Virtualized multi-master shared concurrent access architecture and driving method thereof

Abstract

The invention relates to a virtualized multi-master shared concurrent access architecture and a driving method thereof.The architecture comprises a physical hardware layer, a hardware abstraction layer, a virtualization management layer, a kernel driving layer and a user application layer which are sequentially connected, all the layers interact through standardized interfaces, the physical hardware layer comprises PCIe hardware equipment, and the kernel driving layer comprises a kernel driving layer and a kernel driving layer; the PCIe hardware equipment comprises a hard disk, a gigabit network card, a 10-gigabit network card and a secure clock board card; the hardware abstraction layer comprises BIOS firmware; the virtualization management layer comprises a Hypervisor, a centralized management unit, a HyperCall request processor and a second-stage page table mapping module; the kernel driving layer comprises a driving program running on an SVM (Support Vector Machine) and SCB (Service Control Block) driving components respectively running on business virtual machines, and the business virtual machines comprise a ReWorks virtual machine and an RT-Linux virtual machine; and the user application layer comprises a real-time service application program running in each service virtual machine. Compared with the prior art, concurrent access of multiple virtual machines to the same secure clock board card is realized, and the real-time performance of data access and the hardware utilization rate are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of secure operation, in particular to a virtualized multi-master shared concurrent access architecture and a driving method thereof. BACKGROUND

[0002] At present, with the wide application of cloud platforms in various industries, the demand for accessing PCIe board cards in servers is increasing. In traditional design, the board card (such as a secure clock board card) is usually allocated to a specific virtual machine (commonly known as a "proxy virtual machine") through virtualization technology (such as PCIe Pass-through) in an exclusive manner, forming a single master-slave architecture. If other virtual machines need to access the board card, they must indirectly access it through the communication channel established by the proxy virtual machine, that is, the proxy virtual machine receives the read and write requests of other virtual machines, accesses the board card on behalf of them, and then returns the results. With the increasing demand for real-time processing of cloud platforms, this traditional method has obvious defects: 1) Poor resource utilization and scalability: The board card is exclusively occupied by a single virtual machine, forming a "resource island". Other virtual machines cannot directly access it, which not only leads to low utilization of valuable hardware resources, but also severely limits the horizontal expansion capability of the system. When business growth requires more virtual machine instances to access the same hardware function, this architecture cannot support it flexibly, becoming a system bottleneck.

[0003] 2) Difficulty in guaranteeing real-time performance: Since the access request must be transferred through the proxy virtual machine, it needs to undergo multiple context switches, data serialization / deserialization, and cross-virtual machine data copying. These operations introduce significant and uncertain delays and jitter, which cannot meet the stringent requirements of microsecond or even nanosecond delays in financial transactions, real-time control, and other scenarios. The complex communication protocol itself also increases processing overhead.

[0004] 3) High system complexity and maintenance cost: This architecture introduces additional failure points (proxy virtual machine and its communication stack). When upgrading the system, changing the hardware, or updating the driver, not only does the driver inside the proxy virtual machine need to be modified, but the communication logic of all client virtual machines that depend on the proxy also needs to be adjusted, redeveloped, and adapted. This greatly increases the coupling of the system, the complexity of testing and verification, and the cost of later maintenance.

[0005] 4) Risk of data integrity and reliability: The proxy virtual machine serves as the only access channel. If it fails, crashes, or becomes a performance bottleneck, it will prevent all business virtual machines that depend on it from accessing the board card, posing a single point of failure risk and potentially affecting data integrity and system continuous availability.

[0006] Generally, the conventional virtual machine PCIE security clock drive component design is in the traditional single master-slave mode, and the access to the PCIE memory or IO space of the security clock board card is initiated by a certain virtual machine to obtain or rewrite data. Other virtual machine nodes can only communicate with the CPU through the corresponding communication protocol interface to obtain or rewrite the data of the board card. However, this will cause the real-time performance of the real-time security system to decrease, and the data integrity and availability may be affected. In addition, during the later system upgrade, the related driver may be rewritten and re-adapted.

[0007] To improve the communication delay, patent application CN109445905A proposes a virtual machine data communication method, which allocates devices to a single virtual machine through PCIe pass-through technology, and configures end-to-end forwarding rules in the switch to avoid address conversion. However, this method still does not break through the single virtual machine exclusive architecture, and has the following inherent defects: first, the PCIe device is still exclusive to a single virtual machine, and cannot be directly shared by other virtual machines, and the hardware resource utilization and scalability problem has not been fundamentally solved; second, all accesses depend on the exclusive virtual machine, and its failure will cause the interruption of the entire access channel, and the single point failure risk still exists; third, this scheme only optimizes the communication between devices within the same virtual machine, and cross-virtual machine access still needs protocol transfer, and the delay introduced by context switching and data copying cannot meet the microsecond-level real-time requirement; in addition, the system needs to maintain complex switch forwarding rules and address alignment configurations, and needs to adjust the virtual machine and the switch double configurations synchronously when the hardware changes or the driver upgrades, which has strong coupling and high maintenance cost.

[0008] In summary, the traditional proxy-based PCIe device virtualization scheme has been difficult to adapt to the demand of modern cloud platforms for high performance, high real-time performance, high scalability and high reliability due to its inherent architectural limitations. SUMMARY

[0009] The purpose of the present application is to overcome the defects of the prior art and provide a virtualized multi-master shared concurrent access architecture and a driving method thereof, which realizes the concurrent access of multiple virtual machines to the same security clock board card and improves the real-time performance of data access and hardware utilization.

[0010] The purpose of the present application can be realized by the following technical solutions: A virtualized multi-master shared concurrent access architecture, comprising a physical hardware layer, a hardware abstraction layer, a virtualization management layer, a kernel driver layer and a user application layer connected in sequence, and interacting through standardized interfaces between layers, The physical hardware layer comprises a PCIe hardware device, and the PCIe hardware device includes a hard disk, a gigabit network card, a terabit network card and a security clock board card. The hardware abstraction layer comprises a BIOS firmware. The virtualization management layer includes a Hypervisor, a centralized management unit, a HyperCall request processor, and a second-stage page table mapping module; The kernel driver layer includes a driver running on the SVM and SCB driver components running on each service virtual machine, respectively, which obtain an IPA address from a pre-configured DTS device tree file, call the Hypervisor to convert the IPA address to a virtual address through a memory mapping service, directly access registers and storage areas of the secure clock board card in parallel via the second-stage page table mapping, and unify the mapping relationship of the IPA address of each service virtual machine to the physical address of the secure clock board card through the virtualization management layer to realize direct hardware sharing of multiple virtual machines without proxy protocol. The user application layer includes real-time service application programs running in each service virtual machine.

[0011] Further, the secure clock board card integrates an FPGA master unit, a storage unit, and a clock management unit, and is connected to a server through a PCIe 3.0 x4 interface, the storage unit is connected to the FPGA master unit through an SPI bus, the storage unit includes a Nor Flash 1, a Nor Flash 2, and an NVSRAM, the Nor Flash 1 is used to store an FPGA configuration bit stream file, the Nor Flash 2 is used to store non-volatile data, and the NVSRAM is used to cache high-speed data, and the clock management unit is an independent crystal oscillator clock.

[0012] Further, the BIOS firmware is configured to perform device enumeration on PCIe hardware devices according to the PCIe bus condition of the entire server in the BIOS running stage, identify the secure clock board card, and allocate resources to the secure clock board card.

[0013] Further, the specific steps of identifying the secure clock board card and allocating resources to the secure clock board card include: All hardware devices on the PCIe bus are traversed, and the existence of the secure clock board card is detected by reading standard registers with configuration space offsets of 0x00 to 0xFF. According to the memory resource requirement applied by the secure clock board card to the server, the BIOS firmware performs the following resource allocation operations: The secure clock board card is allocated a physical address space corresponding to a base address register, the physical address and capacity are recorded, and the allocation result is written into the PCIe configuration space for subsequent reading and use by the Hypervisor and the SCB driver components of the service virtual machines.

[0014] Further, the HyperCall request processor is configured to receive resource authorization information transmitted by a driver running in SVM in the kernel driver layer.

[0015] Further, the resource authorization information includes multiple information such as physical resource location information, target virtual machine identification information, intermediate physical address allocation information and access permission control information.

[0016] Further, the centralized management unit is configured to create independent memory slots for each service virtual machine according to the resource authorization information, and map the physical address space of the secure clock board card into each of the memory slots, so that each service virtual machine can directly operate the secure clock board card by accessing its corresponding memory slot.

[0017] Further, the second stage page table mapping module is configured to build a mapping relationship between the IPA address of each service virtual machine and the physical address of the secure clock board card and set differentiated access permissions.

[0018] Further, the SVM driver is configured to obtain physical addresses and capacities from the PCIe configuration space through an ACPI parsing interface, and transmit resource authorization information to the virtualization management layer via the HyperCall request processor.

[0019] Further, the memory mapping service receives an IOCTL command transmitted by the SVM driver, and establishes a mapping relationship between the physical address and the IPA address on the processor core specified by the CMU based on the physical address and the capacity of the secure clock board card.

[0020] Further, the mapping relationship between the physical address and the IPA address is built by the following steps: The Hypervisor allocates independent IPA address intervals for the ReWorks virtual machine and the RT-Linux virtual machine respectively, and the IPA address intervals of the ReWorks virtual machine and the RT-Linux virtual machine both point to the same physical address space of the secure clock board card; The centralized management unit creates independent memory slots for each service virtual machine; All page table entries in each memory slot are traversed, the IPA address of the service virtual machine is converted into a physical address, the memory attribute of the mapping entry is set to shared device memory, and a mapping relationship between the physical address and the IPA address is established.

[0021] Further, the memory slot is used to record an IPA base address, a number of mapping pages, an access permission flag and a memory attribute, and the IPA base address is the starting address of the IPA address interval.

[0022] Further, the memory mapping service supports a dynamic remapping function, when the system is upgraded or the resources are reconfigured, by updating the second-stage page table mapping, the SCB driver component obtains the updated IPA address through the HyperCall request processor and remaps it to a virtual address, thereby realizing zero-modification adaptation of the driver.

[0023] Further, the real-time service application program is configured to call the SCB driver component of each service virtual machine through a standard driver API interface, to perform reading of the counter, reading and writing of the NVSRAM, and acquisition of the secure clock board information.

[0024] Further, the service virtual machine includes a ReWorks virtual machine and an RT-Linux virtual machine.

[0025] According to another aspect of the present application, a driver method of a virtualized multi-master shared concurrent access architecture is provided, for driving the virtualized multi-master shared concurrent access architecture as described above, comprising the following steps: The BIOS firmware performs device enumeration according to the PCIe bus conditions of the entire server, identifies the secure clock board, and allocates resources to it, and writes the allocation result into the PCIe configuration space; The SVM loads and runs, obtains the physical address and capacity of the secure clock board from the PCIe configuration space through its driver, and calls the SCB driver component according to the IOCTL command, and transmits the resource authorization information to the virtualization management layer through the HyperCall request processor; The Hypervisor allocates the SCB card resources to the on-core specified by the centralized management unit according to the resource authorization information, and modifies the DTS device tree files of the ReWorks virtual machine and the RT-Linux virtual machine respectively, and configures the IPA address interval to the device nodes of each service virtual machine; The SCB driver component of each service virtual machine obtains the corresponding IPA address from the DTS device tree file of each service virtual machine, calls the memory mapping service of the Hypervisor to convert the IPA address to a virtual address, directly accesses the registers and storage areas of the secure clock board through the second-stage page table mapping, and performs reading of the counter, reading and writing of the NVSRAM, and acquisition of the secure clock board information, thereby realizing direct hardware sharing concurrent access of the multi-service virtual machine without proxy protocol.

[0026] Further, the SCB card resources include memory slots, physical address space, access permission flags, and IPA address intervals.

[0027] Compared with the prior art, the present application has the following beneficial effects: 1. The application realizes multi-virtual machine proxyless protocol direct hardware sharing and concurrent and direct access of multiple virtual machines to the same secure clock board card by the second stage page table mapping module and the centralized management unit of the virtualization management layer, which unifies the mapping relationship of each service virtual machine intermediate physical address to the physical address of the secure clock board card, and through unified construction of the mapping relationship of IPA and board card physical address, the SCB drive component converts the IPA into a virtual address through the memory mapping service of the Hypervisor, without the need of transferring through the proxy virtual machine, and directly operates the secure clock board card register and storage area through the standard API call drive component, greatly improving the real-time performance of data access and hardware utilization.

[0028] 2. The application realizes prepositioning of hardware resource management by pre-completing resource enumeration and initial allocation of PCIe hardware devices through the following steps: traversing all devices on the PCIe bus in the BIOS startup stage, accurately identifying the existence of the secure clock board card by reading the standard register with configuration space offset 0x00 to 0xFF, dynamically allocating physical address space and recording capacity information based on the memory resource requirement, and finally writing the allocation result into the PCIe configuration space.

[0029] 3. The application avoids address resource conflicts caused by system dynamic allocation and guarantees the determinacy and stability of the mapping relationship by modifying the DTS file of each service virtual machine according to the resource authorization information obtained from the SVM drive program, writing the pre-defined IPA address interval into the device node, parsing the IPA address from the DTS file by the SCB drive component when the virtual machine starts, calling the memory mapping service of the Hypervisor to convert it into a virtual address, and finally directly accessing the physical resources of the secure clock board card through the second stage page table mapping. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 The structural schematic diagram of the virtualized multi-master shared concurrent access architecture proposed by the application; Figure 2 The structural schematic diagram of the secure clock board card; Figure 3 The flowchart of the driving method of the virtualized multi-master shared concurrent access architecture proposed by the application. DETAILED DESCRIPTION

[0031] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. These embodiments are based on the technical solution of the present invention and provide detailed implementation methods and specific operating procedures. However, the scope of protection of the present invention is not limited to the following embodiments.

[0032] The following English abbreviations are involved: Basic Input Output System (BIOS) High-speed peripheral component interconnect: Peripheral Component Interconnect Express, PCIe Base Address Register (BAR) Secure Clock Board (SCB) Input / Output Control (IOCTL) System Virtual Machine (SVM) Central Management Unit (CMU) Physical Address (PA) Intermediate Physical Address (IPA) Non-volatile static random access memory: Non-volatile SRAM, NVSRAM Differentiated System Description Table (DSDT) Serial Peripheral Interface (SPI) Device Tree Source (DTS) Application Programming Interface (API) Virtual Address (VA) Advanced Configuration and Power Management Interface (ACPI) Example 1 This embodiment provides a virtualized multi-master shared concurrent access architecture, such as...Figure 1 As shown, it includes a physical hardware layer, a hardware abstraction layer, a virtualization management layer, a kernel driver layer, and a user application layer connected in sequence, with each layer interacting through a standardized interface.

[0033] The physical hardware layer includes PCIe hardware devices, such as hard drives, gigabit network cards, 10-gigabit network cards, and security clock cards.

[0034] like Figure 2 As shown, the secure clock board integrates an FPGA main control unit, a storage unit, and a clock management unit, and is connected to the server via a PCIe 3.0 x4 interface. The storage unit is connected to the FPGA main control unit via an SPI bus. The storage unit includes Nor Flash1, Nor Flash2, and NVSRAM. Nor Flash1 is used to store the FPGA configuration bitstream file, Nor Flash2 is used to store non-volatile data, and NVSRAM is used to cache high-speed data. The clock management unit is an independent crystal oscillator clock that does not depend on the system clock, ensuring the independence and reliability of the time base.

[0035] The hardware abstraction layer includes the BIOS firmware, which is configured to enumerate PCIe hardware devices based on the PCIe bus status of the entire server during the BIOS operation phase, identify the security clock board, and allocate resources to it.

[0036] The specific steps for identifying and allocating resources to a secure clock board include: By traversing all hardware devices on the PCIe bus and reading the standard registers with configuration space offsets from 0x00 to 0xFF, the presence of the security clock board is detected. Based on the memory resource requests submitted by the security clock board to the server, the BIOS firmware performs the following resource allocation operations: Allocate the physical address space corresponding to the base address register for the security clock board, record the physical address and capacity, and write the allocation result into the PCIe configuration space for subsequent use by the SCB driver components of the Hypervisor and business virtual machines.

[0037] The virtualization management layer includes the Hypervisor, the centralized management unit, the HyperCall request processor, and the second-stage page table mapping module.

[0038] As the core of the virtualization management layer, the hypervisor runs directly on the physical hardware and is responsible for virtual machine lifecycle management, physical resource scheduling and isolation.

[0039] The centralized management unit is configured to create independent memory slots for each business virtual machine based on resource authorization information, and to map the physical address space of the security clock board to each memory slot. This enables each business virtual machine to directly operate the security clock board by accessing its corresponding memory slot, thus achieving shared access to hardware resources.

[0040] The HyperCall request handler is used to receive resource authorization information from drivers running on the SVM in the kernel driver layer. This resource authorization information includes various types of information such as physical resource location information, target virtual machine identification information, intermediate physical address allocation information, and access control information.

[0041] The second-stage page table mapping module is used to build the mapping relationship between the IPA address of each business virtual machine and the physical address of the security clock board, and set differentiated access permissions to realize the isolation and direct allocation of hardware resources, ensure the secure isolation of hardware resources, and prevent virtual machines from accessing them without authorization.

[0042] The kernel driver layer contains drivers running on the SVM and SCB driver components running on each business virtual machine, including ReWorks virtual machines and RT-Linux virtual machines. The SVM driver is configured to obtain physical addresses and capacity from the PCIe configuration space via the ACPI resolution interface and pass resource authorization information to the virtualization management layer via the HyperCall request processor. After obtaining the resource authorization information, the SVM driver does not directly manipulate the hardware, but instead submits the resource authorization information to the virtualization management layer through the HyperCall request processor, requesting the Hypervisor to authorize these resources for use by the specified business virtual machines.

[0043] Each service virtual machine's SCB driver component obtains the IPA address from the pre-configured DTS device tree file, calls the hypervisor in the virtualization management layer to convert the IPA address into a virtual address via memory mapping service, and then performs concurrent access to the registers and storage areas of the security clock board directly through the second-stage page table mapping. Concurrent access is achieved by unifying the mapping relationship between the intermediate physical address of each service virtual machine and the physical address of the security clock board through the virtualization management layer, enabling direct hardware sharing among multiple virtual machines without agent protocols.

[0044] The memory mapping service receives IOCTL commands from the SVM driver and, based on the physical address and capacity of the security clock board, establishes a mapping relationship between physical addresses and IPA addresses on the processor core specified by the CMU. The specific steps for constructing the physical address to IPA address mapping relationship include: The Hypervisor assigns independent IPA address ranges to the ReWorks virtual machine and the RT-Linux virtual machine respectively. The IPA address ranges of the ReWorks virtual machine and the RT-Linux virtual machine both point to the same physical address space of the security clock board, laying the foundation for isolation and concurrent access. Each business virtual machine is created with an independent memory slot through a centralized management unit. The memory slot is used to record the IPA base address, the number of mapped pages, the access permission flags and memory attributes. The IPA base address is the starting address of the IPA address range. Traverse all page table entries in each memory slot, translate the IPA address of the business virtual machine into a physical address, set the memory attribute of the mapping entry to shared device memory, and establish a mapping relationship from physical address to IPA address.

[0045] The memory mapping service supports dynamic remapping. When the system is upgraded or resources are reconfigured, the virtualization management layer modifies the second-stage page table mapping by updating the second-stage page table, adjusting the mapping relationship between IPA and physical address. Through the HyperCall mechanism, the updated IPA address information is passed to the SCB driver component in the business virtual machine. The SCB driver component uses HyperCall to request the processor to obtain the updated IPA address and remap it to a virtual address, thereby achieving zero-modification adaptation of the driver.

[0046] The user application layer contains real-time business applications running in various business virtual machines. These applications are configured to call the SCB driver components of each business virtual machine via standard driver API interfaces to perform operations such as reading counters, reading and writing NVSRAM, and obtaining information from the security clock board. For reading counters, the request is passed to the SCB driver component within the business virtual machine through a communication mechanism provided by the virtualization management layer. The driver component ultimately reads the counter value on the security clock board directly through the register address mapped to the virtual machine's address space and returns it to the application. For reading and writing NVSRAM, the application calls the corresponding API interface, and the SCB driver component ensures that the read / write operation is correctly directed to the physical memory area corresponding to the NVSRAM on the board. The application can query metadata information such as the board's firmware version and status through the corresponding API. The SCB driver component reads this information from specific registers or memory units on the board and returns it to the application.

[0047] Example 2 This embodiment provides a driving method for a concurrent access architecture of virtualized multi-master sharing, used to drive the concurrent access architecture of virtualized multi-master sharing as proposed in Embodiment 1, such as... Figure 3 As shown, it includes the following steps: S1. The BIOS firmware enumerates devices based on the PCIe bus status of the entire server, identifies the security clock board, allocates resources to it, and writes the allocation results to the PCIe configuration space.

[0048] S2 and SVM are loaded and running. They obtain the physical address and capacity of the security clock card from the PCIe configuration space through their drivers, and call the SCB driver component according to the IOCTL command to pass the resource authorization information to the virtualization management layer through the HyperCall request processor.

[0049] Based on the resource authorization information, S3 and Hypervisor allocate SCB card resources to the cores specified by the centralized management unit, and modify the DTS device tree files of ReWorks virtual machines and RT-Linux virtual machines respectively, configuring the IPA address range to the device nodes of each service virtual machine.

[0050] SCB card resources include memory slots, physical address space, access permission flags, and IPA address ranges.

[0051] S4. Obtain the corresponding IPA address from the DTS device tree file of each service virtual machine through the SCB driver component of each service virtual machine, call the Hypervisor's memory mapping service to convert the IPA address into a virtual address, and directly access the registers and storage areas of the security clock board through the second-stage page table mapping to perform operations such as reading the counter, reading and writing the NVSRAM, and obtaining information from the security clock board, thereby realizing direct hardware sharing and concurrent access to multiple service virtual machines without agent protocol.

[0052] The specified IPA address is passed to the ReWorks virtual machine. The SCB driver component runs on the ReWorks virtual machine. The SCB driver first obtains the IPA address from the DTS device tree file, calls the Hypervisor's memory mapping service to convert the IPA address into a virtual address, and directly accesses the registers and storage areas of the security clock board through the second-stage page table mapping to complete the operations of reading the counter value, reading the security clock board information, and reading and writing NVSRAM.

[0053] The specified IPA address is passed to the RT-Linux virtual machine. The SCB driver component runs on the RT-Linux virtual machine. The SCB driver component first obtains the IPA address from the DTS device tree file, calls the Hypervisor's memory mapping service to convert the IPA address into a virtual address, and directly accesses the registers and storage areas of the security clock board through the second-stage page table mapping to complete the operations of reading the counter value, reading the security clock board information, and reading and writing NVSRAM.

[0054] The rest is the same as in Example 1.

[0055] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A concurrent access architecture for virtualized multi-master sharing, characterized in that, It consists of a physical hardware layer, a hardware abstraction layer, a virtualization management layer, a kernel driver layer, and a user application layer, which are connected in sequence. The layers interact with each other through standardized interfaces. The physical hardware layer includes PCIe hardware devices, which include hard drives, gigabit network cards, 10-gigabit network cards, and security clock cards. The hardware abstraction layer includes the BIOS firmware; The virtualization management layer includes a Hypervisor, a centralized management unit, a HyperCall request processor, and a second-stage page table mapping module. The kernel driver layer includes a driver running on the SVM and SCB driver components running on each service virtual machine. The SCB driver components of each service virtual machine obtain the IPA address from the pre-configured DTS device tree file, call the Hypervisor to convert the IPA address into a virtual address through the memory mapping service, and directly access the registers and storage areas of the security clock board concurrently through the second-stage page table mapping. The virtualization management layer unifies the mapping relationship between the IPA address of each service virtual machine and the physical address of the security clock board, realizing direct hardware sharing of multiple virtual machines without agent protocol. The user application layer contains real-time business applications running in various business virtual machines.

2. The concurrent access architecture for virtualized multi-master sharing according to claim 1, characterized in that, The secure clock board integrates an FPGA main control unit, a storage unit, and a clock management unit, and is connected to the server via a PCIe 3.0 x4 interface. The storage unit is connected to the FPGA main control unit via an SPI bus. The storage unit includes Nor Flash1, Nor Flash2, and NVSRAM. Nor Flash1 is used to store the FPGA configuration bitstream file, Nor Flash2 is used to store non-volatile data, and NVSRAM is used to cache high-speed data. The clock management unit is an independent crystal clock.

3. The concurrent access architecture for virtualized multi-master sharing according to claim 1, characterized in that, The BIOS firmware is configured to enumerate PCIe hardware devices based on the PCIe bus status of the entire server during the BIOS operation phase, identify the security clock board, and allocate resources to it.

4. The concurrent access architecture for virtualized multi-master sharing according to claim 3, characterized in that, The specific steps for identifying the secure clock board and allocating its resources include: By traversing all hardware devices on the PCIe bus and reading the standard registers with configuration space offsets from 0x00 to 0xFF, the presence of the security clock board is detected. Based on the memory resource requests submitted by the security clock board to the server, the BIOS firmware performs the following resource allocation operations: Allocate the physical address space corresponding to the base address register for the security clock board, record the physical address and capacity, and write the allocation result into the PCIe configuration space for subsequent use by the SCB driver components of the Hypervisor and business virtual machines.

5. The concurrent access architecture for virtualized multi-master sharing according to claim 1, characterized in that, The HyperCall request processor is used to receive resource authorization information transmitted by the driver running on SVM in the kernel driver layer.

6. The concurrent access architecture for virtualized multi-master sharing according to claim 5, characterized in that, The resource authorization information includes various types of information such as physical resource location information, target virtual machine identification information, intermediate physical address allocation information, and access control information.

7. The concurrent access architecture for virtualized multi-master sharing according to claim 5, characterized in that, The centralized management unit is configured to create independent memory slots for each business virtual machine based on the resource authorization information, and to map the physical address space of the security clock board to each memory slot, so that each business virtual machine can directly operate the security clock board by accessing its corresponding memory slot.

8. The concurrent access architecture for virtualized multi-master sharing according to claim 1, characterized in that, The second-stage page table mapping module is used to construct the mapping relationship between the IPA address of each service virtual machine and the physical address of the security clock board, and to set differentiated access permissions.

9. The concurrent access architecture for virtualized multi-master sharing according to claim 1, characterized in that, The SVM driver is configured to obtain the physical address and capacity from the PCIe configuration space through the ACPI resolution interface, and to pass resource authorization information to the virtualization management layer via the HyperCall request processor.

10. The concurrent access architecture for virtualized multi-master sharing according to claim 1, characterized in that, The memory mapping service receives the IOCTL command from the SVM driver and establishes a mapping relationship from physical address to IPA address on the processor core specified by the CMU based on the physical address and capacity of the security clock board.

11. The concurrent access architecture for virtualized multi-master sharing according to claim 10, characterized in that, The steps for constructing the mapping relationship from physical address to IPA address specifically include: The Hypervisor allocates independent IPA address ranges for the ReWorks virtual machine and the RT-Linux virtual machine, respectively, and the IPA address ranges of the ReWorks virtual machine and the RT-Linux virtual machine both point to the same physical address space of the security clock board; The centralized management unit creates an independent memory slot for each business virtual machine. Traverse all page table entries in each memory slot, translate the IPA address of the business virtual machine into a physical address, set the memory attribute of the mapping entry to shared device memory, and establish a mapping relationship from physical address to IPA address.

12. The concurrent access architecture for virtualized multi-master sharing according to claim 11, characterized in that, The memory slot is used to record the IPA base address, the number of mapped pages, the access permission flag, and the memory attributes. The IPA base address is the starting address of the IPA address range.

13. The concurrent access architecture for virtualized multi-master sharing according to claim 11, characterized in that, The memory mapping service supports dynamic remapping. When the system is upgraded or resources are reconfigured, the second-stage page table mapping is updated, and the SCB driver component uses HyperCall to request the processor to obtain the updated IPA address and remap it to a virtual address, thereby achieving zero-modification adaptation of the driver.

14. The concurrent access architecture for virtualized multi-master sharing according to claim 1, characterized in that, The real-time business application is configured to call the SCB driver components of each business virtual machine through the standard driver API interface to perform operations such as reading the counter, reading and writing the NVSRAM, and obtaining information from the security clock board.

15. The concurrent access architecture for virtualized multi-master sharing according to claim 14, characterized in that, The business virtual machines include ReWorks virtual machines and RT-Linux virtual machines.

16. A driving method for a concurrent access architecture of virtualized multi-master sharing, characterized in that, For driving the concurrent access architecture of virtualized multi-master sharing as described in any one of claims 1-15, the following steps are included: The BIOS firmware enumerates devices based on the PCIe bus status of the entire server, identifies the security clock board, allocates resources to it, and writes the allocation results to the PCIe configuration space. SVM loads and runs, obtains the physical address and capacity of the security clock card from the PCIe configuration space through its driver, and calls the SCB driver component according to the IOCTL command to pass the resource authorization information to the virtualization management layer through the HyperCall request processor. Based on the resource authorization information, the Hypervisor allocates SCB card resources to the core specified by the centralized management unit, modifies the DTS device tree files of the ReWorks virtual machine and the RT-Linux virtual machine respectively, and configures the IPA address range to the device nodes of each service virtual machine. The corresponding IPA address is obtained from the DTS device tree file of each service virtual machine through the SCB driver component of each service virtual machine. The Hypervisor's memory mapping service is called to convert the IPA address into a virtual address. The registers and storage areas of the security clock board are directly accessed through the second-stage page table mapping to perform operations such as reading the counter, reading and writing the NVSRAM, and obtaining information from the security clock board. This enables direct hardware sharing and concurrent access to multiple service virtual machines without agent protocol.

17. The driving method for a concurrent access architecture of virtualized multi-master sharing according to claim 16, characterized in that, The SCB card resources include memory slots, physical address space, access permission flags, and IPA address ranges.

Images