confidential virtual machine, the first external device can access the first confidential virtual machine through the second mapping relationship.

[0226] In a possible embodiment, before the secure virtual machine hypervisor establishes the first mapping relationship in the MMU and the second mapping relationship in the IOMMU, it can check the validity of the configuration parameters carried by the device pass-through request for configuring the first external device to directly connect to the first confidential virtual machine (such as the device identifier of the first external device, the MMIO address space, and the DMA address space, etc.); if it is determined that the configuration parameters are valid, the first mapping relationship and the second mapping relationship are established; if it is determined that the configuration parameters are invalid, the first mapping relationship and the second mapping relationship are not established, so as to avoid establishing an erroneous mapping relationship, which may result in the subsequent first confidential virtual machine and the first external device being unable to communicate normally, and the user is reminded.

[0227] For example, the secure virtual machine hypervisor checks whether there is a device identifier of the first external device carried by the device direct pass request among the device identifiers of multiple external devices connected to the computing device 800 recorded in the security firmware of the computing device 800. When it is determined that the device identifier of the first external device carried by the device direct pass request exists among the device identifiers of the multiple external devices recorded in the security firmware, the secure virtual machine hypervisor checks whether the MMIO address space corresponding to the device identifier of the first external device recorded in the security firmware is the same as the MMIO address space carried by the device direct pass request. When it is determined that the MMIO address space corresponding to the device identifier of the first external device is the same as the MMIO address space carried by the device direct pass request, it is determined that the device identifier and MMIO address space of the first external device carried by the device direct pass request are both valid. Thereafter, based on the MMIO address space carried by the device direct pass request, the secure virtual machine hypervisor checks whether the MMIO address space corresponding to the device identifier of the first external device is the same as the MMIO address space carried by the device direct pass request. A first mapping relationship is established in the MMU; when it is determined that the device identifier of the first external device carried by the device pass-through request does not exist among the device identifiers of multiple external devices recorded in the security firmware, it is determined that the device identifier of the first external device carried by the device pass-through request is invalid, the first mapping relationship is not established in the MMU, and the user is reminded that the device identifier of the first external device is invalid; when it is determined that the device identifier of the first external device carried by the device pass-through request exists among the device identifiers of multiple external devices recorded in the security firmware, but it is checked that the MMIO address space corresponding to the device identifier of the first external device recorded in the security firmware is different from the MMIO address space carried by the device pass-through request, it is determined that the device identifier of the first external device carried by the device pass-through request is valid but the carried MMIO address space is invalid, the first mapping relationship is not established in the MMU, and the user is reminded that the MMIO address space is invalid.

[0228] For another example, the secure virtual machine hypervisor checks whether the DMA address space carried by the device pass-through request belongs to the physical address space of the first confidential virtual machine. When it is determined that it belongs to the physical address space of the first confidential virtual machine, the DMA address space carried by the device pass-through request is determined to be valid. Afterwards, a second mapping relationship is established in the IOMMU based on the DMA address space carried by the device pass-through request. When it is determined that it does not belong to the physical address space of the first confidential virtual machine, the DMA address space carried by the device pass-through request is determined to be invalid, a second mapping relationship is not established in the IOMMU, and the user is reminded that the DMA address space is invalid.

[0229] S7023: The secure virtual machine hypervisor sends a security mark instruction to the IO hardware module, instructing the IO hardware module to add a security mark in the first message received from the first external device, or sends a security mark instruction to the first external device, instructing the first external device to add a security mark in the generated first message, and the security mark indicates that the first external device has access rights to the secure memory.

[0230] The IO hardware module, as shown in FIG8B , is deployed in the hardware layer of the computing device 800. The IO hardware module is a bridge for communication between the computing device 800 and external devices. That is, when the computing device 800 communicates with an external device, the communication data is forwarded through the IO hardware module. For example, after completing the direct-through configuration between the first external device and the first confidential virtual machine, the communication data between the first confidential virtual machine running on the computing device 800 and the first external device will be forwarded by the IO hardware module. It should be noted that the IO hardware module can also be called a security controller (protection controller), or an external device security controller, etc. This application does not specifically limit the name of the hardware module. In a possible embodiment, when the external device communicates with the processor through the PCIE protocol, the IO hardware module can be integrated into the root complex.

[0231] The specific implementation process of S7023 is introduced in detail below.

[0232] (1) Regarding the secure virtual machine hypervisor sending a security marking instruction to the IO hardware module, instructing the IO hardware module to add a security flag to the first message received from the first external device, the specific implementation process may include steps S901-S904 shown in FIG9A :

[0233] S901: The secure virtual machine hypervisor sends a security marking instruction carrying a device identifier of a first external device to the IO hardware module.

[0234] S902: The IO hardware module records the security tag locally according to the security tag instruction. The security tag includes a device identifier of the first external device. The security tag indicates that the first external device is a security device.

[0235] A secure device may also be called a confidential device or a trusted device.

[0236] S903: The IO hardware module receives a first message sent by the first external device carrying the device identification of the first external device, matches the device identification of the first external device carried in the first message with the device identification of the first external device in the security tag, determines that the two are the same, and executes S904.

[0237] S904: The IO hardware module determines that the first external device is a safety device and adds a safety flag to the first message.

[0238] The IO hardware module adds a security flag to the first message and sends it to the IOMMU.

[0239] In the present application, if the IO hardware module receives a second message from a second external device (here referring to an external device that is not security-marked in the IO hardware module, i.e., a non-secure external device), the device identifier of the second external device carried in the second message can be matched with the device identifier in the locally recorded security mark, and it can be determined that the device identifier of the second external device is not included in the locally recorded security mark, thereby determining that the second external device is a non-secure device, and then, a non-secure flag is added to the second message and sent to the IOMMU.

[0240] When the IOMMU receives the first message carrying a security flag, it can determine that the first external device can access the non-secure memory on the REE side and the secure memory on the TEE side based on the security flag carried by the first message. Afterwards, based on the destination address carried by the first message (belonging to the IO virtual address space of the first external device), the IOMMU queries the locally configured first page table, which includes the mapping relationship of the secure memory on the TEE side (such as the first mapping relationship and the second mapping relationship mentioned above, in the first mapping relationship, the MMIO address space is secure memory, and in the second mapping relationship, the DMA address space is secure memory) and the mapping relationship of the non-secure memory on the REE side. By querying the first page table, the IOMMU can determine whether there is a memory space mapped to the destination address in the non-secure memory on the REE side / the secure memory on the TEE side. If it is determined that there is a memory space mapped to the destination address, the IOMMU forwards the first message to the memory space mapped to the destination address. Otherwise, the first message is not forwarded.

[0241] When the IOMMU receives the second message carrying the non-secure flag, it can determine that the second external device can access the non-secure memory on the REE side but cannot access the secure memory on the TEE side based on the non-secure flag carried by the second message. Afterwards, based on the destination address carried by the second message (belonging to the IO virtual address space of the second external device), the IOMMU queries the locally configured second page table, which includes the mapping relationship of the non-secure memory on the REE side. By querying the second page table, the IOMMU can determine whether there is a memory space mapped to the destination address in the non-secure memory on the REE side. If it is determined that there is a memory space mapped to the destination address, the IOMMU forwards the second message to the memory space mapped to the destination address. Otherwise, the second message is not forwarded.

[0242] In a specific implementation, the IO hardware module may add a security flag / non-security flag to the message by adding a security flag (security ID) field (such as a flag bit (NS bit)) and a value (value) of the security flag field to the message. If the value of the added security flag field is 0, it indicates that a security flag is added. If the value of the added security flag field is 1, it indicates that a non-security flag is added.

[0243] Optionally, the values ​​corresponding to the security flag and the non-security flag may also be other, and this application does not specifically limit this. For example, if the value of the added security flag field is 00, it means that the security flag is added, and if the value of the added security flag field is 01, it means that the non-security flag is added.

[0244] It can be seen that since the message from the non-secure external device (i.e., the second external device mentioned above) carries a non-secure flag, after receiving the message from the non-secure external device, the IOMMU determines that the non-secure external device cannot access the secure memory on the TEE side based on the non-secure flag carried in the message, thereby protecting the resource security on the TEE side.

[0245] (2) Regarding the secure virtual machine hypervisor sending a security marking instruction to the first external device, instructing the first external device to add a security flag to the generated first message, the specific implementation process may include steps S910-S930 shown in FIG9B :

[0246] S910: The secure virtual machine hypervisor sends a security marking instruction to the first external device.

[0247] S920: The first external device marks itself as a secure device according to the security marking instruction.

[0248] S930: The first external device adds a security flag to the generated first message according to the flag that the first external device is a security device.

[0249] The first external device adds a security flag to the generated first message and sends it to the IOMMU.

[0250] In this application, the second external device (here refers to an external device that is not marked as a secure device, that is, a non-secure external device) will add a non-secure flag to the second message generated by itself and send it to the IOMMU because it is not marked as a secure device.

[0251] The subsequent operations performed by the IOMMU on the first message / second message when receiving the first message carrying a security flag / the second message carrying a non-security flag have been introduced in detail in the content of Figure 9A. Please refer to the relevant description in Figure 9A. For the sake of brevity of the specification, they will not be elaborated here.

[0252] In a specific implementation, the specific implementation method of the external device adding a security flag / non-security flag to the message can be: adding a security flag (security ID) field (such as a flag bit (NS bit)) and adding a value (value) of the security flag field to the message. If the value of the added security flag field is 0, it means adding a security flag. If the value of the added security flag field is 1, it means adding a non-security flag.

[0253] Optionally, the values ​​corresponding to the security flag and the non-security flag may also be other, and this application does not specifically limit this. For example, if the value of the added security flag field is 00, it means that the security flag is added, and if the value of the added security flag field is 01, it means that the non-security flag is added.

[0254] It can be seen that since the message from the non-secure external device (i.e., the second external device mentioned above) carries a non-secure flag, after receiving the message from the non-secure external device, the IOMMU determines that the non-secure external device cannot access the secure memory on the TEE side based on the non-secure flag carried in the message, thereby protecting the resource security on the TEE side.

[0255] From the above description of Figures 7B, 9A, and 9B, it can be seen that the secure virtual machine hypervisor establishes a first mapping relationship in the MMU, so that when the first confidential virtual machine needs to access the first external device (such as when instructions or data need to be sent to the first external device), the MMU, after receiving the message from the first confidential virtual machine, determines through the first mapping relationship that the first confidential virtual machine can access the first external device, and then forwards the message of the first confidential virtual machine to the first external device, thereby enabling the first confidential virtual machine to access the first external device. It can also be seen that the secure virtual machine hypervisor establishes a second mapping relationship in the IOMMU and sends a security mark instruction to the IO hardware module, instructing the IO hardware module to add a security mark in the first message received from the first external device, or sends a security mark instruction to the first external device, instructing the first external device to add a security mark in the generated first message. This allows the first external device to access the first confidential virtual machine (such as returning data to the first confidential virtual machine) when the first external device needs to access the first confidential virtual machine. After receiving the first message from the first external device, the IOMMU determines that the first external device can access the first confidential virtual machine through the second mapping relationship and the security mark in the first message, and forwards the message of the first external device to the first confidential virtual machine, thereby enabling the first external device to access the first confidential virtual machine.

[0256] It can be understood that since the MMIO address space of the first external device and the DMA address space of the first external device both belong to the memory of the first confidential virtual machine, and the memory of the first confidential virtual machine belongs to the secure memory on the TEE side, the MMIO address space of the first external device and the DMA address space of the first external device are both protected by the hardware security features of the TEE. Even if the host operating system kernel is compromised by an attacker, the attacker cannot access the MMIO address space of the first external device and the DMA address space of the first external device through the host operating system kernel. The attacker cannot access the MMIO address space of the first external device, which means that the first external device cannot be accessed, thereby preventing the attacker from attacking the first external device, protecting the security of the first external device and the data in the first external device (such as data received from the first confidential virtual machine). The attacker cannot access the DMA address space of the first external device, thereby protecting the security of the data from the first external device stored in the DMA address space of the first external device.

[0257] In a possible embodiment, the above-mentioned device pass-through request may also carry the fine-grained access rights (such as read-only, write, execute permissions, etc.) of the first external device to the DMA address space (i.e., the DMA address space of the above-mentioned first external device). The secure virtual machine hypervisor may configure the fine-grained access rights of the first external device to the DMA address space in the IOMMU based on the fine-grained access rights of the first external device to the DMA address space carried by the device pass-through request. Subsequently, when the first external device accesses the DMA address space (i.e., accesses the first confidential virtual machine), the IOMMU may control the access of the first external device to the DMA address space based on the above-mentioned fine-grained access rights configured locally. For example, if the secure virtual machine hypervisor only configures the first external device to have read-only permission to the DMA address space in the IOMMU based on the device pass-through request, then the IOMMU only allows the first external device to read the DMA address space, and does not allow the first external device to perform other operations on the DMA address space.

[0258] In a possible embodiment, the above-mentioned device direct pass request may also carry the fine-grained access rights (such as read-only, write, execute permissions, etc.) of the first confidential virtual machine to the MMIO address space (i.e., the MMIO address space of the above-mentioned first external device). The secure virtual machine hypervisor may configure the fine-grained access rights of the first confidential virtual machine to the MMIO address space in the MMU based on the fine-grained access rights of the first confidential virtual machine to the MMIO address space carried by the device direct pass request. Subsequently, when the first confidential virtual machine accesses the MMIO address space (i.e., accesses the first external device), the MMU may control the access of the first confidential virtual machine to the MMIO address space based on the above-mentioned fine-grained access rights configured locally. For example, if the secure virtual machine hypervisor only configures the first confidential virtual machine to have read-only permission to the MMIO address space in the MMU based on the device direct pass request, then the MMU only allows the first confidential virtual machine to read the MMIO address space, and does not allow the first confidential virtual machine to perform other operations on the MMIO address space.

[0259] S703: The secure virtual machine management program sends a notification message to the device direct communication management module, notifying that the direct communication configuration between the first external device and the first confidential virtual machine has been completed.

[0260] S704: The device direct communication management module notifies the user that the direct communication configuration between the first external device and the first confidential virtual machine has been completed.

[0261] In one possible embodiment, as shown in FIG8B , the TEE side of the computing device 800 may include, in addition to the confidential virtual machine, a secure IO management (trust input / output management) module. The secure IO management module may run on any layer from the SEL0 layer to the SEL3 layer on the TEE side, preferably running on the SEL2 layer. When the secure IO management module runs on the SEL2 layer, it may be integrated into the secure virtual machine hypervisor for managing confidential virtual machines, or it may be independent of the secure virtual machine hypervisor. This application does not make specific limitations. In FIG8B , the secure IO management module is integrated into the secure virtual machine hypervisor as an example. It should be noted that the secure IO management module may also be referred to as a secure world IO management module, a security management module, a secure IO module, etc. This application does not make specific limitations on the name of this module.

[0262] In the computing device 800 shown in FIG8B , the steps performed by the secure virtual machine hypervisor in FIG7A , FIG7B , FIG9A , and FIG9B can all be implemented by the secure IO management module.

[0263] In a more specific embodiment, as shown in FIG8B , the device direct management module includes an inbound access control module and an outbound access control module, and the secure IO management module includes an MMIO module and an IOMMU module.

[0264] The inbound access control module is an encapsulation of the IOMMU driver, and is used to provide the IOMMU function for the first confidential virtual machine, that is, to provide the first confidential virtual machine with the ability to be accessed by the first external device.

[0265] Specifically, the inbound direction access control module can access the IOMMU module according to the device direct request, instruct the IOMMU module to access the IOMMU to establish a second mapping relationship in the IOMMU, so that the first external device has the ability to access the first confidential virtual machine through the second mapping relationship.

[0266] The outbound access control module is an encapsulation of an external device driver, and is used to provide the first confidential virtual machine with the ability to access the first external device.

[0267] Specifically, the outbound access control module can access the MMIO module according to the device passthrough request, instruct the MMIO module to access the MMU to establish a first mapping relationship in the MMU, so that the first confidential virtual machine has the ability to access the first external device through the first mapping relationship.

[0268] In a possible embodiment, when the computing device 800 implements external device direct access to user mode based on the VFIO driver framework, the device direct access management module may be integrated into the VFIO driver.

[0269] It should be noted that the above-mentioned MMIO module can also be called MMIO address space configuration module, MMIO configuration module, etc., the above-mentioned IOMMU module can also be called DMA memory configuration module, IOMMU configuration module, etc., the above-mentioned inbound direction access control module can also be called first access control module, first direction access control module, inbound control module, etc., and the above-mentioned outbound direction access control module can also be called second access control module, second direction access control module, outbound control module, etc. This application does not specifically limit the names of the above-mentioned modules.

[0270] It should be noted that FIG7A is an example of the interaction process between the secure virtual machine hypervisor and the user (such as the secure virtual machine hypervisor obtains the device direct connection request input by the user, such as the secure virtual machine hypervisor notifies the user that the direct connection configuration between the first external device and the first confidential virtual machine has been completed), which needs to go through the device direct connection management module. In a specific implementation, the interaction process between the secure virtual machine hypervisor and the user may not go through the device direct connection management module. For example, the secure virtual machine hypervisor directly reads the device direct connection request input by the user to the computing device 800 from the non-secure memory on the REE side without the need for the device direct connection management module to read and forward it. For example, the secure virtual machine hypervisor directly notifies the user that the direct connection configuration between the first external device and the first confidential virtual machine has been completed without the need for the device direct connection management module to notify. Therefore, in a possible embodiment, the computing device 800 shown in FIG8A may also not include the device direct connection management module. This application does not specifically limit the interaction process between the secure virtual machine hypervisor and the user.

[0271] In a specific embodiment of the present application, after completing the direct configuration between the first external device and the first confidential virtual machine, the communication data communicated between the first external device and the first confidential virtual machine will be forwarded by the IO hardware module and the secure virtual machine hypervisor without passing through the REE side. Specifically, the data sent by the first external device to the first confidential virtual machine will be forwarded to the IOMMU via the IO hardware module, and the IOMMU will forward it to the secure virtual machine hypervisor, and then the secure virtual machine hypervisor will forward it to the first confidential virtual machine without passing through the REE side. The data sent by the first confidential virtual machine to the first external device will be forwarded to the MMU via the secure virtual machine hypervisor, and the MMU will forward it to the IO hardware module, and then the IO hardware module will forward it to the first external device without passing through the REE side. In this way, the communication data can be prevented from being accessed by the software on the REE side, such as the host operating system kernel, during the transmission process. Even if the software on the REE side is hacked by an attacker, the communication data between the first external device and the first confidential virtual machine cannot be stolen, thereby ensuring the security of the communication data during transmission.

[0272] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0273] The above describes in detail the method for connecting an external device to a virtual machine provided by the present application. Based on the same inventive concept, the following describes the apparatus and computing device for connecting an external device to a virtual machine provided by the present application.

[0274] It should be understood that the unit modules inside the device for connecting external devices directly to virtual machines can also be divided into multiple types. Each module can be a software module, a hardware module, or partly a software module and partly a hardware module. This application does not limit this.

[0275] Referring to Figure 10A, Figure 10A is a structural diagram of an apparatus 1000A for directly connecting an external device to a virtual machine, which is exemplified in the present application. It can be applied to the computing device 300 shown in Figures 3 and 5 in which the hardware resources are divided into the REE side and the TEE side. As shown in Figure 10A, the apparatus 1000A includes: an acquisition module 1010 and a processing module 1020. The functions of each module of the apparatus 1000A are exemplarily introduced below. It should be understood that the functions of the modules described below are only the functions that the apparatus 1000A may have in some embodiments of the present application, and the present application does not limit the functions of each module.

[0276] The acquisition module 1010 is used to obtain a first instruction on the REE side, where the first instruction indicates configuring a first external device to directly connect to the confidential virtual machine on the TEE side. The first external device is any one or more external devices in the computing device 300.

[0277] The processing module 1020 is used to configure the first external device to directly connect to the confidential virtual machine on the TEE side according to the first instruction.

[0278] In a possible embodiment, the processing module 1020 can configure the first external device to directly connect to the virtual machine in the following manner: the processing module 1020 configures the BAR of the first external device on the TEE side, and then establishes a first mapping relationship and a second mapping relationship, wherein the first mapping relationship is a mapping relationship between the first memory and the second memory, the first memory is the memory in the memory of the virtual machine used for the confidential virtual machine to access the first external device, the second memory is the memory in the BAR of the first external device used for the confidential virtual machine to access the first external device, the second mapping relationship is a mapping relationship between the third memory and the fourth memory, the third memory is the memory in the memory of the confidential virtual machine used for the first external device to access the confidential virtual machine, and the fourth memory is the memory in the BAR of the first external device used for the first external device to access the confidential virtual machine.

[0279] In a possible embodiment, as shown in FIG10A , the apparatus 1000A further includes an access control module 1030 configured to prevent the acquisition module 1010 / processing module 1020 from accessing the first external device when the acquisition module 1010 / processing module 1020 is on the REE side.

[0280] In a possible embodiment, as shown in Figure 10A, the device 1000A also includes a sending module 1040; an obtaining module 1010, which is used to obtain a second instruction on the REE side (the second instruction indicates that the first external device is marked as a security device, and the second instruction carries the device identifier of the first external device); the sending module 1040 is used to send the second instruction to the access control module 1030, and the access control module 1030 is also used to mark the first external device as a security device according to the device identifier of the first external device in the second instruction, and to receive a first message related to the confidential virtual machine from the first external device (the first message carries a first identifier, and the first identifier indicates that the first external device is a security device), and the access control module 1030 is also used to determine that the first external device is a security device based on the first identifier carried by the first message, and then send the first message to the confidential virtual machine.

[0281] In a possible embodiment, the first identifier is a device identifier of the first external device, and the access control module 1030 is used to mark the first external device as a secure device in the root complex of the computing device 300 according to the device identifier of the first external device in the second instruction.

[0282] To increase the flexibility of the solution, in another possible embodiment, the access control module 1030 is configured to mark the first external device as a secure device in the first external device according to the device identification of the first external device in the second instruction.

[0283] In a possible embodiment, a VFIO driver is deployed on the REE side of the computing device 300, and a secure virtual machine hypervisor for managing confidential virtual machines is deployed on the TEE side. The acquisition module 1010 and the sending module 1040 are deployed in the VFIO driver, the processing module 1020 is deployed in the secure virtual machine hypervisor, and the access control module 1030 is deployed in the root complex in the computing device 300. The access control module 1030 can be understood as the security controller shown in Figure 5.

[0284] In a possible embodiment, the access control module 1030 is configured to send the first message to the confidential virtual machine through a secure virtual machine hypervisor.

[0285] In a possible embodiment, the secure virtual machine management program is further configured to send a second message related to the first external device, received from the confidential virtual machine, to the first external device.

[0286] In a possible embodiment, the acquisition module 1010 is further used to acquire configuration information of the confidential virtual machine to be created on the REE side before acquiring the first instruction, and the processing module 1020 is further used to create the confidential virtual machine on the TEE side according to the configuration information.

[0287] In a possible embodiment, the first external device includes any one or more of the following: a GPU, an NPU, a network card, a graphics card, and a sound card. It should be understood that the first external device may also include other types of external devices, which are not specifically limited in this application.

[0288] Specifically, the specific implementation of various operations performed by the above-mentioned device 1000A can refer to the description of the relevant content in the method embodiment of the external device confidential virtual machine shown in Figures 4 and 6 above. For the sake of brevity of the specification, it will not be repeated here.

[0289] Referring to Figure 10B, Figure 10B is a schematic structural diagram of another apparatus 1000B for directly connecting an external device to a virtual machine, exemplified in this application. This apparatus may be the secure virtual machine hypervisor or secure IO management module described in the embodiments of Figures 7A to 9B. As shown in Figure 10B, the apparatus 1000B may include: a receiving module 1001, a configuration module 1002, and a sending module 1003. The functions of each module of the apparatus 1000B are exemplarily introduced below. It should be understood that the functions of each module described below are merely functions that the apparatus 1000B may have in some embodiments of this application, and this application does not limit the functions of each module.

[0290] The receiving module 1001 is used to receive a device direct connection request, which is used to configure a first external device to directly connect to a first confidential virtual machine. The device direct connection request carries a device identifier of the first external device and an identifier of the first confidential virtual machine.

[0291] The configuration module 1002 is configured to configure the first external device to directly connect to the first confidential virtual machine according to the device direct connection request.

[0292] In some possible embodiments, the receiving module 1001 is used to receive a device direct connection request sent by a device direct connection management module, and the device direct connection management module runs in a non-secure world; the sending module 1003 is used to send a notification message to the device direct connection management module, notifying that the direct connection configuration between the first external device and the first confidential virtual machine has been completed.

[0293] In some possible embodiments, the configuration module 1002 is specifically configured to:

[0294] Establishing a first mapping relationship in the MMU and a second mapping relationship in the IOMMU, wherein the first mapping relationship is a mapping relationship between the virtual address space of the first confidential virtual machine and the MMIO address space of the first external device, and the second mapping relationship is a mapping relationship between the IO virtual address space of the first external device and the DMA address space of the first external device, and both the MMIO address space and the DMA address space of the first external device belong to the physical address space of the first confidential virtual machine;

[0295] A security mark instruction is sent to the IO hardware module, instructing the IO hardware module to add a security mark to a message received from the first external device, or the secure virtual machine hypervisor sends a security mark instruction to the first external device, instructing the first external device to add a security mark to a generated message, wherein the security mark indicates that the first external device has access rights to the secure memory.

[0296] In some possible embodiments, when the computing device to which the first confidential virtual machine belongs includes an RC, the IO hardware module is integrated into the RC.

[0297] In some possible embodiments, the device identifier of the first external device is a BDF number.

[0298] In some possible embodiments, the first external device is a GPU, an NPU, a TPU, a network card, or a hard disk.

[0299] In some possible embodiments, the apparatus 1000B is applied to a computing device whose hardware resources are divided into a REE side and a TEE side (such as the computing device 800 shown in FIG8A and FIG8B ), and the first confidential virtual machine is located on the TEE side.

[0300] Specifically, the specific implementation of various operations performed by the above-mentioned device 1000B can refer to the description of the operations performed by the secure virtual machine hypervisor / secure IO management module in the method of external device direct connection to the virtual machine shown in Figures 7A-9B above. For the sake of brevity of the specification, it will not be repeated here.

[0301] Referring to FIG10C , FIG10C is a schematic structural diagram of another apparatus 1000C for directly communicating an external device with a virtual machine, exemplified in the present application. It may be the device direct communication management module described in the embodiments of FIG7A to FIG9B . As shown in FIG10C , the apparatus 1000C may include: a receiving module 1100 and a sending module 1200 . The functions of each module of the apparatus 1000C are exemplarily introduced below. It should be understood that the functions of each module described below are merely functions that the apparatus 1000C may have in some embodiments of the present application, and the present application does not limit the functions of each module.

[0302] The sending module 1200 is used to send a device direct connection request to the secure virtual machine hypervisor. The device direct connection request is used to configure the first external device to directly connect to the first confidential virtual machine. The device direct connection request carries the device identifier of the first external device and the identifier of the first confidential virtual machine.

[0303] The receiving module 1100 is configured to receive a notification message sent by the secure virtual machine hypervisor, where the notification message indicates that the direct connection configuration between the first external device and the first confidential virtual machine has been completed.

[0304] Specifically, the specific implementation of various operations performed by the above-mentioned device 1000C can refer to the description of the operations performed by the device direct connection management module in the method of external device direct connection to the virtual machine shown in Figures 7A-9B above. For the sake of brevity of the specification, it will not be repeated here.

[0305] Referring to FIG11 , FIG11 is a schematic diagram of the structure of another computing device 1110 provided by the present application, which includes: a processor 1111, a memory unit 1112, a communication interface 1113, a storage 1114, an input device 1115, and an output device 1116. The processor 1111, the memory unit 1112, the communication interface 1113, the storage 1114, and the external device 1115 can be interconnected via a bus 1116.

[0306] The processor 1111 can read the program code (including instructions) stored in the memory unit 1112 and execute the program code stored in the memory unit 1112, so that the computing device 300 executes the steps in the above-mentioned method of directly connecting an external device to a confidential virtual machine.

[0307] The processor 1111 can have a variety of specific implementation forms. For example, the processor 1111 can be at least one CPU, as shown in Figure 11, including CPU0 and CPU1. The processor 1111 can also be a GPU, etc. The processor 1111 can also be a single-core processor or a multi-core processor. The processor 1111 can be a combination of a CPU and a hardware chip. The above-mentioned hardware chip can be implemented as an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The above-mentioned PLD can be implemented as a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof. The processor 1111 can also be implemented using a logic device with built-in processing logic, such as an FPGA or a digital signal processor (DSP).

[0308] The memory unit 1112 is used to store the kernel, program code, and program data generated when the processor 1111 executes the program code stored in the memory unit 1112. The program code includes the code of the acquisition module 1010 and the code of the processing module 1020 shown in FIG10A, and the program data includes: a first instruction, a second instruction, configuration information of the confidential virtual machine to be created, etc. Alternatively, the program code includes the code of the receiving module 1001, the code of the configuration module 1002, and the code of the sending module 1003 shown in FIG10B, and the program data includes: a device direct connection request, a notification message indicating that the direct connection configuration between the first external device and the first confidential virtual machine has been completed, etc. Alternatively, the program code includes the code of the receiving module 1100 and the sending module 1200 shown in FIG10C, and the program data includes: a device direct connection request, a notification message indicating that the direct connection configuration between the first external device and the first confidential virtual machine has been completed, etc.

[0309] The communication interface 1113 may be a wired interface (e.g., an Ethernet interface, a fiber optic interface, or other types of interfaces (e.g., an InfiniBand (IB) interface)) or a wireless interface (e.g., a cellular network interface or a wireless local area network interface) for communicating with other computing devices or apparatuses. When the communication interface 1113 is a wired interface, the communication interface 1113 may employ a protocol suite above the Transmission Control Protocol / Internet Protocol (TCP / IP), such as the Remote Function Call (RFC) protocol, the Simple Object Access Protocol (SOAP) protocol, the Simple Network Management Protocol (SNMP) protocol, the Common Object Request Broker Architecture (CORBA) protocol, and distributed protocols, etc.

[0310] The memory 1114 may be a non-volatile memory, such as a read-only memory (ROM), a programmable ROM (PROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), or a flash memory. The memory 1114 may also be a volatile memory, such as a random access memory (RAM), which is used as an external cache.

[0311] The external devices 1115 may include a graphics card, a network card, a sound card, an acceleration device (such as a GPU, an NPU), a disk, and the like.

[0312] The bus 1116 may be a PCIE bus, etc. The bus 1116 may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, FIG11 shows only one thick line, but this does not mean that there is only one bus or one type of bus.

[0313] It should be understood that the computing device of the embodiment of the present application may correspond to the computing device including device 1000A, 1000B or 1000C in the embodiment of the present application, and may correspond to executing the corresponding subjects in the method shown in Figures 4, 6, 7A, 7B, 9A, and 9B in the embodiment of the present application, and the operations and / or functions of each module in the computing device are respectively to implement the corresponding processes of the method shown in Figures 4, 6, 7A, 7B, 9A, and 9B. For the sake of brevity, they will not be repeated here.

[0314] It should be understood that computing device 300 is only an example provided for an embodiment of the present application, and computing device 300 may have more or fewer components than those shown in FIG. 11 , may combine two or more components, or may have different configuration implementations of the components.

[0315] The present application also provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed, some or all steps of the method for connecting an external device to a virtual machine described in the above embodiment can be implemented.

[0316] The present application also provides a computer program product. When the computer program product is read and executed by a computer, it can implement some or all of the steps of the method for connecting an external device directly to a virtual machine recorded in the above method embodiment.

[0317] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0318] In the above embodiments, it can be implemented in whole or in part by software, hardware or any combination thereof. When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium, or a semiconductor medium.

[0319] The above is only a specific embodiment of the present application. Those skilled in the art may conceive of changes or substitutions based on the specific embodiment provided in this application, and all such changes or substitutions shall fall within the scope of protection of this application.

Claims

1. A method for high-speed serial computer expansion bus standard PCIE device to directly access a virtual machine, characterized in that: Applied to a computing device, the hardware resources of the computing device are divided into a rich execution environment (REE) side and a trusted execution environment (TEE) side, the computing device includes a first PCIE device, the TEE side includes a virtual machine, and the method includes: The processor of the computing device obtains a first instruction on the REE side, where the first instruction indicates configuring the first PCIE device to directly pass through the virtual machine; The processor configures the first PCIE device on the TEE side to directly connect to the virtual machine according to the first instruction.

2. The method according to claim 1, characterized in that The processor configures, on the TEE side, the first PCIE device to directly pass through the virtual machine, including: The processor configures a base address register BAR of the first PCIE device on the TEE side; The processor establishes a first mapping relationship on the TEE side, wherein the first mapping relationship is a mapping relationship between the first memory and a second memory, the first memory is a memory in the memory of the virtual machine used for the virtual machine to access the first PCIE device, and the second memory is a memory in the BAR of the first PCIE device used for the virtual machine to access the first PCIE device; The processor establishes a second mapping relationship on the TEE side, wherein the second mapping relationship is a mapping relationship between a third memory and a fourth memory, the third memory is a memory in the memory of the virtual machine used for the first PCIE device to access the virtual machine, and the fourth memory is a memory in the BAR of the first PCIE device used for the first PCIE device to access the virtual machine.

3. The method according to claim 1 or 2, characterized in that: The computing device includes a root complex RC, and the method further includes: When the processor is at the REE side, the RC does not allow the processor to access the first PCIE device.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: The processor obtains a second instruction at the REE side, where the second instruction indicates marking the first PCIE device as a security device, and the second instruction carries an identifier of the first PCIE device; The processor sends the second instruction to the RC in the computing device; The RC marks the first PCIE device as a security device according to the identifier of the first PCIE device in the second instruction; The RC receives a first message related to the virtual machine from the first PCIE device, where the first message carries a first identifier, and the first identifier indicates that the first PCIE device is a security device; The RC determines, based on the first identifier in the first message, that the first PCIE device is a security device; The RC sends the first message to the virtual machine.

5. The method according to claim 4, characterized in that The first identifier is an identifier of the first PCIE device, and the RC marks the first PCIE device as a security device according to the identifier of the first PCIE device in the second instruction, including: The RC marks the first PCIE device as a security device in the RC according to the identifier of the first PCIE device in the second instruction.

6. The method according to claim 4, characterized in that The RC marks the first PCIE device as a security device according to the identifier of the first PCIE device in the second instruction, including: The RC marks the first PCIE device as a secure device in the first PCIE device according to the identifier of the first PCIE device in the second instruction.

7. The method according to any one of claims 1 to 6, characterized in that: A virtual function input and output VFIO driver is deployed on the REE side, and a virtual machine manager for managing the virtual machine is deployed on the TEE side; The operations performed by the processor on the REE side are performed by the processor running the VFIO driver, and the operations performed by the processor on the TEE side are performed by the processor running the virtual machine manager.

8. The method according to claim 7, characterized in that The RC sends the first message to the virtual machine, including: The RC sends the first message to the virtual machine through the virtual machine manager; The method further comprises: The processor executes the virtual machine manager to send a second message related to the first PCIE device received from the virtual machine to the first PCIE device.

9. The method according to any one of claims 1 to 8, characterized in that: Before the processor obtains the first instruction on the REE side, the method further includes: The processor obtains, on the REE side, configuration information of the virtual machine to be created; The processor creates the virtual machine on the TEE side according to the configuration information.

10. The method according to any one of claims 1 to 9, characterized in that: The first PCIE device includes any one or more of the following: a graphics processor GPU, an embedded neural network processor NPU, a network card, a graphics card and a sound card.

11. A method for connecting an external device to a virtual machine, characterized in that: The method comprises: The secure virtual machine management program receives a device direct connection request, where the device direct connection request is used to configure a first external device to directly connect to a first confidential virtual machine, and the device direct connection request carries a device identifier of the first external device and an identifier of the first confidential virtual machine; The secure virtual machine hypervisor configures the first external device to directly connect to the first confidential virtual machine according to the device direct connection request.

12. The method according to claim 11, characterized in that The secure virtual machine hypervisor receives a device direct access request, including: The secure virtual machine management program receives a device direct access request sent by a device direct access management module, and the device direct access management module runs in a non-secure world; After the secure virtual machine hypervisor configures the first external device to directly communicate with the first confidential virtual machine, the method further includes: The secure virtual machine management program sends a notification message to the device direct communication management module, notifying that the direct communication configuration between the first external device and the first confidential virtual machine has been completed.

13. The method according to claim 11 or 12, characterized in that: The secure virtual machine hypervisor configures the first external device to directly connect to the first confidential virtual machine, including: The secure virtual machine management program establishes a first mapping relationship in a memory management unit MMU and a second mapping relationship in an input-output memory management unit IOMMU, wherein the first mapping relationship is a mapping relationship between a virtual address space of the first confidential virtual machine and a memory-mapped input-output MMIO address space of the first external device, and the second mapping relationship is a mapping relationship between an IO virtual address space of the first external device and a direct memory access DMA address space of the first external device, and both the MMIO address space and the DMA address space belong to a physical address space of the first confidential virtual machine; The secure virtual machine hypervisor sends a security mark instruction to the IO hardware module, instructing the IO hardware module to add a security mark in a message received from the first external device, or the secure virtual machine hypervisor sends a security mark instruction to the first external device, instructing the first external device to add a security mark in a generated message, and the security mark indicates that the first external device has access rights to the secure memory.

14. The method according to claim 13, characterized in that When the computing device to which the first confidential virtual machine belongs includes a root complex RC, the IO hardware module is integrated into the RC.

15. The method according to any one of claims 11 to 14, characterized in that: The device identifier of the first external device is a bus-device-function BDF number.

16. The method according to any one of claims 11 to 15, characterized in that: The secure virtual machine hypervisor includes a secure IO management module, and the operations performed by the secure virtual machine hypervisor are performed by the secure IO management module.

17. The method according to any one of claims 11 to 16, characterized in that: The first external device is a GPU, an NPU, a tensor processing unit TPU, a network card or a hard disk.

18. The method according to any one of claims 11 to 17, characterized in that: The method is applied to a computing device whose hardware resources are divided into a REE side and a TEE side, and the first confidential virtual machine is located on the TEE side.

19. A method for connecting an external device to a virtual machine, characterized in that: The method comprises: The device direct access management module sends a device direct access request to the secure virtual machine management program, the device direct access management module runs in the non-secure world, the device direct access request is used to configure a first external device to directly access the first confidential virtual machine, and the device direct access request carries a device identifier of the first external device and an identifier of the first confidential virtual machine; The device direct communication management module receives a notification message sent by the secure virtual machine hypervisor, where the notification message indicates that direct communication configuration between the first external device and the first confidential virtual machine has been completed.

20. The method according to claim 19, characterized in that The device identification of the first external device is a BDF number.

21. The method according to claim 19 or 20, characterized in that The first external device is a GPU, an NPU, a TPU, a network card or a hard disk.

22. The method according to any one of claims 19 to 21, characterized in that: The method is applied to a computing device whose hardware resources are divided into a REE side and a TEE side, and the first confidential virtual machine is located on the TEE side.

23. A device for connecting an external device to a virtual machine, characterized in that: The device comprises: A receiving module, configured to receive a device direct connection request, wherein the device direct connection request is used to configure a first external device to directly connect to a first confidential virtual machine, and the device direct connection request carries a device identifier of the first external device and an identifier of the first confidential virtual machine; A configuration module is used to configure the first external device to directly connect to the first confidential virtual machine according to the device direct connection request.

24. The device according to claim 23, characterized in that The device also includes a sending module; The receiving module is used to receive a device direct access request sent by a device direct access management module, wherein the device direct access management module runs in a non-secure world; The sending module is used to send a notification message to the device direct communication management module to notify that the direct communication configuration between the first external device and the first confidential virtual machine has been completed.

25. The device according to claim 23 or 24, characterized in that The configuration module is specifically used for: Establishing a first mapping relationship in the MMU and a second mapping relationship in the IOMMU, wherein the first mapping relationship is a mapping relationship between the virtual address space of the first confidential virtual machine and the MMIO address space of the first external device, and the second mapping relationship is a mapping relationship between the IO virtual address space of the first external device and the DMA address space of the first external device, and both the MMIO address space and the DMA address space belong to the physical address space of the first confidential virtual machine; A security mark instruction is sent to the IO hardware module to instruct the IO hardware module to add a security mark in a message received from the first external device, or the secure virtual machine hypervisor sends a security mark instruction to the first external device to instruct the first external device to add a security mark in a generated message, wherein the security mark indicates that the first external device has access rights to the secure memory.

26. The device according to claim 25, characterized in that In the case where the computing device to which the first confidential virtual machine belongs includes an RC, the IO hardware module is integrated into the RC.

27. The device according to any one of claims 23 to 26, characterized in that The device identification of the first external device is a BDF number.

28. The device according to any one of claims 23 to 27, characterized in that The device further includes a secure IO management module, and the operation performed by the device is performed by the secure IO management module.

29. The device according to any one of claims 23 to 28, characterized in that The first external device is a GPU, an NPU, a TPU, a network card or a hard disk.

30. The device according to any one of claims 23 to 29, characterized in that The apparatus is applied to a computing device whose hardware resources are divided into a REE side and a TEE side, and the first confidential virtual machine is located on the TEE side.

31. A device for connecting an external device to a virtual machine, characterized in that: The device comprises: A sending module, used for sending a device direct access request to a secure virtual machine management program, wherein the device direct access management module runs in a non-secure world, and the device direct access request is used for configuring a first external device to directly access a first confidential virtual machine, and the device direct access request carries a device identifier of the first external device and an identifier of the first confidential virtual machine; A receiving module is used to receive a notification message sent by the secure virtual machine hypervisor, where the notification message indicates that the direct connection configuration between the first external device and the first confidential virtual machine has been completed.

32. The device according to claim 31, characterized in that The device identification of the first external device is a BDF number.

33. The device according to claim 31 or 32, characterized in that The first external device is a GPU, an NPU, a TPU, a network card or a hard disk.

34. The device according to any one of claims 31 to 33, characterized in that The apparatus is applied to a computing device whose hardware resources are divided into a REE side and a TEE side, and the first confidential virtual machine is located on the TEE side.

35. A computing device, characterized in that The computing device comprises a processor and a memory; the processor of the computing device is configured to execute instructions stored in the memory of the computing device, so that the computing device executes the method according to any one of claims 1 to 22.

36. A computer-readable storage medium, characterized in that: The method comprises computer program instructions, and when the computer program instructions are executed by a computing device, the computing device performs the method according to any one of claims 1 to 22.

Images