Resource isolation method, host machine, virtualization system and computer program product

Abstract

The invention provides a resource isolation method, a host machine, a virtualization system and a computer program product, the resource isolation method can be applied to the host machine, and a virtualization management program and a device tree coverage driver run on the host machine. The method comprises the steps that the virtualization management program obtains information of hardware resources needed by a virtual machine by analyzing a static resource configuration file of the virtual machine to be started; and the virtualization management program sends the information of the hardware resources to the equipment tree coverage driver, so that the equipment tree coverage driver executes equipment tree coverage operation according to the information of the hardware resources, and isolation of the host machine and the hardware resources is realized. By executing the method, isolation of hardware resources of the host machine and the virtual machine can be achieved more efficiently.

Description

Technical Field

[0001] This application relates to the field of computer technologies, and in particular, to a resource isolation method, a host computer, a virtualization system, and a computer program product. Background Art

[0002] In lightweight virtualization technologies, it is usually necessary to isolate hardware resources between a host computer and a virtual machine, such as hardware peripheral resources like serial ports, I2C, USB, network cards, etc. After the hardware resources are isolated, the host computer will no longer use the isolated hardware resources, and the virtual machine will take over the isolated hardware resources.

[0003] Currently, when performing resource isolation operations on a host computer and a virtual machine, generally, after the hardware resources are partitioned, developers need to manually modify and recompile the device tree of the host computer to update the device tree of the host computer and ensure that the host computer does not access the isolated hardware resources. The above resource management isolation method requires a large amount of manual operations and has low processing efficiency. Summary of the Invention

[0004] Based on the above technical problems, this application proposes a resource isolation method, a host computer, a virtualization system, and a computer program product, which can more efficiently implement the isolation of hardware resources between the host computer and the virtual machine.

[0005] A first aspect of this application proposes a resource isolation method, which is applied to a host computer on which a virtualization management program and a device tree overlay driver are running. The method includes:

[0006] The virtualization management program obtains information about the hardware resources required by the virtual machine by parsing the static resource configuration file of the virtual machine to be started;

[0007] The virtualization management program sends the information about the hardware resources to the device tree overlay driver, so that the device tree overlay driver performs a device tree overlay operation according to the information about the hardware resources, and realizes the isolation between the host computer and the hardware resources.

[0008] In some implementation manners of the first aspect, the method further includes:

[0009] The virtualization management program starts the virtual machine when receiving a first message sent by the device tree overlay driver;

[0010] Wherein, the first message is a message sent by the device tree overlay driver to the virtualization management program after the device tree overlay operation is completed.

[0011] In some implementation manners of the first aspect, the method further includes:

[0012] When the virtual machine is shut down, the hypervisor sends information about the hardware resources to the device tree overlay driver, so that the device tree overlay driver performs a device tree overlay operation according to the information about the hardware resources, and cancels the isolation between the host and the hardware resources.

[0013] In some implementations of the first aspect, the hypervisor sending the information about the hardware resources to the device tree overlay driver includes:

[0014] The hypervisor sends a second message to the device tree overlay driver, where the second message includes the information about the hardware resources and a first instruction for instructing the device tree overlay driver to cancel the isolation between the host and the hardware resources.

[0015] In some implementations of the first aspect, the hypervisor sending the information about the hardware resources to the device tree overlay driver includes:

[0016] The hypervisor sends a third message to the device tree overlay driver, where the third message includes the information about the hardware resources and a second instruction for instructing the device tree overlay driver to isolate the host from the hardware resources.

[0017] Another resource isolation method is proposed in the second aspect of this application, which is applied to a host. A hypervisor and a device tree overlay driver are running on the host. The method includes:

[0018] When the device tree overlay driver receives the information about the hardware resources sent by the hypervisor, it performs a device tree overlay operation according to the information about the hardware resources to isolate the host from the hardware resources;

[0019] Among them, the information about the hardware resources is obtained by the hypervisor through parsing the static resource configuration file of the virtual machine to be started.

[0020] In some implementations of the second aspect, the method further includes:

[0021] When the device tree overlay driver finishes performing the device tree overlay operation, it sends a first message to the hypervisor, so that the hypervisor starts the virtual machine when receiving the first message.

[0022] In some implementations of the second aspect, after the device tree overlay driver sends the first message to the hypervisor, the method further includes:

[0023] When the device tree overlay driver receives the information of the hardware resource, it performs a device tree overlay operation according to the information of the hardware resource to cancel the isolation between the host and the hardware resource;

[0024] Among them, when the virtual machine is shut down, the hypervisor sends the information of the hardware resource to the device tree overlay driver.

[0025] In some implementation manners of the second aspect, the device tree overlay driver receiving the information of the hardware resource includes:

[0026] The device tree overlay driver receives a second message sent by the hypervisor, and the second message includes the information of the hardware resource and a first instruction for instructing the device tree overlay driver to cancel the isolation between the host and the hardware resource.

[0027] In some implementation manners of the second aspect, the device tree overlay driver receiving the information of the hardware resource sent by the hypervisor includes:

[0028] The device tree overlay driver receives a third message sent by the hypervisor, and the third message includes the information of the hardware resource and a second instruction for instructing the device tree overlay driver to isolate the host from the hardware resource.

[0029] In the third aspect of this application, a host is proposed. A hypervisor and a device tree overlay driver are running on the host. The hypervisor is configured to execute the resource isolation method described in the first aspect or any implementation manner of the first aspect, and / or the device tree overlay driver is configured to execute the resource isolation method described in the second aspect or any implementation manner of the second aspect.

[0030] In the fourth aspect of this application, a virtualization system is proposed. A hypervisor and a device tree overlay driver are running on the host of the virtualization system. The hypervisor is configured to execute the resource isolation method described in the first aspect or any implementation manner of the first aspect, and / or the device tree overlay driver is configured to execute the resource isolation method described in the second aspect or any implementation manner of the second aspect.

[0031] In the fifth aspect of this application, a computer program product is proposed, including computer program instructions. When the computer program instructions are run by a processor, the processor is caused to execute the resource isolation method described in the first aspect or any implementation manner of the first aspect, and / or the processor is caused to execute the resource isolation method described in the second aspect or any implementation manner of the second aspect.

[0032] Based on the resource isolation method proposed in this application, before a virtual machine starts, the hypervisor running on the host parses the static resource configuration file of the virtual machine to be started, obtains information about the hardware resources required by the virtual machine, and then sends the configuration information of the hardware resources to the device tree overlay driver running on the host. After receiving the configuration information of the hardware resources, the device tree overlay driver performs a device tree overlay operation on the device tree of the host based on the configuration information of the hardware resources, realizing the isolation between the host and the hardware resources. The above solution realizes the automatic isolation of the host and the hardware resources required by the virtual machine before the virtual machine starts through the automatic interaction between the hypervisor of the host and the device tree overlay driver, and has higher resource isolation efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only the embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on the provided drawings without creative efforts.

[0034] Figure 1 It is a schematic structural diagram of a virtualization system provided by an embodiment of the present application.

[0035] Figure 2 It is a schematic flowchart of a resource isolation method provided by an embodiment of the present application.

[0036] Figure 3 It is a schematic flowchart of another resource isolation method provided by an embodiment of the present application.

[0037] Figure 4 It is a schematic structural diagram of a resource isolation device provided by an embodiment of the present application.

[0038] Figure 5 It is a schematic flowchart of another resource isolation method provided by an embodiment of the present application.

[0039] Figure 6 It is a schematic structural diagram of another resource isolation device provided by an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0040] The technical solutions in the embodiments of the present application are applicable to the application scenario of establishing hardware resource isolation between the host and the virtual machine on the host. By adopting the technical solutions in the embodiments of the present application, the processing efficiency of isolating the hardware resources of the host and the virtual machine can be improved.

[0041] Isolating the hardware resources of the host machine from the virtual machine means, for the virtual machines running on the host machine, specifying the hardware resources required for the virtual machines to run, such as serial ports, I2C, USB, network cards, etc., and allocating these hardware resources on the host machine to the virtual machines for use, so that the host machine no longer accesses these hardware resources.

[0042] Existing Linux-based lightweight virtualization technologies (such as Jailhouse, Xen) mainly focus on providing methods for allocating hardware resources to virtual machines. Currently, to achieve hardware resource isolation in these lightweight virtual machines, static resource configuration generally needs to be performed first. For example, the core design of Jailhouse is static resource allocation, using C source files to divide the hardware resources of the host machine and the virtual machines, that is, at system startup, the ownership of each I / O device is clearly specified through a configuration file.

[0043] The configuration file will define which I / O devices are allocated to which virtual machine, and once the configuration is completed, the access rights of the devices are fixed. The host machine and the virtual machines cannot obtain access rights to the same device simultaneously. If accessed simultaneously, there is a risk of system crash. To avoid the risk of system crash caused by simultaneous access, generally, after statically allocating resources, the device tree of the host machine needs to be manually processed to mask the I / O device nodes that have been allocated to the virtual machines, and then the device tree is recompiled, the system is restarted, and the virtual machines are run. This method of manually modifying the device tree makes the efficiency of implementing hardware resource isolation on the host machine relatively low, increasing the time for system debugging and virtual machine deployment.

[0044] In view of the above technical problems, the embodiments of the present application propose a solution to achieve more efficient hardware resource isolation by means of the device tree overlay technology. This solution realizes fully automated hardware resource isolation operations through the interaction between the virtualization management program on the host machine and the device tree overlay driver, so that hardware resource isolation of the host machine can be achieved without manual operation.

[0045] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

[0046] First, this specification will first explain the technical terms applied in the embodiments of the present application:

[0047] The hypervisor is the core component for implementing virtualization technology. It is a lightweight software layer that can run directly on physical hardware or the host operating system, and is responsible for creating, managing, and isolating multiple virtual machines. For example, the hypervisor can abstract physical hardware (CPU, memory, storage, etc.) into a virtual resource pool for virtual machines to allocate as needed, coordinate the access requests of virtual machines to physical resources, avoid resource conflicts, and can also ensure secure isolation between virtual machines and with the host through hardware-assisted technologies (such as Intel VT-x, AMD-V).

[0048] According to the differences in operating levels and architectures, hypervisors are divided into two categories: Type-1 (bare-metal hypervisor) and Type-2 (hosted hypervisor). Among them, the Type-1 (bare-metal hypervisor) runs directly on the physical hardware layer, with low latency, high throughput, and high security. Typical representatives include Jailhouse, Xen, etc. The Type-2 (hosted hypervisor) runs on top of the host operating system, depends on the operating system scheduling of the host, has higher performance losses, and its security also depends on the security of the host operating system. Typical representatives include VMware Workstation, Oracle VirtualBox, etc.

[0049] In the hypervisors described in the embodiments of this application, it specifically refers to the Type-1 hypervisor, such as Jailhouse or Xen.

[0050] Device tree overlay is a technology for dynamically modifying the device tree, which allows operations such as adding, deleting, and modifying nodes of the device tree during system runtime. Its core goal is to flexibly adapt to changes in hardware configurations and avoid recompiling the entire device tree or restarting the system due to hardware adjustments.

[0051] The device tree overlay driver is a driver program located in the host operating system kernel for performing device tree overlay operations.

[0052] Figure 1 Shows an architecture diagram of a virtualization system, where the physical hardware layer is the physical hardware resources on the host, such as CPU, memory, peripherals, etc.

[0053] As Figure 1 shown, in the above virtualization system, a hypervisor runs on the host, and a device tree overlay driver runs in the host operating system kernel. The hypervisor and the device tree overlay driver can communicate and interact through the host kernel.

[0054] Among them, one or more processor cores can be set on the host machine. When there are multiple processor cores on the host machine, the hypervisor and the device tree overlay driver can run on different processor cores respectively. Alternatively, the hypervisor and the device tree overlay driver can also run on the same processor core.

[0055] Based on the above virtualization system and host machine architecture, an embodiment of the present application proposes a resource isolation method. This method realizes the automatic isolation of the hardware resources of the host machine and the virtual machine through the automatic interaction between the hypervisor and the device tree overlay driver.

[0056] See Figure 2 As shown, the method includes:

[0057] S101. The hypervisor obtains information about the hardware resources required by the virtual machine by parsing the static resource configuration file of the virtual machine to be started.

[0058] Among them, when a user creates a virtual machine on the host machine, resource information required for the created virtual machine, including hardware resource information, software resource information, etc., can be input to the host machine in the form of a static resource configuration file.

[0059] When the hypervisor on the host machine receives a virtual machine creation request and a static resource configuration file, it can create a virtual machine. Before starting the created virtual machine, the hypervisor parses the static resource configuration file of the virtual machine to be started, and extracts information about the hardware resources required by the virtual machine from it, such as obtaining information about hardware resources such as serial ports, I2C, USB, network cards, etc. required for the virtual machine to run.

[0060] S102. The hypervisor sends the information about the hardware resources to the device tree overlay driver.

[0061] Specifically, after the hypervisor parses the static resource configuration file of the virtual machine to be started and obtains information about the hardware resources required for the virtual machine to run, it sends the information about the hardware resources to the device tree overlay driver through kernel communication.

[0062] In some embodiments, when the hypervisor sends the above information about the hardware resources to the device tree overlay driver, a third message is generated using the information about the hardware resources and a second instruction. For example, the information about the hardware resources and the second instruction are combined to generate a third message, and then the generated third message is sent to the device tree overlay driver.

[0063] Among them, the above-mentioned second instruction is an instruction used to instruct the device tree overlay driver to isolate the host from the hardware resources included in the third message. The second instruction can be a specific message or an identifier, and the specific form of the second instruction is not limited in this embodiment.

[0064] The third message can more clearly instruct the device tree overlay driver to perform what operations based on the information of the hardware resources in the message, thereby improving the interaction efficiency between the hypervisor and the device tree overlay driver.

[0065] S103. When the device tree overlay driver receives the information of the hardware resources sent by the hypervisor, it performs a device tree overlay operation according to the information of the hardware resources to isolate the host from the hardware resources.

[0066] Specifically, after the device tree overlay driver receives the information of the hardware resources sent by the hypervisor, it parses the information to identify each host hardware resource, and then based on these hardware resources, it performs a device tree overlay operation on the device tree of the host. Specifically, through the device tree overlay operation, these hardware resources are deleted from the host device tree, making these hardware resources invisible to the host, thereby realizing the isolation between the host and these hardware resources.

[0067] In this embodiment, after the device tree overlay driver receives the information of the hardware resources, it can first verify whether it is the first time to receive the information of the hardware resources. If it is the first time to receive the information of the hardware resources, the device tree overlay driver performs a device tree overlay operation on the device tree of the host and deletes these hardware resources from the device tree to isolate the host from these hardware resources.

[0068] If it is not the first time to receive the information of the hardware resources, it means that the information of the hardware resources has been received before performing step S103, and the device tree overlay operation has been performed based on the information of the hardware resources to isolate the host from these hardware resources. At this time, when the device tree overlay driver receives the information of the hardware resources again, it performs the device tree overlay operation again and adds these hardware resources to the device tree of the host, making these hardware resources visible to the host, thereby canceling the isolation between the host and these hardware resources.

[0069] The above solution makes the device tree overlay driver clear what kind of overlay operation should be performed on the device tree by verifying whether it is the first time to receive the information of the hardware resources, thereby realizing accurate isolation or cancellation of isolation of the hardware resources.

[0070] In another embodiment, when the hypervisor sends the information of the above-mentioned hardware resources to the device tree overlay driver, it generates a third message by using the information of the hardware resources and the second instruction. For example, it combines the information of the hardware resources and the second instruction to generate the third message, and then sends the third message to the device tree overlay driver. In this embodiment, when the device tree overlay driver receives the third message containing the information of the above-mentioned hardware resources and the second instruction, it extracts the information of the hardware resources from the third message, and then performs a device tree overlay operation based on the information of the hardware resources to achieve isolation between the host and the hardware resources. In this embodiment, the interaction purpose between the hypervisor and the device tree overlay driver is clearer, which can enable the device tree overlay driver to directly determine what kind of overlay operation needs to be performed on the device tree according to the interaction message, that is, to clarify whether to isolate or cancel the isolation of the hardware resources from the host, thereby improving the interaction efficiency.

[0071] S104. When the device tree overlay driver finishes performing the device tree overlay operation, it sends a first message to the hypervisor.

[0072] Specifically, when the device tree overlay driver finishes performing the device tree overlay operation on the device tree of the host, it sends a first message to the hypervisor. This first message is a message used to indicate that the device tree overlay operation has been completed. It can be a pre-defined signal, message or identifier used to indicate that the device tree overlay operation has been completed. The specific form of the first message is not limited in this embodiment.

[0073] S105. When the hypervisor receives the first message sent by the device tree overlay driver, it starts the virtual machine.

[0074] Specifically, when the hypervisor receives the first message sent by the device tree overlay driver, it can determine that the device tree overlay driver has completed the device tree overlay operation, that is, the isolation of the hardware resources required for the virtual machine to run from the host has been achieved. In this case, the hypervisor can control the virtual machine to be started. At this time, the virtual machine runs based on the hardware resources isolated from the host, and there will be no situation where the virtual machine and the host compete for hardware resources.

[0075] S106. When the virtual machine is shut down, the hypervisor sends the information of the hardware resources to the device tree overlay driver.

[0076] Specifically, when the above-mentioned virtual machine is shut down, the hardware resources it requires should be released back to the host so that other virtual machines can use these hardware resources.

[0077] Therefore, when the hypervisor confirms the shutdown of the virtual machine as described above, it sends the information of the hardware resources required for the operation of the virtual machine to the device tree overlay driver again through kernel communication, that is, it sends the information of the hardware resources sent in step S102 to the device tree overlay driver again, to instruct the device tree overlay driver to cancel the isolation between these hardware resources and the host machine.

[0078] In some embodiments, when the hypervisor sends the above-mentioned information of the hardware resources to the device tree overlay driver by executing step S106, it uses the information of the hardware resources and the first instruction to generate a second message, for example, combines the information of the hardware resources and the first instruction to generate a second message, and then sends the generated second message to the device tree overlay driver.

[0079] Among them, the above-mentioned first instruction is an instruction used to instruct the device tree overlay driver to cancel the isolation between the host machine and the hardware resources included in the second message. The first instruction can be a specific message or an identifier. The specific form of this first instruction is not limited in this embodiment.

[0080] This second message can more clearly instruct the device tree overlay driver to perform what operations based on the information of the hardware resources in the message, thereby improving the interaction efficiency between the hypervisor and the device tree overlay driver.

[0081] S107. When the device tree overlay driver receives the information of the hardware resources, it performs a device tree overlay operation according to the information of the hardware resources to cancel the isolation between the host machine and the hardware resources.

[0082] Specifically, after receiving the information of the hardware resources sent by the hypervisor, the device tree overlay driver parses the information, identifies each host machine hardware resource from it, and then based on these hardware resources, performs a device tree overlay operation on the device tree of the host machine. Specifically, through the device tree overlay operation, these hardware resources are added to the host machine device tree, making these hardware resources visible to the host machine, that is, enabling the host machine to take over these hardware resources, thereby canceling the isolation between the host machine and these hardware resources.

[0083] In this embodiment, after receiving the information of the hardware resources, the device tree overlay driver can first check whether it is the first time to receive the information of the hardware resources. If it is the first time to receive the information of the hardware resources, the device tree overlay driver performs a device tree overlay operation on the device tree of the host machine and deletes these hardware resources from the device tree to achieve the isolation between the host machine and these hardware resources.

[0084] If it is not the first time to receive the information of the hardware resource, for example, when the device tree overlay driver executes step S107 and detects that the information of the same hardware resource has been received before executing step S107, it indicates that it is not the first time to receive the information of the hardware resource. Based on the operation of isolating the host from the hardware resource when receiving the information of the hardware resource for the first time, the device tree overlay driver can determine that the device tree overlay operation has been performed based on the information of the hardware resource before executing step S107, and the isolation between the host and these hardware resources has been achieved. At this time, when executing step S107, the device tree overlay driver receives the information of the hardware resource again and performs the device tree overlay operation again, adding these hardware resources to the device tree of the host, making these hardware resources visible to the host, thereby canceling the isolation between the host and these hardware resources.

[0085] The above solution enables the device tree overlay driver to clearly determine what kind of overlay operation should be performed on the device tree by verifying whether it is the first time to receive the information of the hardware resource, thereby achieving accurate isolation or cancellation of isolation of the hardware resource.

[0086] In another embodiment, when the hypervisor sends the information of the above-mentioned hardware resource to the device tree overlay driver, it uses the information of the hardware resource and the first instruction to generate a second message. For example, it combines the information of the hardware resource and the first instruction to generate a second message, and then sends the second message to the device tree overlay driver. In this embodiment, when the device tree overlay driver receives the second message containing the information of the above-mentioned hardware resource and the first instruction, it extracts the information of the hardware resource from the second message, and then performs the device tree overlay operation based on the information of the hardware resource to cancel the isolation between the host and the hardware resource. In this embodiment, the interaction purpose between the hypervisor and the device tree overlay driver is clearer, which can enable the device tree overlay driver to directly determine what kind of overlay operation needs to be performed on the device tree according to the interaction message, that is, to clarify whether to isolate the hardware resource from the host or cancel the isolation, improving the interaction efficiency.

[0087] As can be seen from the above introduction, based on the resource isolation method proposed in the embodiments of the present application, the hypervisor running on the host obtains the information of the hardware resources required by the virtual machine by parsing the static resource configuration file of the virtual machine to be started before the virtual machine starts, and then sends the configuration information of the hardware resource to the device tree overlay driver running on the host. After receiving the configuration information of the hardware resource, the device tree overlay driver performs a device tree overlay operation on the device tree of the host based on the configuration information of the hardware resource to achieve the isolation between the host and the hardware resource. The above solution realizes the automatic isolation of the host from the hardware resources required by the virtual machine before the virtual machine starts through the automatic interaction between the hypervisor of the host and the device tree overlay driver, and its resource isolation efficiency is higher.

[0088] In addition, an embodiment of the present application further provides a resource isolation method for a hypervisor applied to the Figure 1 host computer shown in. The hypervisor can run on the processor of the host computer, or when the host computer has multiple processor cores, the hypervisor can run on the first processor core.

[0089] Referring to Figure 3 shown, the resource isolation method executed by the hypervisor includes:

[0090] S201. By parsing the static resource configuration file of the virtual machine to be started, obtain information on the hardware resources required by the virtual machine.

[0091] S202. Send the information on the hardware resources to the device tree overlay driver, so that the device tree overlay driver performs a device tree overlay operation according to the information on the hardware resources, and realizes isolation between the host computer and the hardware resources.

[0092] In some implementation manners, the method further includes:

[0093] When the hypervisor receives a first message sent by the device tree overlay driver, start the virtual machine;

[0094] wherein, the first message is a message sent by the device tree overlay driver to the hypervisor after the device tree overlay operation is completed.

[0095] In some implementation manners, the method further includes:

[0096] When the virtual machine is shut down, the hypervisor sends the information on the hardware resources to the device tree overlay driver, so that the device tree overlay driver performs a device tree overlay operation according to the information on the hardware resources, and cancels the isolation between the host computer and the hardware resources.

[0097] In some implementation manners, the hypervisor sending the information on the hardware resources to the device tree overlay driver includes:

[0098] The hypervisor sends a second message to the device tree overlay driver, and the second message includes the information on the hardware resources and a first instruction for instructing the device tree overlay driver to cancel the isolation between the host computer and the hardware resources.

[0099] In some implementation manners, the hypervisor sending the information on the hardware resources to the device tree overlay driver includes:

[0100] The hypervisor sends a third message to the device tree overlay driver, where the third message includes information about the hardware resources and a second instruction for instructing the device tree overlay driver to isolate the host from the hardware resources.

[0101] Among them, in the above resource isolation method, for the specific processing procedures of each execution step of the hypervisor and the beneficial effects of this method, reference can be made to Figure 2 the specific processing procedures of the corresponding steps executed by the hypervisor in the shown resource isolation method, which will not be repeated here.

[0102] Corresponding to the above resource isolation method applied to the hypervisor, another embodiment of the present application further proposes a resource isolation device, which can be applied to Figure 1 the host shown in Figure 4 As shown, the resource isolation device includes:

[0103] A file parsing unit 010, configured to obtain information about the hardware resources required by the virtual machine by parsing the static resource configuration file of the virtual machine to be started;

[0104] An information sending unit 011, configured to send the information about the hardware resources to the device tree overlay driver, so that the device tree overlay driver performs a device tree overlay operation according to the information about the hardware resources, and realizes the isolation between the host and the hardware resources.

[0105] In some implementation manners, the device further includes:

[0106] A start control unit, configured to start the virtual machine when receiving the first message sent by the device tree overlay driver;

[0107] Wherein, the first message is a message sent by the device tree overlay driver to the start control unit after the device tree overlay operation is completed.

[0108] In some implementation manners, the information sending unit 011 is further configured to:

[0109] When the virtual machine is shut down, send the information about the hardware resources to the device tree overlay driver, so that the device tree overlay driver performs a device tree overlay operation according to the information about the hardware resources, and cancels the isolation between the host and the hardware resources.

[0110] In some implementation manners, the information sending unit 011 sending the information about the hardware resources to the device tree overlay driver includes:

[0111] Send a second message to the device tree overlay driver, where the second message includes information about the hardware resource and a first instruction for instructing the device tree overlay driver to cancel the isolation between the host and the hardware resource.

[0112] In some implementations, the information sending unit 011 sends the information about the hardware resource to the device tree overlay driver, including:

[0113] Send a third message to the device tree overlay driver, where the third message includes information about the hardware resource and a second instruction for instructing the device tree overlay driver to isolate the host from the hardware resource.

[0114] In addition, another embodiment of the present application further proposes an application for Figure 1 The resource isolation method of the device tree overlay driver in the host shown, where the device tree overlay driver can run on the processor of the host, or when the host has multiple processor cores, the device tree overlay driver can run on the second processor core.

[0115] See Figure 5 As shown, the resource isolation method executed by the device tree overlay driver includes:

[0116] S301. When receiving the information about the hardware resource sent by the hypervisor, perform a device tree overlay operation according to the information about the hardware resource to isolate the host from the hardware resource;

[0117] Among them, the information about the hardware resource is obtained by the hypervisor by parsing the static resource configuration file of the virtual machine to be started.

[0118] In some implementations, the method further includes:

[0119] After the device tree overlay driver finishes performing the device tree overlay operation, send a first message to the hypervisor so that the hypervisor starts the virtual machine when receiving the first message.

[0120] In some implementations, after the device tree overlay driver sends the first message to the hypervisor, the method further includes:

[0121] When the device tree overlay driver receives the information about the hardware resource, perform a device tree overlay operation according to the information about the hardware resource to cancel the isolation between the host and the hardware resource;

[0122] Among them, when the virtual machine is shut down, the hypervisor sends the information about the hardware resource to the device tree overlay driver.

[0123] In some implementations, the device tree overlay driver receives information about the hardware resources, including:

[0124] The device tree overlay driver receives a second message sent by the hypervisor, where the second message includes information about the hardware resources and a first instruction for instructing the device tree overlay driver to cancel the isolation between the host and the hardware resources.

[0125] In some implementations, the device tree overlay driver receives information about the hardware resources sent by the hypervisor, including:

[0126] The device tree overlay driver receives a third message sent by the hypervisor, where the third message includes information about the hardware resources and a second instruction for instructing the device tree overlay driver to isolate the host from the hardware resources.

[0127] Among them, in the above resource isolation method, for the specific processing procedures of each execution step of the device tree overlay driver and the beneficial effects of this method, reference can be made to Figure 2 the specific processing procedures of the corresponding steps executed by the device tree overlay driver in the shown resource isolation method, which will not be repeated here.

[0128] Corresponding to the above resource isolation method applied to the device tree overlay driver, another embodiment of the present application further proposes a resource isolation device, which can be applied to Figure 1 the host shown in Figure 6 to implement the above resource isolation method executed by the device tree overlay driver. As shown in

[0129] The isolation processing unit 110 is configured to perform a device tree overlay operation according to the information about the hardware resources when receiving the information about the hardware resources sent by the hypervisor, so as to isolate the host from the hardware resources;

[0130] Among them, the information about the hardware resources is obtained by the hypervisor through parsing the static resource configuration file of the virtual machine to be started.

[0131] In some implementations, the isolation processing unit 110 is further configured to:

[0132] After completing the device tree overlay operation, send a first message to the hypervisor, so that the hypervisor starts the virtual machine when receiving the first message.

[0133] In some implementations, after sending the first message to the hypervisor, the isolation processing unit 110 is further configured to:

[0134] Upon receiving the information of the hardware resource, perform a device tree overlay operation according to the information of the hardware resource to cancel the isolation between the host and the hardware resource;

[0135] Wherein, when the virtual machine is shut down, the hypervisor sends the information of the hardware resource to the isolation processing unit 110.

[0136] In some implementations, the isolation processing unit 110 receiving the information of the hardware resource includes:

[0137] The isolation processing unit 110 receives a second message sent by the hypervisor, where the second message includes the information of the hardware resource and a first instruction for instructing the isolation processing unit 110 to cancel the isolation between the host and the hardware resource.

[0138] In some implementations, the isolation processing unit 110 receiving the information of the hardware resource sent by the hypervisor includes:

[0139] The isolation processing unit 110 receives a third message sent by the hypervisor, where the third message includes the information of the hardware resource and a second instruction for instructing the isolation processing unit 110 to isolate the host from the hardware resource.

[0140] The resource isolation device provided in the above embodiments belongs to the same inventive concept as the resource isolation method corresponding to the resource isolation device, and can execute the resource isolation method corresponding to the resource isolation device, and has the corresponding functional modules and beneficial effects of the execution method. For the technical details not described in detail in this embodiment, reference may be made to the specific processing content of the resource isolation method provided in the above embodiments of the present application, which will not be elaborated herein.

[0141] The functions implemented by each unit in the above resource isolation device can be respectively implemented by the same or different processors, which is not limited in the embodiments of the present application.

[0142] It should be understood that the units in the above device can be implemented in the form of a processor invoking software. For example, the device includes a processor, the processor is connected to a memory, instructions are stored in the memory, and the processor invokes the instructions stored in the memory to implement any of the above methods or the functions of each unit of the device. The processor can be a general-purpose processor, such as a CPU or a microprocessor, etc., and the memory can be a memory inside the device or a memory outside the device. Alternatively, the units in the device can be implemented in the form of a hardware circuit, and the functions of some or all of the units can be implemented through the design of the hardware circuit. The hardware circuit can be understood as one or more processors; for example, in one implementation, the hardware circuit is an ASIC, and the functions of some or all of the above units are implemented through the design of the logical relationship between the components in the circuit; again, in another implementation, the hardware circuit can be implemented through a PLD. Taking an FPGA as an example, it can include a large number of logic gate circuits, and the connection relationship between the logic gate circuits is configured through a configuration file, so as to implement the functions of some or all of the above units. All units of the above device can be all implemented in the form of a processor invoking software, or all implemented in the form of a hardware circuit, or some implemented in the form of a processor invoking software, and the remaining part implemented in the form of a hardware circuit.

[0143] In the embodiments of the present application, the processor is a circuit with the ability to process signals. In one implementation, the processor can be a circuit with the ability to read and execute instructions, such as a CPU, a microprocessor, a GPU, or a DSP, etc.; in another implementation, the processor can implement certain functions through the logical relationship of a hardware circuit, and the logical relationship of the hardware circuit is fixed or can be reconstructed. For example, the processor is a hardware circuit implemented by an ASIC or a PLD, such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document to implement the configuration of the hardware circuit can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as a type of ASIC, such as an NPU, a TPU, a DPU, etc.

[0144] It can be seen that each unit in the above device can be one or more processors (or processing circuits) configured to implement the above method, such as: a CPU, a GPU, an NPU, a TPU, a DPU, a microprocessor, a DSP, an ASIC, an FPGA, or a combination of at least two of these processor forms.

[0145] In addition, each unit in the above device can be fully or partially integrated together, or can be implemented independently. In one implementation, these units are integrated together and implemented in the form of an SOC. The SOC may include at least one processor for implementing any of the above methods or implementing the functions of each unit of the device. The types of the at least one processor can be different. For example, it includes a CPU and an FPGA, a CPU and an artificial intelligence processor, a CPU and a GPU, etc.

[0146] Another embodiment of the present application further provides a host computer. Refer to Figure 1 the host computer shown in. On the host computer provided in this embodiment, a virtualization manager and a device tree overlay driver are running. The virtualization manager is configured to execute the resource isolation method executed by the virtualization manager in the above embodiment, and / or the device tree overlay driver is configured to execute the resource isolation method executed by the device tree overlay driver in the above embodiment. Thus, in this host computer, the virtualization manager and the device tree overlay driver automatically interact to implement isolation and cancellation of isolation between the hardware resources of the host computer and the virtual machine.

[0147] Another embodiment of the present application further provides a virtualization system. The structure of the virtualization system can be referred to Figure 1 as shown in. On the host computer in this virtualization system, a virtualization manager and a device tree overlay driver are running. The virtualization manager is configured to execute the resource isolation method executed by the virtualization manager in the above embodiment, and / or the device tree overlay driver is configured to execute the resource isolation method executed by the device tree overlay driver in the above embodiment. Thus, in this virtualization system, the virtualization manager and the device tree overlay driver on the host computer automatically interact to implement isolation and cancellation of isolation between the hardware resources of the host computer and the virtual machine.

[0148] In addition to the above methods and devices, an embodiment of the present application can also be a computer program product, which includes computer program instructions. When the computer program instructions are run by a processor, the processor is caused to execute the steps in the resource isolation method described in any of the above embodiments of this specification.

[0149] The computer program product can be written in any combination of one or more programming languages for programming code to execute the operations of the embodiments of the present application. The programming languages include object-oriented programming languages such as Java, C++, etc., and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, executed as an independent software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0150] In addition, an embodiment of the present application may also be a storage medium, on which a computer program is stored, and the computer program is executed by a processor to perform the steps in the resource isolation method described in any of the above embodiments of this specification.

[0151] For the foregoing method embodiments, for the sake of simple description, they are all expressed as a series of action combinations. However, those skilled in the art should know that the present application is not limited by the described action sequence, because according to the present application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the present application.

[0152] It should be noted that the embodiments in this specification are all described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The same or similar parts among the embodiments can be referred to each other. For the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0153] The steps in the methods of the embodiments of the present application can be adjusted, combined, and deleted according to actual needs. The technical features recorded in each embodiment can be replaced or combined.

[0154] The modules and sub-modules in the devices and terminals in the embodiments of the present application can be combined, divided, and deleted according to actual needs.

[0155] In several embodiments provided by the present application, it should be understood that the disclosed terminals, devices, and methods can be implemented in other ways. For example, the terminal embodiments described above are merely illustrative. For example, the division of modules or sub-modules is only a logical function division. In actual implementation, there may be other division methods. For example, multiple sub-modules or modules can be combined or integrated into another module, or some features can be ignored or not executed. Another point is that the displayed or discussed couplings or direct couplings or communication connections to each other can be through some interfaces. The indirect couplings or communication connections of devices or modules can be in electrical, mechanical, or other forms.

[0156] The modules or sub-modules described as separate components may or may not be physically separated. The components as modules or sub-modules may or may not be physical modules or sub-modules, that is, they can be located in one place, or they can be distributed to multiple network modules or sub-modules. Some or all of the modules or sub-modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0157] In addition, in each embodiment of the present application, each functional module or sub-module can be integrated into a processing module, can exist physically alone for each module or sub-module, or two or more modules or sub-modules can be integrated into one module. The above integrated module or sub-module can be implemented in the form of hardware or in the form of a software functional module or sub-module.

[0158] Those skilled in the art can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described according to functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Skilled professionals can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0159] The steps of the method or algorithm described in combination with the embodiments disclosed herein can be directly implemented by hardware, a software unit executed by a processor, or a combination of the two. The software unit can be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, or any other form of storage medium well-known in the technical field.

[0160] Finally, it should also be noted that in this document, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not expressly listed, or further includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "including one..." does not exclude the existence of additional identical elements in the process, method, article or device including the said element.

[0161] The foregoing description of the disclosed embodiments enables those skilled in the art to practice or use the present application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Thus, the present application is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A resource isolation method, characterized in that, Applied to a host machine on which a hypervisor and a device tree overlay driver are running, the method includes: The hypervisor obtains information about the hardware resources required by the virtual machine by parsing the static resource configuration file of the virtual machine to be started; The hypervisor sends the information about the hardware resources to the device tree overlay driver, so that the device tree overlay driver performs a device tree overlay operation according to the information about the hardware resources, realizing isolation between the host machine and the hardware resources.

2. The method according to claim 1, characterized in that, The method further includes: The hypervisor starts the virtual machine when receiving a first message sent by the device tree overlay driver; Wherein, the first message is a message sent by the device tree overlay driver to the hypervisor after completing the device tree overlay operation.

3. The method according to claim 2, wherein The method further includes: When the virtual machine is shut down, the hypervisor sends the information about the hardware resources to the device tree overlay driver, so that the device tree overlay driver performs a device tree overlay operation according to the information about the hardware resources to cancel the isolation between the host machine and the hardware resources.

4. The method according to claim 3, wherein The hypervisor sending the information about the hardware resources to the device tree overlay driver includes: The hypervisor sends a second message to the device tree overlay driver, and the second message includes the information about the hardware resources and a first instruction for instructing the device tree overlay driver to cancel the isolation between the host machine and the hardware resources.

5. The method according to any one of claims 1 to 4, characterized in that The hypervisor sending the information about the hardware resources to the device tree overlay driver includes: The hypervisor sends a third message to the device tree overlay driver, and the third message includes the information about the hardware resources and a second instruction for instructing the device tree overlay driver to isolate the host machine from the hardware resources.

6. A resource isolation method, characterized in that, Applied to a host machine on which a hypervisor and a device tree overlay driver are running, the method includes: When receiving the information about the hardware resources sent by the hypervisor, the device tree overlay driver performs a device tree overlay operation according to the information about the hardware resources to realize isolation between the host machine and the hardware resources; Wherein, the information about the hardware resources is obtained by the hypervisor by parsing the static resource configuration file of the virtual machine to be started.

7. The method according to claim 6, wherein The method further includes: When the device tree overlay driver finishes the device tree overlay operation, it sends a first message to the hypervisor, so that the hypervisor starts the virtual machine when receiving the first message.

8. The method according to claim 7, wherein After the device tree overlay driver sends the first message to the hypervisor, the method further includes: When receiving the information about the hardware resources, the device tree overlay driver performs a device tree overlay operation according to the information about the hardware resources to cancel the isolation between the host machine and the hardware resources; Wherein, when the virtual machine is shut down, the hypervisor sends the information about the hardware resources to the device tree overlay driver.

9. The method according to claim 8, wherein The device tree overlay driver receives information about the hardware resources, including: The device tree overlay driver receives a second message sent by the hypervisor, where the second message includes information about the hardware resources and a first instruction for instructing the device tree overlay driver to cancel the isolation between the host and the hardware resources.

10. The method according to any one of claims 6 to 9, characterized in that, The device tree overlay driver receives information about the hardware resources sent by the hypervisor, including: The device tree overlay driver receives a third message sent by the hypervisor, where the third message includes information about the hardware resources and a second instruction for instructing the device tree overlay driver to isolate the host from the hardware resources.

11. A host computer, characterized in that, A hypervisor and a device tree overlay driver are running on the host. The hypervisor is configured to execute the resource isolation method according to any one of claims 1 to 5, and / or the device tree overlay driver is configured to execute the resource isolation method according to any one of claims 6 to 10.

12. A virtualization system, characterized in that, A hypervisor and a device tree overlay driver are running on the host of the virtualization system. The hypervisor is configured to execute the resource isolation method according to any one of claims 1 to 5, and / or the device tree overlay driver is configured to execute the resource isolation method according to any one of claims 6 to 10.

13. A computer program product, characterized in that, It includes computer program instructions that, when run by a processor, cause the processor to execute the resource isolation method according to any one of claims 1 to 5, and / or cause the processor to execute the resource isolation method according to any one of claims 6 to 10.

Images