A memory protection method and protection agent control device

Abstract

The present application discloses a memory protection method and a protection proxy control device. When an accelerator or an IO device requests direct physical address access to the system memory, the protection proxy control device can obtain the permission information of the physical page table where the physical address requested to be accessed by the data stream of the accelerator or the IO device is located according to the identifier of the data stream of the accelerator or the IO device, and perform a permission check on the memory access request according to the permission information, and only allow the accelerator or the IO device to perform direct physical address access when the permission check passes, thereby ensuring the security of the system memory.

Description

Technical Field

[0001] The present application relates to the field of computer processing technology, and in particular to a memory protection method and a protection agent control device. Background Art

[0002] In recent years, hardware accelerators have been used more and more widely. By using some interface technologies, accelerators can be more closely integrated with the central processor unit (CPU) logically. For example, in a heterogeneous system architecture (HSA), by using shared virtual memory (SVM) technology, the accelerator and the CPU can share virtual address space and cache, thereby bringing consistency to software programming.

[0003] However, while these interface technologies bring performance improvements and power reduction, they also bring serious security and isolation risks. In particular, when the accelerator or input-output (IO) device is designed and produced by a third-party manufacturer, if the accelerator or IO device is allowed to directly access the system memory through the physical address, it may bring many risks to the system memory. For example, if the physical address space that does not have read permission is accessed, the confidentiality of the system memory will be threatened; if the physical address space that does not have write permission is accessed, the correctness of the system memory will be threatened.

[0004] To this end, there is a TrustZone mechanism under the ARM architecture in the prior art, which divides the system resources of software and hardware into two parts: the secure world and the normal world, thereby preventing unsafe accelerators / IO devices from accessing the system memory belonging to the operating system (OS). Under this mechanism, processes in the normal world can only access the system resources of the normal world, and processes in the secure world can access the system resources of the normal world and the system resources of the secure world. Since the system resources are only divided into the secure world and the normal world, the protection granularity of the mechanism for system memory is very coarse, and the mechanism cannot provide effective protection for processes belonging to the normal world. Summary of the invention

[0005] The present application provides a memory protection method and a protection agent control device, which are used to check memory access permissions when an accelerator or IO device directly uses a physical address to access system memory, thereby effectively ensuring the security of system memory.

[0006] In a first aspect, the present application provides a memory protection method, which can be executed by a protection agent control device, and the method includes: receiving a memory access request from an accelerator or an input / output (IO) device, the memory access request including an identifier of a data stream of the accelerator or IO device and a first physical address requested for access; reading permission information corresponding to a first physical page table where the first physical address is located according to the identifier of the data stream of the accelerator or IO device, the permission information corresponding to the first physical page table being used to indicate whether the data stream has read permission and / or write permission in the first physical page table; performing a permission check on the memory access request according to the permission information corresponding to the first physical page table, and if the permission check passes, allowing the memory access request to access the first physical address.

[0007] By adopting the above technical solution, when an accelerator or IO device requests direct physical address access to system memory, the protection agent control device can obtain permission information of the data stream accessing the first physical page table where the first physical address is located according to the identifier of the data stream of the accelerator or IO device, and perform a permission check on the memory access request according to the permission information. Direct physical address access of the accelerator or IO device is allowed only when the permission check passes, thereby ensuring the security of the system memory.

[0008] In a possible design of the first aspect, reading the permission information corresponding to the first physical page table where the first physical address is located according to the identifier of the data stream of the accelerator or IO device may include: determining the physical page table protection table and the protection table cache corresponding to the data stream according to the identifier of the data stream of the accelerator or IO device, the physical page table protection table storing permission information corresponding to at least one physical page table, and the protection table cache being a cache of the physical page table protection table; judging whether the permission information corresponding to the first physical page table exists in the protection table cache according to the identifier of the first physical page table, and if so, reading the permission information corresponding to the first physical page table from the protection table cache; if not, reading the permission information corresponding to the first physical page table from the physical page table protection table, and loading the permission information corresponding to the first physical page table into the protection table cache.

[0009] By adopting the above technical solution, a corresponding protection table cache is set for the physical page table protection table corresponding to a data stream to cache the permission information of the physical page table in the physical page table protection table. When the protection agent control device needs to obtain the permission information of the data stream in a certain physical page table, it can first search in the corresponding protection table cache. When it cannot be found, it can then search in the physical page table protection table. In this way, the efficiency of searching for permission information can be effectively improved.

[0010] In a possible design of the first aspect, one entry of the protection table cache stores permission information corresponding to one or more physical page tables, and the entry in the protection table cache where the permission information corresponding to each physical page table is located is indexed according to the hash value of the identifier of the physical page table. In this way, the storage space of the protection table cache can be fully utilized while ensuring search efficiency, thereby improving resource utilization.

[0011] In a possible design of the first aspect, reading the permission information corresponding to the first physical page table where the first physical address is located according to the identifier of the data stream of the accelerator or IO device may include: determining a physical page table protection table corresponding to the data stream according to the identifier of the data stream of the accelerator or IO device, the physical page table protection table storing permission information corresponding to at least one physical page table; and reading the permission information corresponding to the first physical page table from the physical page table protection table according to the identifier of the first physical page table.

[0012] In a possible design of the first aspect, before reading the permission information corresponding to the first physical page table where the first physical address is located according to the identifier of the data flow of the accelerator or IO device, the method also includes: reading a protection flow table entry corresponding to the flow identifier of the data flow of the accelerator or IO device in the protection flow table, the protection flow table entry including first control information and second control information, wherein the first control information is used to indicate whether the global permission information of the physical page table protection table corresponding to the data flow is unreadable and unwritable, and the second control information is used to indicate the boundary range of the physical page table protection table; if it is determined according to the first control information and the second control information that the global permission information of the physical page table protection table is not unreadable and unwritable, and the first physical address is located within the boundary range of the physical page table protection table, then the permission information corresponding to the first physical page table where the first physical address is located is read.

[0013] By adopting the above technical solution, by establishing a protection flow table entry corresponding to the data flow in the protection flow table, various control configuration information can be set for the data flow, thereby realizing the access control function.

[0014] In a possible design of the first aspect, the protection flow table entry also includes third control information, which is used to indicate the protection granularity of the physical page table protection table; before reading the permission information corresponding to the first physical page table where the first physical address is located, the method also includes: determining the first physical page table where the first physical address is located according to the boundary range and protection granularity of the physical page table protection table.

[0015] In a possible design of the first aspect, the protection flow table entry also includes fourth control information, and the fourth control information is used to indicate whether a function of checking memory access permissions for the data flow is enabled; after obtaining the protection flow table entry corresponding to the flow identifier of the data flow of the accelerator or IO device in the protection flow table, the method also includes: determining, based on the fourth control information, that the function of checking memory access permissions for the data flow is enabled.

[0016] In a possible design of the first aspect, the method further includes: receiving an identifier of a data stream of the accelerator or IO device, a first physical address, and permission information of the accelerator or IO device to access the first physical address from a translation agent unit; if permission information corresponding to a first physical page table where the first physical address is located exists in a protection table cache corresponding to the data stream, and the permission information corresponding to the first physical page table in the protection table cache is inconsistent with the permission information of the accelerator or IO device to access the first physical address received from the translation agent unit, then updating the permission information corresponding to the physical page table protection table corresponding to the data stream and the first physical page table in the protection table cache according to the permission information of the accelerator or IO device to access the first physical address received from the translation agent unit.

[0017] In a possible design of the first aspect, the method also includes: if the permission information corresponding to the first physical page table where the first physical address is located does not exist in the protection table cache corresponding to the data stream, the permission information for the accelerator or IO device to access the first physical address received from the translation agent unit is used as the permission information corresponding to the first physical page table where the first physical address is located, and is written into the physical page table protection table and / or protection table cache corresponding to the data stream respectively.

[0018] By adopting the above technical solution, before the accelerator or IO device initiates direct physical address access using the physical address obtained from the translation agent unit, the protection agent control device can refresh the permission information of the corresponding physical page table in the protection table cache and the physical page table protection table according to the physical address and corresponding permission information obtained from the translation agent unit, thereby ensuring that accurate permission information can be used to perform permission checks on memory access requests of the accelerator or IO device in the future to ensure the security of system memory.

[0019] In a possible design of the first aspect, the method also includes: receiving page table invalidation information from a page table management module, the page table invalidation information including an identifier of a data stream of the accelerator or IO device and an identifier of one or more invalidated physical page tables; updating the permission information corresponding to the one or more invalidated physical page tables in the protection table cache corresponding to the data stream and the physical page table protection table to be unreadable and unwritable.

[0020] In a possible design of the first aspect, the method also includes: receiving page table invalidation information from a page table management module, the page table invalidation information including an identifier of a data flow of the accelerator or IO device and indication information for globally invalidating a physical page table related to the data flow; and setting the global permission information of a physical page table protection table corresponding to the data flow stored in a protection flow table entry corresponding to the identifier of the data flow in the protection flow table to be unreadable and unwritable.

[0021] By adopting the above technical solution, the protection agent control device can make corresponding processing when the physical page table related to the data flow of the accelerator or IO device is invalidated, so that the permission information of the invalidated physical page table can be updated to be unreadable and unwritable in time, thereby avoiding subsequent access to this part of the invalid physical page table and ensuring the security of the system memory.

[0022] In a second aspect, the present application provides a protection agent control device, in which a protection flow table and a physical page table protection table corresponding to at least one data flow are provided. The protection agent control device implements access control of a third-party accelerator or IO accessing the system memory through the protection flow table and the physical page table protection table corresponding to at least one data flow.

[0023] Among them, the protection flow table includes a protection flow table entry corresponding to the at least one data flow, and the protection flow table entry corresponding to each data flow stores the control configuration information of the data flow; the physical page table protection table corresponding to each data flow stores the permission information corresponding to at least one physical page table, and the permission information corresponding to each physical page table is used to indicate whether the data flow has read permission and / or write permission in the physical page table.

[0024] In a possible design of the second aspect, the protection agent control device also includes a protection table cache for each physical page table protection table, and the protection table cache is used to cache permission information corresponding to the physical page table in the physical page table protection table.

[0025] In a possible design of the second aspect, the control configuration information includes one or more of the following information: first control information, second control information, third control information, fourth control information and fifth control information, wherein the first control information is used to indicate whether the global permission information of the physical page table protection table corresponding to the data stream is unreadable and unwritable, the second control information is used to indicate the boundary range of the physical page table protection table corresponding to the data stream, the third control information is used to indicate the protection granularity of the physical page table protection table corresponding to the data stream, the fourth control information is used to indicate whether the function of checking memory access permissions is enabled for the data stream, and the fifth control information is used to indicate whether the accelerator or IO device to which the data stream belongs is controlled to only initiate virtual address access.

[0026] In a third aspect, an embodiment of the present application provides a protection agent control device, which has the function of implementing the first aspect or any possible design of the first aspect. The function of the device can be implemented by hardware, or by hardware executing corresponding software, and the hardware or software includes one or more modules or units corresponding to the above functions.

[0027] In one possible design, the structure of the device includes a processing module and a transceiver module, and the processing module is configured to support the device to perform the corresponding functions in the above-mentioned first aspect or any one of the designs of the first aspect. The transceiver module is used to support communication between the device and other communication devices (such as accelerators or IO devices). The device may also include a storage module, which is coupled to the processing module and stores program instructions and data necessary for the device. As an example, the processing module can be a processor, the communication module can be a transceiver, and the storage module can be a memory. The memory can be integrated with the processor or can be set separately from the processor, which is not limited in this application.

[0028] In another possible design, the structure of the device includes a processor and may also include a memory. The processor is coupled to the memory and can be used to execute computer program instructions stored in the memory so that the device performs the method in the first aspect or any possible design of the first aspect. Optionally, the device also includes a communication interface, and the processor is coupled to the communication interface. The communication interface can be a transceiver or an input / output interface, or when the specific implementation form of the device is a chip, the communication interface can be an input / output interface of the chip. Optionally, the transceiver can be a transceiver circuit, and the input / output interface can be an input / output circuit.

[0029] In a fourth aspect, an embodiment of the present application provides a chip system, which includes a processor, wherein the processor is coupled to a memory, and the memory is used to store programs or instructions. When the program or instructions are executed by the processor, the chip system implements the method in the above-mentioned first aspect or any possible design of the first aspect.

[0030] Optionally, the chip system also includes an interface circuit, which is used to interact with code instructions to the processor.

[0031] Optionally, there may be one or more processors in the chip system, and the processor may be implemented by hardware or software. When implemented by hardware, the processor may be a logic circuit, an integrated circuit, etc. When implemented by software, the processor may be a general-purpose processor implemented by reading software code stored in a memory.

[0032] Optionally, the memory in the chip system may be one or more. The memory may be integrated with the processor or may be separately provided with the processor, which is not limited in the present application. Exemplarily, the memory may be a non-transient processor, such as a read-only memory ROM, which may be integrated with the processor on the same chip or may be provided on different chips. The present application does not specifically limit the type of memory and the arrangement of the memory and the processor.

[0033] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program or instructions stored thereon. When the computer program or instructions are executed, the computer executes the method in the above-mentioned first aspect or any possible design of the first aspect.

[0034] In a sixth aspect, an embodiment of the present application provides a computer program product. When a computer reads and executes the computer program product, the computer executes the method in the above-mentioned first aspect or any possible design of the first aspect.

[0035] In a seventh aspect, an embodiment of the present application provides a computer system, which includes the protection agent control device described in the present application, and a CPU coupled to the protection agent control device, and at least one third-party accelerator or IO device. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1a to Figure 1d A schematic diagram of a system architecture applicable to an embodiment of the present application;

[0037] Figure 2 A schematic diagram of the structure of a protection proxy control device provided in an embodiment of the present application;

[0038] Figure 3a A schematic diagram of a protection flow table provided in an embodiment of the present application;

[0039] Figure 3b A schematic diagram of a secondary protection flow table provided in an embodiment of the present application;

[0040] Figure 3c A schematic diagram of a process-level protection flow table provided in an embodiment of the present application;

[0041] Figure 4 A schematic diagram of a physical page table protection flow provided in an embodiment of the present application;

[0042] Figure 5 A schematic diagram of a protection table cache provided in an embodiment of the present application;

[0043] Figure 6 A schematic diagram of a memory protection method provided in an embodiment of the present application;

[0044] Figure 7 This is a schematic diagram of the system software directly controlling the PAC device in an embodiment of the present application;

[0045] Figures 8a to 8d A schematic diagram of the overall process involved in the memory protection method in the embodiment of the present application;

[0046] Fig. 9 Another structural schematic diagram of a protection agent control device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the accompanying drawings.

[0048] It should be noted that the specific operating methods in the method embodiments of the present application can also be applied to device embodiments or system embodiments. "Multiple" refers to two or more. In view of this, "multiple" can also be understood as "at least two" in the embodiments of the present application. "At least one" can be understood as one or more, for example, one, two or more. For example, including at least one means including one, two or more, and there is no restriction on which ones are included. For example, including at least one of A, B and C, then A, B, C, A and B, A and C, B and C, or A and B and C can be included. Similarly, the understanding of descriptions such as "at least one" is similar. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / ", unless otherwise specified, generally indicates that the associated objects before and after are in an "or" relationship.

[0049] Unless otherwise specified, the embodiments of the present application mention ordinal numbers such as "first" and "second" for distinguishing between multiple objects, and are not used to limit the order, timing, priority or importance of multiple objects, and the descriptions of "first" and "second" do not limit the objects to be different.

[0050] The memory protection method provided in the embodiment of the present application can be executed by a protection agent control (PAC) device to implement access permission checks on access requests from third-party accelerators or IO devices that directly access system memory using physical addresses.

[0051] Specifically, the PAC device can be integrated into the existing input-output memory management unit (IOMMU) / system memory management unit (SMMU) system as a standard address access protection module, or can also be integrated between the accelerator and the system memory or between the IO device and the system memory as a proxy module. By setting up the PAC device, all access requests from the accelerator / IO device to directly access the system memory through the physical address can be checked by the PAC module to see if they have the corresponding access rights, thereby ensuring the security of the system memory.

[0052] For example, the technical solution provided in this application can be applied to a system on chip (SoC) system that integrates a third-party accelerator. Figure 1a As shown, the SoC system includes system memory, CPU, accelerator (accel) from an untrusted third party, and the PAC device, wherein the PAC device is integrated between the system memory and the third-party accelerator, and has the effect of protecting the system memory. The SoC system also includes a memory management unit (MMU), a translation lookaside buffer (TLB), an address translation service (ATS) and other modules that are respectively matched with the CPU and the third-party accelerator.

[0053] The technical solution provided by this application can also be applied to a computing network system extended by a PCI Express bus. Figure 1b As shown, the CPU is connected to the external IO device through the PCI Express bus to form a computing network system. Among them, the PAC device is integrated in the host, the IO device of the PCI Express bus implements the ATS function of the PCI Express protocol, and the IO device locally implements the address translation cache (ATC) function. The IO device can obtain the physical address that needs direct memory access from the host in advance through the ATS mechanism, and then cache it to the local ATC module. In this way, when the IO device needs direct memory access, it can directly initiate the physical address to access the host memory, and no longer needs the IOMMU / SMMU to check the page table. It only needs to pass the PAC permission check to safely access the system memory.

[0054] The technical solution provided by this application can also be applied to computing network systems that are not extended by PCI Express buses. Figure 1c As shown, the CPU connects to external IO devices through a non-PCI Express bus to form a computing network system. The host integrates the PAC device of the present application, and the bus supports an ATS mechanism similar to the PCI Express bus, which can enable the IO device to obtain the physical address of the system memory space in advance when direct memory access is required, and then cache it to the local ATC module. In this way, when direct memory access is required, the IO device can directly initiate a physical address to access the host memory. At this time, the IOMMU / SMMU page table is no longer required, and the system memory can be safely accessed only through the PAC permission check.

[0055] The technical solution provided in this application can also be applied to a hybrid high-performance computing system architecture. Figure 1d As shown, in this computing system, the CPU is connected to multiple external IO devices via a PCI Express bus, and in addition, the CPU is also connected to an external accelerator via a non-PCI Express bus. These IO devices / accelerators all support ATS or ATS-like mechanisms, and can obtain the physical address of the system memory space that requires direct memory access in advance. The PAC device of the present application is implemented between these IO devices / external accelerators and the system memory. In addition, a third-party accelerator (such as a third-party accelerator IP) is integrated into the CPU, and the PAC device of the present application is also implemented between it and the system memory. By arranging the PAC device of the present application between the IO device / accelerator UI system memory, the security protection of the IO device / accelerator accessing the system memory can be achieved.

[0056] Please refer to Figure 2 , is a schematic diagram of the structure of a protection agent control (PAC) device provided in an embodiment of the present application. The PAC device includes a protection stream table (PST) and a physical page protection table (PPPT) corresponding to at least one data stream. Optionally, to improve the table lookup performance, the PAC device may also include a protection table cache (PTC) for each physical page protection table.

[0057] The protection flow table, physical page table protection table, and protection table cache implemented in the PAC device are described in detail below.

[0058] 1. Protect the flow table

[0059] The protection stream table includes at least one protection stream table entry (PSTE) corresponding to a data stream, and the protection stream table entry corresponding to each data stream stores control configuration information corresponding to the data stream.

[0060] For a data stream, the control configuration information may include one or more of the first control information, the second control information, the third control information, the fourth control information and the fifth control information. Among them, the first control information is used to indicate whether the global permission information of the physical page table protection table corresponding to the data stream is unreadable and unwritable, the second control information is used to indicate the boundary range of the physical page table protection table corresponding to the data stream, the third control information is used to indicate the protection granularity of the protection stream table corresponding to the data stream, the fourth control information is used to indicate whether to enable the function of checking memory access rights for the data stream, and the fifth control information is used to indicate whether to control the accelerator or IO device to which the data stream belongs to only initiate virtual address access.

[0061] It should be noted that in the embodiment of the present application, the protection flow table can provide a software programming interface to the outside, through which the system software can set control configuration information for different data flows. Since the control configuration information corresponding to different data flows is set separately and is independent of each other, the information content contained in the control configuration information corresponding to different data flows can be the same or different, and the present application does not limit it.

[0062] In an embodiment of the present application, the protection flow table is indexed based on the identifier of the data flow. In this way, for a data flow, the protection flow table entry corresponding to the data flow can be located according to the identifier of the data flow, and then the control configuration information corresponding to the data flow can be obtained from the corresponding protection flow table entry. As mentioned above, the second control information in the control configuration information is used to indicate the boundary range of the physical page table protection table corresponding to the data flow, and the boundary range of the physical page table protection table can also be understood as the interval range of the physical addresses of all physical page tables involved in the physical page table protection table. For example, the second control information may include information such as the base address and size of the physical page table protection table.

[0063] The identification of the data stream is used to distinguish the data streams of different accelerators or IO devices, and the identification of the data stream can be mapped one by one with the device identification of the accelerator or IO device. The identification of the data stream can also be called a stream identity number (stream ID), and the device identification can also be called a device identity number (device ID). For example, the identification of the data stream can be a stream identification (Stream ID) in the SMMU under the ARM architecture, and the device identification can be a requester identification (Requester ID) in the PCI Express bus, and Requester ID is mapped one by one with Stream ID, so that the PCI Express bus can also be realized under the ARM architecture.

[0064] Please refer to Figure 3a , is a schematic diagram of a protection flow table provided in an embodiment of the present application. The protection flow table includes multiple protection flow table entries such as PSTE0, PSTE1, PSTE2, PSTE3, ..., etc. The protection flow table is indexed by the identifier of the data stream (stream ID), that is, one data stream corresponds to one protection flow table entry, and different protection flow table entries can be indexed according to the identifiers of different data streams. For example, data stream 0 can be indexed with Figure 3a The PSTE0 shown in FIG. 1 corresponds to the PSTE0 shown in FIG. 1 , and the PSTE0 can be indexed according to the identifier of data stream 0; data stream 1 can be indexed with Figure 3a The PSTE1 shown in FIG. 1 corresponds to the PSTE1 shown in FIG. 1 , and the PSTE1 can be indexed according to the identifier of the data stream 1; the data stream 2 can be indexed with Figure 3a The PSTE2 shown in FIG. 2 corresponds to the PSTE2 shown in FIG. 2 , and the PSTE2 can be indexed according to the identifier of the data stream 2; the data stream 3 can be indexed with Figure 3a The PSTE3 shown in FIG. 1 corresponds to the PSTE3 shown in FIG. 1 , and the PSTE3 can be indexed according to the identifier of the data stream 3.

[0065] Taking the protection flow table entry PSTE0 as an example, the protection flow table entry may include the following fields for control configuration information:

[0066] 1) EN field, used to indicate whether to enable the protection agent control (PAC) mechanism, that is, whether to check the data flow's permission to directly access the system memory using the physical address. The EN is the fourth control information mentioned above, indicating whether to enable the function of checking memory access rights for the data flow.

[0067] For example, the EN field can be represented by one bit. When the value of the EN field is 1, it can indicate that the PAC mechanism is enabled, and memory access permissions need to be checked for all memory access requests from the data stream. When the value of the EN field is 0, it can indicate that the PAC mechanism is not enabled, and memory access permissions are not checked for memory access requests from the data stream.

[0068] 2) Zero field, used to indicate whether the physical page table protection table corresponding to the data stream is in the initialization period. If it is in the initialization period, the permission information of all physical page tables in the physical page table protection table corresponding to the data stream is unreadable and unwritable. The Zero field is the first control information mentioned above, which is used to indicate whether the global permission information of the physical page table protection table corresponding to the data stream is unreadable and unwritable.

[0069] 3) OU field, used to indicate whether to control the accelerator or IO device to which the data flow belongs to only initiate virtual address access, but not physical address access. The OU field is the fifth control information mentioned above, used to indicate whether to control the accelerator or IO device to which the data flow belongs to only initiate virtual address access.

[0070] For example, the OU field can be represented by a bit. When the value of the bit is 1, it means that the accelerator or IO device to which the data flow belongs is only allowed to initiate virtual address access, and physical address access is not allowed; when the value of the bit is 0, it means that the accelerator or IO device to which the data flow belongs is allowed to initiate physical address access. In this way, if the PAC device receives a memory access request from an accelerator or IO device, requesting to directly use the physical address to access a block of address space in the system memory, then the PAC device can query the corresponding protection flow table entry in the protection flow table based on the identifier of the data flow of the accelerator or IO device. At this time, if the value of the OU field in the protection flow table entry is 1, the PAC device can determine that the accelerator or IO device to which the data flow belongs needs to be controlled to only initiate virtual address access, and then reject the memory access request.

[0071] 4) PGS field, used to indicate the granularity of the memory access permission check for the data stream. In the embodiment of the present application, the PAC device can check the memory access permission in units of physical page tables. Therefore, the check granularity refers to the size of each physical page table, that is, the protection granularity of the physical page table protection table. The PGS field is the third control information mentioned above, which is used to indicate the protection granularity of the physical page table protection table corresponding to the data stream.

[0072] 5)(PAC base address_H field, PAC base address_L field), used to indicate the base address of the physical page table protection table corresponding to the data stream. Among them, the PAC base address_H field (i.e., the PAC base address_H field) represents the high N bits of the base address of the physical page table protection table, and the PAC base address_L field (i.e., the PAC base address_L field) represents the low N bits of the base address of the physical page table protection table. The N value can be 32, for example, that is, the PAC base address_H field and the PAC base address_L field are used to indicate the high 32 bits and low 32 bits of the base address of the physical page table protection table, respectively.

[0073] 6) The PAT boundary field is used to indicate the size of the physical page table protection table corresponding to the data stream.

[0074] The (PAC base address_H field, PAC base address_L field) and PAT boundary field are the second control information mentioned above. These fields can uniquely determine the boundary range of the physical page table protection table corresponding to the data stream, that is, the interval range of the physical address involved in the physical page table in the physical page table protection table, so as to facilitate the subsequent query of the physical page table protection table according to the physical address or the identifier of the physical page table to determine the memory access rights of the data stream.

[0075] It should be noted that the above fields are several examples of control configuration information in the protection flow table entry, and the protection flow table entry may also contain other control configuration information, which is not limited by the present application. Furthermore, since the protection flow table can provide a software programming interface to the outside, through the software programming interface, the system software can expand more other control configuration information in the protection flow table entry, thereby enhancing the security and scalability of access control.

[0076] In a possible implementation manner, the protection flow table in the embodiment of the present application may also be a secondary protection flow table, and the secondary protection flow table may also be understood as a protection flow table of a secondary index. Figure 3b As shown, it is a schematic diagram of a two-level protection flow table provided in an embodiment of the present application. Specifically, the two-level protection flow table means that the protection flow table is divided into two levels, each entry (Desc) in the upper level protection flow table stores the description information of the sub-protection flow table, and the description information of different sub-protection flow tables points to different protection flow tables at the next level, and each entry (PSTE) in the next level protection flow table stores the control configuration information of the corresponding data flow.

[0077] Both levels of protection flow tables can be indexed by the identifier of the data flow. In the previous level protection flow table, different entries can be indexed in the previous level protection flow table according to the identifier of the data flow. However, it should be noted that the identifier of a data flow can correspond to an entry in the previous level protection flow table, but an entry in the previous level protection flow table can correspond to the identifiers of one or more data flows, or to an interval of a data flow identifier. In other words, in the previous level protection flow table, the relationship between the identifier of the data flow and the entry can be one-to-one or many-to-one. According to the identifier of a data flow, a unique entry can be indexed in the previous level data flow table, but the identifiers of different data flows may index the same entry in the previous level data flow table.

[0078] In the next level protection flow table, different entries can be indexed in the next level protection flow table according to the identifier of the data flow, and the identifier of the data flow corresponds one to one with the entry in the next level protection flow table. According to the identifier of a data flow, a unique entry can be indexed in the next level protection flow table, and the control configuration information corresponding to the data flow is stored in the entry.

[0079] In an embodiment of the present application, by setting the data flow table as a secondary protection flow table, the query efficiency of the data flow table can be improved when the number of data flows is large, so that the protection flow table entry corresponding to the data flow can be found more efficiently and the corresponding control configuration information can be obtained.

[0080] In another possible implementation, the protection flow table in the embodiment of the present application can also be a process-level protection flow table. Specifically, the protection flow table mentioned in the above text of the present application can be understood as a device-level protection flow table, which means that the data flows of different accelerators / IO devices correspond to different protection flow table entries in the protection flow table, so that control configuration information can be set for the data flows of different accelerators / IO devices respectively, and the data flows of different accelerators / IO devices can correspond to different physical page table protection tables, so that access control can be performed separately for the data flows of different accelerators / IO devices.

[0081] The process-level protection flow table refers to further distinguishing the sub-data flows of different processes in the data flow of an accelerator / IO device. Accordingly, a process-level sub-protection flow table is created for the data flow under the device-level protection flow table. The sub-protection flow table includes at least one sub-protection flow table entry corresponding to a sub-data flow, and the sub-data flows of different processes correspond to different sub-protection flow table entries in the sub-protection flow table. In this way, control configuration information can be set for the sub-data flows of different processes in the data flow, and the sub-data flows of different processes can correspond to different physical page table protection tables, so that access control can be performed separately for the sub-data flows of different processes in a data flow, effectively improving the precision of access control.

[0082] Figure 3c A schematic diagram of a process-level protection flow table provided in an embodiment of the present application is shown as follows: Figure 3c As shown, in the device-level protection flow table, there is a protection flow table entry corresponding to at least one data flow. The data flow of an accelerator or IO device corresponds to a protection flow table entry, and different protection flow table entries are indexed based on the identifier of the data flow, and the identifier of the data flow is mapped one-to-one with the device identifier of the accelerator or IO device.

[0083] It should be noted that the at least one data flow involved in the protection flow table may include data flows that need to be access controlled separately for sub-data flows of different processes in the data flow (i.e., data flows that are access controlled from the process level), and may also include data flows that do not need to be access controlled separately for sub-data flows of different processes in the data flow (i.e., data flows that are access controlled from the data flow level). In view of this, in the device-level protection flow table, the protection flow table entry corresponding to each data flow may also include an indication information for indicating whether the data flow needs to be access controlled separately for sub-data flows of different processes therein, and the indication information may be represented by one bit.

[0084] For a data flow, if it is necessary to perform access control on the sub-data flows of different processes in the data flow separately, the description information of the sub-protection flow table of the data flow may be stored in the protection flow table entry corresponding to the data flow, and the description information of the sub-protection flow table points to the sub-protection flow table of the data flow.

[0085] Furthermore, in the sub-protection flow table of the data stream, there is included a sub-protection flow table entry corresponding to at least one sub-data stream. One sub-data stream corresponds to one sub-protection flow table entry, and different sub-protection flow table entries are indexed based on the identifier of the sub-data stream. The identifier of the sub-data stream is used to distinguish the sub-data streams of different processes in the data stream of an accelerator or IO device, and the identifier of the sub-data stream can be mapped one-to-one with the identifier of the process. For a sub-data stream, the sub-protection flow table entry corresponding to the sub-data stream stores the control configuration information corresponding to the sub-data stream. The specific information content included in the control configuration information corresponding to the sub-data stream can refer to the above description of the control configuration information corresponding to the data stream, which will not be repeated here.

[0086] For a data flow, if it is not necessary to perform access control on the sub-data flows of different processes in the data flow separately, the control configuration information corresponding to the data flow may be stored in the protection flow table entry corresponding to the data flow; or, the description information of the sub-protection flow table of the data flow may be stored in the protection flow table entry corresponding to the data flow, and the description information of the sub-protection flow table points to the sub-protection flow table of the data flow, but the sub-protection flow table of the data flow only includes one sub-protection flow table entry, which stores the control configuration information applicable to the sub-data flows of all processes of the data flow.

[0087] 2. Physical Page Table Protection Table

[0088] The physical page table protection table corresponding to each data stream is used to store the permission information corresponding to at least one physical page table. Specifically, for a data stream, its corresponding physical page table protection table includes a physical page table protection table entry corresponding to at least one physical page table, and the physical page table protection table entry corresponding to each physical page table stores the permission information of the data stream in the physical page table, and the permission information is used to indicate whether the data stream has read permission and / or write permission in the physical page table. For example, the permission information can be represented by 2 bits, wherein the value of one bit (R) is used to indicate whether there is read permission, and the value of the other bit (W) is used to indicate whether there is write permission. It can be understood that the read permission refers to whether the data stream has the permission to perform read operations in the physical page table, and the write permission refers to whether the data stream has the permission to perform write operations in the physical page table.

[0089] The physical page table protection table can be indexed based on the physical address aligned according to the size of the protection granularity, such as the identifier of the physical page table, the physical page number (PPN), etc. In this way, if an accelerator or IO device wants to directly access a piece of memory space using a physical address, the PAC device can locate the protection flow table entry corresponding to the data flow in the protection flow table according to the identifier of the data flow of the accelerator or IO device, and determine the physical page table number of the physical page table where the physical address of the memory space requested to be accessed by the accelerator or IO device is located through the indication of the control configuration information of the data flow stored in the protection flow table entry, and then locate the physical page table protection table entry corresponding to the physical page table in the physical page table protection table according to the physical page table number of the physical page table, and then obtain the permission information of the data flow in the physical page table from the physical page table protection table entry, and determine whether the data flow has read permission and write permission in the physical page table.

[0090] Please refer to Figure 4, a schematic diagram of a physical page table protection flow table provided in an embodiment of the present application. The physical page table protection table is a flattened table based on the physical address space, which stores information for indicating the access rights of the data flow in each physical page table, that is, the permission information mentioned above. As an example, the access rights include read permission and write permission, and accordingly, each physical page table in the physical page table protection table can have 2 bits of permission information. Among them, 1 bit of permission information in the 2 bits of permission information can be called permission information R, which is used to indicate whether the data flow has read permission in the data page table. For example, when the value of the permission information R is 1, it can indicate that it has read permission (that is, it can be read), and when the value of the permission information R is 0, it can indicate that it does not have read permission (that is, it cannot be read). Another 1 bit of permission information can be called permission information W, which is used to indicate whether the data flow has write permission in the data page table. For example, when the value of the permission information R is 1, it can indicate that it has write permission (that is, it can be written), and when the value of the permission information W is 0, it can indicate that it does not have write permission (that is, it cannot be written).

[0091] In this way, after obtaining the physical address that the accelerator or IO device wants to access, the physical page table number of the physical page table where the physical address is located can be determined based on the physical address and the protection granularity of the physical page table protection table, and then the physical page table protection table can be queried based on the physical page table number to locate the physical page table protection table entry corresponding to the physical page table, and then based on the permission information of the physical page table stored in the physical page table entry, it can be determined whether the data stream of the accelerator or IO device has access rights to the physical page table.

[0092] 3. Protecting table cache

[0093] Each physical page table protection table may have a corresponding protection table cache for caching the permission information corresponding to the physical page table in the physical page table protection table. The protection table cache may also be referred to as a protection table cache, or it may also be referred to as a cache of a physical page table protection table or a cache of a physical page table protection table, which is not limited in this application.

[0094] As a cache of the physical page table protection table, the protection table cache usually stores the permission information that has been recently accessed or frequently accessed, so the hit rate of the protection table cache may be relatively high. When you need to find the permission information corresponding to a data flow in a physical page table in the physical page table protection table, you can first search in the protection table cache of the physical page table protection table. If it cannot be found in the protection table cache, then search in the physical page table protection table, thereby effectively improving the efficiency of finding permission information.

[0095] It can be understood that in the embodiments of the present application, a certain cache replacement algorithm can be used to load the permission information in the physical page table protection table into the protection table cache, and the permission information with low cache utilization or long access time in the protection table cache can be deleted according to performance requirements. Therefore, the permission information of which physical page tables is cached in the cache of the physical page table protection table changes dynamically.

[0096] Specifically, for a physical page table protection table, the protection table cache of the physical page table protection table may also include multiple entries, and different entries may also be indexed based on physical addresses, such as physical address numbers or physical page table identifiers (such as physical page table number PPN), etc. In a possible implementation, an entry in the protection table cache may store only permission information corresponding to a physical page table, and in this case, there are only 2 bits of useful information in one entry.

[0097] In another possible implementation, considering that the permission information corresponding to a physical page table is only 2 bits, and the number of bits occupied by each entry in the protection table cache is fixed and usually greater than 2 bits, for example, it may be 8 bits, so storing the permission information of each physical page table separately in one entry will cause a waste of storage resources. In view of this, in order to efficiently utilize the storage space in the protection table cache, such as Figure 5 As shown in , the permission information (page permissions) corresponding to one or more physical page tables can be stored in the same entry of the protection table cache. At this time, different entries can be indexed by the hash value of the physical page table identifier, that is, the tag of each entry in the protection table cache is the hash value of the physical page table identifier. As an example, the hash value can be the divisor obtained by dividing the physical page table number by the maximum number of permission information of the physical page table that can be stored in an entry in the protection table cache, indicating that the permission information of multiple physical page tables with consecutive physical page table numbers can be stored in the same entry of the protection table cache. It should be noted that the present application does not specifically limit the hash algorithm used when calculating the hash value based on the identifier of the physical page table.

[0098] It should be noted that the above-mentioned physical page table protection table and protection table cache are described as an example of the protection flow table as a device-level protection flow table, and the physical page table protection table and protection table cache corresponding to the data flow in the case where access control is performed separately for the data flows of different accelerators or IO devices. It can be understood that in the embodiment of the present application, different data flows can correspond to different protection flow table entries in the protection flow table, and different data flows can correspond to different physical page table protection tables and protection table caches. This means that access rights can be set separately for different data flows, and access control can be performed separately.

[0099] In a possible implementation, different data streams may also correspond to the same protection flow table entry in the protection flow table, and different data streams may correspond to the same physical page table protection table and protection table cache. This means that the access rights of the data streams of all accelerators / IO devices are consistent, and unified permission control can be performed on all data streams. It should be noted that in this case, it is no longer necessary to index the protection flow table entry according to the identifier of the data stream, because the protection flow table only includes one protection flow table entry, and the control configuration information corresponding to the data streams of all accelerators or IO devices is the same, and memory access rights can be checked by searching the same physical page table protection table and protection table cache.

[0100] It should also be understood that when the protection flow table is a process-level protection flow table, on the basis of distinguishing the data flows of different accelerators or IO devices, access control is performed separately for the sub-data flows of different processes in the same data flow. The physical page table protection table and protection table cache corresponding to the sub-data flow can be implemented using a method similar to the description above, and this application will not go into details.

[0101] Based on the above system architecture and PAC device, please refer to Figure 6 , is a flow chart of a memory protection method provided in an embodiment of the present application, the method comprising:

[0102] Step S601: The PAC device receives a memory access request from an accelerator or an IO device, where the memory access request includes an identifier of a data flow of the accelerator or the IO device and a first physical address that the accelerator or the IO device requests to access.

[0103] Step S602: The PAC device reads permission information corresponding to the first physical page table where the first physical address is located according to the identifier of the data flow of the accelerator or IO device, where the permission information corresponding to the first physical page table is used to indicate whether the data flow has read permission and / or write permission in the first physical page table.

[0104] Optionally, before reading the permission information corresponding to the first physical page table where the first physical address is located, the PAC device may determine the identifier of the first physical page table where the first physical address is located, for example, the physical page table number of the first physical page table, based on the first physical address, the boundary range of the physical page table protection table corresponding to the configured data stream, and the protection granularity of the physical page table protection table.

[0105] In the embodiment of the present application, the PAC device can read the permission information of the first physical page table where the first physical address is located through the following two possible implementations:

[0106] In a possible implementation, the PAC device may determine the physical page table protection table corresponding to the data stream of the accelerator or IO device based on the identifier of the data stream of the accelerator or IO device, and then read the permission information of the first physical page table from the physical page table protection table entry corresponding to the identifier of the first physical page table in the physical page table protection table based on the identifier of the first physical page table.

[0107] In another possible implementation, the PAC device may determine the physical page table protection table and the protection table cache of the physical page table protection table corresponding to the data stream of the accelerator or IO device according to the identifier of the data stream of the accelerator or IO device. Then, according to the identifier of the first physical page table, the permission information of the first physical page table is searched in the protection table cache. If the permission information of the first physical page table is found in the protection table cache, the permission information of the first physical page table is read from the protection table cache. Otherwise, if the permission information of the first physical page table cannot be found in the protection table cache, the permission information of the first physical page table is read from the physical page table protection table according to the identifier of the first physical page table, and the permission information of the first physical page table is loaded into the protection table cache.

[0108] Step S603: The PAC device performs a permission check on the memory access request according to the permission information corresponding to the first physical page table, and if the permission check passes, the memory access request is allowed to access the first physical address, otherwise, the memory access request is denied to access the first physical address.

[0109] Specifically, the PAC device may perform a permission check on the memory access request according to the permission information corresponding to the first physical page table, which may include: if the memory access request requests to perform a read operation at the first physical address, and the permission information corresponding to the first physical page table indicates that the data stream of the accelerator or IO device has read permission in the first physical page table, that is, it can read, then the permission check passes. Correspondingly, at this time, the PAC device allows the memory access request to access the first physical address, which means that the data stream of the accelerator or IO device is allowed to read the information stored in the first physical address, that is, it is allowed to perform a read operation at the first physical address.

[0110] If the memory access request requests to perform a read operation at the first physical address, but the permission information corresponding to the first physical page table indicates that the data stream of the accelerator or IO device does not have read permission in the first physical page table, that is, it is unreadable, then the permission check fails and the PAC device should deny the memory access request to access the first physical address.

[0111] If the memory access request requests to perform a write operation at the first physical address, and the permission information corresponding to the first physical page table indicates that the data stream of the accelerator or IO device has write permission in the first physical page table, that is, it can be written, then the permission check passes. Correspondingly, at this time, the PAC device allows the memory access request to access the first physical address, which means that the data stream of the accelerator or IO device is allowed to write new information in the first physical address, that is, it is allowed to perform a write operation at the first physical address.

[0112] If the memory access request requests to perform a write operation at the first physical address, but the permission information corresponding to the first physical page table indicates that the data stream of the accelerator or IO device does not have write permission in the first physical page table, that is, it is not writable, then the permission check fails, and the PAC device should deny the memory access request to access the first physical address.

[0113] If the memory access request requests to perform read and write operations at the first physical address, and the permission information corresponding to the first physical page table indicates that the data stream of the accelerator or IO device has both read and write permissions in the first physical page table, that is, it can read and write, then the permission check passes. Correspondingly, at this time, the PAC device allows the memory access request to access the first physical address, which means that the data stream of the accelerator or IO device is allowed to read the information stored in the first physical address, and also allows the data stream of the accelerator or IO device to write new information in the first physical address, that is, it allows to perform read and write operations at the first physical address.

[0114] If the memory access request requests to perform read and write operations at the first physical address, but the permission information corresponding to the first physical page table indicates that the data stream of the accelerator or IO device does not have read permission in the first physical page table (i.e., it is not readable), or the permission information corresponding to the first physical page table indicates that the data stream of the accelerator or IO device does not have write permission in the first physical page table (i.e., it is not writable), then the permission check fails and the PAC device should deny the memory access request to access the first physical address.

[0115] Optionally, before executing step S602 to read the permission information of the first physical page table where the first physical address is located, the PAC device may also read the protection flow table entry corresponding to the flow identifier of the data flow of the accelerator or IO device in the protection flow table. As mentioned above, the protection flow table entry stores the control configuration information of the data flow of the accelerator or IO device, including first control information for indicating whether the global permission information of the physical page table protection table corresponding to the data flow is unreadable and unwritable, second control information for indicating the boundary range of the physical page table protection table, third control information for indicating the protection granularity of the physical page table protection table, fourth control information for indicating whether to enable the function of checking memory access rights for the data flow, etc.

[0116] In this way, after the PAC device reads the protection flow table entry corresponding to the flow identifier of the data flow of the accelerator or IO device in the protection flow table, it can first determine whether the function of checking memory access rights for the data flow is enabled according to the instruction of the fourth control information therein. If it is enabled, it means that the memory access rights need to be checked for the data flow, and the PAC device can continue the subsequent process of checking memory access rights. If it is not enabled, it means that the memory access rights are not checked for the data flow, and the PAC device can directly route this access forward.

[0117] After the PAC device determines that the function of checking memory access rights for the data flow has been enabled, it can determine whether it is necessary to control the data flow to only initiate virtual address access and not physical address access according to the instruction of the fifth control information. If the fifth control information indicates that the data flow can only initiate virtual address access and not physical address access, the PAC device can directly deny this access. If the fifth control information indicates that the data flow can initiate physical address access, the PAC device can continue the subsequent process of checking memory access.

[0118] Subsequently, the PAC device can determine whether the global permission information of the physical page table protection table corresponding to the data stream is unreadable and unwritable based on the indication of the first control information, and determine whether the first physical address is within the boundary range of the physical page table protection table corresponding to the data stream indicated by the second control information.

[0119] If the global permission information of the physical page table protection table corresponding to the data stream indicated by the first control information is unreadable and unwritable, it means that all physical page tables involved in the physical page table protection table are inaccessible, that is, the permission information of all physical page tables is unreadable and unwritable. This situation may be because the memory access request arrives before the initialization of the physical page table protection table. At this time, the PAC device can directly reject the access. Similarly, if the first physical address is outside the boundary range of the physical page table protection table indicated by the second control information, it means that the data stream of the accelerator or IO device attempts to access an address space outside its permission range or that is invisible or unknown to it. At this time, the PAC device can also directly reject the access.

[0120] If the global permission information of the physical page table protection table corresponding to the data stream indicated by the first control information is not unreadable and unwritable, and the first physical address is within the boundary range of the physical page table protection table indicated by the second control information, the PAC device can read the permission information of the first physical page table where the first physical address is located.

[0121] Optionally, before reading the permission information of the first physical page table where the first physical address is located, the PAC device can determine the identifier of the first physical page table where the first physical address is located based on the first physical address, the boundary range of the physical page table protection table corresponding to the data stream indicated in the second control information, and the protection granularity of the physical page table protection table corresponding to the data stream indicated in the third control information, for example, obtain the physical page table number of the first physical page table, and then execute step S602 to read the permission information of the data stream in the first physical page table from the physical page table protection table or from the protection table cache of the physical page table protection table.

[0122] Optionally, the PAC device may also execute a protection table refresh process before executing step S601. Specifically, the PAC device may receive from the translation agent unit an identifier of the data stream of the accelerator or IO device, a first physical address requested to be accessed by the data stream, and permission information for the accelerator or IO device to access the first physical address.

[0123] In an embodiment of the present application, the translation agent unit is a functional unit for translating a virtual address into a corresponding physical address. The translation agent unit can receive an address translation request from an accelerator or an IO device, and the address translation request includes an identifier of a data stream of the accelerator or the IO device, and a first virtual address requested to be translated by the accelerator or the IO device. After receiving the address translation request, the translation agent unit can translate the first virtual address into a corresponding first physical address, and then carry the first physical address in the address translation result and send it to the accelerator or the IO device. In addition, the translation agent unit can also synchronously send the address translation result to the PAC device, and the address translation result includes the first physical address, and at the same time send the identifier of the data stream of the accelerator or the IO device, the permission information of the accelerator or the IO address to access the first physical page table where the first physical address is located, and other related information.

[0124] After the PAC device receives the identifier of the data flow of the accelerator or IO device and the request of the accelerator or IO device to access the first physical address from the translation agent unit, it can determine the protection flow table entry corresponding to the identifier of the data flow from the protection flow table according to the identifier of the data flow of the accelerator or IO device, and read the control configuration information of the data flow from the corresponding protection flow table entry. Furthermore, the PAC device determines the physical page table protection table corresponding to the data flow of the accelerator or IO device and the identifier of the first physical page table where the first physical address is located according to the control configuration information of the data flow.

[0125] Furthermore, the PAC device can determine whether the permission information of the first physical page table stored in the physical page table protection table corresponding to the data stream of the accelerator or IO device is consistent with the permission information of the accelerator or IO device to access the first physical address received from the translation agent unit, that is, determine whether the physical page table protection table corresponding to the data stream of the accelerator or IO device stores the accurate access rights of the data stream in the first physical page table.

[0126] Specifically, if the protection table cache of the physical page table protection table corresponding to the data stream stores permission information corresponding to the first physical page table, and the permission information corresponding to the first physical page table stored in the protection table cache is inconsistent with the permission information of the accelerator or IO device accessing the first physical address received by the PAC device from the translation agent unit, the PAC device can update the permission information corresponding to the first physical page table stored in the physical page table protection table corresponding to the data stream and the protection table cache according to the permission information of the accelerator or IO device accessing the first physical address received from the translation agent unit.

[0127] That is, the PAC device may consider the permission information of the accelerator or IO device accessing the first physical address received from the translation agent unit as the accurate access permission of the accelerator or IO device at the first physical page table. If the permission information stored in the physical page table protection table and the protection table cache corresponding to the data stream is inconsistent with the access permission, the permission information of the first physical page table stored in the physical page table protection table and the protection table cache is refreshed with the accurate permission information received from the translation agent unit, thereby ensuring that the PAC device uses the accurate permission information when checking the memory access permission using the permission information stored in the physical page table protection table or the protection table cache.

[0128] If the protection table cache of the physical page table protection table corresponding to the data stream stores permission information corresponding to the first physical page table, and the permission information corresponding to the first physical page table stored in the protection table cache is consistent with the permission information of the accelerator or IO device accessing the first physical address received by the PAC device from the translation agent unit, then the PAC device does not need to do anything.

[0129] If the protection table cache of the physical page table protection table corresponding to the data stream does not store the permission information corresponding to the first physical page table, the PAC device can use the permission information of the accelerator or IO device to access the first physical address received from the translation agent unit as the permission information corresponding to the first physical page table, and write it into the physical page table protection table corresponding to the data stream and / or the protection table cache of the physical page table protection table.

[0130] Specifically, the PAC device can create a new physical page table protection table entry in the physical page table protection table corresponding to the data stream, and establish a mapping relationship between the physical page table protection table entry and the identifier of the first physical page table, and then store the permission information of the accelerator or IO device to access the first physical address in the physical page table protection table entry. The method by which the PAC device writes the permission information of the accelerator or IO device to access the first physical address into the protection table cache is similar to this and will not be repeated here.

[0131] Optionally, during the operation of the accelerator or IO device, the relevant physical page table may be updated. For example, a new physical page table may be established, or the mapping between virtual addresses and physical addresses may change. At this time, the system software may choose to invalidate some physical page tables, or choose to invalidate all physical page tables related to a process in the accelerator or IO device, or even choose to invalidate all physical page tables related to the accelerator or IO device. In either case, the page table management module in the system software knows which specific physical page tables will be invalidated, and sends the information of the invalidated physical page tables to the PAC device, so that the PAC device can make corresponding processing, including refreshing the control configuration information corresponding to the data flow of the accelerator or IO device stored in the protection flow table, and the permission information of the invalidated physical page table stored in the physical page table protection table.

[0132] Specifically, in a possible implementation, the PAC device may receive page table invalidation information from the page table management module, the page table invalidation information including the identifier of the data stream of the accelerator or IO device and the identifier of one or more invalidated physical page tables. Further, the PAC device may update the permission information corresponding to the one or more invalidated physical page tables in the physical page table protection table corresponding to the data stream and the corresponding protection table cache to be unreadable and unwritable.

[0133] In another possible implementation, the PAC device may receive page table invalidation information from the page table management module, and the page table invalidation information includes the identifier of the data stream of the accelerator or IO device and the indication information for globally invalidating the physical page table related to the data stream. Furthermore, the PAC device may set the global permission information of the physical page table protection table corresponding to the data stream in the protection stream table to be unreadable and unwritable. If the number of physical page tables related to the data stream is small, the PAC device may also choose to traverse the physical page table protection table corresponding to the data stream and / or the physical page table in the protection table cache, and set the permission information of each physical page table one by one to be unreadable and unwritable, which is not limited by the present application. This implementation can be referred to as global invalidation based on stream identification (stream ID).

[0134] In another possible implementation, the PAC device may receive page table invalidation information from the page table management module, the page table invalidation information including the identifier of the data stream of the accelerator or IO device, the identifier of the sub-data stream of a process in the accelerator or IO device, and the indication information for globally invalidating the physical page table related to the sub-data stream. In this scenario, if the protection stream table is a process-level protection stream table, and the sub-data stream of each process in the accelerator or IO device has a corresponding physical page table protection table, then the PAC device may set the global permission information of the physical page table protection table corresponding to the sub-data stream in the sub-protection stream table of the data stream to be unreadable and unwritable. Alternatively, if the number of physical page tables related to the sub-data stream is small, the PAC device may also choose to traverse the physical page table protection table corresponding to the sub-data stream and / or the physical page table in the protection table cache, and set the permission information of each physical page table to be unreadable and unwritable one by one. This implementation can be called global invalidation based on sub-stream ID.

[0135] It should be noted that, in the embodiment of the present application, the physical page table protection table and the protection table cache in the PAC device can be automatically maintained and refreshed by hardware. However, it should be noted that this method requires the accelerator or IO device to support the address translation service (ATS) mechanism or other similar mechanisms, such as the distributed translation interface (DTI) mechanism under the ARM architecture. The ATS mechanism means that the accelerator or IO device carries its own data stream identifier and sub-data stream identifier (if necessary), the starting address and space size of the virtual address space and other information, and applies to the system translation agent (TA) for the physical address space corresponding to the virtual address space, so as to obtain the corresponding address space and related address space attributes and other information before the accelerator or IO device accesses the system memory.

[0136] Alternatively, the physical page table protection table and protection table cache in the PAC device can also be maintained and refreshed by the system software through software. For details, please refer to Figure 7As shown, the system software (such as the operating system (OS)) can directly control the PAC device. Before the driver of the corresponding accelerator or IO device starts its business work, the system software allocates relevant resources for it, establishes corresponding protection flow table entries in the protection flow table, and sets the control configuration information. In addition, the system software also establishes a physical page table protection table corresponding to the accelerator or IO device in the PAC device, and configures the access rights of the relevant physical addresses in the corresponding physical page table protection table.

[0137] Below through Figures 8a to 8d The overall process involved in the memory protection method provided in the embodiment of the present application is described in detail with reference to the flowchart in FIG.

[0138] 1. Initialization

[0139] Please refer to Figure 8a First, the system management software discovers the accelerator / IO device, and the system software enables the ATS mechanism. The system software creates a corresponding protection flow table entry for the accelerator / IO device based on the stream ID or device ID (such as stream ID or requesterID) of the accelerator / IO device, and initializes the protection flow table entry. Then the system software starts the accelerator to start working.

[0140] During initialization, the system software does not need to traverse the entire physical page table protection table and set the permission bits of each physical page table to 00b (indicating no read permission and no write permission) one by one. Instead, when initializing the protection flow table entry corresponding to the accelerator / IO device, the Zero bit position can be set to 1, indicating that the accelerator / IO device with the corresponding flow identifier has no read permission and no write permission, that is, the global permission of the corresponding physical page table protection table is not readable or writable.

[0141] The system software may also set other control configuration information such as the base address and boundary size of the physical page table protection table corresponding to the accelerator / IO device in the memory during initialization.

[0142] 2. Protection table refresh

[0143] Please refer to Figure 8bWhen the local ATC of the accelerator / IO device is missing, the accelerator / IO device can request the IOMMU / SMMU to perform address translation through the ATS mechanism. After the address translation is completed, the IOMMU / SMMU can return the corresponding address translation result to the accelerator / IO device. In addition, the IOMMU / SMMU can also synchronously send the address translation result and related information to the PAC device in this application. Among them, the address translation result includes the physical address of the address space requested to be accessed by the accelerator / IO device, and the related information may include the flow identifier of the accelerator / IO device and the permission information of the corresponding physical page table.

[0144] Subsequently, the PAC device can determine whether its local protection table cache corresponding to the stream identifier of the accelerator / IO device has access rights. If the protection table cache contains permission information corresponding to the physical page table, and the permission information in the protection table cache is consistent with the permission information provided by the IOMMU / SMMU, the PAC device does not need to do anything; if the protection table cache contains permission information corresponding to the physical page table, but the permission information in the protection table cache is inconsistent with the permission information provided by the IOMMU / SMMU, the PAC device refreshes the permission information corresponding to the physical page table in the protection table cache, and writes the permission information back to the corresponding physical page table protection table (Physical Page Protection Table, PPPT); if the protection table cache does not contain permission information corresponding to the physical page table, the PAC device creates an entry cache corresponding to the physical page table in the protection table cache, and writes the permission information of the physical page table to the corresponding physical page table protection table.

[0145] Memory Access

[0146] Please refer to Figure 8c, the accelerator / IO device initiates memory access after obtaining the physical address. At this time, all memory access requests will be checked for access rights by the PAC device in this application. If it is found that the check switch bit in the protection table flow table entry corresponding to the accessed stream is not turned on (i.e., the EN field indicates that the access is not checked), then the access is directly routed forward. Otherwise, if the access request of the accelerator / IO device to access the system memory using the physical address arrives before the physical page table protection table is initialized (i.e., the ZERO field indicates that the global permission information is not readable or writable, or the ZERO field is considered invalid), or the value of the physical address granularity alignment of this access is greater than the boundary range of the physical page table protection table, then the access is directly blocked and the event is reported to the system software. Otherwise, it is determined whether there is permission information corresponding to the physical page table in the protection table cache in the PAC device at this time. If not, the permission information corresponding to the physical page table is loaded from the physical page table protection table into the protection table cache, and then a permission check is performed; otherwise, the permission information corresponding to the physical page table in the protection table cache is directly read for a permission check. If the permission check passes, the access can be routed forward, otherwise, the access is blocked and the event is reported to the software.

[0147] 4. Invalidation of protection table

[0148] Please refer to Figure 8d , during the progress of the process, the corresponding physical page table may be updated. If a new physical page table needs to be established or the previous mapping between virtual addresses and physical addresses has changed, then the PAC device of the present application must also perform corresponding processing. At this time, the system software can choose to invalidate some page table mappings or invalidate all page tables belonging to this process. In either case, the page table management module of the system needs to know which page tables of the specific physical page tables need to be invalidated. At this time, this information will be synchronized to the PAC device, and then the PAC device can mark the cache entry corresponding to the invalid page table in the protection table cache as dirty, refresh the permission information of the relevant invalid page table in the physical page table protection table, and refresh the corresponding protection flow table entry or sub-protection flow table entry in the protection flow table.

[0149] The invalidation can also be global invalidation based on sub-StreamID, or global invalidation based on StreamID, wherein global invalidation based on sub-StreamID means that the invalidation operation will affect all related physical page tables under this SubstreamID, and global invalidation based on StreamID means that the invalidation operation will affect all related physical page tables under this streamID.

[0150] The present application also provides a protection proxy control device, please refer to Fig. 9 , is a schematic diagram of the structure of a protection proxy control device provided in an embodiment of the present application, the protection proxy control device 900 includes: a communication module 910 and a processing module 920. The protection proxy control device can be used to implement any of the above method embodiments.

[0151] Exemplarily, when the protection agent control device executes Figure 6 In the method embodiment shown in , the communication module 910 is used to receive a memory access request from an accelerator or an input / output IO device, wherein the memory access request includes an identifier of a data stream of the accelerator or IO device and a first physical address requested for access; the processing module 920 is used to read permission information corresponding to a first physical page table where the first physical address is located, according to the identifier of the data stream of the accelerator or IO device, wherein the permission information corresponding to the first physical page table is used to indicate whether the data stream has read permission and / or write permission in the first physical page table; and, according to the permission information corresponding to the first physical page table, a permission check is performed on the memory access request, and if the permission check passes, the memory access request is allowed to access the first physical address.

[0152] The processing module 920 involved in the protection agent control device can be implemented by a processor or a processor-related circuit component, and the communication module 910 can be implemented by a transceiver or a transceiver-related circuit component. The operations and / or functions of each module in the protection agent control device are respectively to achieve Figure 6 , Figure 7 , Figure 8a , Figure 8b , Figure 8c or Figure 8d For the sake of brevity, the corresponding process of the method shown in is not repeated here.

[0153] An embodiment of the present application also provides a chip system, including: a processor, the processor is coupled to a memory, the memory is used to store programs or instructions, when the program or instructions are executed by the processor, the chip system implements the method in any of the above method embodiments.

[0154] Optionally, the processor in the chip system may be one or more. The processor may be implemented by hardware or by software. When implemented by hardware, the processor may be a logic circuit, an integrated circuit, etc. When implemented by software, the processor may be a general-purpose processor implemented by reading software code stored in a memory.

[0155] Optionally, the memory in the chip system may be one or more. The memory may be integrated with the processor or may be separately provided with the processor, which is not limited in the present application. Exemplarily, the memory may be a non-transient processor, such as a read-only memory ROM, which may be integrated with the processor on the same chip or may be provided on different chips. The present application does not specifically limit the type of memory and the arrangement of the memory and the processor.

[0156] Exemplarily, the chip system can be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a digital signal processor (DSP), a microcontroller unit (MCU), a programmable logic device (PLD) or other integrated chips.

[0157] It should be understood that each step in the above method embodiment can be completed by a logic circuit in a processor or an instruction in software form. The method steps disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware processor, or by a combination of hardware and software modules in a processor.

[0158] An embodiment of the present application further provides a computer-readable storage medium, in which computer-readable instructions are stored. When a computer reads and executes the computer-readable instructions, the computer executes the method in the above method embodiment.

[0159] The embodiment of the present application also provides a computer program product. When a computer reads and executes the computer program product, the computer executes the method in the above method embodiment.

[0160] An embodiment of the present application provides a computer system, which includes the protection agent control device described in the present application, and a CPU coupled to the protection agent control device, and at least one third-party accelerator or IO device.

[0161] It should be understood that the processor mentioned in the embodiments of the present application may be a CPU, or other general-purpose processors, DSPs, ASICs, FPGAs or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0162] It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0163] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) is integrated in the processor.

[0164] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0165] It should be understood that the various digital numbers involved in the various embodiments of the present application are only distinguished for the convenience of description, and the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0166] In the various embodiments of the present application, unless otherwise specified or provided for in any logical conflict, the terms and / or descriptions between the different embodiments are consistent and may be referenced to each other, and the technical features in the different embodiments may be combined to form new embodiments according to their inherent logical relationships.

[0167] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0168] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0169] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0170] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0171] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0172] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk, or an optical disk.

[0173] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A memory protection method, characterized in that: The method comprises: Receiving a memory access request from an accelerator or an input / output (IO) device, wherein the memory access request includes an identifier of a data flow of the accelerator or the IO device and a first physical address requested for access; Reading, according to the identifier of the data stream of the accelerator or the IO device, permission information corresponding to the first physical page table where the first physical address is located, wherein the permission information corresponding to the first physical page table is used to indicate whether the data stream has read permission and / or write permission in the first physical page table, and different identifiers of different data streams correspond to different physical page table protection tables, and the permission information corresponding to the first physical page table is included in the physical page table protection table corresponding to the identifier of the data stream; A permission check is performed on the memory access request according to the permission information corresponding to the first physical page table, and if the permission check passes, the memory access request is allowed to access the first physical address.

2. The method according to claim 1, characterized in that The step of reading permission information corresponding to a first physical page table where the first physical address is located according to an identifier of a data stream of the accelerator or the IO device includes: Determine, according to the identifier of the data stream of the accelerator or IO device, a physical page table protection table and a protection table cache corresponding to the data stream, wherein the physical page table protection table stores permission information corresponding to at least one physical page table, and the protection table cache is a cache of the physical page table protection table; According to the identifier of the first physical page table, determining whether permission information corresponding to the first physical page table exists in the protection table cache, and if so, reading the permission information corresponding to the first physical page table from the protection table cache; If not, the permission information corresponding to the first physical page table is read from the physical page table protection table, and the permission information corresponding to the first physical page table is loaded into the protection table cache.

3. The method according to claim 2, characterized in that One entry of the protection table cache stores permission information corresponding to one or more physical page tables, and the entry in the protection table cache where the permission information corresponding to each physical page table is located is indexed according to the hash value of the identifier of the physical page table.

4. The method according to claim 1, characterized in that: The step of reading permission information corresponding to a first physical page table where the first physical address is located according to an identifier of a data stream of the accelerator or the IO device includes: Determine, according to the identifier of the data stream of the accelerator or the IO device, a physical page table protection table corresponding to the data stream, wherein the physical page table protection table stores permission information corresponding to at least one physical page table; According to the identifier of the first physical page table, permission information corresponding to the first physical page table is read from the physical page table protection table.

5. The method according to any one of claims 1 to 4, characterized in that Before reading the permission information corresponding to the first physical page table where the first physical address is located according to the identifier of the data stream of the accelerator or the IO device, the method further includes: Reading a protection flow table entry corresponding to a flow identifier of a data flow of the accelerator or IO device in a protection flow table, wherein the protection flow table entry includes first control information and second control information, wherein the first control information is used to indicate whether the global permission information of a physical page table protection table corresponding to the data flow is unreadable and unwritable, and the second control information is used to indicate a boundary range of the physical page table protection table; If it is determined based on the first control information and the second control information that the global permission information of the physical page table protection table is not unreadable and unwritable, and the first physical address is within the boundary range of the physical page table protection table, then the permission information corresponding to the first physical page table where the first physical address is located is read.

6. The method according to claim 5, characterized in that The protection flow table entry also includes third control information, and the third control information is used to indicate the protection granularity of the physical page table protection table; Before reading the permission information corresponding to the first physical page table where the first physical address is located, the method further includes: The first physical page table where the first physical address is located is determined according to the boundary range and protection granularity of the physical page table protection table.

7. The method according to claim 5, characterized in that The protection flow table entry also includes fourth control information, and the fourth control information is used to indicate whether to enable a function of checking memory access rights for the data flow; After obtaining the protection flow table entry corresponding to the flow identifier of the data flow of the accelerator or IO device in the protection flow table, the method further includes: According to the fourth control information, it is determined that a function of checking memory access rights for the data flow is enabled.

8. The method according to any one of claims 1 to 4, characterized in that The method further comprises: receiving, from a translation agent unit, an identifier of a data stream of the accelerator or IO device, the first physical address, and permission information of the accelerator or IO device to access the first physical address; If the protection table cache corresponding to the data stream contains permission information corresponding to the first physical page table where the first physical address is located, and the permission information corresponding to the first physical page table in the protection table cache is inconsistent with the permission information for the accelerator or IO device to access the first physical address received from the translation agent unit, then the physical page table protection table corresponding to the data stream and the permission information corresponding to the first physical page table in the protection table cache are updated according to the permission information for the accelerator or IO device to access the first physical address received from the translation agent unit.

9. The method according to claim 8, characterized in that The method further comprises: If the permission information corresponding to the first physical page table where the first physical address is located does not exist in the protection table cache corresponding to the data stream, the permission information for the accelerator or IO device to access the first physical address received from the translation agent unit is used as the permission information corresponding to the first physical page table where the first physical address is located, and is written into the physical page table protection table corresponding to the data stream and / or the protection table cache respectively.

10. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Receiving page table invalidation information from a page table management module, the page table invalidation information including an identifier of a data stream of the accelerator or IO device and an identifier of one or more invalidated physical page tables; The permission information corresponding to the invalidated one or more physical page tables in the protection table cache corresponding to the data stream and the physical page table protection table is updated to be unreadable and unwritable.

11. The method according to any one of claims 1 to 4, characterized in that The method further comprises: receiving page table invalidation information from a page table management module, the page table invalidation information including an identifier of a data stream of the accelerator or IO device and instruction information for globally invalidating a physical page table related to the data stream; The global permission information of the physical page table protection table corresponding to the data flow stored in the protection flow table entry corresponding to the identifier of the data flow in the protection flow table is set to be unreadable and unwritable.

12. A protection agent control device, characterized in that: The device comprises a processor and a communication interface; wherein, The communication interface is used to receive a memory access request from an accelerator or an input / output (IO) device, wherein the memory access request includes an identifier of a data stream of the accelerator or the IO device and a first physical address requested for access; The processor is used to read permission information corresponding to a first physical page table where the first physical address is located according to an identifier of a data stream of the accelerator or IO device, wherein the permission information corresponding to the first physical page table is used to indicate whether the data stream has read permission and / or write permission in the first physical page table, and different identifiers of different data streams correspond to different physical page table protection tables, and the permission information corresponding to the first physical page table is included in the physical page table protection table corresponding to the identifier of the data stream; And, performing a permission check on the memory access request according to the permission information corresponding to the first physical page table, and if the permission check passes, allowing the memory access request to access the first physical address.

13. The device according to claim 12, characterized in that The processor is specifically used for: Determine, according to the identifier of the data stream of the accelerator or IO device, a physical page table protection table and a protection table cache corresponding to the data stream, wherein the physical page table protection table stores permission information corresponding to at least one physical page table, and the protection table cache is a cache of the physical page table protection table; According to the identifier of the first physical page table, determining whether permission information corresponding to the first physical page table exists in the protection table cache, and if so, reading the permission information corresponding to the first physical page table from the protection table cache; If not, the permission information corresponding to the first physical page table is read from the physical page table protection table, and the permission information corresponding to the first physical page table is loaded into the protection table cache.

14. The device according to claim 13, characterized in that One entry of the protection table cache stores permission information corresponding to one or more physical page tables, and the entry in the protection table cache where the permission information corresponding to each physical page table is located is indexed according to the hash value of the identifier of the physical page table.

15. The device according to claim 12, characterized in that The processor is specifically used for: Determine, according to the identifier of the data stream of the accelerator or the IO device, a physical page table protection table corresponding to the data stream, wherein the physical page table protection table stores permission information corresponding to at least one physical page table; According to the identifier of the first physical page table, permission information corresponding to the first physical page table is read from the physical page table protection table.

16. The device according to any one of claims 12 to 15, characterized in that The processor is further configured to: Reading a protection flow table entry corresponding to a flow identifier of a data flow of the accelerator or IO device in a protection flow table, wherein the protection flow table entry includes first control information and second control information, wherein the first control information is used to indicate whether the global permission information of a physical page table protection table corresponding to the data flow is unreadable and unwritable, and the second control information is used to indicate a boundary range of the physical page table protection table; If it is determined based on the first control information and the second control information that the global permission information of the physical page table protection table is not unreadable and unwritable, and the first physical address is within the boundary range of the physical page table protection table, then the permission information corresponding to the first physical page table where the first physical address is located is read.

17. The device according to claim 16, characterized in that The protection flow table entry also includes third control information, and the third control information is used to indicate the protection granularity of the physical page table protection table; The processor is further configured to determine, according to a boundary range and a protection granularity of the physical page table protection table, a first physical page table where the first physical address is located.

18. The device according to claim 16, characterized in that The protection flow table entry also includes fourth control information, and the fourth control information is used to indicate whether to enable a function of checking memory access rights for the data flow; The processor is further configured to determine, based on the fourth control information, that a function of checking memory access rights for the data flow is enabled.

19. The device according to any one of claims 12 to 15, characterized in that The communication interface is also used for: receiving, from a translation agent unit, an identifier of a data stream of the accelerator or IO device, the first physical address, and permission information of the accelerator or IO device to access the first physical address; The processor is further configured to: If the protection table cache corresponding to the data stream contains permission information corresponding to the first physical page table where the first physical address is located, and the permission information corresponding to the first physical page table in the protection table cache is inconsistent with the permission information for the accelerator or IO device to access the first physical address received from the translation agent unit, then the physical page table protection table corresponding to the data stream and the permission information corresponding to the first physical page table in the protection table cache are updated according to the permission information for the accelerator or IO device to access the first physical address received from the translation agent unit.

20. The device according to claim 19, characterized in that The processor is further configured to: If the permission information corresponding to the first physical page table where the first physical address is located does not exist in the protection table cache corresponding to the data stream, the permission information for the accelerator or IO device to access the first physical address received from the translation agent unit is used as the permission information corresponding to the first physical page table where the first physical address is located, and is written into the physical page table protection table corresponding to the data stream and / or the protection table cache respectively.

21. The device according to any one of claims 12 to 15, characterized in that The communication interface is also used for: Receiving page table invalidation information from a page table management module, the page table invalidation information including an identifier of a data stream of the accelerator or IO device and an identifier of one or more invalidated physical page tables; The processor is further configured to: The permission information corresponding to the invalidated one or more physical page tables in the protection table cache corresponding to the data stream and the physical page table protection table is updated to be unreadable and unwritable.

22. The device according to any one of claims 12 to 15, characterized in that The communication interface is also used for: receiving page table invalidation information from a page table management module, the page table invalidation information including an identifier of a data stream of the accelerator or IO device and instruction information for globally invalidating a physical page table related to the data stream; The processor is further configured to: The global permission information of the physical page table protection table corresponding to the data flow stored in the protection flow table entry corresponding to the identifier of the data flow in the protection flow table is set to be unreadable and unwritable.

23. A communication device, characterized in that: The communication device comprises: A memory for storing instructions; At least one processor is used to call and execute the instructions from the memory so that the communication device implements the method according to any one of claims 1 to 11.

24. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed on a computer, the computer is enabled to execute the method according to any one of claims 1 to 11.

25. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is run on a computer, the computer is caused to execute the method according to any one of claims 1 to 11.

Images