WO2023174127A1 - 基于云的fpga管理控制系统、方法及电子设备 - Google Patents

基于云的fpga管理控制系统、方法及电子设备 Download PDF

Info

Publication number
WO2023174127A1
WO2023174127A1 PCT/CN2023/080337 CN2023080337W WO2023174127A1 WO 2023174127 A1 WO2023174127 A1 WO 2023174127A1 CN 2023080337 W CN2023080337 W CN 2023080337W WO 2023174127 A1 WO2023174127 A1 WO 2023174127A1
Authority
WO
WIPO (PCT)
Prior art keywords
fpga
request
authentication
image file
management
Prior art date
Application number
PCT/CN2023/080337
Other languages
English (en)
French (fr)
Inventor
李峰
李小闯
张军
龙欣
张振祥
Original Assignee
阿里巴巴（中国）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴（中国）有限公司 filed Critical 阿里巴巴（中国）有限公司
Publication of WO2023174127A1 publication Critical patent/WO2023174127A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/61—Installation
    • G06F8/63—Image based installation; Cloning; Build to order
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G06F9/5005—Allocation of resources, e.g. of the central processing unit [CPU] to service a request
    • G06F9/5011—Allocation of resources, e.g. of the central processing unit [CPU] to service a request the resources being hardware resources other than CPUs, Servers and Terminals
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G06F9/5005—Allocation of resources, e.g. of the central processing unit [CPU] to service a request
    • G06F9/5011—Allocation of resources, e.g. of the central processing unit [CPU] to service a request the resources being hardware resources other than CPUs, Servers and Terminals
    • G06F9/5022—Mechanisms to release resources
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2209/00—Indexing scheme relating to G06F9/00
    • G06F2209/50—Indexing scheme relating to G06F9/50
    • G06F2209/5011—Pool

Definitions

  • the embodiments of the present disclosure relate to the field of communication technology, and more specifically, to a cloud-based FPGA management control system, method and electronic device.
  • the FaaS (FPGA as a Server) platform formed by Field-Programmable Gate Array (FPGA) FPGA combined with cloud computing can provide a unified hardware platform and middleware in the cloud, which can reduce users' development and deployment costs.
  • FPGA Field-Programmable Gate Array
  • the FPGA partial reprogramming (PR) file is compiled by FaaS based on the netlist file submitted by the user and stored in the image pool. Users cannot access the FPGA image file. This will cause FPGA users to worry about the security of their own logical files, and at the same time occupy the management resources of a larger FPGA mirror pool.
  • Embodiments of the present disclosure provide a cloud-based FPGA management and control method, which achieves the purpose of compiling and generating FPGA image files by users. FaaS is no longer required to manage the FPGA image pool, and the management resources of the FPGA image pool are released.
  • a cloud-based FPGA management control system including:
  • the computing node includes an FPGA tool and a first interface module; the FPGA tool is used to generate an FPGA image file according to the user's FPGA image file compilation request; the third An interface module is used to send operation requests to the FPGA device;
  • the FPGA device includes a second interface module, an authentication module and an execution module; the second interface module is used to send an operation request to the authentication module; the authentication module is used to authenticate the operation request. authority, and if the authentication is passed, send an execution instruction to the execution module; the execution module is used to execute the operation corresponding to the operation request according to the execution instruction;
  • the FaaS management and control device is used to program flash to the FPGA device.
  • the authentication module includes a download operation authentication unit, a read and write operation authentication unit and a programming operation authentication unit;
  • the download operation request When the operation request is a download operation request, the download operation request includes the FPGA image file, and the download operation authentication unit is used to authenticate the FPGA image file;
  • the read-write operation request When the operation request is a read-write operation request, the read-write operation request at least includes a request address and request content; the read-write operation authentication unit is used to determine whether the user has the qualifications and requirements based on the request address. The operation permission corresponding to the requested content;
  • the programming operation authentication unit authenticates the programming operation request.
  • the download operation authentication unit is specifically configured to: perform FPGA logic authentication on the FPGA image file, or perform control authentication and FPGA logic authentication on the FPGA image file.
  • the programming operation authentication unit is specifically configured to: The authentication result of the programming operation request sent by the computing node is failed; The authentication result of the programming operation request sent by the FaaS management and control device is pass.
  • a cloud-based FPGA management and control method including:
  • the download operation request at least includes the FPGA image file generated by the user through the FPGA tool;
  • authenticating the FPGA image file includes:
  • authenticating the FPGA image file includes:
  • the method also includes:
  • the read and write request at least includes the request address and request content
  • the request address determine whether the user has the operation authority corresponding to the request content
  • performing corresponding processing according to the judgment result includes:
  • an electronic device which includes:
  • a processor and a memory the memory being used to store instructions, the instructions being used to control the processor to perform the method according to any one of the first aspects of the present disclosure.
  • a readable storage medium stores executable instructions.
  • the executable instructions are executed by a processor, any one of the first aspects of the present disclosure is performed. the method described.
  • the FPGA image file is generated through the FPGA tool on the computing node, the operation request is authenticated on the FPGA device, and the corresponding operation is performed if the authentication is passed, and the FaaS control device burns the FPGA device to the FPGA device.
  • Writing flash achieves the purpose of compiling and generating FPGA image files by users. FaaS no longer needs to manage the FPGA image pool, freeing up the management resources of the FPGA image pool.
  • the FPGA device implements hierarchical management of user rights, and users can use the FPGA device to a limited extent.
  • Figure 1 is a schematic diagram of a cloud-based FPGA management control system according to an embodiment of the present disclosure
  • Figure 2 is a schematic diagram of FPGA operations in a FaaS instance
  • Figure 3 is a schematic diagram of IO operations in the bare metal scenario and VM scenario in this embodiment
  • Figure 4 is a schematic diagram of an example of IO operations in this embodiment
  • Figure 5 is a schematic flowchart of a cloud-based FPGA management and control method that can be used in embodiments of the present disclosure
  • Figure 6 is a schematic block diagram of an electronic device that can be used to implement embodiments of the present disclosure
  • FIG. 7 shows a schematic structural diagram of an electronic device that can be used to implement a cloud-based FPGA management and control method according to one embodiment.
  • any specific values are to be construed as illustrative only and not as limiting. Accordingly, other examples of the exemplary embodiments may have different values.
  • FIG. 1 is a schematic diagram of a cloud-based FPGA management control system according to an embodiment of the present disclosure.
  • the cloud-based FPGA management and control system 1000 of this embodiment may include: communication-connected computing nodes 10, FPGA devices 20 and FaaS management and control devices 30.
  • the computing node 10 includes an FPGA tool 101 and a first interface module 102; the FPGA tool 101 is used to generate an FPGA image file according to the user's FPGA image file compilation request; the first interface module 102 is used to provide the The FPGA device 20 sends an operation request.
  • the operation requests may include three types of operation requests: download operation requests, read and write operation requests, and programming operation requests. As shown in Figure 2, these three types of operation requests have three levels in terms of operation and security, namely read and write (IO) operations, download operations and flash programming operations.
  • IO read and write
  • the FPGA device 20 includes a second interface module 201, an authentication module 202 and an execution module 203; the second interface module 201 is used to send an operation request to the authentication module 202; the authentication module 202 is used to Authenticate the operation request, and if the authentication passes, send an execution instruction to the execution module 203; the execution module 203 is used to execute the operation corresponding to the operation request according to the execution instruction. .
  • the FaaS management and control device 30 is used to program flash to the FPGA device 20 .
  • the authentication module 202 includes a download operation authentication unit, a read and write operation authentication unit and a programming operation authentication unit.
  • the download operation request when the operation request is a download operation request, the download operation request includes the FPGA image file, and the download operation authentication unit is used to authenticate the FPGA image file.
  • FPGA image file authentication includes authentication in bare metal (private cloud) scenarios and virtual machine scenarios.
  • the download operation authentication unit is specifically used to: perform FPGA logic authentication on the FPGA image file, or perform control authentication and FPGA logic authentication on the FPGA image file.
  • the download operation authentication unit is used to authenticate the FPGA image file with FPGA logic, and performs FPGA logic authentication on the FPGA image file that may occur. Exceptions are intercepted.
  • possible exceptions may be code errors, malicious access to illegal addresses, etc.
  • the download operation authentication unit is used to perform mixed authentication on the FPGA image file, that is, to perform management and control authentication and FPGA logic authentication at the same time.
  • the FPGA manufacturer's PR tool is used to authenticate whether the FPGA image file complies with the FPGA image file rules and whether it will cause FPGA problems.
  • FPGA logic authentication authenticates FPGA image files and intercepts possible exceptions.
  • possible exceptions may be code errors, malicious access to illegal addresses, etc.
  • the read-write operation request when the operation request is a read-write operation request, the read-write operation request at least includes a request address and request content; the read-write operation authentication unit is configured to determine based on the request address Whether the user has the operation permission corresponding to the requested content.
  • the user can see all FPGA devices 20 (including the dual PF scenario), and can perform IO operations on the FPGA device 20.
  • the FPGA device 20 When performing an IO operation, the FPGA device 20 receives the user's read and write operation request; the read and write operation request at least includes a request address and request content; and based on the request address, determines whether the user has the information corresponding to the request content. Operation authority; perform corresponding processing based on the judgment results.
  • the smart network card has all the permissions to access the management PF (mgmtPF).
  • the user's access permissions to mgmtPF can be set according to the needs.
  • Each function under mgmtPF will be divided into an address.
  • the read and write operation authentication unit will first determine whether it has the operation permission corresponding to the request content based on the request address of the read and write request.
  • the programming operation authentication unit authenticates the programming operation request.
  • the programming operation authentication unit is specifically used to: authenticate the programming operation request sent by the computing node 10 as failed; verify the programming operation request sent by the FaaS management and control device 30 The authentication result is passed.
  • the FaaS management and control device 30 can program flash through VDM.
  • flash programming occurs during the system launch stage and the later FPGA shell upgrade stage. In this way, while allowing users to maximize the use of the FPGA, the security of the underlying logic of the FPGA is ensured, that is, the flash cannot be destroyed.
  • the technical solution of this embodiment is to generate an FPGA image file through the FPGA tool on the computing node, authenticate the operation request on the FPGA device, and perform the corresponding operation if the authentication passes, and the FaaS management and control device sends the request to the FPGA device.
  • Flash programming realizes the purpose of compiling and generating FPGA image files by users. FaaS no longer needs to manage the FPGA image pool, freeing up the management resources of the FPGA image pool.
  • the FPGA device implements hierarchical management of user rights, and users can use the FPGA device to a limited extent.
  • FIG. 5 is a schematic flowchart of a cloud-based FPGA management and control method according to an embodiment of the present disclosure.
  • the cloud-based FPGA management and control method of this embodiment is applied to the system as shown in Figure 1.
  • the cloud-based FPGA management and control method of this embodiment may include the following steps 5100 to 5300:
  • Step 5100 Receive a download operation request sent by the user; the download operation request at least includes the FPGA image file generated by the user through the FPGA tool.
  • the FPGA image file is generated by the user through the FPGA tool. After generating the FPGA image file, the user initiates a download operation to the FPGA through the FPGA device interface. In this way, the purpose of compiling and generating FPGA image files by users can be achieved.
  • Step 5200 Authenticate the FPGA image file.
  • the authentication of FPGA image files is divided into two types according to different scenarios.
  • FPGA image file authentication in a bare metal (private cloud) scenario.
  • FPGA logic authentication is performed on the FPGA image file.
  • FPGA logic authentication can be performed by the FPGA logic authentication module.
  • the FPGA logic authentication module 202 can be located in the FPGA shell.
  • the FPGA logic authentication module 202 authenticates the FPGA image file and handles possible exceptions. Interception.
  • possible exceptions may be code errors, malicious access to illegal addresses, etc.
  • it is FPGA image file authentication in a virtual machine scenario.
  • control authentication and FPGA logic authentication are performed on the FPGA image file.
  • a hybrid authentication mode is used, that is, both management and control authentication and FPGA logic authentication.
  • the management and control authentication is located on the computing node (Computer Node, CN). After obtaining the FPGA image file, based on the FPGA manufacturer's PR tool, it authenticates whether the FPGA image file complies with the FPGA image file rules and whether it will cause FPGA problems. .
  • FPGA logic authentication can be performed by the FPGA logic authentication module.
  • the FPGA logic authentication module 202 is located in the FPGA shell.
  • the FPGA logic authentication module 202 authenticates the FPGA image file and intercepts possible exceptions. .
  • possible exceptions may be code errors, malicious access to illegal addresses, etc.
  • Step 5300 If the authentication result is that the authentication is passed, perform a download operation.
  • the FPGA receives the user's read and write operation requests; the read and write operation requests at least include the request address and the request content; and based on the request address, determine whether the user has the operation permission corresponding to the request content. ; Execute corresponding processing according to the judgment result.
  • the smart network card has all the permissions to access the management PF (mgmtPF).
  • the user's access permissions to mgmtPF can be set according to needs.
  • Each function under mgmtPF will be divided into an address.
  • All read and write requests will first be judged based on the request address of the read and write operation request to determine whether it has the operation permission corresponding to the request content.
  • All read and write operation requests initiated by smartNIC are judged to be passed. For read and write operation requests initiated by users through CN, it is determined according to the request address whether it has the corresponding content corresponding to the request. If the operation authority is provided, the operation corresponding to the request content will be performed and the first request response will be returned to the user. If it is not provided, the second request response will be returned to the user.
  • the FPGA device is set to completely shield the flash of the FPGA device from the PCIe interface, so that the user cannot initiate any flash update or erase operations on the FPGA device.
  • Only messages defined by the FaaS VDM can program the flash. Therefore, users cannot operate the flash of FPGA devices in the case of bare metal (private cloud) or virtual machine (VM).
  • FaaS management and control equipment can update flash through VDM.
  • flash update occurs during the system online stage and the later FPGA shell upgrade stage. In this way, while allowing users to maximize the use of the FPGA, the security of the underlying logic of the FPGA is ensured, that is, the flash cannot be destroyed.
  • the download operation request at least includes the download operation request generated by the user through the FPGA tool.
  • FPGA image file authenticate the FPGA image file; when the authentication result is that the authentication is passed, perform the download operation.
  • the user generates the FPGA image file by himself through the FPGA tool, and sends the FPGA image file to the FPGA when initiating the download operation. This achieves the purpose of compiling and generating the FPGA image file by the user, and no longer requires FaaS to access the FPGA image pool. Management is performed to release the management resources of the FPGA mirror pool.
  • an electronic device is also provided.
  • the electronic device is the electronic device 6000 shown in Figure 6, including:
  • Memory 6100 used to store executable commands.
  • the processor 6200 is configured to execute the method described in any method embodiment of the present disclosure under the control of executable commands stored in the memory 6100.
  • the implementation subject of the method embodiment executed on the electronic device may be a server or an electronic device.
  • composition structure of an electronic device based on the cloud-based FPGA management and control method can be shown in Figure 7.
  • the electronic device 7000 may include a processor 7100, a memory 7200, an interface device 7300, a communication device 7400, a display device 7500, an input device 7600, a speaker 7700, and a microphone. 7800, etc.
  • the processor 7100 is used to execute program instructions, and the program instructions can adopt instruction sets of architectures such as x86, Arm, RISC, MIPS, SSE, etc.
  • the memory 7200 includes, for example, ROM (Read Only Memory), RAM (Random Access Memory), nonvolatile memory such as a hard disk, and the like.
  • the interface device 7300 includes, for example, a USB interface, a headphone interface, and the like.
  • the communication device 7400 is capable of wired or wireless communication, for example.
  • the display device 7500 is, for example, a liquid crystal display screen, a touch display screen, or the like.
  • the input device 7600 may include, for example, a touch screen, a keyboard, or the like.
  • Speaker 7700 is used to output voice information.
  • Microphone 7800 is used to collect voice information.
  • the electronic device 7000 may be any device such as a smartphone, a portable computer, a desktop computer, or a tablet computer.
  • the memory 7200 of the electronic device 7000 is used to store instructions, and the instructions are used to control the processor 7100 to operate to support the implementation of a cloud-based FPGA management control method according to any embodiment of the present disclosure. Skilled personnel can design instructions based on the solutions disclosed in this disclosure. How instructions control the processor to operate is well known in the art and will not be described in detail here.
  • the electronic device 7000 of the embodiment of the present disclosure may only involve some of the devices, for example, only the processor 7100 and the memory. 7200, input device 7600, etc.
  • the electronic device 7000 shown in Figure 7 is illustrative only, and is in no way intended to limit the present disclosure, its application, or uses.
  • This embodiment provides a readable storage medium that stores executable commands.
  • the executable commands are executed by a processor, the method described in any method embodiment of the present disclosure is executed.
  • the invention may be a system, method and/or computer program product.
  • a computer program product may include a computer-readable storage medium having computer-readable program instructions thereon for causing a processor to implement various aspects of the invention.
  • Computer-readable storage media may be tangible devices that can retain and store instructions for use by an instruction execution device.
  • the computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or Any suitable combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM) or Flash memory), Static Random Access Memory (SRAM), Compact Disk Read Only Memory (CD-ROM), Digital Versatile Disk (DVD), Memory Stick, Floppy Disk, Mechanical Coding Device, such as a printer with instructions stored on it.
  • RAM random access memory
  • ROM read-only memory
  • EPROM erasable programmable read-only memory
  • Flash memory Static Random Access Memory
  • CD-ROM Compact Disk Read Only Memory
  • DVD Digital Versatile Disk
  • Memory Stick
  • Computer-readable storage media are not to be construed as transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or through electrical wires. transmitted electrical signals.
  • Computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to various computing/processing devices, or to an external computer or external storage device over a network, such as the Internet, a local area network, a wide area network, and/or a wireless network.
  • the network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and/or edge servers.
  • a network adapter card or network interface in each computing/processing device receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage on a computer-readable storage medium in the respective computing/processing device .
  • Computer program instructions for performing operations of the present invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or instructions in one or more programming languages.
  • the computer-readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server implement.
  • the remote computer can be connected to the user's computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (such as an Internet service provider through the Internet). connect).
  • LAN local area network
  • WAN wide area network
  • an external computer such as an Internet service provider through the Internet. connect
  • an electronic circuit such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA)
  • Program instructions may be read to implement various aspects of the invention.
  • These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus, thereby producing a machine that, when executed by the processor of the computer or other programmable data processing apparatus, , resulting in an apparatus that implements the functions/actions specified in one or more blocks in the flowchart and/or block diagram.
  • These computer-readable program instructions can also be stored in a computer-readable storage medium. These instructions cause the computer, programmable data processing device and/or other equipment to work in a specific manner. Therefore, the computer-readable medium storing the instructions includes An article of manufacture that includes instructions that implement aspects of the functions/acts specified in one or more blocks of the flowcharts and/or block diagrams.
  • Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other equipment, causing a series of operating steps to be performed on the computer, other programmable data processing apparatus, or other equipment to produce a computer-implemented process , thereby causing instructions executed on a computer, other programmable data processing apparatus, or other equipment to implement the functions/actions specified in one or more blocks in the flowcharts and/or block diagrams.
  • each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions that embody one or more elements for implementing the specified logical function(s).
  • Executable instructions may occur out of the order noted in the figures. For example, two consecutive blocks may actually execute substantially in parallel, or they may sometimes execute in the reverse order, depending on the functionality involved.
  • each block of the block diagram and/or flowchart illustration, and combinations of blocks in the block diagram and/or flowchart illustration can be implemented by special purpose hardware-based systems that perform the specified functions or acts. , or can be implemented using a combination of specialized hardware and computer instructions. It is well known to those skilled in the art that implementation by means of hardware, implementation by means of software and implementation by means of software The implementation in combination with hardware is equivalent.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Stored Programmes (AREA)

Abstract

本公开提出了一种基于云的FPGA管理控制系统、方法及电子设备。该系统包括：通信连接的计算节点，FPGA设备和FaaS管控设备；其中，所述计算节点包括FPGA工具和第一接口模块；所述FPGA工具用于根据用户的FPGA镜像文件编译请求生成FPGA镜像文件；所述第一接口模块用于向所述FPGA设备发送操作请求；所述FPGA设备包括第二接口模块，鉴权模块和执行模块；所述第二接口模块用于将操作请求发送至所述鉴权模块；所述鉴权模块用于对所述操作请求进行鉴权，并在鉴权通过的情况下，向所述执行模块发送执行指令；所述执行模块用于根据所述执行指令，执行与所述操作请求对应的操作；所述FaaS管控设备用于向FPGA设备烧写flash。

Description

基于云的FPGA管理控制系统、方法及电子设备
本申请要求于2022年03月14日提交中国专利局、申请号为202210248599.5、申请名称为“基于云的FPGA管理控制系统、方法及电子设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本公开实施例涉及通信技术领域，更具体的，涉及一种基于云的FPGA管理控制系统、方法及电子设备。
背景技术
现场可编程门阵列(Field-Programmable Gate Array，FPGA)FPGA结合云计算形成的FaaS(FPGA as a Server)平台，能够在云端提供统一的硬件平台与中间件，可以降低用户的开发与部署成本。
在FaaS中，出于安全考虑，FPGA的部分重编程(partical reconfiguration，PR)文件是由FaaS根据用户提交的网表文件进行编译后生成并存储在镜像池中，用户无法接触FPGA镜像文件，这会带来FPGA用户对自身逻辑文件安全的担心，同时占用了较大的FPGA镜像池的管理资源。
发明内容
本公开实施例提供一种基于云的FPGA管理控制的方法，实现了由用户编译生成FPGA镜像文件的目的，不再需要FaaS对FPGA镜像池进行管理，释放了FPGA镜像池的管理资源。
根据本公开实施例的第一方面，提供了一种基于云的FPGA管理控制系统，包括：
通信连接的计算节点，FPGA设备和FaaS管控设备；
其中，所述计算节点包括FPGA工具和第一接口模块；所述FPGA工具用于根据用户的FPGA镜像文件编译请求生成FPGA镜像文件；所述第 一接口模块用于向所述FPGA设备发送操作请求；
所述FPGA设备包括第二接口模块，鉴权模块和执行模块；所述第二接口模块用于将操作请求发送至所述鉴权模块；所述鉴权模块用于对所述操作请求进行鉴权，并在鉴权通过的情况下，向所述执行模块发送执行指令；所述执行模块用于根据所述执行指令，执行与所述操作请求对应的操作；
所述FaaS管控设备用于向FPGA设备烧写flash。
可选地，所述鉴权模块包括下载操作鉴权单元，读写操作鉴权单元和烧写操作鉴权单元；
在所述操作请求是下载操作请求的情况下，所述下载操作请求包括所述FPGA镜像文件，所述下载操作鉴权单元用于对所述FPGA镜像文件进行鉴权；
在所述操作请求是读写操作请求的情况下，所述读写操作请求中至少包括请求地址和请求内容；所述读写操作鉴权单元用于根据所述请求地址，判断用户是否具备与所述请求内容对应的操作权限；
在所述操作请求是烧写操作请求的情况下，所述烧写操作鉴权单元对所述烧写操作请求进行鉴权。
可选地，所述下载操作鉴权单元具体用于：对所述FPGA镜像文件进行FPGA逻辑鉴权，或者，对所述FPGA镜像文件进行管控鉴权和FPGA逻辑鉴权。
可选地，所述烧写操作鉴权单元具体用于：对所述计算节点发送的烧写操作请求的鉴权结果为不通过；对FaaS管控设备发送的烧写操作请求的鉴权结果为通过。
根据本公开实施例的第二方面，提供了一种基于云的FPGA管理控制分法，包括：
接收用户发送的下载操作请求；所述下载操作请求中至少包括用户通过FPGA工具生成的FPGA镜像文件；
对所述FPGA镜像文件进行鉴权；
在鉴权结果为鉴权通过的情况下，执行下载操作。
可选地，所述对所述FPGA镜像文件进行鉴权，包括：
对所述FPGA镜像文件进行FPGA逻辑鉴权。
可选地，所述对所述FPGA镜像文件进行鉴权，包括：
对所述FPGA镜像文件进行管控鉴权和FPGA逻辑鉴权。
可选地，所述方法还包括：
接收用户的读写请求；所述读写请求中至少包括请求地址和请求内容；
根据所述请求地址，判断用户是否具备与所述请求内容对应的操作权限；
根据判断结果执行对应的处理。
可选地，所述根据判断结果执行对应的处理，包括：
在所述判断结果为用户具备与所述请求内容对应的操作权限的情况下，执行与所述请求内容对应的操作，并向用户返回第一请求响应；
在所述判断结果为用户不具备与所述请求内容对应的操作权限的情况下，向用户返回第二请求响应。
根据本公开实施例的第三方面，还提供了一种电子设备，其中，包括：
处理器和存储器，所述存储器用于存储指令，所述指令用于控制所述处理器执行根据本公开的第一方面中任一项所述的方法。
根据本公开实施例的第四方面，还提供一种可读存储介质，存储介质存储有可执行指令，所述可执行指令被处理器执行时，执行如本公开的第一方面中任一项所述的方法。
在一个实施例中，在计算节点通过FPGA工具生成FPGA镜像文件，在FPGA设备对操作请求进行鉴权，并在鉴权通过的情况下执行对应的操作，以及，在FaaS管控设备向FPGA设备烧写flash，实现了由用户编译生成FPGA镜像文件的目的，不再需要FaaS对FPGA镜像池进行管理，释放了FPGA镜像池的管理资源。同时，实现了FPGA设备对用户权限进行分层管理，用户可以有限度的使用FPGA设备。
通过以下参照附图对本发明的示例性实施例的详细描述，本发明的其它特征及其优点将会变得清楚。
附图说明
被结合在说明书中并构成说明书的一部分的附图示出了本发明的实施例，并且连同其说明一起用于解释本发明的原理。
图1是根据本公开实施例的基于云的FPGA管理控制系统的示意图；
图2是FaaS实例中的FPGA操作的示意图；
图3是本实施例中裸金属场景和VM场景中的IO操作示意图；
图4是本实施例中IO操作的例子的示意图；
图5是可用于本公开实施例的基于云的FPGA管理控制方法的流程示意图；
图6是可用于实施本公开实施例的电子设备的原理框图；
图7示出了能够用于实施一个实施例的基于云的FPGA管理控制方法的一种电子设备的组成结构示意图。
具体实施方式
现在将参照附图来详细描述本发明的各种示例性实施例。应注意到：除非另外具体说明，否则在这些实施例中阐述的部件和步骤的相对布置、数字表达式和数值不限制本发明的范围。
以下对至少一个示例性实施例的描述实际上仅仅是说明性的，决不作为对本发明及其应用或使用的任何限制。
对于相关领域普通技术人员已知的技术、方法和设备可能不作详细讨论，但在适当情况下，所述技术、方法和设备应当被视为说明书的一部分。
在这里示出和讨论的所有例子中，任何具体值应被解释为仅仅是示例性的，而不是作为限制。因此，示例性实施例的其它例子可以具有不同的值。
应注意到：相似的标号和字母在下面的附图中表示类似项，因此，一旦某一项在一个附图中被定义，则在随后的附图中不需要对其进行进一步讨论。
<系统实施例>
图1是根据本公开实施例的基于云的FPGA管理控制系统的示意图。 如图1所示，本实施例的基于云的FPGA管理控制系统1000可以包括：通信连接的计算节点10，FPGA设备20和FaaS管控设备30。
其中，所述计算节点10包括FPGA工具101和第一接口模块102；所述FPGA工具101用于根据用户的FPGA镜像文件编译请求生成FPGA镜像文件；所述第一接口模块102用于向所述FPGA设备20发送操作请求。
实际应用中，所述操作请求可以包括三类操作请求：下载操作请求，读写操作请求和烧写操作请求。如图2所示，这三类操作请求从操作和安全上看有3个层次，分别是读写(IO)操作，下载操作和烧写flash操作。
所述FPGA设备20包括第二接口模块201，鉴权模块202和执行模块203；所述第二接口模块201用于将操作请求发送至所述鉴权模块202；所述鉴权模块202用于对所述操作请求进行鉴权，并在鉴权通过的情况下，向所述执行模块203发送执行指令；所述执行模块203用于根据所述执行指令，执行与所述操作请求对应的操作。所述FaaS管控设备30用于向FPGA设备20烧写flash。
在一个实现方式中，所述鉴权模块202包括下载操作鉴权单元，读写操作鉴权单元和烧写操作鉴权单元。
可选地，在所述操作请求是下载操作请求的情况下，所述下载操作请求包括所述FPGA镜像文件，所述下载操作鉴权单元用于对所述FPGA镜像文件进行鉴权。
在实际应用中，FPGA镜像文件鉴权包括裸金属(专有云)场景和虚拟机场景下的鉴权。所述下载操作鉴权单元具体用于：对所述FPGA镜像文件进行FPGA逻辑鉴权，或者，对所述FPGA镜像文件进行管控鉴权和FPGA逻辑鉴权。
在本例中，在裸金属(专有云)场景下对所述FPGA镜像文件进行鉴权时，所述下载操作鉴权单元用于对所述FPGA镜像文件进行FPGA逻辑鉴权，并对可能产生的异常进行拦截。可选地，可能产生的异常例如可以是代码错误，恶意访问非法地址等。
在虚拟机场景下对所述FPGA镜像文件进行鉴权时，考虑到本场景中存在多个用户的虚拟机，为避免其中一个用户的下载操作影响到其他用户， 在本场景中，所述下载操作鉴权单元用于对FPGA镜像文件进行混合鉴权，即，同时进行管控鉴权和FPGA逻辑鉴权。
具体的，在获取到FPGA镜像文件后，基于FPGA厂商的PR工具对FPGA镜像文件是否符合FPGA镜像文件规则、是否会引起FPGA问题进行鉴权。同样的，FPGA逻辑鉴权是对FPGA镜像文件进行鉴权，并对可能产生的异常进行拦截。可选地，可能产生的异常例如可以是代码错误，恶意访问非法地址等。
可选地，在所述操作请求是读写操作请求的情况下，所述读写操作请求中至少包括请求地址和请求内容；所述读写操作鉴权单元用于根据所述请求地址，判断用户是否具备与所述请求内容对应的操作权限。
如图3所示，在裸金属或者VM场景下，用户可以看到全部的FPGA设备20(包括双PF场景)，并可以对FPGA设备20进行IO操作。
在进行IO操作时，FPGA设备20接收用户的读写操作请求；所述读写操作请求中至少包括请求地址和请求内容；并根据所述请求地址，判断用户是否具备与所述请求内容对应的操作权限；根据判断结果执行对应的处理。
如图4所示，示例性的，智能网卡(smartNIC)具备访问管理PF(management PF，mgmtPF)的全部权限，用户对于mgmtPF的访问权限可根据需求设置，mgmtPF下每个功能均会划分一段地址，对于向mgmtPF发起的所有读写操作请求，均会先由读写操作鉴权单元根据读写请求的请求地址判断是否具备与请求内容对应的操作权限。
对于smartNIC发起的读写请求，全判断为通过。对于用户通过CN发起的读写请求，根据请求地址判定其是否具有与请求内容对应的操作权限，若具备，则执行与所述请求内容对应的操作，并向用户返回第一请求响应，若不具备，则向用户返回第二请求响应。
可选地，在所述操作请求是烧写操作请求的情况下，所述烧写操作鉴权单元对所述烧写操作请求进行鉴权。
所述烧写操作鉴权单元具体用于：对所述计算节点10发送的烧写操作请求的鉴权结果为不通过；对FaaS管控设备30发送的烧写操作请求的 鉴权结果为通过。
在本实施例中，设置为将FPGA设备20的flash对PCIe接口全部屏蔽，使得用户无法对FPGA设备20发起任何flash烧写操作，只有通过FaaS VDM(vendor define message厂商定义信息)定义的报文才能烧写flash。因此用户在裸金属(专有云)或者虚拟机(VM)的情况下无法操作FPGA设备20的flash。FaaS管控设备30通过VDM可以烧写flash，通常烧写flash发生在系统上线阶段和后期的FPGA shell升级阶段。这样，在满足了用户可以最大限度的使用FPGA的同时，保证了FPGA底层逻辑的安全，即，无法破坏flash。
本实施例的技术方案，在计算节点通过FPGA工具生成FPGA镜像文件，在FPGA设备对操作请求进行鉴权，并在鉴权通过的情况下执行对应的操作，以及，在FaaS管控设备向FPGA设备烧写flash，实现了由用户编译生成FPGA镜像文件的目的，不再需要FaaS对FPGA镜像池进行管理，释放了FPGA镜像池的管理资源。同时，实现了FPGA设备对用户权限进行分层管理，用户可以有限度的使用FPGA设备。
<方法实施例>
图5是根据本公开实施例的基于云的FPGA管理控制方法的流程示意图。本实施例的基于云的FPGA管理控制方法应用于如图1所示的系统中，如图5所示，本实施例的基于云的FPGA管理控制方法可以包括如下步骤5100～步骤5300：
步骤5100，接收用户发送的下载操作请求；所述下载操作请求中至少包括用户通过FPGA工具生成的FPGA镜像文件。
也就是说，本实施例中，FPGA镜像文件是用户自己通过FPGA工具生成的。在生成FPGA镜像文件后，用户通过FPGA设备接口向FPGA发起下载操作。这样，能够实现由用户编译生成FPGA镜像文件的目的。
步骤5200，对所述FPGA镜像文件进行鉴权。
在本实施例中，对于FPGA镜像文件的鉴权，根据不同的场景分为两种。
在一个例子中，是裸金属(专有云)场景下的FPGA镜像文件鉴权。 在本例中，对所述FPGA镜像文件进行FPGA逻辑鉴权。
具体的，FPGA逻辑鉴权可以由FPGA逻辑鉴权模块执行，该FPGA逻辑鉴权模块202可以位于FPGA shell中，FPGA逻辑鉴权模块202对FPGA镜像文件进行鉴权，并对可能产生的异常进行拦截。可选地，可能产生的异常例如可以是代码错误，恶意访问非法地址等。
在另一个例子中，是虚拟机场景下的FPGA镜像文件鉴权。在本例中，对所述FPGA镜像文件进行管控鉴权和FPGA逻辑鉴权。
考虑到本场景中一台FPGA设备上存在多个用户的虚拟机，为避免其中一个用户的下载操作影响到其他用户，在本场景中，使用混合鉴权模式，即，同时进行管控鉴权和FPGA逻辑鉴权。
具体的，管控鉴权位于计算节点(Computer Node，CN)上，在获取到FPGA镜像文件后，基于FPGA厂商的PR工具对FPGA镜像文件是否符合FPGA镜像文件规则、是否会引起FPGA问题进行鉴权。
同样的，FPGA逻辑鉴权可以由FPGA逻辑鉴权模块执行，该FPGA逻辑鉴权模块202位于FPGA shell中，FPGA逻辑鉴权模块202对FPGA镜像文件进行鉴权，并对可能产生的异常进行拦截。可选地，可能产生的异常例如可以是代码错误，恶意访问非法地址等。
步骤5300，在鉴权结果为鉴权通过的情况下，执行下载操作。
进一步地，用户可以对FPGA设备进行IO操作。在进行IO操作时，FPGA接收用户的读写操作请求；所述读写操作请求中至少包括请求地址和请求内容；并根据所述请求地址，判断用户是否具备与所述请求内容对应的操作权限；根据判断结果执行对应的处理。
示例性的，智能网卡(smartNIC)具备访问管理PF(management PF，mgmtPF)的全部权限，用户对于mgmtPF的访问权限可根据需求设置，mgmtPF下每个功能均会划分一段地址，对于向mgmtPF发起的所有读写请求，均会先根据读写操作请求的请求地址判断是否具备与请求内容对应的操作权限。
对于smartNIC发起的读写操作请求，全判断为通过。对于用户通过CN发起的读写操作请求，根据请求地址判定其是否具有与请求内容对应 的操作权限，若具备，则执行与所述请求内容对应的操作，并向用户返回第一请求响应，若不具备，则向用户返回第二请求响应。
进一步地，本实施例中，设置为将FPGA设备的flash对PCIe接口全部屏蔽，使得用户无法对FPGA设备发起任何flash更新、擦除操作，只有通过FaaS VDM定义的报文才能烧写flash。因此用户在裸金属(专有云)或者虚拟机(VM)的情况下无法操作FPGA设备的flash。FaaS管控设备可以通过VDM更新flash，通常更新flash发生在系统上线阶段和后期的FPGA shell升级阶段。这样，在满足了用户可以最大限度的使用FPGA的同时，保证了FPGA底层逻辑的安全，即，无法破坏flash。
以上已结合附图对本公开实施例的基于云的FPGA管理控制方法进行了说明，在本实施例中，通过接收用户发送的下载操作请求；所述下载操作请求中至少包括用户通过FPGA工具生成的FPGA镜像文件；对所述FPGA镜像文件进行鉴权；在鉴权结果为鉴权通过的情况下，执行下载操作。本公开实施例中，用户通过FPGA工具自行生成FPGA镜像文件，在发起下载操作时将FPGA镜像文件发送到FPGA中，实现了由用户编译生成FPGA镜像文件的目的，不再需要FaaS对FPGA镜像池进行管理，释放了FPGA镜像池的管理资源。
<设备实施例>
本实施例中，还提供一种电子设备，该电子设备为图6所示的电子设备6000，包括：
存储器6100，用于存储可执行命令。
处理器6200，用于在存储器6100存储的可执行命令的控制下，执行本公开任意方法实施例中描述的方法。
在电子设备根据所执行的方法实施例的实施主体，可以是服务器，也可以是电子设备。
在一个可行的实现方式中，基于云的FPGA管理控制方法的一种电子设备的组成结构可以如图7所示。
具体的，电子设备7000可以包括处理器7100、存储器7200、接口装置7300、通信装置7400、显示装置7500、输入装置7600、扬声器7700、麦克风 7800，等等。
其中，处理器7100用于执行程序指令，该程序指令可以采用比如x86、Arm、RISC、MIPS、SSE等架构的指令集。存储器7200例如包括ROM(只读存储器)、RAM(随机存取存储器)、诸如硬盘的非易失性存储器等。接口装置7300例如包括USB接口、耳机接口等。通信装置7400例如能够进行有线或无线通信。显示装置7500例如是液晶显示屏、触摸显示屏等。输入装置7600例如可以包括触摸屏、键盘等。扬声器7700用于输出语音信息。麦克风7800用于采集语音信息。
电子设备7000可以是智能手机、便携式电脑、台式计算机、平板电脑等任意设备。
本实施例中，电子设备7000的存储器7200用于存储指令，所述指令用于控制所述处理器7100进行操作以支持实现根据本公开任意实施例的基于云的FPGA管理控制方法。技术人员可以根据本公开所公开方案设计指令。指令如何控制处理器进行操作，这是本领域公知，故在此不再详细描述。
本领域技术人员应当理解，尽管在图7中示出了电子设备7000的多个装置，但是，本公开实施例的电子设备7000可以仅涉及其中的部分装置，例如，只涉及处理器7100、存储器7200、输入装置7600等。
图7所示的电子设备7000仅是解释性的，并且决不是为了要限制本公开、其应用或用途。
<可读存储介质实施例>
本实施例提供一种可读存储介质，该存储介质中存储有可执行命令，该可执行命令被处理器执行时，执行本公开任意方法实施例中描述的方法。
本发明可以是系统、方法和/或计算机程序产品。计算机程序产品可以包括计算机可读存储介质，其上载有用于使处理器实现本发明的各个方面的计算机可读程序指令。
计算机可读存储介质可以是可以保持和存储由指令执行设备使用的指令的有形设备。计算机可读存储介质例如可以是――但不限于――电存储设备、磁存储设备、光存储设备、电磁存储设备、半导体存储设备或者 上述的任意合适的组合。计算机可读存储介质的更具体的例子(非穷举的列表)包括：便携式计算机盘、硬盘、随机存取存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(EPROM或闪存)、静态随机存取存储器(SRAM)、便携式压缩盘只读存储器(CD-ROM)、数字多功能盘(DVD)、记忆棒、软盘、机械编码设备、例如其上存储有指令的打孔卡或凹槽内凸起结构、以及上述的任意合适的组合。这里所使用的计算机可读存储介质不被解释为瞬时信号本身，诸如无线电波或者其他自由传播的电磁波、通过波导或其他传输媒介传播的电磁波(例如，通过光纤电缆的光脉冲)、或者通过电线传输的电信号。
这里所描述的计算机可读程序指令可以从计算机可读存储介质下载到各个计算/处理设备，或者通过网络、例如因特网、局域网、广域网和/或无线网下载到外部计算机或外部存储设备。网络可以包括铜传输电缆、光纤传输、无线传输、路由器、防火墙、交换机、网关计算机和/或边缘服务器。每个计算/处理设备中的网络适配卡或者网络接口从网络接收计算机可读程序指令，并转发该计算机可读程序指令，以供存储在各个计算/处理设备中的计算机可读存储介质中。
用于执行本发明操作的计算机程序指令可以是汇编指令、指令集架构(ISA)指令、机器指令、机器相关指令、微代码、固件指令、状态设置数据、或者以一种或多种编程语言的任意组合编写的源代码或目标代码，所述编程语言包括面向对象的编程语言—诸如Smalltalk、C++等，以及常规的过程式编程语言—诸如“C”语言或类似的编程语言。计算机可读程序指令可以完全地在用户计算机上执行、部分地在用户计算机上执行、作为一个独立的软件包执行、部分在用户计算机上部分在远程计算机上执行、或者完全在远程计算机或服务器上执行。在涉及远程计算机的情形中，远程计算机可以通过任意种类的网络—包括局域网(LAN)或广域网(WAN)—连接到用户计算机，或者，可以连接到外部计算机(例如利用因特网服务提供商来通过因特网连接)。在一些实施例中，通过利用计算机可读程序指令的状态信息来个性化定制电子电路，例如可编程逻辑电路、现场可编程门阵列(FPGA)或可编程逻辑阵列(PLA)，该电子电路可以执行计算机 可读程序指令，从而实现本发明的各个方面。
这里参照根据本发明实施例的方法、装置(系统)和计算机程序产品的流程图和/或框图描述了本发明的各个方面。应当理解，流程图和/或框图的每个方框以及流程图和/或框图中各方框的组合，都可以由计算机可读程序指令实现。
这些计算机可读程序指令可以提供给通用计算机、专用计算机或其它可编程数据处理装置的处理器，从而生产出一种机器，使得这些指令在通过计算机或其它可编程数据处理装置的处理器执行时，产生了实现流程图和/或框图中的一个或多个方框中规定的功能/动作的装置。也可以把这些计算机可读程序指令存储在计算机可读存储介质中，这些指令使得计算机、可编程数据处理装置和/或其他设备以特定方式工作，从而，存储有指令的计算机可读介质则包括一个制造品，其包括实现流程图和/或框图中的一个或多个方框中规定的功能/动作的各个方面的指令。
也可以把计算机可读程序指令加载到计算机、其它可编程数据处理装置、或其它设备上，使得在计算机、其它可编程数据处理装置或其它设备上执行一系列操作步骤，以产生计算机实现的过程，从而使得在计算机、其它可编程数据处理装置、或其它设备上执行的指令实现流程图和/或框图中的一个或多个方框中规定的功能/动作。
附图中的流程图和框图显示了根据本发明的多个实施例的系统、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段或指令的一部分，所述模块、程序段或指令的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。在有些作为替换的实现中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个连续的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。也要注意的是，框图和/或流程图中的每个方框、以及框图和/或流程图中的方框的组合，可以用执行规定的功能或动作的专用的基于硬件的系统来实现，或者可以用专用硬件与计算机指令的组合来实现。对于本领域技术人员来说公知的是，通过硬件方式实现、通过软件方式实现以及通过软件 和硬件结合的方式实现都是等价的。
以上已经描述了本发明的各实施例，上述说明是示例性的，并非穷尽性的，并且也不限于所披露的各实施例。在不偏离所说明的各实施例的范围和精神的情况下，对于本技术领域的普通技术人员来说许多修改和变更都是显而易见的。本文中所用术语的选择，旨在最好地解释各实施例的原理、实际应用或对市场中的技术改进，或者使本技术领域的其它普通技术人员能理解本文披露的各实施例。本发明的范围由所附权利要求来限定。

Claims (11)

  1. 一种基于云的FPGA管理控制系统，其特征在于，包括：通信连接的计算节点，FPGA设备和FaaS管控设备；
    其中，所述计算节点包括FPGA工具和第一接口模块；所述FPGA工具用于根据用户的FPGA镜像文件编译请求生成FPGA镜像文件；所述第一接口模块用于向所述FPGA设备发送操作请求；
    所述FPGA设备包括第二接口模块，鉴权模块和执行模块；所述第二接口模块用于将操作请求发送至所述鉴权模块；所述鉴权模块用于对所述操作请求进行鉴权，并在鉴权通过的情况下，向所述执行模块发送执行指令；所述执行模块用于根据所述执行指令，执行与所述操作请求对应的操作；
    所述FaaS管控设备用于向FPGA设备烧写flash。
  2. 根据权利要求1所述的基于云的FPGA管理控制系统，其特征在于，所述鉴权模块包括下载操作鉴权单元，读写操作鉴权单元和烧写操作鉴权单元；
    在所述操作请求是下载操作请求的情况下，所述下载操作请求包括所述FPGA镜像文件，所述下载操作鉴权单元用于对所述FPGA镜像文件进行鉴权；
    在所述操作请求是读写操作请求的情况下，所述读写操作请求中至少包括请求地址和请求内容；所述读写操作鉴权单元用于根据所述请求地址，判断用户是否具备与所述请求内容对应的操作权限；
    在所述操作请求是烧写操作请求的情况下，所述烧写操作鉴权单元对所述烧写操作请求进行鉴权。
  3. 根据权利要求2所述的基于云的FPGA管理控制系统，其特征在于，所述下载操作鉴权单元具体用于：对所述FPGA镜像文件进行FPGA逻辑鉴权，或者，对所述FPGA镜像文件进行管控鉴权和FPGA逻辑鉴权。
  4. 根据权利要求2所述的基于云的FPGA管理控制系统，其特征在于，所述烧写操作鉴权单元具体用于：对所述计算节点发送的烧写操作请求的鉴权结果为不通过；对FaaS管控设备发送的烧写操作请求的鉴权结果 为通过。
  5. 一种基于云的FPGA管理控制方法，其特征在于，包括：
    接收用户发送的下载操作请求；所述下载操作请求中至少包括用户通过FPGA工具生成的FPGA镜像文件；
    对所述FPGA镜像文件进行鉴权；
    在鉴权结果为鉴权通过的情况下，执行下载操作。
  6. 根据权利要求5所述的方法，其特征在于，所述对所述FPGA镜像文件进行鉴权，包括：
    对所述FPGA镜像文件进行FPGA逻辑鉴权。
  7. 根据权利要求5所述的方法，其特征在于，所述对所述FPGA镜像文件进行鉴权，包括：
    对所述FPGA镜像文件进行管控鉴权和FPGA逻辑鉴权。
  8. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    接收用户的读写请求；所述读写请求中至少包括请求地址和请求内容；
    根据所述请求地址，判断用户是否具备与所述请求内容对应的操作权限；
    根据判断结果执行对应的处理。
  9. 根据权利要求8所述的方法，其特征在于，所述根据判断结果执行对应的处理，包括：
    在所述判断结果为用户具备与所述请求内容对应的操作权限的情况下，执行与所述请求内容对应的操作，并向用户返回第一请求响应；
    在所述判断结果为用户不具备与所述请求内容对应的操作权限的情况下，向用户返回第二请求响应。
  10. 一种电子设备，其中，包括：
    处理器和存储器，所述存储器用于存储指令，所述指令用于控制所述处理器执行根据权利要求5至9中任一项所述的方法。
  11. 一种可读存储介质，存储介质存储有可执行指令，所述可执行指令被处理器执行时，执行如权利要求5至9中任一项所述的方法。
PCT/CN2023/080337 2022-03-14 2023-03-08 基于云的fpga管理控制系统、方法及电子设备 WO2023174127A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210248599.5A CN114691157A (zh) 2022-03-14 2022-03-14 基于云的fpga管理控制系统、方法及电子设备
CN202210248599.5 2022-03-14

Publications (1)

Publication Number Publication Date
WO2023174127A1 true WO2023174127A1 (zh) 2023-09-21

Family

ID=82138486

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/080337 WO2023174127A1 (zh) 2022-03-14 2023-03-08 基于云的fpga管理控制系统、方法及电子设备

Country Status (2)

Country Link
CN (1) CN114691157A (zh)
WO (1) WO2023174127A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114691157A (zh) * 2022-03-14 2022-07-01 阿里巴巴（中国）有限公司 基于云的fpga管理控制系统、方法及电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10141026B1 (en) * 2017-10-11 2018-11-27 International Business Machines Corporation Access control for hardware resources
CN109783118A (zh) * 2017-11-13 2019-05-21 阿里巴巴集团控股有限公司 Fpga云主机开发方法和系统
CN110377297A (zh) * 2019-07-12 2019-10-25 苏州浪潮智能科技有限公司 一种镜像文件固化系统、方法、装置以及相关设备
CN114691157A (zh) * 2022-03-14 2022-07-01 阿里巴巴（中国）有限公司 基于云的fpga管理控制系统、方法及电子设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10141026B1 (en) * 2017-10-11 2018-11-27 International Business Machines Corporation Access control for hardware resources
CN109783118A (zh) * 2017-11-13 2019-05-21 阿里巴巴集团控股有限公司 Fpga云主机开发方法和系统
CN110377297A (zh) * 2019-07-12 2019-10-25 苏州浪潮智能科技有限公司 一种镜像文件固化系统、方法、装置以及相关设备
CN114691157A (zh) * 2022-03-14 2022-07-01 阿里巴巴（中国）有限公司 基于云的fpga管理控制系统、方法及电子设备

Also Published As

Publication number Publication date
CN114691157A (zh) 2022-07-01

Similar Documents

Publication Publication Date Title
US20220109721A1 (en) Access services in hybrid cloud computing systems
US10031735B2 (en) Secure deployment of applications in a cloud computing platform
CN111404923B (zh) 容器集群访问权限的控制方法及系统
US10530775B2 (en) Usage tracking in hybrid cloud computing systems
TWI420338B (zh) 安全之瀏覽器基礎應用程式
US10218790B2 (en) Providing access to a resource for a computer from within a restricted network
JP2020523685A (ja) ハードウェアを使用してオペレーティング・システム構成をセキュアにすること
US10762193B2 (en) Dynamically generating and injecting trusted root certificates
US11799644B2 (en) Default password removal
US10289397B2 (en) Silent installation of software with dependencies
WO2011142996A2 (en) Methods and systems for forcing an application to store data in a secure storage location
US20200057868A1 (en) Privacy annotation from differential analysis of snapshots
WO2023174127A1 (zh) 基于云的fpga管理控制系统、方法及电子设备
CN115039100A (zh) 为安全访客保留一个或多个安全模块
US11036308B2 (en) Automated keyboard mapping for virtual desktops
TWI822038B (zh) 用於安全客戶之多部分元資料之客製化之電腦程式產品、電腦系統及電腦實施方法
US11356255B1 (en) System and method for securely connecting applications to middleware services in a cloud platform
CN116018580A (zh) 用于跨云壳层的实例持久化数据的技术
US11632251B1 (en) Commit signing service
KR102411144B1 (ko) 부팅 중 통신 모듈 적용을 통한 원격 터미널 접속을 위한 방법 및 시스템
US10990664B2 (en) Eliminating and reporting kernel instruction alteration

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23769633

Country of ref document: EP

Kind code of ref document: A1