Input / output memory management unit, memory access method and related equipment

Abstract

The embodiment of the invention provides an input and output memory management unit, a memory access method and related equipment, and the input and output memory management unit comprises an input and output translation bypass buffer which comprises a cache table item used for caching a mapping relation between an equipment virtual address and a system physical address carried by a memory access request; an address space identifier of the equipment sending the memory access request is cached in a label item of the cache table item; and when a memory access request is obtained, querying a cache table item of the input / output translation bypass buffer at least based on the sent address space identifier, so as to obtain a system physical address mapped by the cached equipment virtual address in the address item corresponding to the tag item hit by the query. According to the technical scheme provided by the embodiment of the invention, on the basis of ensuring that the function of the input / output translation bypass buffer is realized, the reliability and the safety of determining the physical address of the system between devices can be improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to an input / output memory management unit, a memory access method, and related devices. Background Art

[0002] The Input / Output Memory Management Unit (IOMMU) relies on its internal Input / Output (IO) page tables for address mapping and permission protection. To reduce the IOMMU's access overhead, an Input / Output Translation Lookaside Buffer (IOTLB) is added to the IOMMU. The IOTLB caches the mapping between device virtual addresses and their mapped system physical addresses.

[0003] Therefore, the IOTLB is crucial for quickly determining the system's physical address. Against this backdrop, providing a technical solution that, while ensuring the functionality of the I / O translation bypass buffer, improves the reliability of determining the system's physical address based on the I / O translation bypass buffer has become a pressing technical challenge for those skilled in the art. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide an input / output memory management unit, a memory access method, and related devices to improve the reliability and security of determining a system physical address based on an input / output translation bypass buffer.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions.

[0006] In a first aspect, an embodiment of the present invention provides an input / output memory management unit, comprising:

[0007] An input / output translation bypass buffer includes a cache entry for caching a mapping relationship between a device virtual address and a system physical address carried in a memory access request; wherein a tag entry of the cache entry caches an address space identifier of a device that issues the memory access request;

[0008] When the input / output memory management unit obtains a memory access request, it queries the cache table entry of the input / output translation bypass buffer based at least on the address space identifier of the device that issues the memory access request, so as to obtain the system physical address mapped by the cached device virtual address in the address item corresponding to the tag item hit by the query.

[0009] In a second aspect, an embodiment of the present invention provides a memory access method, applied to the input / output memory management unit as described in the first aspect, comprising:

[0010] Get memory access request;

[0011] Obtaining an address space identifier bound to a device issuing the memory access request;

[0012] At least using the acquired address space identifier, determine the tag item hit by the query in the cache table entry, so as to obtain the system physical address of the cached device virtual address mapping in the address item corresponding to the tag item hit by the query;

[0013] Memory is accessed based on the system physical address.

[0014] In a third aspect, an embodiment of the present invention provides a memory access device, comprising:

[0015] A memory access request acquisition module, used to acquire memory access requests;

[0016] An address space identifier acquisition module, configured to acquire an address space identifier bound to a device issuing the memory access request;

[0017] a system physical address determination module, configured to determine a tag entry hit by the query in a cache entry using at least the acquired address space identifier, so as to obtain a system physical address mapped to the cached device virtual address in the address entry corresponding to the tag entry hit by the query; the tag entry of the cache entry caches the address space identifier of the device that issued the memory access request;

[0018] A memory access module is used to access the memory based on the system physical address.

[0019] In a fourth aspect, an embodiment of the present invention provides a computer system, including:

[0020] The input-output memory management unit as described in the first aspect.

[0021] An embodiment of the present invention provides an input / output memory management unit, comprising: an input / output translation bypass buffer, comprising a cache table entry, wherein the cache table entry is used to cache a mapping relationship between a device virtual address and a system physical address carried by a memory access request; wherein the address space identifier of the device that issues the memory access request is cached in a tag item of the cache table entry; when the input / output memory management unit obtains a memory access request, the cache table entry of the input / output translation bypass buffer is queried based on at least the address space identifier of the device that issues the memory access request, so as to obtain the system physical address mapped to the cached device virtual address in the address item corresponding to the tag item hit by the query.

[0022] It can be seen that the technical solution provided by the embodiment of the present invention expands the function of the tag item in the input / output translation bypass buffer so that it can be used to cache the address space identifier of the device that issues the memory access request. Since each device has its own unique address space identifier, when the input / output memory management unit obtains the memory access request to query the input / output translation bypass buffer, it can use the address space identifier of the device that issues the memory access request to isolate and distinguish the system physical addresses corresponding to each device; so that the system physical addresses determined by different devices in the input / output translation bypass buffer are safe and reliable, and other devices with different address space identifiers from this device are prevented from accessing the system physical address of this device, thereby improving the reliability and security of the determination of the system physical address between devices on the basis of ensuring the functional realization of the input / output translation bypass buffer. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0024] Figure 1 is a schematic structural diagram of a computer system provided by an embodiment of the present invention;

[0025] Figure 2 This is a schematic diagram of the structure of an input / output memory management unit provided by an embodiment of the present invention;

[0026] Figure 3 1 is a schematic diagram of a cache condition of an input / output translation bypass buffer provided by an embodiment of the present invention;

[0027] Figure 4 This is a schematic diagram of the encryption process provided by an embodiment of the present invention;

[0028] Figure 5 This is a schematic diagram of the decryption process provided by an embodiment of the present invention;

[0029] Figure 6 1 is a schematic diagram of the structure of an address space identification query table provided by an embodiment of the present invention;

[0030] Figure 7 1 is a schematic diagram of a structure of a shared input and output page table provided by an embodiment of the present invention;

[0031] Figure 8 yes Figure 1Schematic diagram of the structure of the cache table entry in the IOTLB shown;

[0032] Figure 9 yes Figure 2 Schematic diagram of the cache status of cache entries in the IOTLB shown;

[0033] Figure 10 is a schematic structural diagram of a device table provided in an embodiment of the present invention;

[0034] Figure 11 This is a flow chart of a memory access method provided by an embodiment of the present invention;

[0035] Figure 12 is another flowchart of the memory access method provided by an embodiment of the present invention;

[0036] Figure 13 This is another flowchart of the memory access method provided by an embodiment of the present invention;

[0037] Figure 14 1 is a schematic structural diagram of an original refresh command provided by an embodiment of the present invention;

[0038] Figure 15 1 is a schematic structural diagram of a new refresh command provided by an embodiment of the present invention;

[0039] Figure 16 It is a structural diagram of a memory access device provided by an embodiment of the present invention;

[0040] Figure 17 It is another structural diagram of the computer system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0042] IOMMU (Input Output Memory Management Unit) is a system-level input and output memory management unit used to connect input and output (IO) devices with direct memory access (DMA) capabilities to system memory.

[0043] IOMMU enables:

[0044] Memory protection: IOMMU can protect access to specific memory blocks as needed, setting specific memory blocks to read-only, write-only, or both read and write, thereby enhancing system security.

[0045] DMARemapping: IOMMU allows non-contiguous physical memory to be mapped into continuous DMA memory space, providing a larger DMA addressing space.

[0046] Virtualization technology support: In virtualization technology, IOMMU can achieve device isolation, improve system security, and optimize performance. Through IOMMU, virtual machines can access devices independently of the host machine, achieving device isolation.

[0047] Avoid using a bounce buffer: Through IOMMU remapping, the additional overhead of copying data from the peripheral address space accessible to the device to the physical address space that the device cannot access is avoided.

[0048] Support for pass-through of PCI (Peripheral Component Interconnect) devices: The IOMMU can support pass-through of PCI devices, which is particularly important for high-performance computing and graphics processing in virtualized environments.

[0049] All peripherals communicate with the RC (Root Complex) through the IOMMU. The main function of the IOMMU is to manage DMA access to input and output devices and provide address translation and permission protection. When a device needs to access the computer system's memory, it sends a DMA request (memory access request). If the IOMMU is enabled, it will intercept these requests from external devices, perform address translation and permission checks, and ensure that the device can only access authorized memory areas. Requests sent by the RC to external devices, such as configuring devices or sending control commands, usually do not require the intervention of the IOMMU. Therefore, the IOMMU will not intercept requests sent by the RC to the device.

[0050] Please refer to Figure 1 , Figure 1 It is a structural diagram of a computer system provided by an embodiment of the present invention.

[0051] like Figure 1As shown, in the hardware topology (i.e., the physical connections and logical relationships between hardware components in a computer system), IOMMU 011 is located between root complex 02 (RC) and device (IO device) 03. When device 03 needs to access memory, it issues a memory access request. IOMMU 011 converts the device virtual address (IOVA) carried in the memory access request into a system physical address (HPA). The system physical address is the actual physical address of the computer system memory that the device wants to access.

[0052] Figure 1 The IOTLB 021 (Input Output Translation Lookaside Buffer) shown in the figure is a high-speed cache implemented in IOMMU 011, used to cache the mapping relationship between IOVA and HPA. When IOMMU 011 processes a memory access request issued by device 03, it first checks whether the IOVA carried in the memory access request exists in IOTLB 021. If so, it directly obtains the corresponding mapped HPA from IOTLB 021. If not, it obtains the HPA through IO page table conversion and inserts the mapping between IOVA and HPA into IOTLB 021. IOTLB 021 can effectively reduce the overhead of IOMMU 011 accessing multi-level page tables and improve the speed at which devices access system physical memory.

[0053] Figure 1 Connected to the root complex 02 is switch 04. Switch 04's primary function is to expand PCIE (Peripheral Component Interconnect Express) links, allowing for the connection of more devices 03. In the PCIE architecture, switch 04 can connect upstream to the root complex 02 or to the downstream port of another switch. Its downstream ports can connect to an EndPoint (EP), another switch 04, or a PCI bridge. Switch 04 connects to virtual PCI bridges, enabling communication and data exchange between devices 03.

[0054] The root complex 02 is directly connected upstream to the multiprocessor system 01 .

[0055] To further reduce the memory occupied by the input / output page table and the overhead of update synchronization operations, the IOMMU 011 supports multiple devices 03 sharing an input / output page table. However, since the mapping relationship between IOVA and HPA cached in the IOTLB 021 cannot distinguish between devices 03 sharing the same input / output page table, the reliability and security of the HPA are reduced when different devices 03 determine the HPA based on the IOTLB 021.

[0056] To solve the above problems, an embodiment of the present invention provides an input / output memory management unit to improve the reliability and security of determining system physical addresses between devices while ensuring the functional implementation of the input / output translation bypass buffer.

[0057] Please refer to Figure 2 , Figure 2 It is a structural diagram of the input and output management unit provided by an embodiment of the present invention.

[0058] like Figure 2 As shown, the input-output memory management unit 1 includes:

[0059] The input / output translation bypass buffer 11 includes a cache entry 111 for caching a mapping relationship between a device virtual address and a system physical address carried in a memory access request; wherein a tag entry of the cache entry 111 caches an address space identifier of a device that issues the memory access request;

[0060] When the input / output memory management unit 1 obtains a memory access request, it queries the cache table entry 111 of the input / output translation bypass buffer 11 based at least on the address space identifier of the device that issues the memory access request, so as to obtain the system physical address mapped by the cached device virtual address in the address item corresponding to the tag item hit by the query.

[0061] The memory access request is for an IO device with DMA (such as Figure 1 The DMA memory access request issued by the device 03 is shown in FIG. The system physical address is the actual memory physical address of the computer system.

[0062] The input / output translation lookaside buffer 11 (IOTLB) can cache the mapping relationship between IOVA and HPA that has been translated by the input / output page table 12 (IO page table).

[0063] The overhead of IOMMU1 accessing the multi-level input and output page tables 12 is relatively high, and the input and output page tables 12 memory needs to be read frequently, which seriously affects the processing speed of memory access requests to the device. The input and output translation bypass buffer 11 is a high-speed cache implemented in IOMMU1, which is used to cache the correspondence between IOVA and HPA. After the addition of IOTLB11, when IOMMU1 processes a memory access request, it first checks whether the IOVA carried by the memory access request has been cached in the tag entry of IOTLB11. If so, the corresponding mapped HPA is directly obtained from the address entry of IOTLB11; if not, the HPA is converted through the input and output page table 12, and the mapping relationship between IOVA and HPA is cached in IOTLB11.

[0064] Cache entries 111 in IOTLB11 generally cache page frames (IOVAs corresponding to page numbers) rather than directly caching device virtual addresses themselves; that is, the device virtual address (IOVA) cached in the tag entry (TAG) actually refers to the page frame address. Correspondingly, the system physical address cached in the address entry (HPA) is also a page frame address. For convenience, the IOVA and HPA cached in IOTLB11 will refer to page frame addresses.

[0065] Please refer to Figure 3 , Figure 3 This is a schematic diagram of a cache condition of an input / output translation bypass buffer provided by an embodiment of the present invention.

[0066] like Figure 3 As shown, when the IOTLB 11 caches the mapping relationship, the cache entry 111 may be used for caching. The cache entry 111 may cache the mapping relationship between multiple device virtual addresses (IOVAs) and system physical addresses (HPAs).

[0067] In order to quickly determine the HPA mapped by IOVA based on IOTLB11, a tag item (TAG) is used as an index in each cache table entry 111. The tag item corresponds to the address item (HPA), which caches the system physical address mapped by the device virtual address cached in the tag item.

[0068] When IOMMU1 obtains a memory access request issued by the device, it can search the tag item of IOTLB11 based on the device virtual address carried in the memory access request. When it is determined that it corresponds to the device virtual address cached in the tag item, it is called a query hit cache table item. At this time, the system physical address cached in the address item corresponding to the query hit tag item can be obtained, thereby quickly obtaining the system physical address corresponding to the device virtual address, so as to quickly execute the memory access request and access the actual physical memory indicated by the system physical address.

[0069] However, since IOMMU011 may leak the system physical address of the device, in the embodiment of the present invention, Figure 2 As shown, the address space identifier of the device that issued the memory access request is cached in the tag item, and the address space identifier (ASID) of each device is uniquely corresponding to the device. Therefore, when IOMMU1 queries IOTLB11 subsequently, the address space identifier can be used as an index object, and the tag item in the cache table of IOTLB11 can be queried with the help of the address space identifier. This ensures that each device can obtain the system physical address corresponding to it, while preventing other devices with different address space identifiers from the device from obtaining the system physical address of the device, ensuring that the system physical address of each device is securely isolated, and improving the reliability and security of the system physical address provided by IOTLB11.

[0070] In a virtualized environment, virtual machines (VMs) need to communicate with physical devices (such as Figure 1 The IOMMU1 plays a crucial role in the process of devices issuing memory access requests to directly access the system's physical memory. It is responsible for managing memory access between virtual machines and physical devices. Each virtual machine has its own independent address space, and the ASID is used to distinguish the address spaces of different virtual machines. When a virtual machine performs DMA operations, the IOMMU1 uses the ASID to determine which virtual machine initiated the DMA request and performs address translation accordingly.

[0071] At the same time, when performing DMA operations, the device uses the IOVA (I / O Virtual Address) as the address. The IOMMU1 can convert the device's IOVA and its associated ASID into the corresponding HPA. By using the ASID, the IOMMU1 can ensure that DMA requests from different virtual machines are properly isolated, preventing the device of one virtual machine from accessing the memory space of another virtual machine, thereby enhancing the security of the computer system.

[0072] It can be seen that the technical solution provided by the embodiment of the present invention expands the function of the tag item in the input / output translation bypass buffer so that it can be used to cache the address space identifier of the device that issues the memory access request. Since each device has its own unique address space identifier, when the input / output memory management unit obtains the memory access request to query the input / output translation bypass buffer, it can use the address space identifier of the device that issues the memory access request to isolate and distinguish the system physical addresses corresponding to each device; so that the system physical addresses determined by different devices in the input / output translation bypass buffer are safe and reliable, and other devices with different address space identifiers from this device are prevented from accessing the system physical address of this device, thereby improving the reliability and security of the determination of the system physical address between devices on the basis of ensuring the functional realization of the input / output translation bypass buffer.

[0073] Please continue to refer to Figure 2 , the input and output management unit 1 may further include:

[0074] an input / output page table 12 for converting a corresponding system physical address based on the device virtual address carried in the memory access request when the system physical address mapped to the device virtual address carried in the memory access request is not determined in the input / output translation bypass buffer 11;

[0075] After the system physical address is converted using the input / output page table 12 , the mapping relationship between the converted system physical address and the device virtual address is cached in the input / output translation bypass buffer 11 .

[0076] The address mapping function and permission protection function of IOMMU1 depend on the input and output page table 12, through which IOVA is converted into HPA.

[0077] Among them, the input and output page table 12 of IOMMU1 adopts a multi-level tree structure to convert the device virtual address into the system physical address. The page table page size of each level of the input and output page table 12 is 4K bytes, each item in the page table page occupies 8 bytes, and each page has 512 (4*1024 / 8) items. The 9 bits in the device virtual address are used to index the page table entries of the input and output page table 12. The last level page table entry of the input and output page table 12 records the system physical address obtained by the final conversion of the device virtual address. Except for the last level, the page table entries of other levels record the physical address of the next level page table. The highest level page table address is recorded in the input and output page table address bit in the device table (located in the memory of the computer system).

[0078] As can be seen, the input and output page table 12 uses a multi-level structure. Each level of the page table entry contains the physical address pointing to the next level of the page table (the last level page), and of course, also contains some permission control bits and status indication bits. When a device initiates a memory access request, if the computer system and device configuration enable IOMMU1, at this time, IOMMU1 will use the device virtual address IOVA of the memory access request as input, and through step-by-step access to the input and output page table 12, it will eventually convert the IOVA into the HPA.

[0079] The input-output translation bypass buffer 11 can reduce the overhead of IOMMU1 accessing multiple levels of input-output page tables 12. When IOMMU1 obtains a memory access request, it first queries IOTLB11 to see if the device virtual address carried by the obtained memory access request is cached. If so, the corresponding mapped system physical address can be directly obtained from the cache table entry 111 of IOTLB11; if not, IOMMU1 then uses the input-output page table 12 to convert the device virtual address into a system physical address, completing the memory access request's access to the actual system physical memory. At the same time, the system physical address and device virtual address converted by the input-output page table 12 are cached in IOTLB11 for subsequent use.

[0080] To address growing data security threats, meet security requirements in virtualized and cloud computing environments, and comply with regulatory and compliance requirements, hardware-level memory encryption can provide stronger data protection, prevent various attack methods, and ensure data security and privacy.

[0081] For example, a high-performance encryption engine (SM4 encryption engine) is added to each memory controller. The key used by this encryption engine to encrypt and decrypt data is randomly generated by the security processor and stored in a specific register of the memory controller. The software running on the CPU core cannot access the key, which has high security. In a virtualized environment, data security can be protected by secure virtual machine (CSV, China Secure Virtualization) technology. The computer system can assign an ASID to the secure virtual machine. When the secure virtual machine is started, the security processor randomly generates a key bound to the ASID of the secure virtual machine and writes it to a specific register in the memory controller. This facilitates the encryption engine to implement data encryption and decryption.

[0082] To illustrate the implementation of memory encryption, please refer to Figure 4 and Figure 5 , Figure 4 This is a schematic diagram of the encryption process provided by an embodiment of the present invention. Figure 5 This is a schematic diagram of the decryption process provided by an embodiment of the present invention.

[0083] Figure 4 and Figure 5 The example shown is a CPU (central processing unit) issuing a processor memory access request.

[0084] like Figure 4 and Figure 5 As shown, when the CPU is running in a secure virtual machine, the CPU accesses memory and sends a memory access request to the CPU. After receiving the memory access request from the CPU, the memory controller 05 first checks whether the encryption flag (C bit, such as the 47th bit of the physical address) on the physical address (Paddr) in the memory access request to the CPU is set. If the encryption flag is set, the memory controller 05 obtains the ASID from the physical address of the CPU's memory access request, and then uses the encryption engine 06 to encrypt and decrypt the data (data) based on the key corresponding to the ASID. If the encryption flag is not set, the memory controller 05 does not use the encryption engine 06 to encrypt and decrypt the data. When the secure virtual machine is destroyed, the security processor unbinds the ASID and the key in the memory controller 05. When the ASID is used again later, the security processor generates a new key and configures it in the register of the memory controller 05.

[0085] Therefore, in order to meet the data security requirements, in one embodiment, Figure 2 As shown, the input-output memory management unit 1 may further include an address space identification query table 13; the address space identification query table 13 is used to record the pairing information of the device identification and the address space identification bound thereto;

[0086] Among them, when the input-output memory management unit 1 determines the device identifier of the device that issues the memory access request and records it in the address space identifier query table 13, the address space identifier corresponding to the record in the address space identifier query table 13 is returned for the memory access request; otherwise, the address space identifier with the identifier value as the default value is returned for the memory access request.

[0087] By implementing the address space identification query table (BDF-ASID) 13 inside IOMMU1, IOMMU1 supports external devices to access encrypted memory. The address space identification query table 13 records the device identification (BDF, Bus, Device, Function) and ASID pairing information of the device. Please refer to Figure 6 , Figure 6 It is a structural diagram of an address space identification query table provided by an embodiment of the present invention.

[0088] like Figure 6As shown, the address space identifier query table 13 records the pairing information of the device identifier (BDF) and the address space identifier (ASID). After obtaining the device identifier of the device that issues the memory access request, the pairing information can be queried. If the device identifier of the device exists in the table, then when the device issues a memory access request, the device virtual address is converted to the system physical address through IOMMU1, and the system physical address will carry the information of the ASID bound to the device queried from the address space identifier query table 13. The memory controller can then use the secret key corresponding to the ASID to encrypt and decrypt the memory. If the device identifier (BDF) of the device does not exist in the table, the system physical address carries an ASID with a value of "0" by default. That is, the default value of ASID is "0".

[0089] IOMMU1 supports devices accessing encrypted memory, and such devices are called secure devices to meet data security requirements. Therefore, after determining the device ID based on a memory access request, if the device ID exists in the address space ID lookup table described above, the device can be determined to be a secure device and access to encrypted memory is allowed.

[0090] In addition to security devices, ordinary devices are also included. Therefore, in one embodiment, when the device identifier of the device issuing the memory access request is recorded in the address space identifier query table 13, the device issuing the memory access request is a security device, otherwise, the device issuing the memory access request is an ordinary device; the address space identifier of the security device is configured by the security processor, the identifier value of the address space identifier of the ordinary device is a default value, and the address space identifier of the ordinary device is different from the address space identifier of the security device.

[0091] Address space identification query table 13 is designed to enable IOMMU1 to support device access to encrypted memory. Therefore, if a device's device identification is recorded in address space identification query table 13, it can be determined that the device is a secure device. Devices not recorded in the address space identification query table are ordinary devices, and ordinary devices are not allowed to access encrypted memory, ensuring the security of sensitive data.

[0092] The address space identifier of the security device is configured by the security processor to prevent it from being tampered with by a virtual machine monitor (such as a hypervisor) or other device attacks, ensuring the security of the security device's access to encrypted memory.

[0093] The identifier value of the address space identifier of a common device is a default value of "0", which is distinguished from the identifier value of the address space identifier of a secure device to prevent the common device from accessing the encrypted memory.

[0094] In order to enable the IOMMU1 to convert the device virtual address into the system physical address and cache it in the IOTLB11 for memory access requests issued by different devices, in one embodiment, for each device, the tag entry also caches the domain identifier (Domain ID) and the device virtual address corresponding to the device issuing the memory access request, so that the input / output memory management unit determines the system physical address cached in the address entry corresponding to the tag entry hit by the query based on the domain identifier, the address space identifier, and the device virtual address;

[0095] The domain identifier is determined based on a device table in a memory, and the domain identifiers of devices sharing one input and output page table are the same;

[0096] The device table records the correspondence between the device identifier and the domain identifier of the device; when the device issuing the memory access request is an ordinary device, the domain identifier is determined based on the non-encrypted device table; when the device issuing the memory access request is a secure device, the domain identifier is determined based on the encrypted device table.

[0097] A domain identifier (DomainID) is used to identify a specific address space or virtual machine. In a virtualized environment, different virtual machines may have different DomainIDs.

[0098] The device table is located in the computer system's memory. The IOMMU uses the device's device identifier (BDF) as an index to find the corresponding device entry in the device table. Each entry occupies 16 bytes and contains the mode bit, the input and output page table address, the GCR3 table root address (Guest CR3 Table Root Pointer), the interrupt remapping table address, some control bits, and a 16-bit domain identifier (DomainID).

[0099] In the design of IOMMU, in order to reduce Figure 1 The size of the memory occupied by the input and output page table in the IOMMU011 is shown. The IOMMU011 is usually designed to support multiple devices sharing one input and output page table. Figure 7 , Figure 7 It is a schematic diagram of the structure of a shared input and output page table provided by an embodiment of the present invention.

[0100] like Figure 7As shown, multiple devices share an input / output page table 13, and the device table of each device is stored in the memory 2. The DomainID field in the DTE (Device Table Entry) of all devices sharing the same input / output page table 13 is configured identically, and the page table root pointer field (page table root pointer) and Mode field in the DTE are also configured identically.

[0101] Figure 1 The IOMMU011 shown supports shared input and output page tables, so the DomainID field is introduced in the tag entry of IOTLB021, and {DomainID, IOVA} is used as the content of the tag entry cache in the IOTLB021 cache table. Please refer to Figure 8 , Figure 8 yes Figure 1 FIG. 4 is a schematic diagram of the structure of the cache table entries in the IOTLB shown in FIG.

[0102] like Figure 8 As shown, the domain identifier (DomainID) and the device virtual address (IOVA) are cached in the tag entry of IOTLB021, and the system physical address mapped by the device virtual address is cached in the address entry (HPA).

[0103] according to Figure 7 and Figure 8 As shown, the domain identifiers of multiple devices sharing the same input and output page table 13 are the same, which makes Figure 1 In the tag entry of IOTLB021 shown in the figure, when caching the mapping relationship corresponding to the device of the shared input and output page table 13, only one item is cached for the case where the device virtual address is the same: {DomainID, IOVA, HPA}, in order to save the cached content in the cache entry of IOTLB021. Figure 1 When IOMMU011 queries IOTLB021, devices with the same device virtual address may incorrectly obtain the system physical address. For example, when a standard device and a secure device share an input / output page table 13, if the device virtual address carried in the memory access request issued by the standard device and the secure device is the same, the standard device will obtain the system physical address of the secure device through IOTLB021, resulting in the leakage of the secure device's system physical address and reducing the security of the secure device's access to encrypted memory.

[0104] Therefore, based on the embodiment of the present invention that expands the cache content of the tag item and introduces the address space identifier of the device into the cache content of the tag item, the above situation can be addressed by making use of the characteristic that the address space identifier uniquely corresponds to the device, so that the improved IOMMU1 provided by the embodiment of the present invention can accurately return the system physical address that the device wants to access in IOTLB11, preventing other devices with ASIDs different from this device from obtaining the system physical address, especially preventing ordinary devices from accessing the system physical address of the security device, thereby improving the security and reliability of IOMMU1 when obtaining the system physical address, and avoiding IOMMU1 from leaking the system physical address of the security device.

[0105] Please refer to Figure 9 , Figure 9 yes Figure 2 FIG. 4 is a schematic diagram of the cache status of cache entries in the IOTLB shown in FIG.

[0106] like Figure 9 As shown, the tag item of the input / output translation bypass buffer 11 includes the cache content of the address space identifier. Only when the address space identifier, the device virtual address, the domain identifier and the tag item in the cache table item are completely consistent, it is determined that the query hits the tag item, and then the system physical address cached in the address item corresponding to the tag item is obtained.

[0107] Since the address space identifier corresponds to a device one-to-one, each device can be isolated by caching the ASID of the device that issues the memory access request, especially devices that share the same input and output page table, preventing devices other than the ASID from obtaining the HPA address mapped by IOVA through the cache table entry 111 of IOTLB11, thereby ensuring the confidentiality of the mapping relationship of the security device.

[0108] The IOMMU supports device access to encrypted memory. Therefore, devices that are allowed to access encrypted memory are called secure devices, while devices that are not allowed to access encrypted memory are called non-secure devices (ordinary devices). The domain ID of a device is based on a device table query. Therefore, to satisfy the query of the domain IDs of secure and ordinary devices, two device tables are also provided in the computer system's memory: an encrypted device table and a non-encrypted device table.

[0109] Please refer to Figure 10 , Figure 10 It is a structural diagram of a device table provided in an embodiment of the present invention.

[0110] like Figure 10 As shown, the device table filled with shaded characters is the encrypted device table, and the device table filled with unshaded characters is the unencrypted device table. The corresponding input and output page tables of ordinary devices are unencrypted input and output page tables, and the input and output page tables of secure devices are encrypted input and output page tables.

[0111] In a computer system that supports secure device access to encrypted memory, there are two device tables in memory 2, one of which is in plain text (such as Figure 10 The non-shaded device table shown in the figure is used for querying domain identifiers for common devices. When the device does not exist in the BDF-ASID table (common device), the plain text (non-encrypted) device table is used. A device table is encrypted (such as Figure 10 When the device exists in the BDF-ASID table (secure device), the encrypted device table is used.

[0112] The encrypted device table is inaccessible to the hypervisor and is read, written, and updated by the security processor for secure devices. Similarly, the input and output page tables corresponding to secure devices are also encrypted, making the hypervisor inaccessible to the hypervisor and read, written, and updated by the security processor, ensuring the confidentiality of secure device memory accesses.

[0113] An embodiment of the present invention further provides a memory access method, which is applied to the input / output memory management unit 1 described in any one of the aforementioned embodiments.

[0114] Please refer to Figure 11 , Figure 11 This is a flow chart of a memory access method provided by an embodiment of the present invention.

[0115] like Figure 11 As shown, the method includes the following steps:

[0116] Step S101: Obtain a memory access request.

[0117] The memory access request is a memory access request issued by an external device for directly accessing the memory.

[0118] Step S102: Acquire the address space identifier bound to the device that issues the memory access request.

[0119] Step S103 , at least using the acquired address space identifier, determines the query hit tag item in the cache table entry, and obtains the system physical address mapped to the cached device virtual address in the address item corresponding to the query hit tag item.

[0120] The cache entry is located in the input / output translation bypass buffer of the input / output memory management unit, and the tag item of the cache entry caches the address space identifier of the device that issues the memory access request.

[0121] The address space identifier corresponds one-to-one with the device, which can distinguish different devices. When querying the IOTLB, the system physical address corresponding to the device virtual address carried in the memory access request issued by the device can be accurately obtained.

[0122] Step S104: accessing the memory based on the system physical address.

[0123] It can be seen that the technical solution provided by the embodiment of the present invention expands the function of the tag item in the input / output translation bypass buffer so that it can be used to cache the address space identifier of the device that issues the memory access request. Since each device has its own unique address space identifier, when the input / output memory management unit obtains the memory access request to query the input / output translation bypass buffer, it can use the address space identifier of the device that issues the memory access request to isolate and distinguish the system physical addresses corresponding to each device; so that the system physical addresses determined by different devices in the input / output translation bypass buffer are safe and reliable, and other devices with different address space identifiers from this device are prevented from accessing the system physical address of this device, thereby improving the reliability and security of the determination of the system physical address between devices on the basis of ensuring the functional realization of the input / output translation bypass buffer.

[0124] In one embodiment, the paired address space identifier (ASID) may be queried in the address space identifier table according to the device identifier (BDF) of the device.

[0125] Please refer to Figure 12 , Figure 12 This is another flowchart of the memory access method provided by an embodiment of the present invention.

[0126] like Figure 12 As shown, the method may include the following steps:

[0127] Step S201: Obtain a memory access request.

[0128] Step S202: Determine the device identification of the device that issues the memory access request.

[0129] Step S203: acquiring the address space identifier bound to the determined device identifier from the address space identifier query table based on the device identifier.

[0130] The address space identifier query table is used to record the pairing information of the device identifier of the device and the address space identifier bound thereto.

[0131] Since the address space identification query table (BDF-ASID) inside the IOMMU is recorded in BDF, the corresponding paired ASID can be queried based on BDF.

[0132] Please continue to refer to Figure 12 In one embodiment, the method may further include:

[0133] Step S204: Based on the device identifier, read the device table to obtain a domain identifier corresponding to the device identifier.

[0134] The device table is a table provided in the memory of the computer system, and is used to provide a domain identifier (DomainID) of each device.

[0135] Step S205, using the domain identifier, the device virtual address and the obtained address space identifier, determine the query hit tag item in the cache table entry, and obtain the system physical address mapped to the cached device virtual address in the address item corresponding to the query hit tag item.

[0136] When querying the cache entry of the IOLTB, all the contents recorded in the tag item of the cache entry are checked at the same time: {ASID, DomainID, IOVA}. When the address space identifier (ASID), device virtual address (IOVA), and domain identifier (DomainID) determined based on the obtained memory access request are the same as the contents of the tag item cache, it is determined that the IOTLB cache entry hits. If there is no cache entry with a tag item (TAG) of {ASID, DomainID, IOVA} in the IOTLB, then the cache entry does not hit. Therefore, since the address space identifier of the device is uniquely determined, even if there is a memory access request with the same device virtual address, the system physical address of this device will not be obtained by other devices.

[0137] To accurately obtain the address space identifier of each device, in one implementation, please refer to Figure 13 , Figure 13 This is another flowchart of the memory access method provided by an embodiment of the present invention.

[0138] like Figure 13 As shown, the method may include:

[0139] Step S301: Obtain a memory access request.

[0140] Step S302: Determine the device identification of the device that issues the memory access request.

[0141] Step S303, query whether the device identification is recorded in the address space identification query table, if yes, execute step S304, if not, execute step S305.

[0142] Step S304: acquiring the address space identifier bound to the determined device identifier from the address space identifier query table based on the device identifier.

[0143] Step S305: Acquire an address space identifier whose identifier value is a default value.

[0144] The default value can be "0".

[0145] If the device ID is recorded in the BDF-ASID table, the corresponding ASID can be directly obtained based on the pairing relationship recorded in the BDF-ASID. If it is not recorded in the BDF-ASID table, an ASID of "0" can be returned. This makes it easy to distinguish different devices.

[0146] Please continue to refer to Figure 13 , the method may further include:

[0147] Step S306: Based on the device identifier, read the encrypted device table to obtain a domain identifier corresponding to the device identifier.

[0148] For the address space identifier obtained from the address space identifier table, it can be determined that the device is a secure device, so the encrypted device table is accessed to obtain the domain identifier.

[0149] Step S307: Based on the device identifier, read the unencrypted device table to obtain the domain identifier corresponding to the device identifier.

[0150] For an address space identifier whose obtained identifier value is the default value, it can be determined that the device is a common device, so the unencrypted device table is accessed to obtain the domain identifier.

[0151] The acquisition of domain identifiers by devices that meet different security requirements.

[0152] Please continue to refer to Figure 13 , the method may further include:

[0153] Step S308, determining whether the domain identifier, the device virtual address and the acquired address space identifier hit the tag item of the cache entry, if yes, executing step S309, if not, executing step S310.

[0154] Step S309, using the domain identifier, the device virtual address and the obtained address space identifier, determine the query hit tag item in the cache table entry to obtain the system physical address mapped to the cached device virtual address in the address item corresponding to the query hit tag item.

[0155] Step S310: traverse the input and output page table using the device virtual address carried in the memory access request to obtain the system physical address mapped by the device virtual address.

[0156] The ASID and DomainID obtained in the previous two steps, along with the IOVA carried in the memory access request, are used as tags to search the IOTLB cache entry. If a match is found with the cache entry's tag, the HPA is obtained from the address corresponding to the matching tag. The memory access request directly accesses the system's memory using the HPA, bypassing the input / output page table lookup and conversion. If a match is not found with the cache entry's tag, the IOMMU traverses the device's corresponding IO page table to ultimately obtain the HPA corresponding to the IOVA.

[0157] Please continue to refer to Figure 13 ,like Figure 13 As shown, in the case where no tag item is hit, the method may further include:

[0158] Step S311, caching the system physical address obtained from the input / output page table in the address item of the cache entry; and caching the missed device virtual address, the domain identifier, and the address space identifier in the tag item of the cache entry.

[0159] When adding new cache content to the cache table entry of the IOTLB, the missed {ASID, DomainID, IOVA} is used as the cache content in the tag entry, and the HPA obtained by searching the input and output page table is inserted into the address entry of the IOTLB as the new cache content.

[0160] If there is no hit in the IOTLB cache entry, the IOMMU will traverse the input and output page tables to obtain the HPA corresponding to the IOVA. On the one hand, the memory access request issued by the device this time uses the HPA to access the system physical memory. On the other hand, the IOMMU adds new cache content to the IOTLB cache entry. This allows the device to directly obtain the corresponding HPA by hitting the IOTLB cache entry the next time it accesses the IOVA, without traversing the device's corresponding IO page table, thus reducing access latency.

[0161] On the basis of extending the tag entry function of the IOTLB, the refresh command of the IOTLB is synchronously updated to meet the refresh of the IOTLB.

[0162] In one embodiment, the method may further include:

[0163] A refresh command is obtained, wherein the refresh command includes an address space identifier, a domain identifier, and a device virtual address; and a corresponding cache entry is refreshed based on the refresh command.

[0164] Refresh the IOTLB cache entry, that is, delete the cached content in the cache entry. This is usually done when the address translation information changes to ensure that the IOMMU uses the latest address mapping information.

[0165] The process of refreshing the IOTLB is as follows: the original refresh command is written to a buffer (command buf), which is accessible to the IOMMU. Writing to this buffer triggers the IOMMU to perform a refresh operation and refresh the cache entries of the IOTLB.

[0166] The fields of the original refresh command include "DomainID", "IOVA" and the size control field "S" ("S" specifies the size of the address range to be refreshed). After writing the original refresh command in the buffer, the IOMMU searches the IOTLB and deletes the cache table entry with TAG equal to {DomainID, IOVA} from the IOTLB. Flushing the IOTLB can flush only one cache entry in units of pages, or it can flush multiple cache entries corresponding to a continuous address range with IOVA as the starting address. That is, the refresh operation can be precise, affecting only a specific page, or more extensive, affecting a series of continuous addresses. This depends on the setting of the size control field "S".

[0167] In the embodiment of the present invention, based on the expansion of the TAG item function of the IOTLB, a new refresh command is formed, which uses {ASID, DomainID, Address} as the new refresh command to refresh the cache items of the IOTLB. This is compatible with the original refresh command that can only refresh the IOTLB with {DomainID, Address}.

[0168] Based on the cache memory expansion of tag entries in this embodiment of the present invention, if the original flush command is still used to flush the IOTLB with {DomainID, Address}, the original flush command can only flush cache entries corresponding to {DomainID, Address} with an ASID identification value of "0". However, since "ASID" is added to the new flush command, cache entries corresponding to {ASID, DomainID, Address} can also be flushed.

[0169] Please refer to Figure 14 and Figure 15 , Figure 14 is a structural diagram of an original refresh command provided by an embodiment of the present invention, Figure 15 It is a structural diagram of a new refresh command provided by an embodiment of the present invention.

[0170] like Figure 14 As shown, the original refresh command is a 03h command, which includes the "DomainID" and "Address" fields, that is, refreshes the cache entries corresponding to the "DomainID" and "Address".

[0171] Since the cache function of the tag entry is extended in the embodiment of the present invention, the original refresh command 03h is continued to be used, and it can only refresh the cache entry with the identification value of "ASID" being "0".

[0172] like Figure 15 As shown, the refresh command of the newly formed IOMMU is 0Ah, compared to Figure 14 The original flush command 03h, 0Ah uses the reserved field to form the "ASID" field, indicating that the command flushes one or more cache entries in the IOTLB cache table that match the tag {ASID, DomainID, Address} and satisfy the S attribute. The semantics of other fields are compatible with the IOMMU command 03h.

[0173] The size of the ASID item can be adjusted according to actual needs. If 12 bits are insufficient, other reserved bits can be used.

[0174] like Figure 14 and Figure 15 As shown, the refresh command in this embodiment of the present invention is based on the original refresh command 03h, with the addition of the "ASID" field. This refresh command can be used to refresh cache entries in the IOTLB that match the TAG of {ASID, DomainID, Address} and one or more cache entries that meet the S attribute. When "ASID" is 0, the behavior of this command is exactly the same as command 03h, meaning it is compatible with command 03h.

[0175] At the same time, for I / O page table fault exceptions, the event log format generated by the IOMMU remains unchanged. Because the device identifier (BDF) is unique to the system, even if the cache content of the cache address space identifier is added to the IOTLB tag in this embodiment of the present invention, there is no need to add "ASID" information to the error log. The BDF originally recorded in the event log format is sufficient to describe the error information.

[0176] An embodiment of the present invention further provides a memory access device for implementing the memory access method described in the aforementioned embodiment.

[0177] Please refer to Figure 16 , Figure 16 It is a structural diagram of a memory access device provided by an embodiment of the present invention.

[0178] like Figure 16 As shown, the device may include:

[0179] A memory access request acquisition module 20, configured to acquire a memory access request;

[0180] An address space identifier obtaining module 21, configured to obtain an address space identifier bound to a device issuing the memory access request;

[0181] a system physical address determination module 22 configured to determine a tag entry of a query hit in a cache entry using at least the acquired address space identifier, so as to obtain a system physical address of the cached device virtual address mapping in an address entry corresponding to the tag entry of the query hit; the tag entry of the cache entry caches the address space identifier of the device that issued the memory access request;

[0182] The memory access module 23 is used to access the memory based on the system physical address.

[0183] Optionally, the address space identifier obtaining module 21 is configured to obtain the address space identifier bound to the device that issues the memory access request, including:

[0184] Determining a device identification of a device issuing the memory access request;

[0185] Acquire the address space identifier bound to the determined device identifier in the address space identifier query table based on the device identifier;

[0186] The address space identifier query table is used to record the pairing information of the device identifier of the device and the address space identifier bound thereto.

[0187] Optionally, the device further comprises:

[0188] A domain identifier acquisition module, configured to read a device table based on the device identifier and acquire a domain identifier corresponding to the device identifier;

[0189] The system physical address determination module 22 is configured to determine a tag entry hit by the query in the cache entry using at least the acquired address space identifier, including:

[0190] The domain identifier, the device virtual address and the obtained address space identifier are used to determine the query hit tag item in the cache table entry, so as to obtain the system physical address mapped by the cached device virtual address in the address item corresponding to the query hit tag item.

[0191] Optionally, the device further comprises:

[0192] A device identification query module, configured to query whether the device identification is recorded in the address space identification query table;

[0193] If yes, controlling the address space identifier acquisition module 21 to acquire the address space identifier bound to the determined device identifier from the address space identifier query table based on the device identifier;

[0194] If not, get the address space identifier whose identifier value is the default value.

[0195] Optionally, the device further comprises:

[0196] The refresh module is used to obtain a refresh command, wherein the refresh command includes an address space identifier, a domain identifier, and a device virtual address; and refresh a corresponding cache entry based on the refresh command.

[0197] It can be seen that the technical solution provided by the embodiment of the present invention expands the function of the tag item in the input / output translation bypass buffer so that it can be used to cache the address space identifier of the device that issues the memory access request. Since each device has its own unique address space identifier, when the input / output memory management unit obtains the memory access request to query the input / output translation bypass buffer, it can use the address space identifier of the device that issues the memory access request to isolate and distinguish the system physical addresses corresponding to each device; so that the system physical addresses determined by different devices in the input / output translation bypass buffer are safe and reliable, and other devices with different address space identifiers from this device are prevented from accessing the system physical address of this device, thereby improving the reliability and security of the determination of the system physical address between devices on the basis of ensuring the functional realization of the input / output translation bypass buffer.

[0198] The embodiment of the present invention also provides a computer system, please refer to Figure 17 , Figure 17 It is another structural diagram of the computer system provided by an embodiment of the present invention.

[0199] like Figure 17 As shown, the computer system may include:

[0200] The input / output memory management unit 1 as described in any of the preceding embodiments.

[0201] like Figure 17 As shown, optionally, the computer system may further include:

[0202] The memory 2 includes a device table, and the device table is used to provide the input / output memory management unit 1 with a domain identifier corresponding to the device.

[0203] It can be seen that the technical solution provided by the embodiment of the present invention expands the function of the tag item in the input / output translation bypass buffer so that it can be used to cache the address space identifier of the device that issues the memory access request. Since each device has its own unique address space identifier, when the input / output memory management unit obtains the memory access request to query the input / output translation bypass buffer, it can use the address space identifier of the device that issues the memory access request to isolate and distinguish the system physical addresses corresponding to each device; so that the system physical addresses determined by different devices in the input / output translation bypass buffer are safe and reliable, and other devices with different address space identifiers from this device are prevented from accessing the system physical address of this device, thereby improving the reliability and security of the determination of the system physical address between devices on the basis of ensuring the functional realization of the input / output translation bypass buffer.

[0204] The above describes multiple embodiment schemes provided by the embodiments of the present invention. The various optional methods introduced in each embodiment scheme can be combined and cross-referenced with each other without conflict, thereby extending a variety of possible embodiment schemes, which can all be considered as embodiment schemes disclosed and open in the embodiments of the present invention.

[0205] Although the embodiments of the present invention are disclosed above, the present invention is not limited thereto. Any person skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention should be based on the scope defined by the claims.

Claims

1. An input / output memory management unit, characterized in that: include: An input / output translation bypass buffer includes a cache entry for caching a mapping relationship between a device virtual address and a system physical address carried in a memory access request; wherein a tag entry of the cache entry caches an address space identifier of a device that issues the memory access request; When the input / output memory management unit obtains a memory access request, it queries the cache table entry of the input / output translation bypass buffer based at least on the address space identifier of the device that issues the memory access request, so as to obtain the system physical address mapped by the cached device virtual address in the address item corresponding to the tag item hit by the query.

2. The input-output memory management unit according to claim 1, wherein: Also includes: an input / output page table, configured to convert a corresponding system physical address based on the device virtual address carried in the memory access request when the system physical address mapped to the device virtual address carried in the memory access request is not determined in the input / output translation bypass buffer; After the system physical address is obtained by using the input / output page table for translation, the mapping relationship between the converted system physical address and the device virtual address is cached in the input / output translation bypass buffer.

3. The input-output memory management unit according to claim 2, wherein: The tag item also caches a domain identifier and a device virtual address corresponding to the device that issued the memory access request, so that the input / output memory management unit determines the system physical address cached in the address item corresponding to the tag item hit by the query based on the domain identifier, the address space identifier, and the device virtual address; The domain identifier is determined based on a device table in a memory, and the domain identifiers of devices sharing one input and output page table are the same; The device table is used to record the correspondence between the device identification and domain identification of the device; when the device issuing the memory access request is an ordinary device, the domain identification is determined based on the non-encrypted device table; when the device issuing the memory access request is a secure device, the domain identification is determined based on the encrypted device table.

4. The input / output memory management unit according to any one of claims 1 to 3, wherein: Also includes: The address space identifier query table is used to record the pairing information of the device identifier and the address space identifier bound to it; Among them, when the input and output memory management unit determines the device identifier of the device that issues the memory access request and records it in the address space identifier query table, the address space identifier corresponding to the record in the address space identifier query table is returned for the memory access request; otherwise, the address space identifier with the identifier value as the default value is returned for the memory access request.

5. The input / output memory management unit according to claim 4, wherein: When the device identifier of the device issuing the memory access request is recorded in the address space identifier query table, the device issuing the memory access request is a security device; otherwise, the device issuing the memory access request is an ordinary device; the address space identifier of the security device is configured by the security processor, the identifier value of the address space identifier of the ordinary device is a default value, and the address space identifier of the ordinary device is different from the address space identifier of the security device.

6. A memory access method, applied to the input-output memory management unit according to any one of claims 1 to 5, characterized in that: include: Get memory access request; Obtaining an address space identifier bound to a device issuing the memory access request; At least using the acquired address space identifier, determine the tag item hit by the query in the cache table entry, so as to obtain the system physical address of the cached device virtual address mapping in the address item corresponding to the tag item hit by the query; Memory is accessed based on the system physical address.

7. The memory access method according to claim 6, wherein: The acquiring of the address space identifier bound to the device issuing the memory access request includes: Determining a device identification of a device issuing the memory access request; Acquire the address space identifier bound to the determined device identifier in the address space identifier query table based on the device identifier; The address space identifier query table is used to record the pairing information of the device identifier of the device and the address space identifier bound thereto.

8. The memory access method according to claim 7, wherein: After the step of acquiring the address space identifier bound to the determined device identifier in the address space identifier query table based on the device identifier, the method further includes: Based on the device identifier, read the device table to obtain a domain identifier corresponding to the device identifier; The step of determining a tag entry hit by the query in a cache entry by at least using the acquired address space identifier includes: The domain identifier, the device virtual address and the obtained address space identifier are used to determine the query hit tag item in the cache table entry, so as to obtain the system physical address mapped by the cached device virtual address in the address item corresponding to the query hit tag item.

9. The memory access method according to claim 8, wherein: Before the step of acquiring the address space identifier bound to the determined device identifier in the address space identifier query table based on the device identifier, the method further includes: Query whether the device identifier is recorded in the address space identifier query table; If yes, executing the step of acquiring the address space identifier bound to the determined device identifier in the address space identifier query table based on the device identifier; If not, get the address space identifier whose identifier value is the default value.

10. The memory access method according to claim 9, wherein: The step of reading the device table based on the device identifier to obtain a domain identifier corresponding to the device identifier includes: Based on the device identifier, for the non-default address space identifier, read the encrypted device table to obtain the domain identifier corresponding to the device identifier; For the address space identifier of the default value, the unencrypted device table is read to obtain the domain identifier corresponding to the device identifier.

11. The memory access method according to claim 8, wherein: Before the step of determining a query hit tag item in a cache entry by using the domain identifier, the device virtual address, and the acquired address space identifier, and obtaining a system physical address mapped to the cached device virtual address in an address item corresponding to the query hit tag item, the method further includes: Determine whether the domain identifier, the device virtual address, and the acquired address space identifier hit a tag entry of a cache entry; If yes, performing the step of using the domain identifier, the device virtual address, and the obtained address space identifier to determine, in the address item of the cache table entry, a system physical address mapped corresponding to the device virtual address carried by the memory access request; If not, the device virtual address carried in the memory access request is used to traverse the input and output page table to obtain the system physical address mapped by the device virtual address.

12. The memory access method according to claim 11, wherein: After the step of using the device virtual address carried in the memory access request to traverse the input and output page table to obtain the system physical address mapped by the device virtual address, the method further includes: caching the system physical address obtained from the input / output page table in the address item of the cache table entry; And, the device virtual address, the domain identifier, and the address space identifier that are not hit are cached in the tag item of the cache table item.

13. The memory access method according to any one of claims 6 to 12, wherein: Also includes: Obtaining a refresh command, wherein the refresh command includes an address space identifier, a domain identifier, and a device virtual address; The corresponding cache entry is refreshed based on the refresh command.

14. A memory access device, characterized in that: include: A memory access request acquisition module, used to acquire memory access requests; An address space identifier acquisition module, configured to acquire an address space identifier bound to a device issuing the memory access request; a system physical address determination module, configured to determine a tag entry hit by the query in a cache entry using at least the acquired address space identifier, so as to obtain a system physical address mapped to the cached device virtual address in the address entry corresponding to the tag entry hit by the query; the tag entry of the cache entry caches the address space identifier of the device that issued the memory access request; A memory access module is used to access the memory based on the system physical address.

15. The memory access device according to claim 14, wherein: The address space identifier acquisition module is used to acquire the address space identifier bound to the device that issues the memory access request, including: Determining a device identification of a device issuing the memory access request; Acquire the address space identifier bound to the determined device identifier in the address space identifier query table based on the device identifier; The address space identifier query table is used to record the pairing information of the device identifier of the device and the address space identifier bound thereto.

16. The memory access device according to claim 15, wherein: Also includes: A domain identifier acquisition module, configured to read a device table based on the device identifier and acquire a domain identifier corresponding to the device identifier; The system physical address determination module is configured to determine a tag entry hit by the query in a cache entry by at least using the acquired address space identifier, including: The domain identifier, the device virtual address and the obtained address space identifier are used to determine the query hit tag item in the cache table entry, so as to obtain the system physical address mapped by the cached device virtual address in the address item corresponding to the query hit tag item.

17. The memory access device according to claim 16, wherein: Also includes: A device identification query module, configured to query whether the device identification is recorded in the address space identification query table; If yes, controlling the address space identifier acquisition module to acquire the address space identifier bound to the determined device identifier from the address space identifier query table based on the device identifier; If not, get the address space identifier whose identifier value is the default value.

18. The memory access device according to any one of claims 14 to 17, wherein: Also includes: A refresh module, configured to obtain a refresh command, wherein the refresh command includes an address space identifier, a domain identifier, and a device virtual address; The corresponding cache entry is refreshed based on the refresh command.

19. A computer system, characterized in that: include: An input-output memory management unit as claimed in any one of claims 1 to 5.

20. The computer system of claim 19, wherein: Also includes: The memory includes a device table, and the device table is used to provide the input / output memory management unit with a domain identifier corresponding to the device.

Images