Storage device simulation method and apparatus

Abstract

A storage device simulation method and apparatus are provided, the method comprising: registering a virtual storage device to a peripheral component interconnect express (PCIe) root complex; in response to the virtual storage device being registered to the PCIe root complex, performing a scan of at least one PCIe bus to identify the virtual storage device; and in response to a single root input / output virtualization (SR-IOV) enable request for the virtual storage device, establishing at least one virtual function (VF) corresponding to the virtual storage device, wherein the at least one VF is assigned to at least one virtual machine.

Description

Technical Field

[0001] This application relates to storage device simulation, and more specifically, to a storage device simulation method and apparatus. Background Technology

[0002] Existing technologies include virtual storage devices that emulate storage devices. For example, the NVMeVirt solution provides software-defined virtual Non-Volatile Memory Express (NVMe) devices, but these virtual NVMe devices cannot be mapped to virtual machines. In the QEMU solution, virtualized NVMe devices are implemented and can be mapped (or allocated) to VMs, but these virtual NVMe devices do not support Single Root I / O Virtualization (SR-IOV) functionality, and therefore cannot be mapped to multiple virtual machines simultaneously.

[0003] As the cyber threat ecosystem matures, the number of global security attacks continues to rise, making data security and privacy protection issues increasingly prominent. Various forms of confidential computing are emerging, giving rise to a variety of Trusted Execution Environments (TEEs). However, existing virtual storage devices either cannot be mapped to virtual machines or do not support SR-IOV features, thus preventing mapping to multiple virtual machines. This makes it impossible to utilize virtual storage devices to conduct research on virtualized systems under TEEs.

[0004] How to implement a virtual storage device or storage device simulation device suitable for the above research is a problem that urgently needs to be solved in this field. Summary of the Invention

[0005] The purpose of this invention is to provide a storage device emulation method and apparatus to at least solve the problems in the aforementioned related technologies, or to solve none of the aforementioned problems.

[0006] According to one aspect of an exemplary embodiment of the present disclosure, a storage device emulation method is provided, comprising: registering a virtual storage device to a Peripheral Component Rapid Interconnect (PCIe) root complex; in response to the virtual storage device being registered to the PCIe root complex, performing a scan of at least one PCIe bus to identify the virtual storage device; and in response to a Single Root Input / Output Virtualization (SR-IOV) enable request for the virtual storage device, establishing at least one Virtual Function (VF) corresponding to the virtual storage device, wherein the at least one VF is assigned to at least one virtual machine.

[0007] Optionally, the step of registering the virtual storage device to the PCIe root complex includes: registering the virtual storage device to the PCIe root complex by creating a virtual bus corresponding to the virtual storage device using the host's kernel functions.

[0008] Optionally, the method further includes: in response to the virtual storage device being identified, allocating a memory-mapped input / output (MMIO) space and a direct memory access (DMA) space to the virtual storage device, wherein the step of establishing at least one VF includes: allocating MMIO space and DMA space to the at least one VF, and wherein the MMIO space and DMA space allocated to the virtual storage device are independent of the MMIO space and DMA space allocated to the at least one VF.

[0009] Optionally, the step of establishing at least one VF includes: preparing resources for the at least one VF, the resources including at least one of access interface resources, interrupt resources, and storage medium resources.

[0010] Optionally, the step of preparing resources for the at least one VF includes: extracting contiguous flash memory space from a physical storage device; and allocating at least a portion of the extracted contiguous flash memory space to the at least one VF.

[0011] Optionally, the method further includes: in response to a read / write request for the at least one VF, converting an I / O virtual memory address corresponding to data corresponding to the read / write request into a physical memory address; and performing a read / write operation on the data based on the physical memory address.

[0012] Optionally, the step of converting the I / O virtual memory address corresponding to the data corresponding to the read / write request into a physical memory address includes: obtaining an address translation table corresponding to the at least one VF from a register of the Input / Output Memory Management Unit (IOMMU) based on the identifier of the at least one VF, wherein the identifier indicates the bus number, device number, and function number of the at least one VF; and converting the I / O virtual memory address into the physical memory address based on the address translation table.

[0013] Optionally, the step of converting the I / O virtual memory address corresponding to the data corresponding to the read / write request into a physical memory address includes: obtaining an address translation table corresponding to the at least one VF from a register of the Input / Output Memory Management Unit (IOMMU) based on the identifier of the at least one VF and the process address space identifier (PASID) corresponding to the data, wherein the identifier indicates the bus number, device number, and function number of the at least one VF; and converting the I / O virtual memory address into the physical memory address based on the address translation table.

[0014] Optionally, the method further includes: establishing a secure channel between a security core circuit corresponding to the virtual storage device and a host security manager; and controlling the security core circuit and the host security manager to establish a security key for secure communication between the at least one VF and the at least one VM corresponding to the at least one VF through the secure channel.

[0015] Optionally, the method further includes: controlling a security core circuitry corresponding to the virtual storage device to interact with the at least one VF to manage the security information of the at least one VF in real time and / or monitor the status of the at least one VF.

[0016] According to another aspect of exemplary embodiments of the present disclosure, a storage device emulation apparatus is provided, comprising: a memory storing one or more instructions; and at least one processor operatively coupled to the memory, wherein the one or more instructions, when executed by the at least one processor, cause the storage device emulation apparatus to: register the virtual storage device to a Peripheral Component Rapid Interconnect (PCIe) root complex; perform a scan of at least one PCIe bus to identify the virtual storage device in response to the virtual storage device being registered to the PCIe root complex; and establish at least one virtual function (VF) corresponding to the virtual storage device in response to a Single Root Input / Output Virtualization (SR-IOV) enable request for the virtual storage device, wherein the plurality of at least one VFs are assigned to at least one virtual machine.

[0017] Optionally, when the one or more instructions are executed by the at least one processor, the storage device emulation device also causes the virtual storage device to register the virtual storage device to the PCIe root complex by creating a virtual bus corresponding to the virtual storage device using the host's kernel functions.

[0018] Optionally, when the one or more instructions are executed by the at least one processor, the storage device emulation device further causes the storage device to: allocate a memory-mapped input / output (MMIO) space and a direct memory access (DMA) space for the virtual storage device in response to the identification of the virtual storage device; and allocate MMIO space and DMA space for the at least one virtual storage device (VF), wherein the MMIO space and DMA space allocated for the virtual storage device are independent of the MMIO space and DMA space allocated for the at least one VF.

[0019] Optionally, when the one or more instructions are executed by the at least one processor, the storage device also causes the storage device to simulate a device: prepare resources for the at least one VF, the resources including at least one of access interface resources, interrupt resources, and storage medium resources.

[0020] Optionally, when executed by the at least one processor, the one or more instructions further cause the storage device emulation device to: extract contiguous flash memory space from the physical storage device; and allocate at least a portion of the extracted contiguous flash memory space to the at least one VF.

[0021] Optionally, when the one or more instructions are executed by the at least one processor, the storage device emulation device further causes the storage device to: in response to a read / write request for the at least one VF, translate an I / O virtual memory address corresponding to data corresponding to the read / write request into a physical memory address; and perform a read / write operation on the data based on the physical memory address.

[0022] Optionally, when the one or more instructions are executed by the at least one processor, the memory device emulates the following: obtaining an address translation table corresponding to the at least one VF from a register of the Input / Output Memory Management Unit (IOMMU) based on an identifier of the at least one VF, wherein the identifier indicates the bus number, device number, and function number of the at least one VF; and translating the I / O virtual memory address into the physical memory address based on the address translation table.

[0023] Optionally, when the one or more instructions are executed by the at least one processor, the storage device emulates the following: obtaining an address translation table corresponding to the at least one VF from a register of the Input / Output Memory Management Unit (IOMMU) based on the identifier of the at least one VF and the process address space identifier (PASID) corresponding to the data, wherein the identifier indicates the bus number, device number, and function number of the at least one VF; and translating the I / O virtual memory address into the physical memory address based on the address translation table.

[0024] Optionally, when the one or more instructions are executed by the at least one processor, the storage device emulation device further causes the storage device to: establish a secure channel between the security core circuitry corresponding to the virtual storage device and the host security manager; and control the security core circuitry and the host security manager to establish a security key for secure communication between the at least one VF and the at least one VM corresponding to the at least one VF through the secure channel.

[0025] Optionally, when the one or more instructions are executed by the at least one processor, the storage device emulation device also causes the security core circuitry corresponding to the virtual storage device to interact with the at least one VF to manage the security information of the at least one VF in real time and / or monitor the status of the at least one VF.

[0026] According to another aspect of exemplary embodiments of the present disclosure, a computer-readable storage medium storing a computer program is provided, wherein when the computer program is executed by a processor, the processor causes the processor to implement the storage device emulation method as described above.

[0027] The storage device emulation method and apparatus according to the disclosed exemplary embodiments have SR-IOV capability and can be allocated to multiple virtual machines. Furthermore, the virtual storage device implementation method and apparatus according to the disclosed exemplary embodiments can support a TEE I / O security architecture. Attached Figure Description

[0028] The above and other objects and features of the invention will become clearer from the following description taken in conjunction with the accompanying drawings, which exemplarily illustrate exemplary embodiments, wherein: Figure 1 This is a schematic diagram illustrating the SR-IOV architecture; Figure 2 This is a schematic diagram illustrating confidential computing based on Intel Trust Domain Extensions (TDX); Figure 3 This is a flowchart illustrating a method for implementing a virtual storage device according to exemplary embodiments of the present disclosure; Figure 4 This is an overall architecture diagram illustrating a virtual storage device implementation method according to exemplary embodiments of the present disclosure; Figure 5 This is a diagram showing the virtual PCIe bus and physical PCIe bus registered to the Peripheral Component Interconnect Express (PCIe) root complex; Figure 6 This is a diagram illustrating the structure of a virtual storage device module according to an exemplary embodiment of the present disclosure; Figure 7 This is a flowchart illustrating an example of a virtual storage device module installation process according to an exemplary embodiment of the present disclosure.

[0029] Figure 8 This is a flowchart illustrating the operation of the VF controller; Figure 9 This is a comparative diagram illustrating an address translation scheme for a virtual storage device and an address translation scheme for a physical storage device according to exemplary embodiments of the present disclosure; Figure 10This is a schematic diagram illustrating the lookup of the address translation table in coarse-grained mode by a virtual input / output memory management unit (IOMMU) according to an exemplary embodiment of the present disclosure; Figure 11 This is a schematic diagram illustrating a virtual IOMMU looking up an address translation table in fine-grained mode according to an exemplary embodiment of the present disclosure; Figure 12 This is a schematic diagram illustrating an exemplary embodiment of the present disclosure of finding the corresponding Central Processing Unit (CPU) based on an interrupt mapping table; Figure 13 This is a flowchart illustrating operations performed by a storage medium module according to exemplary embodiments of the present disclosure; Figure 14 This is a schematic diagram illustrating the operations performed by a security core module in a virtual storage device module according to an exemplary embodiment of the present disclosure; Figure 15 This is a block diagram illustrating the structure of a virtual storage device implementation apparatus according to exemplary embodiments of the present disclosure; and Figure 16 This is an example computer diagram illustrating an embodiment of the present disclosure. Detailed Implementation

[0030] Hereinafter, various exemplary embodiments of the present disclosure are described with reference to the accompanying drawings, wherein the same reference numerals are used to denote the same or similar elements, features, and structures. However, it is not intended that the present disclosure be limited to the specific exemplary embodiments described herein, but rather that the present disclosure covers all modifications, equivalents, and / or substitutions of the present disclosure, provided they are within the scope of the appended claims and their equivalents. The terms and words used in the following description and claims are not limited to their dictionary meanings, but are used only to enable a clear and consistent understanding of the present disclosure. Therefore, it will be apparent to those skilled in the art that the following description of various exemplary embodiments of the present disclosure is for illustrative purposes only and is not intended to limit the purpose of the present disclosure as defined by the appended claims and their equivalents.

[0031] It should be understood that, unless the context clearly indicates otherwise, the singular form includes the plural form. The terms “comprising,” “including,” and “having” as used herein indicate the presence of a disclosed function, operation, or element, but do not exclude other functions, operations, or elements.

[0032] For example, the expression “A or B” or “at least one of A and / or B” can indicate A and B, or A or B. For example, the expression “A or B” or “at least one of A and / or B” can indicate (1) A, (2) B or (3) both A and B.

[0033] In the various exemplary embodiments of this disclosure, it is intended that when a component (e.g., a first component) is referred to as being "coupled" or "connected" to, or being "coupled" or "connected" to, another component (e.g., a second component), the component may be directly connected to, or may be connected via, another component (e.g., a third component). In contrast, when a component (e.g., a first component) is referred to as being "directly coupled" or "directly connected" to, or being directly coupled to or directly connected to, another component (e.g., a second component), there is no other component (e.g., a third component) between the component and the other component.

[0034] The expression “configured as” used in describing the various exemplary embodiments of this disclosure may be used interchangeably, for example, with expressions such as “suitable for,” “capable of,” “designed for,” “suitable for,” “manufactured as,” and “capable,” depending on the context. The term “configured as” may not necessarily indicate that the hardware is “specifically designed for.” Rather, in some cases, the expression “a device configured as…” may indicate that the device and another device or part are “capable of…”. For example, the expression “a processor configured to perform A, B, and C” may indicate a dedicated processor (e.g., an embedded processor) for performing the respective operations or a general-purpose processor (e.g., a central processing unit CPU or application processor (AP)) for performing the respective operations by executing at least one software program stored in a memory device.

[0035] The terminology used herein is intended to describe certain exemplary embodiments of this disclosure, but is not intended to limit the scope of other exemplary embodiments. Unless otherwise stated herein, all terms used herein (including technical or scientific terms) may have the same meaning as commonly understood by one of ordinary skill in the art. Generally, terms defined in dictionaries should be considered to have the same meaning as in the context of the relevant field, and should not be interpreted differently or as having an overly formal meaning unless expressly defined herein. In no event should the terminology defined in this disclosure be construed as excluding exemplary embodiments of this disclosure.

[0036] As will be understood by those skilled in the art, the term "module" can refer to hardware, software, or a combination of both. For example, a module can be a specific piece of hardware circuitry designed to perform one or more functions. In another example, a module can be a processor operatively coupled to memory, wherein the memory stores one or more instructions that cause the processor to perform one or more functions.

[0037] To facilitate understanding of this disclosure, the relevant concepts involved in this disclosure are described below.

[0038] Figure 1 This is a schematic diagram of the SR-IOV architecture. SR-IOV can provide multiple virtual PCIe interfaces on storage devices with PCIe ports for direct data transfer with multiple TEE Virtual Machines (TVMs) on the host side. SR-IOV enables virtual machines (VMs) to bypass the software switching layer of the hypervisor virtualization stack, achieving relatively high performance (e.g., low latency) and data isolation.

[0039] In traditional virtual computing architectures, virtual machines and storage devices receive and send data to each other through a Virtual Machine Monitor (VMM) (e.g., Hypervior), which introduces a certain data transmission latency. (See reference...) Figure 1 For the SR-IOV architecture, SR-IOV provides multiple virtual PCIe functions on a single physical PCIe function. Each virtual PCIe function can serve as an independent PCIe storage device to provide data services to host applications.

[0040] As the cyber threat ecosystem matures, the number of global security attacks continues to rise. Data security and privacy protection issues are becoming increasingly prominent. Confidential computing can be used to address these issues.

[0041] Figure 2 This is a schematic diagram illustrating confidential computing based on Intel TDX.

[0042] Reference Figure 2Confidential computing may involve TVM 210, VMM 220, host kernel 230, and TEE I / O devices 240. To isolate TVM 210s (e.g., TVM1, TVM2, and TVMn) from each other, a separate TEE Device Interface (TDI) needs to be provided for the TEE I / O devices 240. For PCIe devices that do not support TEE I / O, the TVM implements I / O virtualization through the interface provided by VMM 220, which can be implemented by the host kernel 230. Alternatively, for PCIe devices that support TEE I / O, the SR-IOV function can be used to create a VF to achieve isolated TDIs.

[0043] As mentioned above, storage devices are an indispensable part of confidential computing, responsible for ensuring the security of data at rest. Currently, there are no physical solid-state drives (SSDs) or virtual SSDs that support TEE I / O, making it impossible to conduct security research on the complete data stack in confidential computing.

[0044] This disclosure presents a storage device simulation method and apparatus for supporting research on multi-VM systems under TEE.

[0045] Figure 3 This is a flowchart illustrating a storage device emulation method according to an exemplary embodiment of the present disclosure.

[0046] As an example, the storage device described in this article may be an SSD or other type of storage device.

[0047] Reference Figure 3 In step S310, the virtual storage device is registered to the PCIe Root Complex (RC). In one or more examples, the RC can be the root of the PCIe topology, serving as the interface between the CPU / memory subsystem and the PCIe switching architecture. The RC can act as a host bridge connecting peripherals such as NVMe drives or GPUs to the processor to manage device enumeration, configuration, and data traffic.

[0048] The RC is the core control unit in the entire PCIe system architecture, responsible for coordinating and managing the communication between the CPU, memory, and PCIe devices.

[0049] As an example, the functions that RC performs may include: 1) Address space allocation The RC (Registry Controller) is responsible for allocating and managing address space for PCIe devices. For example, the RC can allocate a segment of system memory addresses to each PCIe device. It can also map the device's configuration space addresses (e.g., register addresses) into the CPU's address space.

[0050] 2) Address translation and routing When the CPU accesses a PCIe device via read / write operations, the RC (Responsible Controller) can translate the memory address or configuration address issued by the CPU into the address format used by the PCIe bus. The RC can then encapsulate these read / write requests into PCIe frames and send them to the corresponding PCIe device. Furthermore, the RC can convert data returned from the PCIe device back into a format that the CPU can recognize and write it into system memory.

[0051] 3) Address mapping table maintenance The RC maintains an address mapping table that records the correspondence between the memory addresses and configuration addresses of PCIe devices and their corresponding CPU address spaces. When a PCIe device is added to or removed from the system, this mapping table is dynamically updated to ensure the accuracy and consistency of the address mapping.

[0052] 4) Equipment Management and Configuration It participates in the configuration and management of PCIe devices. During system initialization and device configuration, the RC can send configuration data to the PCIe device through configuration write operations to complete the device initialization and configuration.

[0053] As an example, the step of registering the virtual storage device to the PCIe root complex may include: registering the virtual storage device to the PCIe root complex by creating a virtual bus corresponding to the virtual storage device using the host's kernel functions.

[0054] As an example, a virtual bus can be created using standard kernel functions of the host (e.g., the CPU), to which virtual storage devices are attached: As an example, a virtual bus can be created based on standard kernel functions as follows: #define NVMEV_PCI_BUS_NUM 0x10bus = pci_scan_bus(NVMEV_PCI_BUS_NUM,&nvmev_pci_ops,&nvmev_pci_sysdata).

[0055] As an example, Figure 3The method may further include: in response to the identification of the virtual storage device, allocating memory-mapped I / O (MMIO) space and direct memory access (DMA) space to the virtual storage device.

[0056] As those skilled in the art will understand, each PCIe device has a PCIe configuration space (e.g., a set of registers). Upon system power-up, system software allocates system memory space for the PCIe device based on information from the PCIe configuration space (e.g., information from the base address register) and writes the allocated base address to the base address register. During PCIe initialization and enumeration, the specific values ​​of the BDFs (e.g., Bus Number, Device Number, and Function Number) are determined by an enumeration process performed by configuration software (e.g., system firmware, BIOS, or operating system). This process aims to discover all connected PCIe devices in the system, establish their topology, and allocate necessary resources. Bus numbers are assigned sequentially according to the order in which buses are discovered, ensuring that each bus has a unique identifier. Device number allocation is performed on a per-bus basis. For each bus with an assigned bus number, the enumeration software attempts to traverse all possible device numbers (e.g., 0 to 31). The existence of a device can be detected by attempting to read the Vendor ID and Device ID registers for Function 0 on each device number. If a valid Vendor ID is read, it indicates that a device exists for that device number.

[0057] In one or more examples, the function number is determined differently from the bus number and device number. It is not assigned by enumeration software, but is an inherent attribute of the device's internal design and implementation.

[0058] Since virtual storage devices do not have PCIe configuration space, parameters related to the virtual storage device can be set when creating a virtual bus corresponding to the virtual storage device. After the virtual storage device is identified based on bus scanning, memory-mapped input / output (MMIO) space and direct memory access (DMA) space can be allocated to the virtual storage device based on the parameters.

[0059] Furthermore, the BDF of a virtual storage device can be set when the virtual bus is created. For example, the BDF of a virtual storage device is determined differently than that of a real PCIe device; it can be set via software or kernel functions.

[0060] In step S320, in response to the virtual storage device being registered to the PCIe root complex, a PCIe bus scan (or a scan of at least one PCIe bus) is performed to identify the virtual storage device.

[0061] As an example, the PCIe bus registered to the PCIe root complex can be scanned based on the virtual PCIe bus being registered to the PCIe root complex.

[0062] It will be understood that recognizing the virtual storage device only indicates that a newly connected PCIe device has been identified, and does not indicate that the virtual storage device can be identified as virtual. For example, the host or root complex may assume that a real PCIe device has been identified and may not know whether the detected PCIe is virtual.

[0063] In one or more examples, since the host only performs a PCIe bus scan when the system is powered on, triggering a PCIe bus scan allows the host to promptly identify the virtual storage device. As an example, based on the installation of the virtual storage device module, a virtual Peripheral Component Interconnect Express (PCIe) bus can be registered to the PCIe root complex, wherein the virtual PCIe bus corresponds to the virtual storage device module.

[0064] According to exemplary embodiments of this disclosure, a virtual storage device module is installed on a host, and the installed virtual storage device module implements the functions of a virtual storage device. Therefore, the virtual storage device module and the virtual storage device described herein may have the same or similar meanings and can be used interchangeably.

[0065] In step S330, in response to the Single Root Input / Output Virtualization (SR-IOV) Enable Request for the virtual storage device, a plurality of Virtual Functions (VFs) (or at least one VF) corresponding to the virtual storage device are established, wherein the plurality of VFs (or at least one VF) are respectively assigned to a plurality of virtual machines (or assigned to at least one virtual machine).

[0066] Figure 4 This is an overall architecture diagram illustrating a virtual storage device implementation method according to exemplary embodiments of the present disclosure. According to exemplary embodiments of the present disclosure, the virtual storage device described herein may refer to a virtual SSD, a virtual NVMe storage device, a virtual SR-IOV NVMe device (e.g., virtual SR-IOV NVMe device 460), a virtual NVMe SSD, a virtual SR-IOV storage device, etc.

[0067] Reference Figure 4A physical PCIe device 450 (hereinafter referred to as a physical storage device) and a virtual SR-IOV NVMe device 460 (hereinafter referred to as a virtual SR-IOV storage device) can be registered to the PCIe root complex 440. The physical storage device can be assigned to, for example, VM1, and can be driven by the driver of VM1. The physical function (PF) of the virtual SR-IOV storage device 460 can be driven by the driver of the kernel 430. Virtual SR-IOV storage devices such as VF2 and VFn can be assigned to, for example, VM2 and VMn respectively, and can be driven by the drivers of VM2 and VMn respectively.

[0068] As those skilled in the art will understand, a PF can be a PCI function used to support SR-IOV functionality, and each PF can be discovered and managed by a physical host. A PF contains an SR-IOV functionality architecture for managing SR-IOV functionality.

[0069] In one or more examples, a PF can have fully configured resources that can be used to configure or control PCIe devices. All PF resources can be directly accessed through the PF driver on the physical host, and all VFs can be configured, such as setting the number of VFs and globally starting or stopping them.

[0070] A Virtual Function (VF) can be a function virtualized by a Power Function (PF). A VF can be a lightweight PCIe function, possessing only configuration resources for its own behavior. One or more VFs share a single PF, and their drivers can be installed on a virtual machine. Once a VF is assigned to a virtual machine, the machine can initialize and configure it as if it were a regular PCIe device. Each SR-IOV device can have one PF. A PF can create VFs using registers designed with attributes specifically for this purpose. As long as SR-IOV is enabled in the PF, the PCI configuration space of each VF can be accessed through the PF's Base Functions (BDF). Each VF has a PCI memory space used to map its register set. After VF creation, it can be directly assigned to various applications.

[0071] It will be understood that, in contrast to a VF created for a physical PCIe storage device, a VF created herein for a virtual storage device may be referred to as or indicate a simulated VF. For example, this application creates a simulated VF via software, whereas for a physical PCIe device, the VF is created by the PCIe device itself.

[0072] As an example, the steps of establishing multiple VFs include: allocating MMIO space and DMA space for each of the multiple VFs (or for at least one VF), wherein the MMIO space and DMA space allocated for the virtual storage device are independent of the MMIO space and DMA space allocated for the multiple VFs (or at least one VF).

[0073] Figure 5 This is a diagram showing the virtual PCIe bus and the physical PCIe bus registered to the PCIe root complex 510.

[0074] Those skilled in the art will understand that when a host performs a bus scan, the host does not know whether the scanned bus is a physical PCIe bus or a virtual PCIe bus. For example, when a host scans a bus, it can only determine that there is a PCIe device connected to that bus, but it cannot determine whether the scanned bus is a real PCIe device (e.g., a real SSD 520) or a virtual PCIe device (e.g., a virtual SR-IOV SSD 530).

[0075] Figure 6 This is a diagram illustrating the structure of a virtual storage device module according to an exemplary embodiment of the present disclosure.

[0076] Reference Figure 6 The virtual SR-IOV device module 630 (hereinafter referred to as a virtual storage device or virtual storage device module) may include a virtual device interface module 631, an interrupt manager 632, a VF controller 633, a security core module 634, a virtual input / output memory management unit (IOMMU) module 635, and a storage medium module 636.

[0077] As an example, the virtual device interface module 631 can be used to determine the PCIe space corresponding to the virtual storage device. The PCIe space may refer to the address space used by the virtual storage device in the system, which may include configuration space and memory and / or I / O space (e.g., MMIO space and DMA space).

[0078] As an example, for a real PCIe device, the Linux kernel can determine whether the storage device supports SR-IOV by accessing the storage device's PCIe configuration space. For example, each PCIe device can have a fixed configuration space of 256 bytes for the storage device's metadata (such as vendor ID, device ID, supported capabilities, etc.). PCIe memory and / or I / O space (e.g., MMIO space and DMA space) can be used for data exchange between the virtual storage device and the host. After the virtual storage device module is initialized, it can obtain its independent VF space from the device's PCIe space and provide an access interface to the host (e.g., kernel 620). The VF space is a subset of the PCIe space; each VF has its own independent configuration space and memory and / or I / O space, representing an independent physical device, and can be directly used by the virtual machine.

[0079] As an example, a virtual storage device module or a virtual storage device can be installed on a Linux system. During the installation process, a virtual PCIe bus can be registered to the PCIe root complex, and a virtual storage device can be connected to this virtual PCIe bus. For example, a virtual storage device or a virtual storage device module corresponds to a virtual PCIe bus.

[0080] For example, virtual PCIe bus registration can be completed through the interface of the PCI subsystem already implemented in kernel 620.

[0081] As an example, the installation of a virtual storage device module can trigger (e.g., through the device discovery function of the virtual device interface module 631) the Linux PCIe driver to rescan the PCIe bus, and then the PCIe driver can scan the virtual PCIe bus as if it were a physical PCIe bus.

[0082] As an example, the scan operation can be triggered based on the registration of the virtual PCIe bus.

[0083] As an example, the scan operation can be triggered during the installation of the virtual storage device module after the virtual PCIe bus is registered to the PCIe root complex.

[0084] As an example, after detecting a virtual storage device, the Linux driver checks the virtual storage device's capabilities. As mentioned above, the virtual device interface module allows the host (e.g., kernel 620) to know the capabilities of the virtual storage device, such as whether it supports SR-IOV.

[0085] As an example, based on scanning the virtual PCIe bus, multiple VFs of virtual storage devices implemented through the virtual storage device module can be assigned to multiple virtual machines 610 (e.g., VM-1, VM-2, and VM-n).

[0086] As an example, if the host is aware that the virtual storage device has SR-IOV capability and includes multiple VFs, a PICe device instance can be assigned to each VF. For example, different VFs can be assigned to different virtual machines or different upper-layer applications.

[0087] As an example, it can be determined that the virtual storage device supports Single Root Input / Output Virtualization (SR-IOV) based on scanning the virtual PCIe bus.

[0088] As an example, the steps of establishing the plurality of VFs may include: preparing resources for each of the plurality of VFs, the resources including access interface resources, interrupt resources, and storage medium resources.

[0089] As an example, accessing interface resources can indicate the Base Address Register (BAR) space and the MMIO space.

[0090] As an example, storage media resources can be allocated to each VF via storage media module 636.

[0091] As an example, storage medium module 636 can allocate storage space, such as DRAM and / or SSD, to VF.

[0092] In addition, the VF controller 633 will be referenced later. Figure 8 A detailed description will be provided later; Security Core Module 634 will be referenced. Figure 14 Provide a detailed description.

[0093] Figure 7 This is a flowchart illustrating an example of a virtual storage device module installation process according to an exemplary embodiment of the present disclosure.

[0094] In step S710, the virtual storage device module is installed.

[0095] As an example, during the installation of a virtual storage device module, the virtual PCI bus corresponding to the virtual storage device module can be registered to the original root complex.

[0096] In step S720, the Linux kernel is triggered to begin the PCIe bus scanning process.

[0097] In step S730, when a virtual PCIe bus is detected, it is determined that a PCIe device exists.

[0098] In step S740, it is determined that the PCIe device has SR-IOV capability.

[0099] In step S750, the SR-IOV function is enabled to create multiple VFs through the virtual storage device module.

[0100] As an example, the VF controller in the virtual storage device module can implement generic storage device firmware to receive and process NVMe commands from the host, which may include management commands and I / O commands.

[0101] Figure 8 This is a flowchart illustrating the operation of the VF controller.

[0102] In step ①, VF controller 820 (and Figure 6 The VF controller 633 in the VF controller can simulate a management queue to receive management commands from the VM and simulate multiple I / O queues to receive I / O commands.

[0103] In step ②, the Administrator worker 821 or thread and the I / O worker 822 or thread are respectively responsible for checking the corresponding queues, processing the NVMe commands in the submission queue, and writing the command response back to the completion queue.

[0104] As an example, a completion queue is a data structure that the storage controller sends back to the host after processing the I / O request submitted by the host. Each completion queue can consist of multiple completion queue entries, which contain information such as command status, data transfer length, and error code.

[0105] In step ③, the I / O command corresponding to the data access will be sent to the storage medium module 840 for further data reading / writing.

[0106] In step ④, after the command is processed and the response is written back to the completion queue, the worker (e.g., management worker 821 and / or I / O worker 822) may notify the interrupt trigger module 823 to send an interrupt signal to the virtual machine 810.

[0107] In step ⑤, the interrupt trigger module 823 determines the CPU configured by the virtual machine 810 to handle interrupts so that an interrupt signal is sent to that CPU.

[0108] As an example, the interrupt trigger module 823 can determine the CPU configured to handle interrupts through interaction with the interrupt manager 830. As an example, Figure 3 The method further includes: based on the receipt of a read / write request for the VF, converting the I / O virtual memory address corresponding to the data corresponding to the read / write request into a physical memory address; and performing the read / write of the data based on the physical memory address.

[0109] Since the I / O virtual memory addresses used by PCIe storage devices cannot be directly used by the host, it is necessary to translate the I / O virtual memory addresses corresponding to the data into physical memory addresses in order to perform data read and write operations.

[0110] When a PCIe storage device or its VF initiates a read / write request, the IOMMU can receive the Transaction Layer Packet (TLP) sent by the device, parse out the device information, such as the BDF (Bus, Device, Function), and then find the corresponding address translation table based on this information to translate the I / O virtual memory address into a physical memory address. The BDF indicates the bus number, device number, and function number of the VF.

[0111] However, since software-generated TLPs are relatively difficult to simulate, simulating a TLP and sending it to the IOMMU for address translation will reduce simulation performance.

[0112] As an example, the step of converting the I / O virtual memory address corresponding to the data corresponding to the read / write request into a physical memory address includes: determining an address translation table corresponding to the VF from a register of the Input / Output Memory Management Unit (IOMMU) based on the VF's identifier, wherein the identifier indicates the VF's bus number, device number, and function number; and converting the I / O virtual memory address into the physical memory address based on the address translation table.

[0113] As an example, the step of converting the I / O virtual memory address corresponding to the data corresponding to the read / write request into a physical memory address includes: obtaining an address translation table corresponding to the VF from a register of the Input / Output Memory Management Unit (IOMMU) based on the VF's identifier and the process address space identifier PASID corresponding to the data, wherein the identifier indicates the VF's bus number, device number, and function number; and converting the I / O virtual memory address into the physical memory address based on the address translation table.

[0114] This disclosure is based on the virtual IOMMU module in the virtual memory device module. It obtains the index information of the address translation table from the register of the IOMMU, finds the corresponding address translation table according to the information of the virtual memory device or VF and the index information, and performs address translation based on the found address translation table, thereby avoiding the simulation of TLP.

[0115] Figure 9A comparative diagram is shown of an address translation scheme for a virtual storage device (e.g., a virtual SSD) and an address translation scheme for a physical storage device (e.g., a real or physical SSD) according to exemplary embodiments of the present disclosure.

[0116] For ease of explanation, Figure 9 This disclosure is described using physical SSDs and virtual SSDs as examples. Those skilled in the art will understand that SSDs are merely examples and do not limit this disclosure.

[0117] Reference Figure 9 For the real SSD 910, the TLP generated by the real SSD 910 is sent to the IOMMU 920 to complete the address translation. For the virtual SSD 940, the virtual SSD 940 does not emulate the TLP, but instead emulates simplified storage device information (e.g., BDF), and uses this information to retrieve the corresponding address translation table from the registers of the IOMMU 920 to complete the address translation (e.g., through the virtual IOMMU of the virtual SSD 940).

[0118] According to exemplary embodiments of this disclosure, the virtual IOMMU may employ a coarse-grained address translation mode or a fine-grained address translation mode, which may correspond to the conventional mode and extended mode of the IOMMU, respectively.

[0119] Figure 10 This is a schematic diagram illustrating the virtual IOMMU looking up the address translation table in coarse-grained mode.

[0120] In step 1001, when the virtual machines (e.g., VM 1, VM 2, and VM N) in host 1010 start, each virtual machine establishes its own address translation table or address mapping table and writes the basic information of the address translation table or address mapping table into the register of IOMMU 1020.

[0121] In step 1002, after receiving a read / write request, the virtual storage device calls the virtual IOMMU module to obtain the starting position of the root index table of the address translation table from the registers in IOMMU1020.

[0122] In step 1003, the auxiliary index table in memory 1030 is searched according to the bus number of the virtual storage device.

[0123] In step 1004, the address translation table is looked up based on the device number and function number of the virtual storage device.

[0124] Then, the translation from I / O virtual memory address to physical memory address can be completed based on the found address translation table.

[0125] As described above, in coarse-grained mode, the virtual IOMMU module looks up the address translation table from the IOMMU registers based solely on the VF's identifier (e.g., BDF).

[0126] According to exemplary embodiments of this disclosure, in addition to using BDF, the fine-grained mode also uses Process Address Space Identifier (PASID) to look up the address translation table from the IOMMU registers. PASID is used to distinguish different processes or contexts within the same device function, supporting finer-grained resource management and sharing. Furthermore, PASIDs between different functions are independent of each other. In fine-grained mode, the address translation table lookup path changes, adding a layer of PASID index table. For example, two address translation tables for two processes within the same device can be found, and address translation is then performed based on the found address translation tables.

[0127] Figure 11 This is a schematic diagram illustrating the virtual IOMMU looking up the address translation table in fine-grained mode.

[0128] Reference Figure 11 In step 1101, when the virtual machines (e.g., VM 1, VM 2, and VM N) in host 1110 start up, each virtual machine establishes its own address mapping table or address translation table and writes the basic information of the address mapping table or address translation table into the register of IOMMU 1120.

[0129] In step 1102, after receiving a read / write request, the virtual storage device calls the virtual IOMMU module to obtain the starting position of the root index table of the address translation table from the registers in the IOMMU.

[0130] In step 1103, the auxiliary index table in memory 1130 is searched according to the bus number of the virtual storage device.

[0131] In step 1104, the PASID directory is searched based on the device number and function number of the virtual storage device.

[0132] In step 1105, the PASID table is searched based on the entries in the found PASID directory.

[0133] In step 1106, the address translation table is looked up based on the found PASID.

[0134] Then, address translation can be completed based on the found address translation table.

[0135] As described above, the address translation method according to exemplary embodiments of the present disclosure requires only BDF or both BDF and PASID, without simulating complex TLP, thereby improving the performance of the virtual storage device.

[0136] As an example, the interrupt manager in the virtual memory device module stores the interrupt vector information of the VF.

[0137] As an example, interrupt vector information can be stored by constructing an interrupt mapping table, which enables fast lookup of interrupt vectors and target CPUs.

[0138] Figure 12 This is a schematic diagram illustrating an interrupt mapping table-based lookup of the appropriate CPU according to an exemplary embodiment of the present disclosure.

[0139] Reference Figure 12 Upon receiving an interrupt query request from worker 1210 (e.g., a management worker or an I / O worker), interrupt manager 1220 first locates the interrupt mapping table for the specified VF. Then, based on the interrupt mapping table of the specified VF, it determines the CPU that will handle the interrupt.

[0140] In addition, after determining the CPU that will handle the interrupt, the interrupt can be sent to that CPU via an interrupt trigger.

[0141] As an example, the step of preparing resources for each of the plurality of VFs includes: extracting contiguous flash memory space from a physical storage device and allocating at least a portion of the extracted memory space to each VF.

[0142] Figure 13 This is a flowchart illustrating the operations performed by a storage medium module according to an exemplary embodiment of the present disclosure.

[0143] Reference Figure 13 The storage media module (e.g., storage media module 636 or storage media module 940 mentioned above) can extract continuous flash memory space from DRAM 1310 and / or physical SSD 1320 or a combination thereof, and can allocate a portion of the storage space to each VF.

[0144] According to embodiments of this disclosure, upon receiving a command for a physical storage device, the host invokes hardware to generate a Time Limiting Flow (TLP) to transmit the command to the physical storage device, which then returns data. Upon receiving a command for a virtual storage device, the host processes the command using a simulated Virtual Function (VF) and returns corresponding information. The simulated VF does not require hardware intervention; its corresponding Base Formatting Flow (BDF) is stored in the default configuration of the simulated VF or the VF simulator.

[0145] As an example, Figure 3The method further includes: establishing a secure channel between a security core unit or security core circuit (or module) corresponding to the virtual storage device and a host security manager; and controlling the security core unit and the host security manager to establish a security key for secure communication between the VF and the virtual machine VM corresponding to the VF through the secure channel.

[0146] As an example, the method is executed by the host, and the virtual storage device module includes the security core unit (or module).

[0147] As an example, Figure 3 The method shown may further include: controlling a security core unit corresponding to the virtual storage device to interact with the VF to manage the security information of the VF and / or monitor the status of the VF in real time.

[0148] As an example, the virtual storage device module includes a security core unit (or module) and a communication layer.

[0149] As an example, the security core unit (or module) can be controlled to interact with the VF through the communication layer to manage the security information of the VF and / or monitor the status of the VF in real time.

[0150] Figure 14 This is a schematic diagram illustrating the operations performed by the security core unit (or module) in the virtual storage device module.

[0151] Reference Figure 14 The security core unit (or module) 1423 can securely interact with other external security managers. It supports many mainstream security protocols, such as SPDM and Cerberus, and currently supports many encryption algorithms, such as ECC256 and RSA256. Furthermore, a secure channel can be established between the security core unit (or module) 1423 and the host security manager 1410. Through this channel, the security core unit (or module) 1423 and the host security manager 1410 can set security keys between VF 1421 and VM 1430 to achieve secure communication between VF 1421 and VM 1430, thereby protecting the security and integrity of message exchanges. In addition, the security core unit (or module) 1423 can also interact with VF 1421 in the virtual storage device module 1420 through the communication layer 1422 in the virtual storage device module 1420, thereby managing the security information of VF 1421 and / or monitoring the status of VF 1421 in real time.

[0152] As described above, the virtual storage device according to exemplary embodiments of the present disclosure can support testing in a variety of security environments.

[0153] Reference above Figures 1 to 14 A method for implementing a virtual storage device according to exemplary embodiments of the present disclosure has been described, and reference is made below. Figure 15 An implementation apparatus for a virtual storage device according to exemplary embodiments of the present disclosure will be described.

[0154] Figure 15 This is a block diagram illustrating the structure of a virtual storage device according to an exemplary embodiment of the present disclosure.

[0155] Reference Figure 15 The storage device emulation device 1500 may include a registration unit 1510, a scanning unit 1520, and an allocation unit 1530. Those skilled in the art will understand that the storage device emulation device 1500 may additionally include other components, and at least one of the components included in the storage device emulation device 1500 may be split or combined.

[0156] As an example, registration unit 1510 can be configured to register the virtual storage device to the Peripheral Component Fast Interconnect PCIe Root Complex.

[0157] As an example, the scanning identification unit 1520 may be configured to perform a PCIe bus scan to identify the virtual storage device in response to the virtual storage device being registered to the PCIe root complex.

[0158] As an example, the Virtual Function (VF) creation unit 1530 may be configured to create multiple VFs corresponding to the virtual storage device in response to a Single Root Input / Output Virtualization (SR-IOV) enable request for the virtual storage device, wherein the multiple VFs are respectively assigned to multiple virtual machines.

[0159] As an example, registration unit 1510 can be configured to register the virtual storage device to the PCIe root complex by using the host's kernel functions to create a virtual bus corresponding to the virtual storage device.

[0160] As an example, the VF establishment unit 1530 may be configured to: allocate a memory-mapped input / output (MMIO) space and a direct memory access (DMA) space for the virtual storage device in response to the identification of the virtual storage device; and allocate an MMIO space and a DMA space for each of the plurality of VFs, wherein the MMIO space and DMA space allocated for the virtual storage device are independent of the MMIO space and DMA space allocated for the plurality of VFs.

[0161] As an example, VF establishment unit 1530 may be configured to prepare resources for each of the plurality of VFs, the resources including access interface resources, interrupt resources and storage medium resources.

[0162] As an example, VF creation unit 1530 may be configured to: extract contiguous flash memory space from a physical storage device; and allocate at least a portion of the extracted memory space to each VF.

[0163] As an example, the storage device emulation device 1500 may further include: a conversion unit configured to convert an I / O virtual memory address corresponding to data corresponding to the read / write request into a physical memory address in response to a read / write request for the VF; and a read / write unit configured to perform read / write operations on the data based on the physical memory address.

[0164] As an example, the translation unit may be configured to: obtain an address translation table corresponding to the VF from a register of the Input / Output Memory Management Unit (IOMMU) based on the VF's identifier, wherein the identifier indicates the VF's bus number, device number, and function number; and translate the I / O virtual memory address into the physical memory address based on the address translation table.

[0165] As an example, the translation unit may be configured to: obtain an address translation table corresponding to the VF from the register of the Input / Output Memory Management Unit (IOMMU) based on the VF's identifier and the process address space identifier (PASID) corresponding to the data, wherein the identifier indicates the VF's bus number, device number, and function number; and translate the I / O virtual memory address into the physical memory address based on the address translation table.

[0166] As an example, the storage device emulation device 1500 may further include: a control unit configured to establish a secure channel between a security core unit corresponding to the virtual storage device and a host security manager; and to control the security core unit and the host security manager to establish a security key for secure communication between the VF and the virtual machine VM corresponding to the VF through the secure channel.

[0167] As an example, the storage device emulation device 1500 may further include: a control unit configured to control a security core unit corresponding to the virtual storage device to interact with the VF to manage the security information of the VF in real time and / or monitor the status of the VF.

[0168] According to exemplary embodiments of the present disclosure, an electronic device is provided, including: a memory for storing computer-readable instructions; and a processor configured to execute the computer-readable instructions to perform the storage device emulation method as described herein.

[0169] According to exemplary embodiments of the present disclosure, a computer-readable storage medium storing instructions may also be provided, wherein when the instructions are executed by at least one processor, the at least one processor causes the at least one processor to perform a virtual storage device implementation method according to exemplary embodiments of the present disclosure. Examples of computer-readable storage media herein include: read-only memory (ROM), random access programmable read-only memory (PROM), electrically erasable programmable read-only memory (EEPROM), random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), flash memory, non-volatile memory, CD-ROM, CD-R, CD+R, CD-RW, CD+RW, DVD-ROM, DVD-R, DVD+R, DVD-RW, DVD+RW, DVD-RAM, BD-ROM, BD-R, BD-R LTH, BD-RE, Blu-ray or optical disc storage, hard disk drive (HDD), solid-state drive (SSD), card storage (such as multimedia cards, secure digital (SD) cards, or ultra-fast digital (XD) cards), magnetic tape, floppy disk, magneto-optical data storage device, optical data storage device, hard disk, solid-state drive, and any other device configured to store a computer program and any associated data, data files, and data structures in a non-transitory manner and to provide the computer program and any associated data, data files, and data structures to a processor or computer so that the processor or computer can execute the computer program. The computer program in the aforementioned computer-readable storage medium can run in an environment deployed in computer devices such as clients, hosts, agent devices, servers, etc. Furthermore, in one example, the computer program and any associated data, data files, and data structures are distributed across a networked computer system, such that the computer program and any associated data, data files, and data structures are stored, accessed, and executed in a distributed manner through one or more processors or computers.

[0170] According to exemplary embodiments of the present disclosure, a computer program product may also be provided, wherein the instructions in the computer program product are executable by a processor of a computer device to perform the storage device emulation method described herein.

[0171] Figure 16 It is a device (such as, Figure 15 A block diagram of example components of the device shown. Figure 16 As shown, device 1600 may include: bus 1610, processor 1620, memory 1630, storage component 1640, input component 1650, output component 1660, and communication interface 1670. In one or more examples, these components may be used to implement storage device emulation device 1500 (or virtual SR-IOV device module 630).

[0172] Bus 1610 includes components that allow communication between components of device 1600. Processor 1620 is implemented in hardware, firmware, or a combination of hardware and software. Processor 1620 is a central processing unit (CPU), graphics processing unit (GPU), accelerated processing unit (APU), microprocessor, microcontroller, digital signal processor (DSP), field-programmable gate array (FPGA), application-specific integrated circuit (ASIC), or other type of processing component. In some embodiments, processor 1620 includes one or more processors capable of being programmed to perform functions. Memory 1630 includes random access memory (RAM), read-only memory (ROM), and / or another type of dynamic or static storage device (e.g., flash memory, magnetic storage, and / or optical storage) that stores information and / or instructions for use by processor 1620.

[0173] Storage component 1640 stores information and / or software related to the operation and use of device 1600. For example, storage component 1640 may include hard disks (e.g., magnetic disks, optical disks, magneto-optical disks, and / or solid-state disks), compact discs (CDs), digital versatile discs (DVDs), floppy disks, cassette tapes, magnetic tapes, and / or other types of non-transitory computer-readable media and corresponding drives.

[0174] Input component 1650 includes components that allow device 1600 to receive information, such as via user input (e.g., a touchscreen display, keyboard, keypad, mouse, buttons, switches, and / or microphone). Additionally or optionally, input component 1650 may include sensors for sensing information (e.g., a Global Positioning System (GPS) component, accelerometer, gyroscope, and / or actuator). Output component 1660 includes components that provide output information from device 1600 (e.g., a display, speaker, and / or one or more light-emitting diodes (LEDs)).

[0175] Communication interface 1670 includes components such as a transceiver (e.g., a transceiver and / or separate receiver and transmitter) that enable device 1600 to communicate with other devices, such as via a wired connection, a wireless connection, or a combination of wired and wireless connections. Communication interface 1670 may allow device 1600 to receive information from and / or provide information to another device. For example, communication interface 1670 may include an Ethernet interface, an optical interface, a coaxial interface, an infrared interface, a radio frequency (RF) interface, a universal serial bus (USB) interface, a Wi-Fi interface, a cellular network interface, etc.

[0176] Apparatus 1600 may perform one or more of the processes described herein. Apparatus 1600 may perform these processes in response to processor 1620 executing software instructions stored in a non-transitory computer-readable medium, such as memory 1630 and / or storage component 1640. Computer-readable medium is defined herein as a non-transitory memory device. A memory device includes storage space within a single physical storage device or storage space distributed across multiple physical storage devices.

[0177] Software instructions can be read into memory 1630 and / or storage component 1640 via communication interface 1670 from another computer-readable medium or from another device. When executed, the software instructions stored in memory 1630 and / or storage component 1640 can cause processor 1620 to perform one or more processes described herein. Alternatively or additionally, hardwired circuitry may be used in place of or in combination with software instructions to perform one or more processes described herein. Therefore, the embodiments described herein are not limited to any particular combination of hardware circuitry and software.

[0178] Figure 16 The number and arrangement of components shown are provided as an example. In practice, with... Figure 16 Compared to the components shown, device 1600 may have more components, fewer components, different components, or components arranged differently. Additionally or alternatively, a group of components of device 1600 (e.g., one or more components) may perform one or more functions described as being performed by another group of components of device 1600.

[0179] While various aspects of the embodiments have been specifically shown and described, it will be understood that various changes in form and detail may be made without departing from the spirit and scope of the appended claims.

Claims

1. A method for simulating a storage device, comprising: Register the virtual storage device to the Peripheral Component Rapid Interconnect PCIe root complex; In response to the virtual storage device being registered to the PCIe root complex, a scan of at least one PCIe bus is performed to identify the virtual storage device; as well as In response to a Single Root Input / Output Virtualization (SR-IOV) enable request for the virtual storage device, at least one Virtual Function (VF) corresponding to the virtual storage device is established, wherein the at least one VF is assigned to at least one virtual machine.

2. The method as described in claim 1, wherein, The steps of registering the virtual storage device to the PCIe root complex include: The virtual storage device is registered to the PCIe root complex by using the host's kernel functions to create a virtual bus corresponding to the virtual storage device.

3. The method of claim 1, further comprising: In response to the virtual storage device being identified, a memory-mapped input / output (MMIO) space and a direct memory access (DMA) space are allocated to the virtual storage device. The step of establishing at least one VF includes: allocating MMIO space and DMA space for the at least one VF, and The MMIO space and DMA space allocated for the virtual storage device are independent of the MMIO space and DMA space allocated for the at least one VFVF.

4. The method of claim 1, wherein, The steps to establish at least one VF include: Prepare resources for the at least one VF, the resources including at least one of access interface resources, interrupt resources, and storage medium resources.

5. The method of claim 4, wherein, The steps for preparing resources for the at least one VF include: Extracting contiguous flash memory space from a physical storage device; and At least a portion of the extracted contiguous flash memory space is allocated to the at least one VF.

6. The method of claim 1, further comprising: In response to a read / write request for the at least one VF, the I / O virtual memory address corresponding to the data corresponding to the read / write request is translated into a physical memory address; as well as The data is read / written based on the physical memory address.

7. The method of claim 6, wherein, The step of translating the I / O virtual memory address corresponding to the data corresponding to the read / write request into a physical memory address includes: Based on the identifier of the at least one VF, an address translation table corresponding to the at least one VF is obtained from the register of the Input / Output Memory Management Unit (IOMMU), wherein the identifier indicates the bus number, device number, and function number of the at least one VF; and The I / O virtual memory address is translated into the physical memory address based on the address translation table.

8. The method of claim 6, wherein, The step of translating the I / O virtual memory address corresponding to the data corresponding to the read / write request into a physical memory address includes: Based on the identifier of the at least one VF and the process address space identifier (PASID) corresponding to the data, the address translation table corresponding to the at least one VF is obtained from the register of the Input / Output Memory Management Unit (IOMMU), wherein the identifier indicates the bus number, device number, and function number of the at least one VF; and The I / O virtual memory address is translated into the physical memory address based on the address translation table.

9. The method of claim 1, further comprising: A secure channel is established between the security core circuit corresponding to the virtual storage device and the host security manager; as well as The security core circuit and the host security manager establish a security key for secure communication between the at least one Virtual Function (VF) and the at least one VM corresponding to the at least one VF through the security channel.

10. The method of claim 1, further comprising: The security core circuitry corresponding to the virtual storage device interacts with the at least one VF to manage the security information of the at least one VF and / or monitor the status of the at least one VF in real time.

11. A storage device emulation device, comprising: Memory, which stores one or more instructions; At least one processor is operatively coupled to the memory. Wherein, when the one or more instructions are executed by the at least one processor, the storage device emulates a device: Register the virtual storage device to the Peripheral Component Rapid Interconnect PCIe root complex; In response to the virtual storage device being registered to the PCIe root complex, a scan of at least one PCIe bus is performed to identify the virtual storage device; and In response to a Single Root Input / Output Virtualization (SR-IOV) enable request for the virtual storage device, at least one Virtual Function (VF) corresponding to the virtual storage device is established, wherein the plurality of at least one VFs are assigned to at least one virtual machine.

12. A computer-readable storage medium storing a computer program, wherein, When the computer program is executed by a processor, it causes the processor to implement the method as described in any one of claims 1-10.

Images