System on chip and interrupt isolation method and computer device

Abstract

The present disclosure provides a system on chip and an interrupt isolation method and a computer device. The system on chip comprises: a platform-level interrupt controller, configured to configure an interrupt source as a superuser privilege mode, and generate a second interrupt request after receiving a first interrupt request sent by the interrupt source, the second interrupt request comprising the first interrupt request and a first domain identifier, the first domain identifier being a domain identifier of an execution domain to which the interrupt source belongs; a processor, configured to run a plurality of execution domains in a time-sharing manner in the superuser privilege mode, and determine whether a currently running execution domain is the execution domain to which the interrupt source belongs according to the first domain identifier in the case where the second interrupt request is received, and handle the interrupt request through the currently running execution domain if the currently running execution domain is the execution domain to which the interrupt source belongs; and an on-chip bus, configured to couple the platform-level interrupt controller and the processor. The present disclosure improves the interrupt response speed and solves the technical problem of obvious interrupt delay in the prior art.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of security, in particular to a system on chip and an interrupt isolation method and a computer device. BACKGROUND

[0002] The physical memory protection (PMP) and the multi-layer privilege model provided by the RISC-V architecture enable the processor to virtually create multiple execution zones that are isolated from each other, thereby realizing the trusted execution environment (TEE) on the RISC-V architecture. The isolation of the execution zones is to ensure that the software and hardware resources of each execution zone are immune to illegal operations of other execution zones, and the isolation of interrupt requests among multiple execution zones is required, that is, the interrupt request is only processed by the execution zone to which the interrupt source belongs, which is called interrupt isolation.

[0003] At present, the implementation of interrupt isolation mainly relies on the interrupt interception capability of the machine mode (M-mode) in the multi-layer privilege model. Specifically, the platform level interrupt controller (PLIC) configures all interrupt sources located outside the processor into the machine mode, so that the interrupt requests from each interrupt source outside the processor will first trap into the machine mode, and then the trusted firmware (TF) running in the machine mode uniformly controls all interrupt requests. For each interrupt request, the trusted firmware will "forward" it to the execution zone to which the interrupt source belongs after identifying the interrupt source, so as to complete the interrupt response. This interrupt processing method can meet the interrupt isolation requirements among different execution zones, but since the interrupt request needs to be forwarded by the trusted firmware, the trusted firmware needs to switch the execution zone context when forwarding each interrupt request, which makes the interrupt response slow and causes obvious interrupt delay. SUMMARY

[0004] Therefore, the present disclosure aims to provide an interrupt isolation technology for multiple execution zones to improve the interrupt response speed and solve the technical problem of obvious interrupt delay in the prior art.

[0005] According to a first aspect of the present disclosure, a system on chip is provided, comprising:

[0006] a platform-level interrupt controller, configured to configure an interrupt source as a super-user privilege mode, and generate a second interrupt request after receiving a first interrupt request sent by the interrupt source, the second interrupt request comprising the first interrupt request and a first domain identifier, the first domain identifier being a domain identifier of an execution domain to which the interrupt source belongs;

[0007] a processor, configured to run a plurality of execution domains in a time-sharing manner in the super-user privilege mode, and determine whether a currently running execution domain is the execution domain to which the interrupt source belongs according to the first domain identifier in the case where the second interrupt request is received, and process the first interrupt request by the currently running execution domain if the currently running execution domain is the execution domain to which the interrupt source belongs;

[0008] an on-chip bus, configured to couple the platform-level interrupt controller and the processor.

[0009] Optionally, the first interrupt request carries an interrupt source identifier identifying the interrupt source.

[0010] The platform-level interrupt controller comprises an interrupt enable register, and the interrupt enable register stores interrupt enable information, the interrupt enable information being information for configuring an interrupt target for the interrupt source.

[0011] The platform-level interrupt controller is further configured to determine the interrupt target configured for the interrupt source according to the interrupt source identifier and the interrupt enable information, obtain the execution domain to which the interrupt source belongs according to the determined interrupt target, and take the domain identifier of the obtained execution domain as the first domain identifier after receiving the first interrupt request sent by the interrupt source.

[0012] Optionally, the first interrupt request carries an interrupt source identifier identifying the interrupt source.

[0013] The platform-level interrupt controller comprises an association register, and the association register stores association information, the association information being information generated after an interrupt source identifier of an interrupt source and a domain identifier of an execution domain to which the interrupt source belongs are associated.

[0014] The platform-level interrupt controller is further configured to determine the first domain identifier according to the interrupt source identifier and the association information after receiving the first interrupt request sent by the interrupt source.

[0015] Optionally, the processor is further configured to:

[0016] in the case where the currently running execution domain is not the execution domain to which the interrupt source belongs, send the first interrupt request to a trusted firmware running in a machine privilege mode by the currently running execution domain, so as to control the interrupt request by the trusted firmware.

[0017] Optionally, the plurality of execution domains of the processor belong to a normal execution environment and a trusted execution environment, and the execution domain of the normal execution environment and the execution domain of the trusted execution environment adopt different domain identifiers.

[0018] According to a second aspect of the present disclosure, a peripheral processor is provided, which is used as an interrupt source of a target processor and is connected to the target processor through a platform-level interrupt controller, wherein,

[0019] The peripheral processor is configured by the platform-level interrupt controller in one of a machine privilege mode and a superuser privilege mode;

[0020] In the case that the peripheral processor is configured by the platform-level interrupt controller in the superuser privilege mode:

[0021] The first interrupt request sent by the peripheral processor is converted by the platform-level interrupt controller into a second interrupt request, the second interrupt request comprising the first interrupt request and a first domain identifier, the first domain identifier being a domain identifier of an execution domain to which the peripheral processor belongs in the target processor; and

[0022] After the second interrupt request is received by the target processor, if the target processor determines according to the first domain identifier that a currently running execution domain is the execution domain to which the peripheral processor belongs, the first interrupt request sent by the peripheral processor is processed by the currently running execution domain of the target processor.

[0023] According to a third aspect of the present disclosure, an interrupt isolation method is provided for realizing isolation of a first interrupt request among a plurality of execution domains, an interrupt source generating the first interrupt request being configured in a superuser privilege mode, the method comprising:

[0024] Receiving a second interrupt request, the second interrupt request comprising the first interrupt request and a first domain identifier, the first domain identifier being a domain identifier of an execution domain to which the interrupt source belongs;

[0025] Determining whether a currently running execution domain is the execution domain to which the interrupt source belongs according to the first domain identifier;

[0026] In the case that the currently running execution domain is the execution domain to which the interrupt source belongs, processing the first interrupt request by the currently running execution domain.

[0027] Optionally, determining whether the currently running execution domain is the execution domain to which the interrupt source belongs according to the first domain identifier comprises:

[0028] Obtaining a second domain identifier, the second domain identifier being a domain identifier of the currently running execution domain;

[0029] determine whether the first domain identifier and the second domain identifier are identical;

[0030] In a case where the first domain identifier and the second domain identifier are identical, the currently running execution domain is the execution domain to which the interrupt source belongs.

[0031] Optionally, the interrupt isolation method further comprises: in a case where the currently running execution domain is not the execution domain to which the interrupt source belongs, sending, by the currently running execution domain, the first interrupt request to a trusted firmware running in a machine privilege mode, so as to control the first interrupt request by the trusted firmware.

[0032] Optionally, the plurality of execution domains belong to a normal execution environment and a trusted execution environment, and execution domains of the normal execution environment and execution domains of the trusted execution environment adopt different domain identifiers.

[0033] According to a fourth aspect of the present disclosure, a computer device is provided, comprising: any one of the system on chips according to the first aspect; an off-chip bus; and a storage device coupled to the system on chip through the off-chip bus.

[0034] In the embodiments of the present disclosure, the interrupt source is no longer configured in a machine privilege mode, but is configured in a superuser privilege mode by a platform-level interrupt controller, so that the interrupt request sent by the interrupt source is allowed to be directly processed by an execution domain; and the platform-level interrupt controller extends the first interrupt request into a second interrupt request comprising the first interrupt request and a first domain identifier, the first domain identifier being a domain identifier of an execution domain to which the interrupt source belongs, so that after receiving the second interrupt request, the processor can determine, in the currently running execution domain, whether the currently running execution domain is the execution domain to which the interrupt source belongs according to the first domain identifier. If the processor determines that the currently running execution domain is the execution domain to which the interrupt source belongs, the first interrupt request is directly processed by the currently running execution domain, which not only ensures that the first interrupt request is processed by the execution domain to which the interrupt source belongs, and realizes interrupt isolation, but also makes the first interrupt request not need to be forwarded by a trusted firmware, thereby saving the time consumed for switching the execution domain context, improving the interrupt response speed, and solving the technical problem of obvious interrupt delay in the prior art. BRIEF DESCRIPTION OF DRAWINGS

[0035] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of embodiments of the present disclosure, taken in conjunction with the accompanying drawings, in which:

[0036] Figure 1 A schematic diagram of a privilege model in a RISC-V processor without security extension is shown;

[0037] Figure 2 A schematic diagram of a privilege model in a RISC-V processor with security extension is shown.

[0038] Figure 3 A delivery diagram of an exemplary interrupt request in the prior interrupt response method is shown;

[0039] Figure 4 A flowchart of responding to an exemplary interrupt request in the prior interrupt response method is shown;

[0040] Figure 5 A connection structure diagram of an interrupt source to a processor in a RISC-V based computer device is shown;

[0041] Figure 6 A structure diagram of a system on chip provided by an embodiment of the present disclosure is shown;

[0042] Figure 7 A delivery diagram of an exemplary interrupt request in the interrupt response process of a system on chip provided by an embodiment of the present disclosure is shown;

[0043] Figure 8 A response flowchart of an exemplary interrupt request in the interrupt response process of a system on chip provided by an embodiment of the present disclosure is shown;

[0044] Figure 9 A flowchart of an interrupt isolation method provided by an embodiment of the present disclosure is shown;

[0045] Figure 10 A structure diagram of a general-purpose computer device applying the system on chip of the present disclosure is shown. DETAILED DESCRIPTION

[0046] The present disclosure is described below based on embodiments, but the present disclosure is not limited to only these embodiments. In the following detailed description of the present disclosure, some specific details are described in detail. The present disclosure can also be fully understood without the description of these details by those skilled in the art. In order to avoid confusion of the essence of the present disclosure, well-known methods, processes, and flows are not described in detail. In addition, the drawings are not necessarily drawn to scale.

[0047] Secure extended RISC-V processor

[0048] RISC-V processors without security extensions do not provide isolation technology similar to ARM TrustZone, and such processors run in a general execution environment (Rich Execution Environment, referred to as REE) as a whole, as shown in FIG. 1. Referring to FIG. 1, the RISC-V processor is running in the REE, and the REE is running in the operating system (Operating System, referred to as OS). Figure 1 Figure 1 ​The structure of the software stack in the processor is divided into multiple layers, specifically including SEE (Supervisor Execution Environment), OS (operating system), and APP (application); the privilege levels include machine privilege mode (M mode), supervisor privilege mode (S mode), and user privilege mode (U mode), wherein the user privilege mode runs the APP, the supervisor privilege mode runs the OS, and the machine privilege mode runs the SEE; the multiple APPs in the user privilege mode and the user privilege mode and the supervisor privilege mode are isolated through a memory management unit (MMU); and the user privilege mode / supervisor privilege mode and the machine mode are isolated through a physical memory protection mechanism.

[0049] In fact, the RISC-V technology provides two attributes with security expansion capabilities, namely the above-mentioned physical memory protection mechanism and the machine privilege mode, wherein the physical memory protection mechanism can divide the access space of the processor into physical memory regions of any size, different regions can be granted different access permissions, and the physical memory protection mechanism can separate the running environments of multiple supervisor privilege modes from each other; the machine privilege mode can be used to manage the running environments of multiple supervisor privilege modes and can intercept interrupts and exceptions from the running environments in any user privilege mode / supervisor privilege mode. With the physical memory protection mechanism and the machine privilege mode, it means that the running environments of the supervisor privilege modes can be isolated from each other and the supervisor privilege mode environments can be managed through a higher privilege (i.e., the machine mode). Based on this, the RISC-V processor can be safely expanded.

[0050] Specifically, the RISC-V processor after security expansion virtually creates multiple execution zones (Zones) under the coordination of software, each execution zone increases a zone identifier (Zone ID), and the overall architecture is as follows Figure 2Zone #0", "Zone #1" and "Zone #N" are domain identifiers, and (N+1) represents the total number of execution domains. Each execution domain can independently run a respective operating system and applications based on the operating system. The operating system runs in a superuser privilege mode, and the applications run in a normal user privilege mode. The processor switches between different execution domains as needed and runs in different execution domains in time-sharing manner. When the processor switches to run in a certain execution domain, it will occupy the entire processor core in real time, and the domain identifier of the processor will also be updated to the identifier of the corresponding execution domain at the same time. The switching of execution domains is completed by a trusted firmware (TF) running in machine mode, and the access isolation between execution domains is realized by a physical memory protection mechanism.

[0051] The trusted firmware described above is an open source software running in a hardware-isolated secure environment and providing security services. The hardware isolation is realized by a separate processor core based on the multi-core structure of the processor, for example. The security services include the execution domain switching function described above, and the interrupt interception function described above, for example. The security services only expose limited interfaces, which can reduce the probability of being attacked. The trusted firmware has its own resources and unique execution thread, further reducing the probability of being attacked.

[0052] The physical memory protection mechanism described above requires each execution domain to be provided with a configuration register. The PMP configuration information stored in the configuration register limits the memory or memory-mapped I / O that the corresponding execution domain is allowed to access. When multiple execution domains need to share memory, the access permissions of the memory region that needs to be accessed in common can be granted to multiple execution domains at the same time, that is, the allowed access permissions of the block of memory are written into the PMP configuration information of each execution domain. When the processor switches from one execution domain to another execution domain, the trusted firmware in machine mode needs to save the PMP configuration information of the current execution domain first, and then load the PMP configuration information of the execution domain that is about to be switched to next, to complete the switching of the access permissions of the memory or memory-mapped I / O, that is, the switching of the PMP configuration. The switching of the PMP configuration makes the currently running execution domain only be able to access the limited memory or memory-mapped I / O, thereby realizing the access isolation of the memory or memory-mapped I / O between multiple execution domains and even the isolation of executable instructions.

[0053] Further, in addition to the execution domains involving the superuser privilege mode and the normal user privilege mode being isolated by the physical memory protection mechanism, the machine mode can also be limited to access a limited region by the locking function of the physical memory protection mechanism, such as only allowing the trusted firmware in machine mode to access / execute the memory region allocated to the trusted firmware (such as the memory region shown in the execution domain Zone #N). Figure 2 the memory region in the execution domain Zone #N shown in the figure,Figure 2 The SecurePartition in the execution domain Zone#N shown is a running unit of the trusted firmware, and various security services provided by the trusted firmware are grouped in one or more security partitions according to categories (for example, a partition providing a secure storage service, a partition providing an encryption and decryption service, and a partition providing an initialization attestation service, etc.), which can reduce attacks on the machine mode and thus protect various critical information controlled in the machine mode.

[0054] Referring to Figure 2 , the plurality of APPs in each execution domain and the normal user privilege mode and the super user privilege mode can be isolated as shown in Figure 1 , and in some embodiments, isolation can also be achieved through a super user privilege mode configurable physical memory isolation technology (SPMP).

[0055] Existing response process of secure extended RISC-V processor to interrupt

[0056] In addition to the need for isolation of instruction execution and memory access between execution domains, interrupt resources also need to be isolated from each other. Referring to Figure 3 , in the RISC-V processor extended with security, the existing method of isolating interrupt resources is to configure all interrupt sources as machine privilege mode, so that interrupt requests from each interrupt source outside the processor (in this disclosure, the interrupt request generated by the interrupt source is also called the first interrupt request, to distinguish from the second interrupt request generated by the platform-level interrupt controller to expand the first interrupt request, which includes the first domain identifier) will first trap into machine privilege mode, and then all interrupt requests are uniformly controlled by the trusted firmware running in machine privilege mode. For each interrupt request, the trusted firmware will "forward" it to the execution domain to which the interrupt source belongs after identifying the interrupt source to complete the interrupt response. Figure 3 In this case, the interrupt source sending the interrupt request 1 belongs to the execution domain Zone#0, the interrupt source sending the interrupt request 2 belongs to the execution domain Zone#1, and the interrupt source sending the interrupt request 3 belongs to the execution domain Zone#N.

[0057] In some examples, the interrupt request carries an interrupt source identifier identifying the interrupt source, and the trusted firmware can obtain the interrupt source identifier by parsing the interrupt request after receiving the interrupt request, so as to identify the interrupt source sending the interrupt request according to the interrupt source identifier. The interrupt source identifier can be an interrupt source serial number. Some processors support up to 1023 interrupt sources, so there are 1023 interrupt source serial numbers from 1 to 1023, which can be used as the interrupt source identifier of the corresponding interrupt source.

[0058] The above process of executing the interrupt response in the machine mode can be referred to Figure 4 . Figure 4The processor is currently running in execution domain Zone#0, the trusted firmware receives interrupt request 1 and interrupt request 2 in sequence, the interrupt source sending the interrupt request 1 belongs to execution domain Zone#0, and the interrupt source sending the interrupt request 2 belongs to execution domain Zone#1, so for the interrupt request whose execution domain of the interrupt source is the same as the current running execution domain, the response process of the interrupt request 1 can be referred to, and for the interrupt request whose execution domain of the interrupt source is different from the current running execution domain, the response process of the interrupt request 2 can be referred to.

[0059] Figure 4 The machine mode execution interrupt response process shown includes:

[0060] In step S110, the processor is currently running in execution domain Zone#0.

[0061] In step S120, the trusted firmware receives interrupt request 1 of self-trapping to machine mode when the processor is running in execution domain Zone#0.

[0062] In step S131, the trusted firmware saves the context of execution domain Zone#0.

[0063] Specifically, the context of an execution domain is a minimum data set required during running of the execution domain. The context of execution domain Zone#0 is stored in a general register, and the trusted firmware saving the context of execution domain Zone#0 means that the trusted firmware reads the general register to obtain the context of execution domain Zone#0, and saves the obtained context of execution domain Zone#0 in a memory area of the trusted firmware.

[0064] In step S132, the trusted firmware obtains the interrupt source identifier carried by the interrupt request 1, and determines that the execution domain to which the interrupt source belongs is execution domain Zone#0 according to the obtained interrupt source identifier.

[0065] Specifically, the memory area of the trusted firmware stores an association relationship table generated by associating the interrupt source identifier and the domain identifier of the execution domain to which the interrupt source belongs, so that the execution domain to which the interrupt source belongs can be determined by querying the association relationship table after the interrupt source identifier is obtained.

[0066] In step S133, the trusted firmware switches the PMP configuration information and the domain identifier according to the determined execution domain Zone#0.

[0067] It should be noted that switching the PMP configuration information and the domain identifier means switching the PMP configuration information and the domain identifier from the currently running execution domain to the execution domain processing the interrupt request. Here, since the execution domain of the interrupt source of the interrupt request 1 is the same as the current running execution domain, the PMP configuration information and the domain identifier are the same before and after switching.

[0068] Step S134, the trusted firmware flushes all general registers.

[0069] Specifically, the trusted firmware flushes all general registers, i.e. erases the context of the current running execution domain stored in all general registers.

[0070] It should be noted that the general registers, as important data storage resources in the processor, store the context of the execution domain, avoiding the operation of storing and reading the context from the memory. Since the access speed of the registers is faster than that of the memory blocks, the operand can be quickly read out during the running of the execution domain. However, since the number and capacity of the general registers are limited, the general registers only save the context of the currently running execution domain. Here, the trusted firmware flushes all general registers, in order to make the general registers available for the execution domain handling the interrupt request.

[0071] Step S135, the trusted firmware acquires the interrupt entry of the interrupt request 1 in the execution domain Zone#0 (i.e. the execution domain to which the interrupt source belongs).

[0072] It should be noted that the interrupt entry refers to the interrupt handler, which is the program that needs to be run by the processor in the process of handling the emergency event required to be handled by the interrupt request. Referring to Figure 2 , the execution domain runs the operating system and also runs multiple different application programs, and the interrupt handler is usually only part of the program running in the execution domain (starting from part of the program in the operating system, and in some cases, also involving part of the application program), so it is necessary to determine the interrupt entry of the interrupt request in the execution domain to which the interrupt source belongs.

[0073] Step S136, the trusted firmware exits the running of the machine privilege mode by executing the mret instruction and jumps to the interrupt entry of the execution domain Zone#0 (i.e. the execution domain to which the interrupt source belongs).

[0074] Step S140, the execution domain Zone#0 executes the interrupt handler corresponding to the interrupt request 1;

[0075] Step S137, the execution of the sret instruction by the execution domain Zone#0 makes the running of the superuser privilege mode exit and the processor jumps to the running of the trusted firmware, and then the trusted firmware restores the context of the execution domain Zone#0 saved in step S131 into the general registers, and the trusted firmware exits the running of the machine privilege mode by executing the mret instruction and makes the processor jump to the running of the execution domain Zone#0.

[0076] It should be noted that the above sret instruction and mret instruction are a set of exit instructions defined in the RISC-V architecture, and the set of exit instructions also includes uret instruction executed by the normal user privilege mode, and the implementation of the above-mentioned functions after the execution of these exit instructions belongs to the prior art, which will not be described in detail here.

[0077] Step S150, the execution domain Zone#0 continues to run the program interrupted by the interrupt request 1.

[0078] It should be understood that since step S37 restores the context of the execution domain Zone#0 saved in step S31 into the general register, here the execution domain Zone#0 can continue to run by directly reading the operands from the general register, instead of running from the beginning.

[0079] Step S160, the trusted firmware receives an interrupt request 2 which is a self-trap to the machine mode when the processor runs in the execution domain Zone#0.

[0080] Step S171, the trusted firmware saves the context of the execution domain Zone#0.

[0081] It should be noted that since the execution domain Zone#0 continues to run the program interrupted by the interrupt request 1 in step S50, the context saved in step S71 is different from the context saved in step S31.

[0082] Step S172, the trusted firmware obtains the interrupt source identifier carried by the interrupt request 2, and determines that the execution domain to which the interrupt source belongs is the execution domain Zone#1 according to the obtained interrupt source identifier.

[0083] Step S173, the trusted firmware switches the PMP configuration information and the domain identifier according to the determined execution domain Zone#1. Here, the switched PMP configuration information and the domain identifier correspond to the execution domain Zone#1, that is, the PMP configuration information and the domain identifier are different before and after switching.

[0084] Step S174, the trusted firmware flushes all general registers.

[0085] Step S175, the trusted firmware obtains the interrupt entry of the execution domain Zone#1 for the interrupt request 2.

[0086] Step S176, the trusted firmware exits the machine privilege mode by executing the mret instruction and jumps to the interrupt entry of the execution domain Zone#0 (i.e. the execution domain to which the interrupt source belongs).

[0087] Step S180, the execution domain Zone#1 executes the interrupt handling program corresponding to the interrupt request 1;

[0088] Step S177, the execution domain Zone#1 exits the superuser privilege mode running by executing the sret instruction and makes the processor jump to the running of the trusted firmware, which then restores the context of the execution domain Zone#0 saved in step S171 into the general registers, and the trusted firmware exits the machine privilege mode running by executing the mret instruction and makes the processor jump to the running of the execution domain Zone#0.

[0089] Step S190, the execution domain Zone#0 continues running the program interrupted by the interruption request 2.

[0090] In the field of Internet of Things, the handling of emergency events often involves interruption, either like the interruption requested by the interruption request 1 or like the interruption requested by the interruption request 2. For example, when a printer finishes a printing task, the computer connected with the printer needs to immediately remind the user of the printing end. In this process, the printer, as the peripheral device, needs to first make an interruption request to the processor of the computer when it finishes the printing task, i.e. to request the processor to stop the currently running program so as to timely remind the user. The interruption request made by the printer to the processor of the computer is the above-mentioned interruption request, and the printer is the interruption source. Referring to Figure 2 For the RISC-V processor with security expansion, the interruption request sent by the printer is processed by the execution domain Zone#0. If the processor is currently running in the execution domain Zone#0, the execution domain Zone#0 needs to interrupt the currently running program (e.g. the application program “Foxmail”) and then generate the information reminding the user of the printing end and control the display to display. If the processor is currently running in an execution domain other than the execution domain Zone#0 (e.g. running the online banking program in the execution domain Zone#1), the currently running execution domain needs to interrupt the running program and jump to the execution domain Zone#0 so as to generate the information reminding the user of the printing end and control the display to display.

[0091] Since the processor runs in different execution domains at different times, and the processor receives different interrupt requests at different times, the trusted firmware can receive interrupt requests from the same execution domain as the current running execution domain (e.g., the interrupt request 1 described above) and interrupt requests from different execution domains (e.g., the interrupt request 2 described above). In the above interrupt response process, the interrupt request 1 and the interrupt request 2 are both trapped into the machine privileged mode, and the trusted firmware running in the machine privileged mode uses a unified process to respond to the interrupt request 1 and the interrupt request 2. Each interrupt request is only processed by the execution domain to which the interrupt source belongs, that is, the interrupt isolation between different execution domains is achieved. However, in this method, each interrupt request is forwarded by the trusted firmware running in the machine privileged mode, and the trusted firmware needs to perform a plurality of processing steps (e.g., steps S131 to S136 and S137, or steps S171 to S176 and S177) in the process of forwarding each interrupt request. The processing process is time-consuming, and the response of each interrupt request is very slow, which leads to obvious interrupt delay.

[0092] In some examples, the step S132 is executed by software configuration, and after the step S132 is executed, it is determined that the execution domain to which the interrupt source belongs is the same as the current running execution domain. Then, the steps S31, S33, S34 and S37 described above are not executed. However, since the interrupt request is first trapped into the machine privileged mode, the steps S35 and S36 described above are indispensable, that is, the jump step from the machine privileged mode to the super user privileged mode is indispensable. Therefore, the interrupt delay is still relatively obvious.

[0093] System on chip provided by embodiments of the present disclosure

[0094] In the RISC-V architecture, interrupts are divided into two categories, namely global interrupts and local interrupts. Figure 5 The connection structure from the interrupt source to the processor in the RISC-V based computer device is shown. Referring to Figure 5, local interrupt, RISC-V standard specifies that there are only two kinds of local interrupt, namely, timer initiated interrupt and software initiated interrupt, and the interrupt source of local interrupt is connected to the processor through CLINT (Core-Local Interruptor, processor core local interrupt controller); global interrupt, also known as external interrupt, is initiated by peripherals, including interrupts initiated by peripherals connected through GPIO (General Purpose Input / Output Port), SPI (Serial Peripheral Interface) and I2C (Serial Transmission Bus), and the interrupt source of external interrupt is connected to the processor through PLIC (Platform Level Interrupt Controller). The biggest difference between CLINT and PLIC is that CLINT has no arbitration and responds immediately upon receiving an interrupt request; PLIC needs a decision-making process of arbitration, that is, to decide which interrupt request is responded first, and there is a problem of interrupt priority configuration.

[0095] In addition to being used to configure the interrupt priority of the external interrupt source, the PLIC is also used to configure the privilege mode and the interrupt target of the external interrupt source. In the existing interrupt response method described above, the PLIC configures the privilege mode of all external interrupt sources as the machine privilege mode, so that the interrupt request sent by each external interrupt source is trapped into the machine privilege mode of the processor through the PLIC. The PLIC configures the interrupt target of the external interrupt source through an interrupt enable register.

[0096] Specifically, each interrupt target in the processor has an interrupt enable bit for each interrupt source, which can be used to enable the corresponding interrupt. The interrupt enable bit is a storage bit in the interrupt enable register (which storage bit in the enable register is the interrupt enable bit for one interrupt source and one interrupt target is configured through an address register). In some computer devices, when the interrupt enable bit is 1, it means that the interrupt is enabled, that is, the interrupt source can interrupt the interrupt target; when the interrupt enable bit is 0, it means that the interrupt is masked, that is, the interrupt source cannot interrupt the interrupt target. In this disclosure, all interrupt enable bits of one interrupt source are called the interrupt enable information of the interrupt source, so that the interrupt enable information configures the interrupt target for the interrupt source. The interrupt target can be a processor core isolated in hardware isolation technology, or an operating system running in an isolated execution domain in software isolation technology. The basic function of the PLIC implemented in some computer devices supports at most interrupt distribution of 4 processor cores or interrupt distribution of 8 operating systems, so the interrupt enable information of one interrupt source includes 4 or 8 interrupt enable bits.

[0097] The present disclosure mainly improves the interrupt isolation method of external interrupt, so that the interrupt request is isolated among multiple execution domains, and the technical effect of relieving interrupt delay is achieved. In the absence of special mention, the interrupt described in the present disclosure is external interrupt, and the interrupt source is peripheral device. In order to relieve the interrupt delay of external interrupt, the present disclosure mainly improves the PLIC and processor shown in Figure 5 , and provides a system on chip as shown in Figure 6 .

[0098] Referring to Figure 6 , the system on chip 100 provided by the present disclosure includes an on-chip bus 110, a PLIC 120 and a processor 130 coupled through the on-chip bus 110, wherein the PLIC 120 no longer configures all interrupt sources as machine privileged mode as in the prior art, but configures all interrupt sources as super user privileged mode, so that the first interrupt request Req sent by the interrupt source is no longer forwarded by the trusted firmware to enter the execution domain running in the super user privileged mode after being received by the processor 130, but is allowed to be directly processed by the execution domain. The PLIC 120 is further configured to extend the first interrupt request Req sent by the interrupt source to generate a second interrupt request Req', the second interrupt request Req' including the first interrupt request Req and a first domain identifier Zone ID x , the first domain identifier Zone ID x being the domain identifier of the execution domain to which the interrupt source belongs. The processor 130 is configured to receive the second interrupt request Req', and after receiving the second interrupt request Req', determine whether the currently running execution domain is the execution domain to which the interrupt source belongs according to the first domain identifier Zone ID x , and in the case that the currently running execution domain is the execution domain to which the interrupt source belongs, directly process the interrupt request Req through the currently running execution domain, that is, the interrupt request Req is directly processed by the corresponding execution domain, the interrupt request Req is quickly processed on the basis of being isolated, and the problem of interrupt delay is effectively relieved.

[0099] Based on the above system 100, the peripherals as the interrupt source of the processor 130 also have corresponding improvements. Specifically, the peripheral processor can send an interrupt request to the processor 130 as an interrupt source of the processor 130, and send an interrupt request to a traditional processor as an interrupt source of the traditional processor. Thus, the peripheral processor is configured as a machine privilege mode by a platform-level interrupt controller matched with the traditional processor, and is configured as a superuser privilege mode by the PLIC 120 matched with the processor 130. When the peripheral processor is configured as the superuser privilege mode by the PLIC 120, the first interrupt request Req sent by the peripheral processor is first converted into a second interrupt request Req' by the PLIC 120. Then, after the second interrupt request Req' is received by the processor 130, if the processor 130 determines that the current running execution domain is not the execution domain to which the peripheral processor belongs according to the first domain identifier Zone ID x If it is determined that the current running execution domain is the execution domain to which the peripheral processor belongs, the first interrupt request Req sent by the peripheral processor is directly processed by the current running execution domain of the processor 130.

[0100] Specifically, the processor 130 is provided with a domain identifier during running. As described above, the domain identifier of the processor 130 is the domain identifier of the currently running execution domain, which is referred to as the second domain identifier. Based on this, the processor 130 determines whether the current running execution domain is the execution domain to which the interrupt source belongs according to the first domain identifier Zone ID x The determination of whether the current running execution domain is the execution domain to which the interrupt source belongs can be: obtaining the second domain identifier, and determining whether the first domain identifier Zone ID x is the same as the second domain identifier. If the first domain identifier Zone ID x is the same as the second domain identifier, the current running execution domain is the execution domain to which the interrupt source belongs. If the first domain identifier Zone ID x is different from the second domain identifier, the current running execution domain is not the execution domain to which the interrupt source belongs.

[0101] In an optional embodiment, the first interrupt request Req carries an interrupt source identifier (also referred to as interrupt identifier, i.e., Interrupt ID) identifying the interrupt source, and the PLIC 120 can determine the interrupt target configured by the interrupt source according to the interrupt source identifier and the interrupt enable information described above upon receiving the first interrupt request Req, and further acquire the execution domain to which the interrupt source belongs according to the determined interrupt target, which can be achieved by the PLIC 120 by querying the correspondence table between the interrupt target and the execution domain. For the interrupt target being an operating system running in the execution domain, the PLIC 120 can determine the execution domain to which the interrupt source belongs according to the information existing in the prior art, since the operating system and the execution domain have a one-to-one correspondence. For the interrupt target being a processor core, the PLIC 120 can also determine the execution domain to which the interrupt source belongs according to the information existing in the prior art, since the processor core usually corresponds to one execution domain in the security extension technology. After acquiring the execution domain to which the interrupt source belongs, the PLIC 120 can take the domain identifier of the acquired execution domain as the first domain identifier Zone IDx x , thereby completing the determination process of the first domain identifier Zone IDx x .

[0102] In another optional embodiment, the first interrupt request Req carries an interrupt source identifier identifying the interrupt source, and the PLIC 120 adds an association register storing association information generated by associating the interrupt source identifier of one interrupt source with the domain identifier of the execution domain to which the interrupt source belongs, so that the PLIC 120 can directly determine the first domain identifier Zone IDx x according to the interrupt source identifier and the association information upon receiving the first interrupt request Req sent by the interrupt source. It should be noted that one interrupt source is allowed to configure only one interrupt target at the same time, and the interrupt target corresponds to a unique execution domain, so the interrupt source and the execution domain have a one-to-one correspondence, and the above association information is a one-to-one correspondence between the interrupt source identifier and the domain identifier.

[0103] Further, the processor 130 is further configured to send the first interrupt request Req to a trusted firmware running in the machine privilege mode in a case where the currently running execution domain is not the execution domain to which the interrupt source belongs, so as to control the first interrupt request Req by the trusted firmware running in the machine privilege mode. It should be noted that the processor 130 judges whether the currently running execution domain is the execution domain to which the interrupt source belongs according to the first domain identifier Zone IDx, and the currently running execution domain processes it, and in a case where the currently running execution domain is not the execution domain to which the interrupt source belongs, the currently running execution domain sends the first interrupt request Req to the trusted firmware running in the machine privilege mode.

[0104] The system-on-chip 100 provided in this disclosure receives sequentially... Figure 3 In the case of interrupt requests 1, 2, and 3 sent by the interrupt sources shown, if processor 130 is currently running in execution zone #0, then as follows: Figure 7 As shown, interrupt request 1 is directly processed by execution domain #0, while interrupt requests 2 and 3 are sent to machine privilege mode; if processor 130 is currently running in execution domain #1, then interrupt request 2 is directly processed by execution domain #1, while interrupt requests 1 and 3 are sent to machine privilege mode; if processor 130 is currently running in execution domain #N, then interrupt request 3 is directly processed by execution domain #N, while interrupt requests 1 and 2 are sent to machine privilege mode.

[0105] When the processor 130 is currently running in an execution domain that is not the execution domain to which the interrupt source belongs, the trusted firmware manages the first interrupt request Req process as in the prior art. Figure 4 Interrupt request 1 and interrupt request 2, the system-on-chip 100 provided in this disclosure through Figure 8 The process shown is as follows. (Refer to...) Figure 8 The process by which the System-on-Chip 100 responds to interrupt request 1 and interrupt request 2 includes:

[0106] Step S210: Processor 130 is currently running in execution domain Zone #0.

[0107] Step S220: Execution zone #0 receives interrupt request 1 whose interrupt source is configured in superuser privilege mode.

[0108] It should be understood that after PLIC 120 sends the extended interrupt request 1 to processor 130, since the interrupt source of interrupt request 1 is configured in superuser privilege mode, the currently running execution domain Zone#0 within processor 130 directly receives interrupt request 1.

[0109] Step S230: Execute the interrupt handler corresponding to interrupt request 1 in Zone#0.

[0110] Specifically, for the extended interrupt request 1, the execution domain Zone#0, as described above, needs to determine whether the execution domain Zone#0 is the execution domain to which the interrupt source belongs based on the first domain identifier Zone#0, and if it is determined that the execution domain Zone#0 is the execution domain to which the interrupt source belongs, the interrupt handler corresponding to interrupt request 1 is executed directly.

[0111] In step S240, the trusted firmware receives an interrupt request 2 that traps itself into machine mode while the processor is running in execution domain Zone#0.

[0112] Specifically, during the execution of the execution domain Zone#0, the extended interrupt request 2 is sent by the PLIC 120 to the processor 130, and the execution domain Zone#0 determines that the currently running execution domain is not the execution domain to which the interrupt source of the interrupt request 2 belongs, and then sends the interrupt request 2 to the trusted firmware running in the machine mode, so that the trusted firmware receives the interrupt request 2 which is self-trapped into the machine mode.

[0113] After the trusted firmware receives the interrupt request 2, the following steps S251 to S256 and S257 are performed as in the prior art, and the execution domain Zone#1 performs the following step S26 between the steps S256 and S257:

[0114] In step S251, the trusted firmware saves the context of the execution domain Zone#0.

[0115] In step S252, the trusted firmware obtains the interrupt source identifier carried by the interrupt request 2, and determines that the execution domain to which the interrupt source belongs is the execution domain Zone#1 according to the obtained interrupt source identifier.

[0116] In step S253, the trusted firmware switches the PMP configuration information and the domain identifier according to the determined execution domain Zone#1. Here, the switched PMP configuration information and the domain identifier correspond to the execution domain Zone#1, that is, the PMP configuration information and the domain identifier are different before and after switching.

[0117] In step S254, the trusted firmware flushes all general registers.

[0118] In step S255, the trusted firmware obtains the interrupt entry of the execution domain Zone#1 for the interrupt request 2.

[0119] In step S256, the trusted firmware exits the machine privileged mode by executing the mret instruction and jumps to the interrupt entry of the execution domain Zone#0.

[0120] In step S260, the execution domain Zone#1 executes the interrupt handling program corresponding to the interrupt request 2;

[0121] In step S257, the execution domain Zone#1 exits the superuser privileged mode by executing the sret instruction and makes the processor jump to the execution of the trusted firmware, and then the trusted firmware restores the context of the execution domain Zone#0 saved in step S251 into the general registers, and the trusted firmware exits the machine privileged mode by executing the mret instruction and makes the processor jump to the execution of the execution domain Zone#0.

[0122] In step S270, the execution domain Zone#0 continues to run the program interrupted by the interrupt request 2.

[0123] The above-mentioned system on chip 100 enables isolation of interrupt requests between different execution domains, and timely response of interrupt requests with the same execution domain as the execution domain of the interrupt source.

[0124] In some use scenarios, the processor 130 is isolated into two execution environments, a rich execution environment (REE) and a trusted execution environment (TEE), i.e., the execution domains of the processor 130 belong to the REE and the TEE. The REE runs a traditional complex operating system, such as Linux shown in FIG. 1, and all conventional tasks are completed in the REE, which occupies a large portion of the running time of the processor. The TEE runs a simplified and lightweight secure operating system, such as Secure OS shown in FIG. 1, and only a small number of security tasks (such as encryption and decryption services) are completed in the TEE, which occupies a small portion of the running time of the processor. In this use scenario, the execution domain of the rich execution environment and the execution domain of the trusted execution environment use different domain identifiers. After this setting: (1) when the processor 130 runs in the rich execution environment, if the interrupt source belongs to the rich execution environment, the first interrupt request is allowed to be directly processed by the rich execution environment; if the interrupt source belongs to the trusted execution environment, the first interrupt request needs to be forwarded to the trusted execution environment by the trusted firmware before being processed by the trusted execution environment. Since the processor runs in the rich execution environment most of the time, the first interrupt request can often be directly processed, and no interrupt delay is caused. (2) When the processor 130 runs in the trusted execution environment, if the interrupt source belongs to the trusted execution environment, the first interrupt request is allowed to be directly processed by the trusted execution environment; if the interrupt source belongs to the rich execution environment, the first interrupt request needs to be forwarded to the rich execution environment by the trusted firmware before being processed by the rich execution environment. Since the first interrupt request of the trusted execution environment can be directly processed in the trusted execution environment, the probability of interrupt delay caused by self-trapping to the trusted firmware is also reduced. Figure 2 Figure 2

[0125] Interrupt isolation method provided by embodiments of the present disclosure

[0126] Figure 9 FIG. 1 shows a flowchart of an interrupt isolation method provided by an embodiment of the present disclosure, which is executed by the above-mentioned processor 130. In this method, the interrupt source generating the interrupt request is configured in a superuser privilege mode, and the method includes the following steps as shown in FIG. 1. Figure 9

[0127] ​​​Step S10: Receive a second interrupt request. The second interrupt request includes a first interrupt request and a first domain identifier. The first domain identifier is the domain identifier of the execution domain to which the interrupt source belongs.

[0128] Step S20: Determine whether the currently running execution domain is the execution domain to which the interrupt source belongs based on the first domain identifier;

[0129] Step S30: If the currently running execution domain is the execution domain to which the interrupt source belongs, process the first interrupt request through the currently running execution domain.

[0130] The interrupt isolation method of this disclosure enables the first interrupt request, which belongs to the same execution domain as the interrupt source and the currently running execution domain, to be directly processed by the execution domain without trapping itself into the trusted firmware and being forwarded by the trusted firmware. Therefore, the interrupt response is timely, which also reduces the probability of interruption delay caused by the first interrupt request trapping itself into the trusted firmware.

[0131] In an optional embodiment, step S20, determining whether the currently running execution domain is the execution domain to which the interrupt source belongs based on the first domain identifier, includes: obtaining a second domain identifier, the second domain identifier being the domain identifier of the currently running execution domain; determining whether the first domain identifier and the second domain identifier are the same; wherein, if the first domain identifier and the second domain identifier are the same, the currently running execution domain is the execution domain to which the interrupt source belongs.

[0132] In an optional embodiment, the interruption isolation method further includes: if the currently running execution domain is not the execution domain to which the interrupt source belongs, sending the first interrupt request to trusted firmware running in machine privilege mode through the currently running execution domain, so that the trusted firmware can manage the interrupt request.

[0133] In an optional embodiment, multiple execution domains belong to a normal execution environment and a trusted execution environment, and the execution domains of the normal execution environment and the execution domains of the trusted execution environment use different domain identifiers.

[0134] The detailed process of each step of the interrupt isolation method provided in this embodiment can be referred to the above-described on-chip system, and will not be repeated here.

[0135] Specific application of system on chip

[0136] Figure 10 This is a schematic diagram of a general-purpose computer device. As shown in the figure, the computer device 10 may include one or more processors 12 and memory 14. Specifically, for one processor 12, in some examples, the computer device 10 is configured with a PLIC (Platform for Computing) located outside of that processor 12. Figure 10The PLIC is connected to the bus 11 and the communication device 18 and external interrupt sources, and the on-chip system 100 provided in the above embodiments is the processor 12 included in the computer device 10 and the PLIC configured for the processor 12; in other examples, the processor 12 is integrated with the PLIC, and the on-chip system 100 provided in the above embodiments can be used as the processor 12 integrated with the PLIC.

[0137] The memory 14 in the computer device 10 can be a main memory (referred to as main memory or memory for short). It is used to store instruction information and / or data information represented by a data signal, for example, to store data provided by the processor 12 (for example, as a result of an operation), and is also used to implement data exchange between the processor 12 and the external storage device 17 (also referred to as auxiliary memory or external memory).

[0138] In some cases, the processor 12 needs to access the memory 14 to obtain data in the memory 14 or modify data in the memory 14. Since the access speed of the memory 14 is relatively slow, in order to alleviate the speed gap between the processor 12 and the memory 14, the computer device 10 further includes a cache memory 19 coupled to the bus 11, which is used to cache some program data or message data in the memory 14 that can be repeatedly called. The cache memory 19 is implemented by a storage device such as a static random access memory (SRAM). The cache memory 19 can be a multi-level structure, for example, a three-level cache structure with a first-level cache (L1 Cache), a second-level cache (L2 Cache), and a third-level cache (L3 Cache), or a cache structure with more than three levels or other types of cache structures. In some embodiments, a part of the cache memory 19 (for example, the first-level cache, or the first-level cache and the second-level cache) can be integrated inside the processor 12 or integrated in the same on-chip system as the processor 12.

[0139] Based on this, the processor 12 can include an instruction execution unit 121, a memory management unit 122, and the like. The instruction execution unit 121 initiates a write access request when executing some instructions that need to modify the memory, and the write access request specifies write data to be written into the memory and a corresponding physical address; the memory management unit 122 is used to translate a virtual address specified by the instructions into a physical address mapped by the virtual address, and the physical address specified by the write access request can be consistent with the physical address specified by the corresponding instructions.

[0140] The information interaction between the memory 14 and the cache memory 19 is usually organized in blocks. In some embodiments, the cache memory 19 and the memory 14 can be divided into data blocks in the same spatial size, and the data blocks can be the minimum unit of data exchange between the cache memory 19 and the memory 14 (including one or more data of a preset length). For the sake of simplicity and clarity of expression, each data block in the cache memory 19 will be referred to as a cache block (which can be referred to as a cacheline or cache line) below, and different cache blocks have different cache block addresses; each data block in the memory 14 will be referred to as a memory block, and different memory blocks have different memory block addresses. The cache block address, for example, includes a physical address tag for locating a data block.

[0141] Due to the limitations of space and resources, the cache memory 19 cannot cache all the contents in the memory 14, that is, the storage capacity of the cache memory 19 is usually smaller than that of the memory 14, and each cache block address provided by the cache memory 19 cannot correspond to all the memory block addresses provided by the memory 14. When the processor 12 needs to access the memory, it first accesses the cache memory 19 through the bus 11 to determine whether the content to be accessed has been stored in the cache memory 19. If so, the cache memory 19 hits, and the processor 12 directly calls the content to be accessed from the cache memory 19. If the content to be accessed by the processor 12 is not in the cache memory 19, the cache memory 19, the processor 12 needs to access the memory 14 through the bus 11 to find the corresponding information in the memory 14. Because the access rate of the cache memory 19 is very fast, the efficiency of the processor 12 can be significantly improved when the cache memory 19 hits, thereby improving the performance and efficiency of the entire computer device 10.

[0142] In addition, the computer device 10 can also include a storage device 17, a display device 13, an audio device 15, a mouse / keyboard 16, and the like input / output devices. The storage device 17 is, for example, a hard disk, an optical disk, a flash memory, and the like device for information access coupled with the bus 11 through a corresponding interface. The display device 13 is, for example, coupled with the bus 11 through a corresponding display card, and is used for display according to the display signal provided by the bus 11.

[0143] The computer device 10 also typically includes a communication device 18, and thus can communicate with a network or other devices in a variety of manners. The communication device 18 may, for example, include one or more communication modules, and as an example, the communication device 18 can include a wireless communication module adapted for a particular wireless communication protocol. For example, the communication device 18 can include a WLAN module for implementing Wi-Fi™ communications in compliance with the 802.11 standards promulgated by the Institute of Electrical and Electronics Engineers (IEEE); the communication device 18 can also include a WWAN module for implementing wireless wide area communications in compliance with cellular or other wireless wide area protocols; the communication device 18 can also include a Bluetooth module or other communication module employing other protocols, or other custom types of communication modules; and the communication device 18 can also be a port for serial transmission of data.

[0144] Of course, different computer systems can vary in structure depending on the motherboard, operating system, and instruction set architecture. For example, many current computer systems have an input / output control hub connected between the bus 11 and various input / output devices, and this input / output control hub can be integrated within the processor 12 or independent of the processor 12.

[0145] Commercial value of embodiments of the present disclosure

[0146] The embodiments of the present disclosure enable the interrupt request of the interrupt source belonging to the same execution domain as the current running execution domain to be quickly responded, and effectively alleviate the state of interrupt delay. The system on chip provided by the embodiments of the present disclosure can form a computer device used in various scenarios, such as an Internet of Things device used in the field of Internet of Things and a smart device used in daily life. In these scenarios, the signal control is more sensitive through timely response by interrupt, and the user experience is improved. Therefore, the system on chip and the computer device constructed by the system on chip have good market prospects.

[0147] It should be understood that each embodiment in the specification is described in a progressive manner, and the same or similar parts between each embodiment can be referred to each other, and each embodiment mainly describes the difference from other embodiments. Especially for the method embodiment, since it is basically similar to the method described in the device and system embodiment, the description is relatively simple, and the related parts can refer to the part of the description of other embodiments.

[0148] It is to be understood that the foregoing description is descriptive only, certain embodiments having been described in particularity. Other embodiments are within the scope of the claims. In some cases the acts or steps recited in the claims can be performed in a different order and still accomplish the desired results. Additionally, the processes depicted in the figures do not necessarily require the particular order shown, or sequential order to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous or necessary.

[0149] It is to be understood that the singular forms "a," "an," and "the" include plural referents unless the context clearly dictates otherwise. Pronouns in the masculine form include the feminine form, and vice versa, and the singular form also includes the plural form, unless the context clearly dictates otherwise. It is further understood that the terms "comprise" and "comprising," when used in this specification, specify the presence of stated features, integers, steps, or components but do not preclude the presence or addition of one or more other features, integers, steps, components, or groups thereof.

[0150] It is also to be understood that the terminology and phraseology employed herein are for the purpose of description and the specification one or more embodiments of the present application should in no way be limited thereto. The use of such terms and expressions does not therefore exclude any equivalents and it is to be understood that the scope of the claims should be interpreted in the broadest manner possible. Other modifications, variations, and alternatives are also possible. Accordingly, the claims as appended hereto should be construed broadly.

Claims

1. A system-on-chip, comprising: a platform-level interrupt controller configured to configure an interrupt source as a super-user privilege mode, and generate a second interrupt request after receiving a first interrupt request sent by the interrupt source, the second interrupt request comprising the first interrupt request and a first domain identification, the first domain identification being a domain identification of an execution domain to which the interrupt source belongs; the first interrupt request carrying an interrupt source identification identifying the interrupt source, the platform-level interrupt controller further comprising an interrupt enable register storing interrupt enable information, the interrupt enable information being information of configuring an interrupt target for the interrupt source; the platform-level interrupt controller, after receiving the first interrupt request, determining the interrupt target configured by the interrupt source according to the interrupt source identification and the interrupt enable information, obtaining the execution domain to which the interrupt source belongs according to the determined interrupt target, and taking the domain identification of the obtained execution domain as the first domain identification; a processor configured to run a plurality of execution domains in a super-user privilege mode in time-sharing manner, and, in the case of receiving the second interrupt request, judging whether a currently running execution domain is the execution domain to which the interrupt source belongs according to the first domain identification, and processing the first interrupt request through the currently running execution domain if the currently running execution domain is the execution domain to which the interrupt source belongs; a bus-on-chip configured to couple the platform-level interrupt controller and the processor.

2. The system-on-chip of claim 1, wherein: the first interrupt request carries an interrupt source identification identifying the interrupt source; the platform-level interrupt controller comprises an association register storing association information, the association information being information generated after associating an interrupt source identification of an interrupt source and a domain identification of an execution domain to which the interrupt source belongs; the platform-level interrupt controller, after receiving the first interrupt request sent by the interrupt source, is further configured to determine the first domain identification according to the interrupt source identification and the association information.

3. The system on chip of claim 1, wherein, the processor is further configured to: in the case that the currently running execution domain is not the execution domain to which the interrupt source belongs, send the first interrupt request to a trusted firmware running in a machine privilege mode through the currently running execution domain, so as to control the interrupt request by the trusted firmware.

4. The system on chip of claim 1, wherein, the plurality of execution domains of the processor belong to a normal execution environment and a trusted execution environment, and execution domains of the normal execution environment and execution domains of the trusted execution environment adopt different domain identifications.

5. A peripheral processor serving as an interrupt source of a target processor, connected with the target processor through a platform-level interrupt controller, wherein: the peripheral processor is configured by the platform-level interrupt controller as one of a machine privilege mode and a super-user privilege mode; in the case that the peripheral processor is configured by the platform-level interrupt controller as the super-user privilege mode: the peripheral processor is configured by the platform-level interrupt controller to generate a first interrupt request in the super-user privilege mode, the first interrupt request carrying an interrupt source identification identifying the peripheral processor; The first interrupt request sent by the peripheral processor is converted into a second interrupt request by the platform-level interrupt controller, the second interrupt request including the first interrupt request and a first domain identifier, the first domain identifier being a domain identifier of an execution domain to which the peripheral processor belongs in the target processor; The first interrupt request carries an interrupt source identifier identifying the interrupt source, and the platform-level interrupt controller further includes an interrupt enable register storing interrupt enable information, the interrupt enable information being information configuring an interrupt target for the interrupt source; after receiving the first interrupt request, the platform-level interrupt controller determines the interrupt target configured by the interrupt source according to the interrupt source identifier and the interrupt enable information, acquires an execution domain to which the interrupt source belongs according to the determined interrupt target, and takes a domain identifier of the acquired execution domain as the first domain identifier. In addition, After the second interrupt request is received by the target processor, if the target processor determines that a currently running execution domain is the execution domain to which the peripheral processor belongs according to the first domain identifier, the first interrupt request sent by the peripheral processor is processed by the currently running execution domain of the target processor.

6. An interrupt isolation method for realizing isolation of a first interrupt request among a plurality of execution domains, an interrupt source generating the first interrupt request being configured in a superuser privilege mode, the method comprising: receiving a second interrupt request, the second interrupt request including the first interrupt request and a first domain identifier, the first domain identifier being a domain identifier of an execution domain to which the interrupt source belongs; The first interrupt request carries an interrupt source identifier identifying the interrupt source; after receiving the first interrupt request, the platform-level interrupt controller determines the interrupt target configured by the interrupt source according to the interrupt source identifier and the interrupt enable information, acquires an execution domain to which the interrupt source belongs according to the determined interrupt target, and takes a domain identifier of the acquired execution domain as the first domain identifier. determining whether a currently running execution domain is the execution domain to which the interrupt source belongs according to the first domain identifier; processing the first interrupt request by the currently running execution domain in the case that the currently running execution domain is the execution domain to which the interrupt source belongs.

7. The interrupt isolation method of claim 6, wherein, determining whether a currently running execution domain is the execution domain to which the interrupt source belongs according to the first domain identifier, comprising: acquiring a second domain identifier, the second domain identifier being a domain identifier of the currently running execution domain; determining whether the first domain identifier and the second domain identifier are the same; wherein, in the case that the first domain identifier and the second domain identifier are the same, the currently running execution domain is the execution domain to which the interrupt source belongs.

8. The interrupt isolation method of claim 6, further comprising: In the case that the currently running execution domain is not the execution domain to which the interrupt source belongs, the first interrupt request is sent to a trusted firmware running in a machine privilege mode by the currently running execution domain, so as to be controlled by the trusted firmware.

9. The interrupt isolation method of claim 6, wherein, The plurality of execution domains belong to a normal execution environment and a trusted execution environment, and execution domains of the normal execution environment and execution domains of the trusted execution environment adopt different domain identifiers.

10. A computer device, comprising: A system on chip as claimed in any of claims 1-4; An off-chip bus; A storage device coupled with the system on chip through the off-chip bus.

Images