Compute node supporting virtual machines and services

1. A compute node comprising:

one or more processors ( 306 , 306 A, 306 B);

one or more memory devices ( 308 ) storing software enabling virtual computing resources and virtual memory to be assigned to support:

a virtual machines compartment ( 402 ) in which a plurality of virtual machines (VM) is enabled by a hypervisor ( 312 ); and

a services compartment ( 404 ) comprising an operating system (OS) enabling one or more of: real time capabilities, security functionality, and hardware accelerators, wherein the services compartment further comprises a virtual machines service manager ( 412 ) adapted to manage service requests received from the virtual machines;

a hardware partition ( 418 ) providing access control between the virtual machines ( 408 ) and the virtual machines services compartment ( 404 ), the hardware partition comprising:

a first memory zone ( 308 C) within the one or more memory devices accessible from only the services compartment;

a second memory zone ( 308 B) within the one or more memory devices accessible from both the services compartment and the virtual machines compartment; and

a bus ( 422 ) accessible by the one or more processors ( 306 , 306 A, 306 B) and coupled to the one or more memory devices ( 308 ), the bus having one or more bus lanes providing one or more access control bits for controlling access to the first and second memory zones, wherein:

the first memory zone ( 308 C) is associated with a first identifier comprising the access control bits and is adapted to be accessible by the bus ( 422 ) only when the one or more access control bits define a first state; and

the second memory zone ( 308 B) is a shared memory associated with a second identifier comprising the access control bits and is adapted to be accessible by the bus ( 422 ) only when the one or more access control bits define a second state different to the first state, wherein the second identifier comprises an identifier of the shared memory allocated by the virtual machine service manager ( 412 ).

2. The compute node of claim 1 , wherein the bus ( 422 ) is further coupled to one or more peripheral devices, the one or more access control bits further controlling access to said peripheral devices.

3. The compute node of claim 1 , wherein the one or more processors ( 306 , 306 A, 306 B) are adapted to apply an identifier having the first state of the access control bits on the one or more bus lanes when accessing the first memory zone ( 308 C) during execution of a service operation associated with the services compartment ( 404 ); and to assert an identifier having the second state of the access control bits on the one or more bus lanes when accessing the second memory zone ( 308 B) in order to share data between the virtual machines compartment ( 402 ) and the services compartment ( 404 ).

4. The compute node of claim 1 , wherein a first of the virtual machines is adapted to access the services compartment ( 404 ) by executing a service request instruction configured to be trapped by the hypervisor of the virtual machines compartment ( 402 ) and communicated to the virtual machines service manager ( 412 ).

5. The compute node of claim 1 , wherein the services compartment ( 402 ) comprises a hardware accelerator ( 416 ), the hardware accelerator comprising one or more of:

an FPGA (field programmable gate array);

a GPU (Graphics Processing Unit);

a DSP (Digital Signal Processor); and

an ASIC (application specific integrated circuit).

6. The compute node of claim 1 , wherein the services compartment ( 402 ) comprises a virtual trusted platform module.

7. A telecommunications system comprising the compute node of claim 1 , wherein the services compartment ( 404 ) is adapted to execute first and second communications applications using a hardware accelerator and/or a real time function, the hardware partition permitting a first virtual machine of the virtual machine compartment ( 402 ) to access the first communications application and not the second communications application.

8. An automotive computing system comprising the compute node of claim 1 , wherein the services compartment ( 404 ) is adapted to execute at least one function, using a hardware accelerator and/or a real time function, for controlling one or more of:

a braking system;

a video assistance system;

an anti-theft security system; and

a speed regulation system.

9. A method of accessing, by a first virtual machine of a plurality of virtual machines, services comprising one or more of real time capabilities, security functionality and hardware acceleration; the method comprising:

providing a compute node comprising: one or more processors ( 306 , 306 A, 306 B); and one or more memory devices ( 308 ) storing software enabling virtual computing resources and virtual memory to be assigned to support a virtual machines compartment ( 402 ) in which the plurality of the virtual machines (VM) is enabled by a hypervisor ( 312 ); and a services compartment ( 404 ) comprising an operating system (OS) enabling the services, wherein the services compartment further comprises a virtual machines service manager ( 412 ) for managing service requests received from the virtual machines; and

providing access control between the virtual machines ( 408 ) and the virtual machines services compartment ( 404 ) using a hardware partition, wherein the hardware partition comprises a first memory zone ( 308 C) within the one or more memory devices accessible from only the services compartment; a second memory zone ( 308 B) within the one or more memory devices accessible from both the services compartment and the virtual machines compartment; and a bus ( 422 ) accessible by the one or more processors ( 306 , 306 A, 306 B) and coupled to the one or more memory devices ( 308 ), wherein providing access control comprises providing, on one or more bus lanes of the bus, one or more access control bits for controlling access to the first and second memory zones, wherein:

the first memory zone ( 308 C) is associated with a first identifier comprising the access control bits and is adapted to be accessible by the bus ( 422 ) only when the one or more access control bits define a first state; and

the second memory zone ( 308 B) is a shared memory associated with a second identifier comprising the access control bits and is adapted to be accessible by the bus ( 422 ) only when the one or more access control bits define a second state different to the first state, wherein the second identifier comprises an identifier of the shared memory allocated by the virtual machine service manager ( 412 ).

10. The method of claim 9 , further comprising:

instantiating a new service by the first virtual machine; and

accessing the new service by the first virtual machine.

11. A method of accessing, by a first virtual machine of a plurality of virtual machines, services comprising one or more of real time capabilities, security functionality and hardware acceleration;

the method comprising:

providing a compute node comprising: one or more processors ( 306 , 306 A, 306 B); and one or more memory devices ( 308 ) storing software enabling virtual computing resources and virtual memory to be assigned to support a virtual machines compartment ( 402 ) in which the plurality of the virtual machines (VM) is enabled by a hypervisor ( 312 ); and a services compartment ( 404 ) comprising an operating system (OS) enabling the services, wherein the services compartment further comprises a virtual machines service manager ( 412 ) for managing service requests received from the virtual machines;

providing access control between the virtual machines ( 408 ) and the virtual machines services compartment ( 404 ) using a hardware partition, wherein the hardware partition comprises a first memory zone ( 308 C) within the one or more memory devices accessible from only the services compartment a second memory zone ( 308 B) within the one or more memory devices accessible from both the services compartment and the virtual machines compartment and a bus ( 422 ) accessible by the one or more processors ( 306 , 306 A, 306 B) and coupled to the one or more memory devices ( 308 ), wherein providing access control comprises providing, on one or more bus lanes of the bus, one or more access control bits for controlling access to the first and second memory zones;

executing, by the first virtual machine, a service request instruction;

trapping the service request instruction by the hypervisor of the virtual machines compartment ( 402 ); and

communicating the service request instruction to the virtual machines service manager ( 412 ).

12. The method of claim 11 , further comprising executing the service request instruction by the virtual machines services compartment ( 404 ) and providing a result to the first virtual machine via a memory zone ( 308 B) shared by the first virtual machine and the virtual machine services compartment ( 404 ).

13. The method of claim 11 , wherein the service request instruction is a secure monitor call (SMC) instruction.

14. A non-transitory computer-readable storage medium storing software instructions executable by one or more processors for implementing a method to cause a first virtual machine of a plurality of virtual machines, to access services comprising one or more of real time capabilities, security functionality and hardware acceleration; the method comprising:

providing a compute node comprising: one or more processors ( 306 , 306 A, 306 B); and one or more memory devices ( 308 ) storing software enabling virtual computing resources and virtual memory to be assigned to support a virtual machines compartment ( 402 ) in which the plurality of the virtual machines (VM) is enabled by a hypervisor ( 312 ); and a services compartment ( 404 ) comprising an operating system (OS) enabling the services, wherein the services compartment further comprises a virtual machines service manager ( 412 ) for managing service requests received from the virtual machines; and

providing access control between the virtual machines ( 408 ) and the virtual machines services compartment ( 404 ) using a hardware partition, wherein the hardware partition comprises a first memory zone ( 308 C) within the one or more memory devices accessible from only the services compartment a second memory zone ( 308 B) within the one or more memory devices accessible from both the services compartment and the virtual machines compartment and a bus ( 422 ) accessible by the one or more processors ( 306 , 306 A, 306 B) and coupled to the one or more memory devices ( 308 ), wherein providing access control comprises providing, on one or more bus lanes of the bus, one or more access control bits for controlling access to the first and second memory zones, wherein:

the first memory zone ( 308 C) is associated with a first identifier comprising the access control bits and is adapted to be accessible by the bus ( 422 ) only when the one or more access control bits define a first state; and

the second memory zone ( 308 B) is a shared memory associated with a second identifier comprising the access control bits and is adapted to be accessible by the bus ( 422 ) only when the one or more access control bits define a second state different to the first state, wherein the second identifier comprises an identifier of the shared memory allocated by the virtual machine service manager ( 412 ).