Method and system for determining memory access permission of equipment and electronic equipment

Abstract

The invention discloses a method and a system for determining memory access permission of equipment and electronic equipment. The method is applied to an input and output physical memory protection (IOPMP) unit and can comprise the steps that a memory access request of equipment is obtained, at least one IOPMP entry matched with the equipment in the IOPMP unit is determined, the memory access request is used for making the equipment request to access data stored in a memory address corresponding to the IOPMP unit, and the IOPMP entry is used for representing a data structure of the IOPMP unit; the memory access request is verified in at least one IOPMP entry, at least one verification result is obtained, and the verification result is used for representing whether the device has the access permission in the corresponding IOPMP entry or not; based on the verification result, an access permission result corresponding to the memory access request is generated, and the access permission result is used for representing whether the device is allowed to access data stored in the memory address or not. The technical problem that the memory access permission of the equipment cannot be effectively determined is solved.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular, to a method and system for determining memory access rights of a device, and an electronic device. Background Art

[0002] At present, with the rapid development of information technology and the increasing complexity of computer systems, data security and privacy protection have become the focus of common concern in the industry and academia. Among them, using devices to attack confidential data stored in computer systems has become an important topic in the current computer system security. In many scenarios such as cloud computing, the Internet of Things, and smart phones, device access in computer systems can be finely isolated and protected to prevent potential security risks and data leakage. In the current information technology environment, ensuring the security and privacy protection of device access is crucial to protecting sensitive data and preventing security risks. Therefore, studying and practicing how to finely isolate and protect device access in computer systems is an important challenge and task in the current field of computer system security.

[0003] The hardware input / output (I / O) isolation mechanism is a hardware-level device security solution that aims to effectively isolate data access between different devices in the system to prevent malicious devices from stealing or tampering with confidential data in the computer system. Among them, two common hardware I / O isolation mechanisms include the I / O isolation mechanism in the Input / Output Memory Management Unit (IOMMU) and the I / O isolation mechanism in the Trusted Execution Environment (TEE).

[0004] However, the above two isolation mechanisms have certain limitations in terms of security, performance, and scalability. Therefore, there is still a technical problem that the memory access rights of the device cannot be effectively determined.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The embodiments of the present application provide a method, system and electronic device for determining memory access rights of a device, so as to at least solve the technical problem that the memory access rights of a device cannot be effectively determined.

[0007] According to one aspect of an embodiment of the present application, a method for determining memory access rights of a device is provided. The method is applied to an input / output physical memory protection IOPMP unit, and may include: obtaining a memory access request of the device, and determining at least one IOPMP entry that matches the device in the IOPMP unit, wherein the memory access request is used to enable the device to request access to data stored in a memory address corresponding to the IOPMP unit, and the IOPMP entry is used to represent the data structure of the IOPMP unit; verifying the memory access request in at least one IOPMP entry to obtain at least one verification result, wherein the verification result is used to indicate whether the device has access rights in the corresponding IOPMP entry; based on the verification result, generating an access rights result corresponding to the memory access request, wherein the access rights result is used to indicate whether the device is allowed to access the data stored in the memory address.

[0008] According to another aspect of the embodiment of the present application, a memory access method for a device is provided. The method is applied to an input / output physical memory protection IOPMP unit, and may include: obtaining a memory access request of the device, and determining at least one IOPMP entry that the device matches in the IOPMP unit, wherein the memory access request is used to enable the device to request access to data stored in a memory address corresponding to the IOPMP unit, and the IOPMP entry is used to represent the data structure of the IOPMP unit; verifying the memory access request in at least one IOPMP entry to obtain at least one verification result, wherein the verification result is used to indicate whether the device has access rights in the corresponding IOPMP entry; generating an access rights result corresponding to the memory access request based on the verification result; if the access rights result is to allow the device to access the data in the memory address, then transmitting the memory access request to the memory address to access the data; if the access rights result is to prohibit the device from accessing the data in the memory address, then prohibiting the memory access request from being transmitted to the memory address to access the data.

[0009] According to another aspect of the embodiment of the present application, a system for determining memory access rights of a device is provided. The system may include: an input-output physical memory protection IOPMP unit and an output end, wherein the IOPMP unit is used to obtain a memory access request of the device and determine at least one IOPMP entry that the device matches in the IOPMP unit, wherein the memory access request is used to make the device request access to the data stored in the memory address corresponding to the IOPMP unit, and the IOPMP entry is used to represent the data structure of the IOPMP unit; the memory access request is verified in at least one IOPMP entry to obtain at least one verification result, wherein the verification result is used to indicate whether the device has access rights in the corresponding IOPMP entry; based on the verification result, an access rights result corresponding to the memory access request is generated, wherein the access rights result is used to indicate whether the device is allowed to access the data stored in the memory address; the output end is used to output the access rights result.

[0010] According to another aspect of an embodiment of the present application, an electronic device is also provided. The electronic device may include a memory and a processor: the memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions. When the computer executable instructions are executed by the processor, the method for determining the memory access rights of the device of the embodiment of the present application is implemented.

[0011] According to another aspect of an embodiment of the present application, a processor is further provided. The processor is used to run a program, wherein the method for determining memory access rights of a device according to an embodiment of the present application is executed when the program is running.

[0012] According to another aspect of the embodiment of the present application, a computer-readable storage medium is provided, which includes a stored program, wherein when the program is executed, the device where the storage medium is located is controlled to execute the method for determining memory access rights of the device of the embodiment of the present application.

[0013] According to another aspect of the embodiment of the present application, a computer program product is also provided. The computer program product includes a computer program, and when the computer program is executed by a processor, the method for determining the memory access permission of the device of the embodiment of the present application is implemented.

[0014] In an embodiment of the present application, if it is necessary to access the memory in the system, the memory access rights of the device can be determined first. In the process of determining the memory access rights, in order to reduce the overhead of secure access to the device, an input output physical memory protection (IOPMP) unit is set. If a memory access request that needs to access the memory of the system is obtained, the IOPMP can be used to check the memory access request. During the inspection process, the memory access request can be used to make the device request to access the data stored in the memory address corresponding to the IOPMP unit. And the IOPMP entry that the device matches in the IOPMP unit can be determined. The memory access request can be verified in the IOPMP entry to determine whether the device has access rights in the corresponding IOPMP entry, and obtain the corresponding verification result. And based on whether the IOPMP entry has access rights, it is determined whether the current memory access request is allowed to access the data in the memory address in the device. In the embodiment of the present application, a pipelined I / O check module, i.e., an IOPMP unit, is provided to perform pipelined and efficient checks on memory access requests, ensuring that the memory access requests of the device can be checked in multiple stages, i.e., multiple IOPMP entries are checked to reduce the overhead of permission checks without affecting the clock frequency. Thus, the purpose of reducing the overhead of secure access to the device is achieved, and the technical effect of effectively determining the memory access rights of the device is achieved, solving the technical problem of being unable to effectively determine the memory access rights of the device.

[0015] It is easy to notice that the above general description and the following detailed description are only for the purpose of exemplifying and explaining the present application, and do not constitute a limitation of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1 is a schematic diagram of an application scenario of a method for determining memory access rights of a device according to an embodiment of the present application;

[0018] Figure 2 is a flow chart of a method for determining memory access rights of a device according to an embodiment of the present application;

[0019] Figure 3 is a flowchart of a memory access method of a device according to an embodiment of the present application;

[0020] Figure 4 is a flow chart of a system for determining memory access rights of a device according to an embodiment of the present application;

[0021] FIG5( a) is a schematic diagram of a source identifier to memory domain mapping table according to an embodiment of the present application;

[0022] FIG5( b) is a schematic diagram of a memory domain configuration table according to an embodiment of the present application;

[0023] FIG5( c ) is a schematic diagram of an input / output physical memory protection entry table according to an embodiment of the present application;

[0024] FIG6( a ) is a schematic diagram of a pipelined I / O check logic according to an embodiment of the present application;

[0025] FIG6( b ) is a schematic diagram of an IOPMP tree arbitration circuit according to an embodiment of the present application;

[0026] FIG6( c ) is a schematic diagram of an IOPMP linear arbitration circuit according to an embodiment of the present application;

[0027] Figure 7 is a schematic diagram of a mountable IOPMP segment table structure according to an embodiment of the present application;

[0028] Figure 8 is a schematic diagram of an IOPMP remapping and device identification information table according to an embodiment of the present application;

[0029] Fig. 9 is a schematic diagram of a software architecture of an IOPMP according to an embodiment of the present application;

[0030] Fig.10 is a schematic diagram of a device for determining memory access rights of a device according to an embodiment of the present application;

[0031] Fig.11 is a schematic diagram of a memory access device of a device according to an embodiment of the present application;

[0032] Fig.12 is a structural block diagram of a computer terminal according to an embodiment of the present application;

[0033] Fig.13 is a block diagram of an electronic device according to a method for determining memory access rights of a device according to an embodiment of the present application;

[0034] Fig.14 It is a hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for determining memory access rights of a device according to an embodiment of the present application;

[0035] Fig.15It is a structural block diagram of a computing environment of a method for determining memory access rights of a device according to an embodiment of the present application. DETAILED DESCRIPTION

[0036] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0037] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to the above-mentioned process, method, product or device.

[0038] First, some nouns or terms that appear in the description of the embodiments of the present application are subject to the following explanations:

[0039] Software Guard Extensions (SGX) are designed to protect critical parts of applications from malware and privileged software attacks. SGX uses a special memory area called an enclave where code and data can be encrypted and isolated in the computer's memory. This ensures that even if the operating system or virtualization environment is attacked, critical parts of the application are protected from attack;

[0040] Physical Memory Protection (PMP) is a hardware-level protection mechanism used to protect the physical memory of a computer system from unauthorized access and modification. PMP is usually supported by hardware in the processor or system chip to limit access to physical memory to enhance system security and stability.

[0041] IOPMP is a hardware-level protection mechanism used to protect the computer system's input / output devices from accessing physical memory from unauthorized access and modification. This technology can limit external devices' access to physical memory at the hardware level to enhance system security and stability;

[0042] IOMMU is a hardware device used to manage the access of input / output devices to memory in a computer system. Its main function is to provide mapping and access control of physical memory for input / output devices at the hardware level, thereby achieving isolation and protection of memory access. In short, IOMMU can provide a hardware-level memory virtualization and isolation mechanism to enhance the security and stability of the system;

[0043] Remote Direct Memory Access (RDMA) is a high-performance network communication technology that allows a computer in a computer system to directly access the memory of a remote computer system without the intervention of the central processing unit (CPU). This ability to directly access remote memory can greatly improve data transmission efficiency and reduce communication latency, especially in high-performance computing and network communications in large-scale data centers.

[0044] System on Chip (SoC) is an integrated circuit that integrates multiple core components of a computer system, usually including a processor core, memory controller, input / output interface, timer, peripheral controller, etc. SoC is a highly integrated chip that integrates multiple components in a traditional computer system onto one chip to achieve a more compact, high-performance and low-power solution;

[0045] DMA is a technology used for data transfer in computer systems. DMA allows external devices (such as network adapters, hard disk controllers, etc.) to directly access system memory without the intervention of the central processing unit (CPU). This direct memory access technology can significantly improve the efficiency of data transfer, reduce the burden on the CPU, and also help reduce system latency;

[0046] Content Addressable Memory (CAM) is a type of computer memory used for fast searching. Unlike traditional RAM (Random Access Memory) that accesses data from an address, CAM is a memory that finds its storage location based on the data itself. In other words, CAM allows data to be retrieved based on the stored content, rather than based on the memory address. This makes CAM very suitable for high-speed search and matching operations;

[0047] Source Identification (SID) refers to the device identifier used in IOPMP checks. In IOPMP, SID is used to identify the device that initiates a memory access request so that the system can identify the source of the request and verify and control its access rights. When a device initiates a memory access request, the system can use SID to determine the device identity of the access request and verify it to ensure the legitimacy of the request. This helps prevent unauthorized devices from accessing memory and strengthens the system's control and security over input / output device access to memory. In short, SID plays an important role in IOPMP as a device identifier, which is used to identify the device identity and verify and control memory access rights;

[0048] Device ID (Device Identification) is a device hardware identifier that is used to uniquely identify and recognize a device. Devices are usually assigned a unique Device ID so that the system can identify and manage different devices.

[0049] A memory domain (MD) is a group of memory address spaces that are grouped together to facilitate management, access, and protection. The concept of memory domain is involved in both computer architecture and operating systems.

[0050] Example 1

[0051] According to an embodiment of the present application, a method for determining memory access permissions of a device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0052] The method for determining the memory access rights of the above device provided in the embodiment of the present application can be applied to the following Figure 1 The application scenarios shown are not limited to these. Figure 1 In the application scenario shown, the server 10 can be a cloud. The server 10 can be connected to one or more client devices 20 via a local area network connection, a wide area network connection, an Internet connection, or other types of data networks. The client devices 20 here may include but are not limited to: smart phones, tablet computers, laptops, PDAs, personal computers, smart home devices, vehicle-mounted devices, etc. The client devices together constitute the client relative to the server. An operation interface for obtaining a memory access request for accessing data stored in a memory address of the device can be deployed on a graphical user interface on the client device. The operation interface can be an operation interface for detecting related operations performed by the user to generate a memory access request. The client device 20 can interact with the user through a graphical user interface to implement a method for determining memory access rights of a device provided in an embodiment of the present application.

[0053] In an embodiment of the present application, the system composed of the client device 20 and the server 10 can perform the following steps: If the user needs to access the data stored in the memory address of the system, the corresponding operation can be performed in the operation interface on the user's client device 20 to upload the memory access request corresponding to the data to be accessed. After receiving the above-mentioned memory access request, the memory access request can be sent to the server 10 through the network. An IOPMP unit can be deployed in the server 10, and the IOPMP unit can be used to check the received memory access request to determine whether it has memory access rights. Specifically, the following steps can be performed in the server 10:

[0054] Step S102, obtaining a memory access request of the device, and determining at least one IOPMP entry matched by the device in the IOPMP unit, wherein the memory access request is used to enable the device to request access to data stored in a memory address corresponding to the IOPMP unit, and the IOPMP entry is used to represent a data structure of the IOPMP unit;

[0055] Step S104, verifying the memory access request in at least one IOPMP entry to obtain at least one verification result, wherein the verification result is used to indicate whether the device has access rights in the corresponding IOPMP entry;

[0056] Step S106: Generate an access permission result corresponding to the memory access request based on the verification result, wherein the access permission result is used to indicate whether the device is allowed to access the data stored in the memory address.

[0057] In the above process, the memory access request in the server 10 can be verified through the network, and the obtained access permission result can be sent to the client device 20. The access permission result can be displayed on the operation interface of the client device 20 for the user to view. And the user can be given corresponding permissions to view the data required to be viewed in the memory address of the system.

[0058] In the embodiment of the present application, a pipelined I / O check module, i.e., an IOPMP unit, is provided to perform pipelined and efficient checks on memory access requests, ensuring that the memory access requests of the device can be checked in multiple stages, i.e., multiple IOPMP entries are checked to reduce the overhead of permission checks without affecting the clock frequency. Thus, the purpose of reducing the overhead of secure access to the device is achieved, and the technical effect of effectively determining the memory access rights of the device is achieved, solving the technical problem of being unable to effectively determine the memory access rights of the device.

[0059] The present application embodiment proposes the following method. In the above application scenario, the present application provides the following Figure 2 The method for determining memory access permissions for a device is shown. Figure 2 is a flowchart of a method for determining memory access rights of a device according to an embodiment of the present application, such as Figure 2 As shown, the method can be applied to an input-output physical memory protection IOPMP unit and may include the following steps:

[0060] Step S202, obtaining a memory access request of a device, and determining at least one IOPMP entry that matches the device in the IOPMP unit.

[0061] In the technical solution provided in the above step S202 of the present application, the device (Device) can be an I / O device. Memory access can be access to the computer system memory (Memory, referred to as Mem), that is, access to the data stored in the memory address of the system. The computer system can also be referred to as a system in the embodiment of the present application. The memory access request can be used to make the device request access to the data stored in the memory address corresponding to the IOPMP unit, and can be a request for the device to access the corresponding data stored in the memory address of the computer system, for example, it can be a DMA request (DMA Request, referred to as Req), which can also be called an I / O request, which may include a memory address and request data, that is, the request data (data) to be accessed can be filled in the memory access request, and the memory address (Addr) where the request data is located. The request data can be confidential data in the memory address.

[0062] Optionally, the most basic structure of IOPMP is the entry array of IOPMP, that is, the IOPMP entry can be used to represent the data structure of the IOPMP unit. The entry array can contain a large number of IOPMP entries, wherein the entry array of IOPMP can also be called an input / output physical memory protection table (IOPMP Table) or an input / output physical memory protection entry table (IOPMP Entry TABLE), and the IOPMP entries in the entry array can be represented as Entry0, Entry x, Entry x+1. It should be noted that this is only an example, and no specific restrictions are imposed on the IOPMP entries in the entry array and the representation method.

[0063] In this embodiment, if it is detected that the device has a memory access request to access data stored in a memory address of the computer system, the memory access request may be input into the IOPMP unit, and an IOPMP entry matching the memory access request may be determined.

[0064] Optionally, if the user needs to access data stored in the memory address of the computer system, the corresponding operation can be performed on the user's client device. For example, the request data to be accessed can be entered, and the memory address where the request data is stored can be entered. The corresponding memory access request is created through the request data and memory data required by the user.

[0065] Optionally, after the user inputs a corresponding memory access request from the client device, the memory access request can be transmitted to the IOPMP unit in the server through the network. The above memory access request can be obtained by using IOPMP, and the IOPMP entry matching the device currently issuing the memory access request can be screened out from the entry array in the IOPMP unit, wherein the IOPMP unit can also be an IOPMP checker (IOPMP Checker), which can be used to check whether the memory access request has access rights.

[0066] In the related art, the two common hardware I / O isolation mechanisms of IOMMU and TEE mentioned above have at least the following problems: IOMMU may have performance issues under heavy workloads because the expensive Input / Output Translation Lookaside Buffer (IOTLB) using asynchronous command queues fails. For the I / O isolation mechanism in TEE, memory encryption may cause additional memory copying, thereby reducing I / O performance; for IOMMU, it only supports page-level isolation, which may not be enough for some Direct Memory Access (DMA) scenarios. For the I / O isolation mechanism in TEE, some implementations may be limited by the number of security domains, the number of devices, and the risk of communication between security domains; in IOMMU, complex page tables and I / O virtual address configurations may cause malicious devices to exploit vulnerabilities and bypass IOMMU checks. In TEE, there are attacks that are difficult to prevent, such as replay attacks and security domain switching vulnerabilities; IOMMU settings may lead to poor scalability, such as input and output virtual address (IOVA) allocation and IOTLB will become bottlenecks in multi-device and tenant scenarios. For TEE, some implementations may have device and security domain number restrictions, which will also affect its scalability. Therefore, there are still technical problems of low system security and reliability.

[0067] However, in an embodiment of the present application, an IOPMP unit is provided, and the IOPMP unit can be used to determine whether the data in the memory address of the device accessing the system has access rights. The IOPMP can limit the access of the I / O device to the memory, that is, it can limit a specific input / output device to access only a specific memory area, thereby improving the control of the system over the access to the peripherals. The IOPMP can perform memory isolation, that is, it can effectively isolate the access of the device to the memory, avoid unrelated devices from unauthorized access to the memory, and improve the security of the system. The IOPMP device can prevent illegal access, that is, through the IOPMP mechanism, the system can effectively prevent unauthorized devices from accessing the memory, and prevent malicious software or unauthorized programs from modifying key system memory areas. IOPMP is generally widely used in scenarios such as embedded systems, operating system kernels, and virtualization platforms to enhance the security and stability of the system. Through the IOPMP mechanism, the system can perform fine-grained permission control on the access of the input / output device to the physical memory, effectively preventing unauthorized access to the memory, and achieving the technical effect of improving the security and reliability of the system.

[0068] Step S204: verify the memory access request in at least one IOPMP entry to obtain at least one verification result.

[0069] In the technical solution provided in step S204 of the present application, the verification result can be used to indicate whether the device has access rights in the corresponding IOPMP entry, and can also be referred to as the result of I / O permission check (I / O check), permission verification result and intermediate result. The access rights can be I / O permissions.

[0070] In this embodiment, after obtaining the memory access request of the device and determining the IOPMP entry that matches the device in the IOPMP unit, the memory access request can be verified in the IOPMP entry to obtain a corresponding verification result.

[0071] Optionally, after determining the IOPMP entry that matches the device, for the memory access request, each matched IOPMP entry may be verified separately to verify whether the device has access rights to the corresponding IOPMP entry.

[0072] In an embodiment of the present application, an IOPMP unit can be used to perform a pipeline check on a memory access request. During the check, at least one IOPMP entry that matches the device that currently issues the memory access request can be determined. If there are multiple IOPMP entries matched, a multi-stage pipeline can be set up during the pipeline check, and parallel permission checks are implemented in each stage of the pipeline, that is, the I / O permissions of the memory access requests under multiple IOPMP entries can be determined in parallel. In the above manner, by performing a tree-like parallel permission check on the memory access request, the purpose of improving the efficiency of determining the memory access rights is achieved, and the purpose of improving the performance and scalability of the computer system is achieved, thereby achieving the technical effect of effectively determining the memory access rights of the device.

[0073] Optionally, when performing permission check on the set multi-stage pipeline, task parallelism can be used to perform permission check on each stage of the pipeline. For example, tree parallelism in task parallelism can be used to improve the efficiency of permission check.

[0074] It should be noted that the above-mentioned parallel method of performing permission checks on each stage of the pipeline is only for illustration and is not specifically limited here. As long as a multi-stage pipeline can be set up and a method and process for performing permission checks on each stage of the pipeline is available, it is within the protection scope of the embodiments of the present application.

[0075] Step S206: Generate access permission results corresponding to the memory access request based on the verification result.

[0076] In the technical solution provided in the above step S206 of the present application, the access permission result can be used to indicate whether the device is allowed to access the data stored in the memory address, and can also be called the final decision, the final access permission of the DMA request, or the final I / O memory access permission.

[0077] In this embodiment, after the memory access request is verified in the IOPMP entry and a verification result is obtained, an access permission result corresponding to the memory access request can be generated based on the verification result.

[0078] Optionally, after determining the verification results of the current memory access request under each IOPMP entry, the verification results of the above IOPMP entries may be combined to comprehensively determine whether the memory access request has the authority to access the data in the memory address in the system.

[0079] Through the above steps S202 to S206 of the present application, if it is necessary to access the memory in the system, the memory access rights of the device can be determined first. In the process of determining the memory access rights, in order to reduce the overhead of secure access to the device, an IOPMP unit is set. If a memory access request that needs to access the memory of the system is obtained, the memory access request can be checked using IOPMP. During the inspection process, the memory access request can be used to make the device request access to the data stored in the memory address corresponding to the IOPMP unit. And the IOPMP entry that the device matches in the IOPMP unit can be determined. The memory access request can be verified in the IOPMP entry to determine whether the device has access rights in the corresponding IOPMP entry, and obtain the corresponding verification result. And based on whether the IOPMP entry has access rights, it is determined whether the current memory access request is allowed to access the data in the memory address in the device. In the embodiment of the present application, a pipelined I / O check module (i.e., IOPMP unit) is provided to perform pipelined and efficient checks on memory access requests, ensuring that the memory access requests of the device can be checked in multiple stages, i.e., multiple IOPMP entries are checked to reduce the overhead of permission checks without affecting the clock frequency. Thus, the purpose of reducing the overhead of secure access to the device is achieved, and the technical effect of effectively determining the memory access rights of the device is achieved, solving the technical problem of being unable to effectively determine the memory access rights of the device.

[0080] The above method of this embodiment is further introduced below.

[0081] As an optional implementation, step S204 verifies the memory access request in at least one IOPMP entry to obtain at least one verification result, including: determining the priority order of at least one IOPMP entry; and verifying the memory access request in at least one IOPMP entry according to the priority order to obtain at least one verification result.

[0082] In this embodiment, in the process of verifying the memory access request under the IOPMP entry, the priority order of the IOPMP entry can be determined, and the memory access request can be verified under the IOPMP entry according to the priority order to obtain a verification result, where the priority order can also be called priority.

[0083] Optionally, after determining the IOPMP request that matches the device of the current memory access request, the priority order between the above matching IOPMP requests can be determined, and the IOPMP checker is used to verify the memory access request one by one under the IOPMP entry according to the above priority order to generate an intermediate result.

[0084] As an optional implementation, a memory access request is verified in at least one IOPMP entry in order of priority to obtain at least one verification result, including: determining a first IOPMP entry in at least one IOPMP entry in order of priority; verifying the memory access request in the first IOPMP entry to obtain a first verification result, wherein the verification result includes the first verification result; if the at least one IOPMP entry includes a second IOPMP entry that is the next to the first IOPMP entry in the priority order, then verifying the first verification result in the second IOPMP entry to obtain a second verification result, wherein the verification result includes the second verification result.

[0085] In this embodiment, in the process of verifying the memory access request in the IOPMP entries according to the priority order, the first IOPMP entry can be determined in the matching IOPMP entries according to the priority order. The memory access request can be verified in the first IOPMP entry to obtain a first verification result. If the IOPMP entry includes a second IOPMP entry next to the first IOPMP entry in the priority order, the first verification result can be verified in the second IOPMP entry to obtain a corresponding second verification result.

[0086] Optionally, the first IOPMP entry can be used to represent the IOPMP entry under the first pipeline stage among multiple pipeline stages in the IOPMP checker. The second IOPMP entry can be used to represent the IOPMP entry under the second pipeline stage below the first pipeline stage among multiple pipeline stages in the IOPMP checker. The verification result may include a first verification result and a second verification result. The first verification result may be an intermediate result obtained by verifying the first IOPMP entry in the first pipeline stage. The second verification result may be an intermediate result obtained by verifying the second IOPMP entry in the second pipeline stage, wherein the first pipeline stage may be the first stage (Stage-1), that is, the first stage in the pipeline. The second pipeline stage may be the second stage (Stage-2). The priority of the first IOPMP entry is higher than that of the second IOPMP entry, that is, the first IOPMP entry is a high priority (High priority) and the second IOPMP entry is a low priority (Lowpriority). The priority order may also be referred to as a static priority.

[0087] Optionally, the IOPMP checker may include multiple pipeline stages, and verify the memory access request and the respective IOPMP entries in different pipeline stages to obtain corresponding intermediate results.

[0088] Optionally, from a large number of IOPMP entries in the IOPMP TABLE, an IOPMP entry that matches the device of the current memory access request can be determined. The priority order in the matching IOPMP entries can be determined. If the IOPMP entry in the priority order can be the first IOPMP entry, an I / O permission check of Stage-1 can be performed, and an intermediate result, i.e., a first verification result, can be generated. A second IOPMP entry with a lower priority order than the first IOPMP entry can be determined, and an I / O permission check of Stage-2 can be performed, and a corresponding intermediate result, i.e., a second verification result, can be generated.

[0089] Optionally, IOPMP is an isolation mechanism for regulating access issued by bus masters and preventing malicious DMA attacks. It manages device access rights to physical memory to ensure that devices can only access authorized memory areas. Each master or a group of masters with the same bus access rights has a unique identifier called a source ID (i.e., SID). This identifier is used to identify the identity of the device or master to control its access rights to memory. MD can be used to organize the physical memory that each device can access. A memory domain contains several consecutive memory areas, each of which can have different access rights. This mechanism allows fine-grained access control to memory. MD contains three memory areas, the receive area (RX), the transmit area (TX), and the control register area, the RX area and the TX area, which are used to store input and output data, respectively. By storing data in different areas and assigning different access rights to each area, strict control and protection of data can be achieved. In general, the standard IOPMP isolation mechanism describes a mechanism for fine-grained management of device access rights to memory, and fine control of device access is achieved through SIDs and memory domains. This mechanism is critical to ensuring the security and privacy of device access.

[0090] Optionally, IOPMP is a basic structure for managing device access to memory. The most basic structure of IOPMP is an array of entries, each entry is indexed from zero and defines a rule when checking transactions. Each IOPMP entry includes a memory region and read / write permissions for the region. This means that each entry describes the access rights to a specific memory region. Each IOPMP entry belongs to only one memory domain, and a memory domain may contain multiple IOPMP entries. Any SID associated with a memory domain is also associated with all IOPMP entries belonging to the memory domain. This association ensures that access rights to memory regions are effectively managed. IOPMP entries have static priorities, where entries with lower numbers have high priorities. This means that entries with lower numbers will have higher priorities. When issuing a transaction, IOPMP checks the transaction against the IOPMP entries in priority order. If the transaction matches the IOPMP entry, IOPMP checks the read / write permissions within the entry. This means that IOPMP is responsible for ensuring that the device's access rights to memory comply with pre-defined rules.

[0091] In summary, the IOPMP entry array is the basic structure of IOPMP, which is used to manage and control the access rights of devices to memory. Each entry describes the access rights to a specific memory area, and through the association with the memory domain and SID, it ensures the effective management of access rights. The priority and permission check mechanism ensures the security and privacy protection of device access.

[0092] Optionally, the behavior of IOPMP is controlled by several configuration register tables. For example, the Source Identifier to Memory Domain Mapping (SRC2MD) table, which is used to identify the memory domain associated with a given SID. It consists of multiple groups of SRCSMD registers, each register having a 64-bit space and two fields: SRC S MD.L and SRC S MD.MD. SRC S MD.L is the lock bit flag of this register, while SRC S MD.MD is a bitmap field used to indicate whether memory domain m is associated with this SID. The Memory Domain Configuration (MDCFG) table, which defines the relationship between IOPMP entries and memory domains. It has a series of configuration registers, where each register MD m CFG is for memory domain m. In the MD m CFG register, MD m CFG.T indicates the last index of the IOPMP entry belonging to memory domain m. Optionally, if MD m-1 CFG.T ≤ j < MD m CFG.T, then the IOPMP entry with index j belongs to memory domain m, where m > 0. Memory domain 0 has IOPMP entries with index j < MD0CFG.T. The above configuration register tables are used to define the relationship between memory domains and SIDs, as well as the relationship between IOPMP entries and memory domains. Through the above configuration register tables, the behavior of IOPMP can be precisely controlled to ensure that the access rights of devices to memory are effectively managed and controlled. This provides an important guarantee for the security and privacy protection of device access.

[0093] As an optional embodiment, the method may include: if at least one IOPMP entry includes the next third IOPMP entry in the priority order of the second IOPMP entry, then the third IOPMP entry is determined as the second IOPMP entry, the second verification result is determined as the first verification result, and the following steps are returned to execute until at least one IOPMP entry does not include the next third IOPMP entry in the priority order of the second IOPMP entry: the first verification result is verified in the second IOPMP entry to obtain a second verification result.

[0094] In this embodiment, if the IOPMP entry also includes the third IOPMP entry that is next to the second IOPMP entry in the priority order, the third IOPMP entry can be determined as the second IOPMP entry, and the second verification result can be determined as the first verification result. The following steps can be returned to execute until the IOPMP entry does not include the third IOPMP entry that is next to the second IOPMP entry in the priority order: the first verification result can be verified in the second IOPMP entry to obtain a second verification result.

[0095] Optionally, if the IOPMP entries matching the current device include, in addition to the first IOPMP entry and the second IOPMP entry, a third IOPMP entry whose priority is lower than that of the first IOPMP entry and the second IOPMP entry, then the third IOPMP entry can be determined as the second IOPMP entry, and an I / O permission check can be performed on the memory access request at the corresponding pipeline stage to obtain a corresponding intermediate result, until no other IOPMP entries exist in the matching IOPMP entries.

[0096] In an embodiment of the present application, the IOPMP unit may include an IOPMP pipeline (IOPMP Pipel ine), that is, the IOPMP checker may be an IOPMP checker in the form of a pipeline. The IOPMP pipeline can perform multi-stage inspections, that is, the I / O inspection can be divided into multiple stages, and each stage performs a specific inspection task, for example, matching inspection, permission verification, etc. according to priority. Such a staged setting helps to improve the parallelism and throughput of the I / O inspection. The IOPMP pipeline can perform parallel processing, that is, different stages can process different I / O requests in parallel, thereby accelerating the overall I / O inspection process. This is crucial to improving the efficiency and performance of the I / O inspection. The IOPMP pipeline can perform high-bandwidth processing, that is, the use of a pipeline helps to improve the bandwidth processing capability of the I / O inspection, so that the system can more effectively handle a large number of I / O requests. Through this pipeline-shaped IOPMP checker, the bandwidth-sensitive I / O access control requirements can be better met, especially in the face of a large number of DMA requests, efficient access control and protection can be provided. This setting helps improve the security and reliability of the system's I / O access.

[0097] As an optional implementation, the first verification result is verified in the second IOPMP entry to obtain a second verification result, including: in the IOPMP unit, determining a sub-check module corresponding to the second IOPMP entry; in the sub-check module, using a first tree-like arbitration circuit to perform parallel verification on the first verification result and the second IOPMP entry to obtain a second verification result.

[0098] In this embodiment, in the process of verifying the first verification result in the second IOPMP entry to obtain the second verification result, in the IOPMP unit, the sub-check module corresponding to the second IOPMP entry can be determined. And in the sub-check module, the first verification result and the second IOPMP entry can be verified in parallel using a first tree arbitration circuit to obtain the second verification result, wherein the first tree arbitration circuit can be a linear arbitration circuit, that is, the IOPMP checker is an IOPMP checker based on a tree arbitration logic. The IOPMP checker can include multiple sub-check modules, and the sub-check modules are connected through pipeline registers.

[0099] Optionally, by combining the IOPMP pipeline and the IOPMP tree arbitration circuit together, the overhead of permission checking is further reduced to improve the efficiency of the system's I / O access.

[0100] Optionally, the IOPMP checker includes multiple sub-check modules, which are connected through pipeline registers. This means that multiple sub-check modules can perform permission checks at the same time without waiting for the previous permission check to be completed, that is, this setting can realize parallel processing of multiple sub-check modules, and they are connected through pipeline registers, which helps to improve the overall inspection processing speed. Each sub-check module adopts a tree arbitration circuit, which means that they can check the permissions of multiple IOPMP entries in parallel. The tree arbitration circuit can effectively handle multiple permission check requirements and improve the efficiency and throughput of the overall inspection. The final permission result obtained by the tree arbitration circuit is written into the pipeline register. In this way, the permission check result can be temporarily saved in the register for subsequent processing. The permissions in each level of pipeline inspection are used to generate the final I / O access rights according to the pipeline priority as the final access rights of the DMA request. This means that the final access rights are generated by the pipeline priority to determine the final access rights of the DMA request.

[0101] Optionally, the function of the above-mentioned tree-like arbitration circuit is to coordinate multiple sub-check modules to check the permissions of multiple IOPMP entries. The tree-like arbitration circuit can effectively handle multiple permission check requirements, and through the pipeline register connection, it can handle multiple inspection tasks in parallel, thereby improving the efficiency and throughput of the overall inspection. The role of the tree-like arbitration circuit is to coordinate and manage the permission check requests of the sub-check modules to ensure that multiple permission checks are performed efficiently. The tree-like arbitration circuit enables multiple sub-check modules to check the permissions of multiple IOPMP entries, and this process can be regarded as a tree-like parallel task allocation and processing. Through the tree-like arbitration circuit, different sub-check modules can perform permission checks on different IOPMP entries in parallel, thereby improving the efficiency of the overall permission check. Therefore, the tree-like arbitration circuit cooperates with the tree-like parallel method used by the permission check to jointly realize the parallel processing of the permissions of multiple IOPMP entries and the determination of the final access rights.

[0102] It should be noted that, through the above analysis, the tree-like punching circuit corresponds to the tree-like parallel mode, and together they realize parallel permission checking. Since the tree-like parallel mode is an example of a parallel mode in the embodiment of the present application, the corresponding tree-like punching circuit is also a corresponding example. In the embodiment of the present application, the above-mentioned tree-like arbitration circuit and tree-like parallel mode are not limited. As long as it is a parallel mode that can perform parallel permission checking, the corresponding punching circuit, and the specific parallel permission checking process under the corresponding parallel mode and punching circuit are within the protection scope of the embodiment of the present application.

[0103] In summary, the present application can process multiple permission check requirements in parallel by combining the IOPMP pipeline and the tree arbitration circuit, and save the intermediate results through the pipeline registers to finally generate the final access rights of the DMA request, thereby reducing the overhead of permission checking.

[0104] As an optional implementation, the method may include: writing the second verification result output by the first tree arbitration circuit into a register.

[0105] In this embodiment, the second verification result output by the first tree-shaped arbitration circuit may be written into a register, wherein the register may be a pipeline register.

[0106] Optionally, there are multiple pipeline stages in the IOPMP checker, and respective IOPMP entries are verified in different pipeline stages, and intermediate results are stored in registers (REG for short).

[0107] Optionally, a pipelined IOPMP checker setting is indeed suitable for improving the efficiency of I / O access control and solving bandwidth-sensitive application scenarios. The IOPMP checker takes memory addresses, request data, and IOPMP entries as input. The above data will be used to perform multi-stage I / O access control checks. The masker can be used to filter the IOPMP entries and select the entries corresponding to the current device ID. This helps to reduce the number of entries that need to be checked and improves the efficiency of the check. There are multiple pipeline stages in the IOPMP checker, each of which verifies its own IOPMP entry and stores the intermediate results in registers. This staged setting improves the parallelism and throughput of the entire I / O check. After passing all I / O permission checks, the IOPMP checker generates a final decision to determine whether the memory access is authorized. This ensures security verification of each access request.

[0108] As an optional implementation, verifying the first verification result in the second IOPMP entry to obtain a second verification result includes: determining a time period corresponding to the second IOPMP entry; and verifying the first verification result in the second IOPMP entry within the time period to obtain a second verification result.

[0109] In this embodiment, in the process of verifying the first verification result in the second IOPMP entry to obtain the second verification result, the time period corresponding to the second IOPMP entry can be determined. Thus, within the time period, the first verification result is verified in the second IOPMP entry to obtain the second verification result, wherein the second tree arbitration circuit can be an IOPMP tree arbitration circuit (Tree-based Arbitration).

[0110] Optionally, regarding the pipeline setting, some new issues do need to be addressed, especially the state consistency between the bus and the IOPMP checker. To address this issue, the addition of a monitor helps maintain the consistency of the blocking state between the bus and the IOPMP checker. This setting helps ensure the effectiveness of I / O access control and system performance.

[0111] Optionally, the IOPMP tree arbitration circuit uses a tree structure to implement prioritized I / O permission checks, aiming to reduce the delay of the check. This solution can effectively reduce the check delay to a logarithmic level (log(N)), thereby improving the efficiency and performance of the system's I / O access.

[0112] Optionally, the inter-species results may be reduced in the IOPMP tree arbitration circuit to obtain access permission results.

[0113] As an optional implementation, step S206, based on the verification result, generates an access permission result corresponding to the memory access request, including: in the IOPMP unit, determining a second tree arbitration circuit; in the second tree arbitration circuit, reducing at least one verification result according to the priority order to obtain the access permission result, wherein the verification result corresponds to a node of the second tree arbitration circuit.

[0114] In this embodiment, in the process of generating the access permission result corresponding to the memory access request based on the verification result, a second tree arbitration circuit can be determined in the IOPMP unit. In the second tree arbitration circuit, at least one verification result can be reduced according to the priority order to obtain the access permission result, wherein the verification result can correspond to the node of the second tree arbitration circuit.

[0115] Optionally, the IOPMP checker based on the tree arbitration logic has the following characteristics: Pairwise comparison, the IOPMP checker compares the permissions of each IOPMP entry pairwise according to the priority and generates an intermediate result. The above intermediate results will be processed in the subsequent reduction stage. Tree structure reduction, the intermediate results are reduced in the tree structure circuit. Unlike other check circuits that may be optimized using back-end EDA tools, tree-based arbitration is implemented at the register transfer level (RTL), with more information and manual optimization. This method can use different tree structures according to actual needs to meet different requirements of timing (binary tree) and area (N-ary tree) to achieve a balance between different setting goals. Permission check result, all permission check results are reduced to the final root node according to the priority, and the permission of the root node is the final I / O memory access permission. Through the reduction of the tree structure, the combination and final decision of I / O permissions can be efficiently realized.

[0116] In summary, the IOPMP checker based on tree arbitration logic uses a tree structure to achieve the reduction and final decision of I / O permissions. This method is highly flexible and optimizable, can perform different levels of optimization according to actual needs, and can efficiently achieve effective management of I / O permissions.

[0117] In an embodiment of the present application, a novel scheme for implementing prioritized I / O permission checking is proposed, namely, an IOPMP tree arbitration circuit based on tree arbitration logic. The scheme reduces the delay of permission checking to the log(N) level through tree arbitration logic. Specifically, the scheme includes the following steps: the IOPMP checker compares the permissions of each IOPMP entry pair by pair according to the priority and generates an intermediate result. This means that a series of pairwise comparisons are performed in the checker to determine the permissions of each IOPMP entry. Next, the above intermediate results are reduced using a tree structure circuit. This means that the intermediate results will be organized into a tree structure and reduced by logical operations. Unlike using back-end EDA tools to optimize the checking circuit, tree-based arbitration is implemented at the RTL level, which means that it has more information and manual optimization. For example, different tree structures, such as binary trees and N-ary trees, can be used according to different requirements of timing and area. The final permission check result is reduced to the final root node according to the priority specification, and the permission of the root node is the final I / O memory access permission. This means that multi-level permission checks are performed through the tree arbitration logic, and the results are reduced to the final root node, thereby determining the final I / O memory access permission. In general, this IOPMP tree arbitration circuit based on tree arbitration logic achieves efficient and prioritized I / O permission checks through pair-by-pair comparison and tree reduction, while optimizing at the RTL level to meet different timing and area requirements.

[0118] As an optional implementation, in the second tree-like arbitration circuit, at least one verification result is reduced in order of priority to obtain an access permission result, including: determining a root node of the second tree-like arbitration circuit; reducing at least one verification result to the root node in order of priority to obtain an access permission result.

[0119] In this embodiment, in the second tree arbitration circuit, at least one verification result is reduced in order of priority to obtain the access permission result. The root node of the second tree arbitration circuit can be determined, and the verification results can be reduced to the root node in order of priority to obtain the access permission result.

[0120] Optionally, after the root node of the IOPMP tree arbitration circuit is determined, the final root node may be obtained according to the priority, and the permission of the root node is the final I / O memory access permission.

[0121] Optionally, the final permission check result is reduced to the final root node according to the priority, and the permission of the root node is the final I / O memory access permission. This means that multi-level permission checks are performed through the tree arbitration logic, and the results are reduced to the final root node, thereby determining the final I / O memory access permission.

[0122] As an optional implementation, the method may include: in the event that source identification information of the device is missing, generating a missing interrupt signal, wherein the missing interrupt signal is used to indicate that the source identification information is missing; in response to the missing interrupt signal, interrupting execution of a memory access request, and obtaining extended source identification information of the device; loading the extended source identification information into an extended register table corresponding to a register table of the IOPMP unit, wherein the register table corresponds to a source identification information set, and is used to identify a memory domain associated with the source identification information in the source identification information set, and the extended register table is obtained by extending the registers in the register table.

[0123] In this embodiment, when the source identification information of the device is missing, a missing interrupt signal can be generated. When the missing interrupt signal is signaled, the memory access request is interrupted and the extended source identification information of the device is obtained. The extended source identification information can be loaded into the extended register table corresponding to the register of the IOPMP unit.

[0124] Optionally, the source identification information may be a device identifier SID. The extended source identification information may be an extended device identifier (Extended Source Identifier, eSID for short). The register table may be a SRC2MD table, which may correspond to a source identification information set, and is used to identify a memory domain associated with the source identification information in the source identification information set, that is, to identify a memory domain associated with a given SID. The extended register table may be obtained by extending the registers in the register table, and may be an extended source identifier to memory domain mapping register (Extended Source Identifier to MemoryDomain Mapping Register, eSRCMD for short), that is, an extended on-chip SRC2MD register.

[0125] Optionally, the concept of the mountable segment table in IOPMP being retained in protected memory. Compared to the entry table or SRC2MD table in IOPMP, the mountable IOPMP segment table is retained in protected memory. This means that the above-mentioned mountable segment table is stored in a protected memory area, such as PMP protected memory in Reduced Instruction Set Computer-V (RISC-V). Such a setting can ensure that unauthorized software or devices cannot directly access the above-mentioned segment table, thereby enhancing security. Since the mountable IOPMP segment table is retained in protected memory, unauthorized software or devices cannot directly access the above-mentioned table. Such a setting provides an effective security mechanism to ensure that access rights to the above-mentioned table are controlled. Based on the above setting, assuming that the physical memory is sufficient, there is no hardware limit on the size of the mountable IOPMP segment table. This means that with sufficient physical memory support, the size of the mountable IOPMP segment table can be expanded as needed without being restricted by hardware.

[0126] In summary, this setup of keeping the mountable IOPMP segment table in protected memory provides an effective security mechanism to ensure that access to the above table is controlled and there is no hardware limit on the size of the mountable segment table with sufficient physical memory support.

[0127] Optionally, the extension of the existing IOPMP entry table may include: an extended SRC2MD register (on-chip), that is, eSRCMD, which indicates that the original SRC2MD register is extended to support new functions or attributes. The extended register eSRCMD may be used to store more information about devices or I / O resources so as to more comprehensively manage the access rights of the above resources. An extended device identifier, that is, eSID, which indicates that the device identifier is extended, which may be to support more types or more complex device identifications, so as to more finely manage the permission control of the above devices. The memory domain index associated with the cold device, that is, MD, which indicates that the memory domain index associated with the cold device is extended to more flexibly manage the memory access rights associated with the above devices. The permissions of the additional IOPMP entries (ExtendIOPMP Entry) of the cold device, which indicates that the permissions of the additional IOPMP entries of the cold device are extended, which may be to support more types or more complex permission control requirements.

[0128] In summary, the above extensions extend the existing IOPMP entry table in terms of functionality and permissions to support more types or more complex device and permission management requirements.

[0129] As an optional implementation, the method also includes: when the extended source identification information is loaded into the extended register table, matching the extended source identification information with the hardware identification information of the device in the memory access request; if the extended source identification information and the hardware identification information of the device in the memory access request match successfully, canceling the interrupt execution of the memory access request.

[0130] In this embodiment, when the extended source identification information is loaded into the extended register table, the extended source identification information and the hardware identification information of the device in the memory access request can be matched to determine whether the match is successful. If the extended source identification information and the hardware identification information of the device in the memory access request are matched successfully, the interrupt execution of the memory access request can be cancelled, wherein the hardware identification information of the device can be a device ID.

[0131] In an embodiment of the present application, a process called "cold device switching" is set up. When the device identifier is not in the on-chip SRC2MD table, the steps for executing the process are as follows: the IOPMP checker generates a SID missing interrupt signal. This means that when it is detected that the device identifier is not in the on-chip SRC2MD table, the IOPMP checker will generate an interrupt signal to notify the system that the device identifier is missing. The secure monitor handles this interrupt: obtains the corresponding IOPMP entry in the mountable IOPMP segment table, and loads the eSID and memory domain into the on-chip eSRCMD register, and the additional IOPMP entry is loaded into the last memory domain in the on-chip IOPMP entry table. This means that the secure monitor will handle the interrupt and perform corresponding operations, including obtaining the corresponding IOPMP entry in the mountable IOPMP segment table, loading the eSID and memory domain into the on-chip eSRCMD register, and loading the additional IOPMP entry into the last memory domain in the on-chip IOPMP entry table.

[0132] In summary, this "cold device switching" process is to handle the situation where the device identifier is missing. By generating an interrupt signal and processing it by the security monitor, it ensures that the system can correctly handle the situation where the device identifier is not in the on-chip SRC2MD table, thereby ensuring the stability and safe operation of the system. In this embodiment of the present invention, the last memory domain can be MD62. This value is for example only and is not specifically limited.

[0133] As an optional implementation manner, step S204, determining at least one IOPMP entry that matches the device in the IOPMP unit, includes: determining at least one IOPMP entry corresponding to the hardware identification information of the device in the IOPMP entry set of the IOPMP unit.

[0134] In this embodiment, in the process of determining at least one IOPMP entry that matches the device in the IOPMP unit, at least one IOPMP entry corresponding to the hardware identification information of the device can be determined in the IOPMP entry set of the IOPMP unit, wherein the IOPMP entry set can be an array of entries. The at least one IOPMP entry corresponding to the hardware identification information of the device can be an IOPMP entry related to the cold device.

[0135] Optionally, once the eSID corresponding to the cold device is loaded into the eSRCMD register in SRC2MD, the Secure Input / Output Memory Management Unit Page Table (sIOPMP) may continue to perform further checks on the DMA request.

[0136] Optionally, sIOPMP further checks the DMA request and may include the following steps: comparing the eSID in the SRCMD table with the device ID in the DMA data packet. This means comparing the eSID in the SRCMD table with the device ID in the DMA request to determine whether they match. When the eSID successfully matches the device ID in the DMA request, the interrupted DMA request is allowed to continue. Once the eSID successfully matches the device ID in the DMA request, the system will allow the interrupted DMA request to continue. The IOPMP checker selects the IOPMP entry associated with the cold device. That is, through the above operation, after the match is successful, the IOPMP checker is used to select the IOPMP entry associated with the cold device, wherein the above entry is located in the last memory domain and other memory domains associated with the device.

[0137] Optionally, based on the selected IOPMP entry, a multi-stage tree-like IOPMP checker is entered to perform a staged permission check to generate the final device I / O memory access permission. Based on the selected IOPMP entry, the system will enter a multi-stage tree-like IOPMP checker to perform a staged permission check to generate the final device I / O memory access permission.

[0138] Since cold device switching only occurs in the first DMA request, subsequent DMA requests do not require additional operations and can directly obtain all permission check information from the on-chip hardware. Therefore, cold device switching provides a fast check path for cold devices.

[0139] In summary, the above steps describe that once the eSID corresponding to the cold device is loaded into the eSRCMD register in SRC2MD, the system further checks and processes the DMA request, ensuring the effectiveness of the fast check path for cold device switching.

[0140] As an optional implementation, the method may include: if the hardware identification information of the device corresponding to the memory access request is found in the device identification information table, then in the device identification information table, determining the source identification information of the device corresponding to the hardware identification information of the device, wherein the device identification information table is used to represent the mapping relationship between the source identification information of the device and the hardware identification information of the device; based on the source identification information of the device, indexing the register table, and determining that the device is in a hot state.

[0141] In this embodiment, in the device identification information, if the hardware identification information of the device corresponding to the memory access request is found, the source identification information of the device corresponding to the hardware identification information of the device can be determined in the device identification information table. Based on the source identification information of the device, the register table can be retrieved, and it can be determined that the device is in a hot state, that is, the device is a hot device, wherein the device identification information table can be a device identifier to source identifier mapping table (Device Identifier to Source Identifier Mapping Table, referred to as DeviceID2SID). The source identification information can be the retrieved SID. The DeviceID2SID table can also be called the Device2SID table. The device identification information can be used to represent the mapping relationship between the source identification information of the device and the hardware identification information of the device, that is, the DeviceID2SID records the mapping relationship between the actual device ID and the SID used in sIOPMP.

[0142] In an embodiment of the present application, a DeviceID2SID table is introduced and an IOPMP remapping mechanism is added to cope with dynamic I / O tasks. The DeviceID2SID table records the mapping relationship between the actual device ID and the SID used in sIOPMP. If a device changes from a cold state to a hot state, the device state can be switched by resetting the mapping in the DeviceID2SID table and assigning a new hot SID to it. This remapping mechanism and the introduction of the DeviceID2SID table enable the system to dynamically adapt to changes in the I / O task load. When the device state changes, the SID can be reallocated through the mapping relationship in the remapping table to achieve the switching of the device state. This mechanism can effectively manage dynamic I / O tasks and ensure that the system can flexibly adapt to changing task requirements.

[0143] Optionally, a CAM is used to implement a fast and efficient SID lookup process to ensure the performance of the critical path of the system. CAM is a special memory that can compare input search data with a storage data table and return the address of the matching data. In the DeviceID2SID table, since the number of SIDs of hot devices is limited, CAM is very suitable for this situation. Since the number of SIDs of hot devices in the embodiment of the present invention is less than 63, CAM is very suitable for this situation. Since the number of SIDs is fixed, CAM can regard SID as an address and device ID as content. Such a setting enables CAM to perform a very efficient search from device ID to SID, because SID is regarded as an address and its number is limited, and the corresponding SID address can be quickly matched in CAM and returned. In general, the present application implements the use of CAM to implement the DeviceID2SID table, using SID as an address and device ID as content to achieve a fast and efficient SID lookup process. This setting is very suitable for situations with a limited number of SIDs, and can ensure that the system can quickly perform a search from device ID to SID in the critical path.

[0144] As an optional implementation, the method may include: if the hardware identification information of the device is not found in the device identification information table, determining that the hardware identification information of the device is extended source identification information, and determining that the device is in a cold state; matching the extended source identification information with the value in the extended register table; if the extended source identification information and the value in the extended register table match successfully, determining that the device is in use; if the extended source identification information and the value in the extended register table fail to match, triggering a missing interrupt signal.

[0145] In this embodiment, if the hardware identification information of the device is not found in the device identification information table, it can be determined that the hardware identification information of the device is the extended source identification information, and it is determined that the device is in a cold state. The extended source identification information and the value in the extended register table can be matched. If the extended source identification information and the value in the extended register table match successfully, it can be determined that the device is in use. If the extended source identification information and the value in the extended register table fail to match, a missing interrupt signal can be triggered.

[0146] Optionally, after adding the DeviceID2SID table, the I / O check process is as follows: After receiving a DMA request, the device ID will be searched in the DeviceID2SID table. This means that the system will first use the device ID to look up in the DeviceID2SID table to determine its corresponding SID. If the match is successful, the retrieved SID will be used to index the subsequent SRC2MD table, and the device is considered a hot device. If the corresponding SID is successfully matched in the DeviceID2SID table, the system will use the SID to index the subsequent SRC2MD table to determine whether the device is a hot device. Otherwise, this device ID will be considered to be an eSID, that is, the device is a cold device.

[0147] Optionally, the eSID is matched with the value in the eSRCMD register: if the match is successful, it means that the cold device is being used, that is, a cold device switch has occurred. If the match is unsuccessful, it means that the cold device is being used for the first time, and a cold device switch interrupt will be generated, which is solved by the relevant technology in the scalable IOPMP segment table of the embodiment of the present application.

[0148] In summary, this flow describes the I / O check process after adding the DeviceID2SID table. By searching the device ID in the DeviceID2SID table, the system can quickly determine the status of the device and then perform corresponding processing to ensure that the system can effectively manage hot and cold devices and ensure the efficiency and reliability of the system.

[0149] As an optional implementation, the method further includes: if the device switches from a cold state to a hot state, establishing a mapping relationship between the source identification information of the device in the hot state and the hardware identification information of the device in the hot state in the device identification information table.

[0150] In this embodiment, if the device switches from a cold state to a hot state, a mapping relationship between the source identification information of the device in the hot state and the hardware identification information of the device in the hot state is established in the device identification information table, wherein if the device is in a cold state, it can be indicated that the device is a cold device.

[0151] Optionally, sIOPMP adopts different strategies for hot and cold device switching, namely explicit switching and implicit switching.

[0152] Optionally, in explicit switching, the system is able to know in advance which devices are in the hot state and which are in the cold state. Therefore, the system can explicitly set the mapping of device IDs to SIDs. This means that for devices in the hot state, the system can directly assign them a valid SID so that they can access the system's physical memory. This explicit switching method enables the system to accurately manage the access rights of devices, assigning appropriate permissions based on their state.

[0153] Optionally, through explicit switching, the system can take different actions in different device states to protect the system from access by potentially malicious devices. This approach can help the system manage and protect system resources more effectively, ensuring that only devices in hot states can access physical memory, while devices in cold states are restricted or prohibited from access. In general, explicit switching is an effective strategy for managing device access rights based on device states to ensure system security and efficient resource utilization.

[0154] As an optional implementation, the method also includes: obtaining the frequency at which the security monitor of the IOPMP unit loads the hardware identification information of the device into the extended register table; if the frequency is greater than a frequency threshold, it is determined that the device is in a hot state, and the security monitor is controlled to replace the source device identification information of the device in the hot state with the source device identification information of the original device in the cold state in the device identification information table.

[0155] In this embodiment, the frequency at which the security monitor of the IOPMP unit loads the hardware identification information of the device into the extended register table can be obtained. The magnitude of the frequency can be determined. If the frequency is greater than the frequency threshold, it can be determined that the device is in a hot state, and the security monitor can be controlled to replace the source device identification information of the device in the hot state with the source device identification information of the original device in the cold state in the device identification information table, wherein the security monitor can be used to process cold device switching.

[0156] Optionally, a clock algorithm, such as a Least Recently Used (LRU) approximation algorithm, and an additional LRU bit are implemented in the DeviceID2SID table to implement the hot and cold state switching of the device.

[0157] Optionally, in implicit switching, the secure monitor considers a device as hot or cold depending on its activity level. When the secure monitor frequently loads a device ID into the eSID bit in the eSRCMD register, the system considers the device as hot, meaning that the device is active and needs to be assigned a valid SID so that it can access physical memory. To achieve this, the system uses the LRU approximation algorithm in the DeviceID2SID table to track the activity level of the device through an additional LRU bit, and then evicts relatively inactive devices from the table based on the LRU bit and assigns their SIDs to new devices.

[0158] Optionally, the above method enables the system to adaptively adjust the hot and cold states of the device, and dynamically adjust the access rights of the device according to the actual activity level of the device. Through this strategy, the system can more effectively manage the access rights of the device and dynamically adjust the hot and cold states of the device according to the actual workload. In general, through the two strategies of explicit switching and implicit switching, the I / O isolation scheme of the embodiment of the present application can adapt to dynamic I / O workloads, effectively manage the hot and cold states of the device, and protect system resources from potential malicious device access.

[0159] As an optional implementation, the method also includes: determining the hardware resources of the IOPMP unit; determining the initial type of operation allowed to be performed on the hardware resources; determining the target type of operation based on the initial type of operation, wherein the scope of operation authority of the target type of operation on the hardware resources is smaller than the scope of operation authority of the initial type of operation on the hardware resources; and / or transferring the operation authority allowed to perform the initial type of operation on the hardware resources from the initial operation object to the target operation object.

[0160] In this embodiment, the hardware resources of the IOPMP unit can be determined. The initial type operation allowed to be performed on the hardware resources can be determined. The target type operation can be determined based on the initial type operation. The operation permission of the hardware resources allowed to perform the initial type operation can be transferred from the initial operation object to the target operation object, wherein the initial type operation can be an I / O access capability or an access capability. The operation permission can be the ownership of the capability. The initial operation object can be the owner of a specific capability. The target operation object can be another entity.

[0161] Optionally, a "capability"-based abstraction is used for the secure management of IOPMP hardware resources. Each capability controls a specific hardware resource, and only the owner has the right to operate the related hardware. This "capability"-based abstraction includes two basic operations: derive and transfer. Derivation, the owner can derive a new capability from an existing capability, but the permissions will be reduced or the scope will be smaller. For example, a new I / O memory access capability can be derived from an existing I / O memory access capability, but the new capability has a narrower scope or has restricted permissions. This mechanism allows the system to generate new capabilities as needed to accommodate different permission requirements while ensuring appropriate degradation or restriction of permissions. Transfer, the owner can send ownership or a copy (i.e., only with read permissions) to another entity. This means that the owner can transfer the capability it owns to other entities so that the other entity can perform related hardware operations. This mechanism provides a secure way to control the allocation and transfer of ownership and access rights of capabilities.

[0162] In summary, the "capability"-based abstraction provides an effective way to manage IOPMP hardware resources. Through derivation and transfer operations, the system can flexibly control the access rights of hardware resources and ensure the appropriate allocation and transfer of permissions. This security mechanism helps to protect the security and stability of the system.

[0163] Optionally, when the system boots, the capabilities are owned by the secure monitor. At this stage, the secure monitor can optionally transfer ownership of the above capabilities to the booting system. When the user intends to create a TEE, use the ownership-based interface, such as Create_TEE(), to transfer the ownership of the device and memory to the TEE. Afterwards, the TEE can call Device_map() to map the memory region for a specific device. By using the ownership-based interface, the secure monitor can easily verify the device mapping operation of the TEE.

[0164] Optionally, this ownership-based mechanism introduces an effective security control method for the system. By granting ownership to the secure monitor at system startup, and allowing the secure monitor to selectively transfer some or all resource ownership to the boot system or TEE, the system can ensure that access to hardware resources is strictly controlled while allowing specific execution environments to obtain the necessary permissions to perform their tasks. This setting provides a secure and verifiable way to manage the transfer of access rights to resources, helping to ensure the security and stability of the system.

[0165] As an optional implementation, the operating permission allowing the initial type of operation to be performed on the hardware resources is transferred from the initial operation object to the target operation object, including: transferring the operating permission allowing the initial type of operation to be performed on the hardware resources from the security monitor of the IOPMP unit to the startup system corresponding to the initial type of operation, wherein the initial operation object includes the security monitor and the target operation object includes the startup system.

[0166] In this embodiment, in the process of transferring the operation permission allowing the initial type operation to be performed on the hardware resource from the initial operation object to the target operation object, the operation permission allowing the initial type operation to be performed on the hardware resource can be transferred from the security monitor of the IOPMP unit to the boot system corresponding to the initial type operation, wherein the initial operation object can include the security monitor. The target operation object can include the boot system.

[0167] Optionally, in order to improve the modularity of the security monitor, the functions are divided into two parts: hardware controller and capability layer. Hardware-related controllers may include, interrupt controller, which is used for interrupt isolation, i.e., a hardware module that controls and manages system interrupts, ensuring the isolation and secure execution of interrupts. IOPMP controller, which is used for device isolation, management and control of IOPMP hardware resources, ensuring that access rights to devices are strictly controlled. PMP controller, which is used for memory isolation, management and control of PMP hardware resources, ensuring that access rights to memory areas are strictly controlled. The "capability" layer abstracts all hardware resources into "capabilities". Only the owners of specific capabilities are granted access rights to the corresponding hardware resources. The device manager and memory manager keep a linked list of ownership transfers for each device and memory area, while the TEE manager saves the mapping relationship from "capabilities" to hardware, i.e., which hardware resources the TEE can access.

[0168] In the embodiments of the present application, this modular setting provides an effective way to manage the hardware resources of the system and ensure that the access rights to the above resources are strictly controlled. By dividing the functions into hardware controller and capability layers, the system can better manage and abstract hardware resources and ensure that only specific "capability" owners can obtain corresponding access rights, thereby improving the security and stability of the system.

[0169] In an embodiment of the present application, a dynamically scalable I / O isolation mechanism is provided, which is intended to greatly reduce the overhead caused by I / O isolation checks in high-load scenarios. The invention provides a micro-architecture for IO checks-a multi-stage tree-like IOPMP checker, which allows more I / O isolation domains (>1000) to be checked without reducing the clock frequency. At the same time, it is also possible to support an unlimited number of I / O devices, and provide corresponding block / slow check paths according to the hot and cold states of the devices, thereby resolving the conflict between the number of devices and resource overhead. Finally, in order to cope with dynamically changing I / O loads, an embodiment of the present application provides an efficient device state switching mechanism, which achieves hot and cold device conversion close to cold overhead. In addition, the SID and device ID in IOPMP are allowed to be remapped, so that the SID and device ID in IOPMP do not need to be hard-bound.

[0170] Optionally, the above method has the characteristics of dynamic scalability, and can greatly reduce the overhead of I / O isolation checks in high-load scenarios by setting a multi-stage tree-like IOPMP checker, and support a large number of I / O isolation domains. The device status management feature can provide block / slow check paths for hot and cold devices to resolve the conflict between the number of devices and resource overhead, while achieving hot and cold device conversion close to cold overhead; the above method also has the characteristics of flexibility, which can allow SIDs and device IDs in IOPMP to be remapped without hard binding, thereby improving the system's adaptability to dynamically changing I / O loads. In general, the embodiments of the present invention provide an efficient, flexible and scalable I / O isolation mechanism, which is expected to significantly improve the performance of the system in high-load scenarios, and provide a reliable solution for dynamically changing I / O loads.

[0171] The embodiment of the present application further provides a method for accessing the memory of a device from the perspective of accessing the memory of a system by the device. Figure 3 is a flowchart of a memory access method of a device according to an embodiment of the present application, such as Figure 3 As shown, the method can be applied to an input-output physical memory protection IOPMP unit and can include the following steps:

[0172] Step S302, obtaining a memory access request of the device, and determining at least one IOPMP entry that matches the device in the IOPMP unit, wherein the memory access request is used to enable the device to request access to data stored in a memory address corresponding to the IOPMP unit, and the IOPMP entry is used to represent the data structure of the IOPMP unit.

[0173] In the technical solution provided in the above step S302 of the present application, if it is detected that the device has a memory access request to access data stored in the memory address of the computer system, the memory access request can be input into the IOPMP unit, and the IOPMP entry matching the memory access request can be determined.

[0174] Optionally, if the user needs to access the data stored in the memory address of the computer system, the corresponding operation can be performed on the user's client device, for example, the request data to be accessed can be input, and the memory address where the request data is stored can be input, and the corresponding memory access request can be written through the request data and memory data required by the above user. Optionally, after the user inputs the corresponding memory access request from the client device, the memory access request can be transmitted to the IOPMP unit in the server through the network. The above memory access request can be obtained by using IOPMP, and the IOPMP entry that matches the device that currently issues the memory access request can be screened out from the entry array in the IOPMP unit.

[0175] Step S304: verify the memory access request in at least one IOPMP entry to obtain at least one verification result, wherein the verification result is used to indicate whether the device has access rights in the corresponding IOPMP entry.

[0176] In the technical solution provided in the above step S304 of the present application, after obtaining the memory access request of the device and determining the IOPMP entry that matches the device in the IOPMP unit, the memory access request can be verified in the IOPMP entry to obtain a corresponding verification result.

[0177] Optionally, after determining the IOPMP entry that matches the device, for the memory access request, each matched IOPMP entry may be verified separately to verify whether the device has access rights to the corresponding IOPMP entry.

[0178] Step S306: Generate access permission results corresponding to the memory access request based on the verification result.

[0179] In the technical solution provided in the above step S306 of the present application, after the memory access request is verified in the IOPMP entry and the verification result is obtained, an access permission result corresponding to the memory access request can be generated based on the verification result.

[0180] Optionally, after determining the verification results of the current memory access request under each IOPMP entry, the verification results of the above IOPMP entries may be combined to comprehensively determine whether the memory access request has the authority to access the data in the memory address in the system.

[0181] Step S308: If the access permission result is to allow the device to access the data in the memory address, the memory access request is transmitted to the memory address to access the data.

[0182] In the technical solution provided in the above step S308 of the present application, if it is determined that the access permission result is to allow the device to access the data in the memory address of the system, the memory access request can be transmitted to the memory address to access the corresponding data.

[0183] Step S310: If the access permission result is that the device is prohibited from accessing the data in the memory address, then the memory access request is prohibited from being transmitted to the memory address to access the data.

[0184] In the technical solution provided in the above step S310 of the present application, if it is determined that the access permission result prohibits the device from accessing data in the memory address of the system, it is possible to prohibit the memory access request from being transmitted to the memory address to access the data.

[0185] Through the above steps S302 to S310 of the present application, the memory access request of the device is obtained, and at least one IOPMP entry that the device matches in the IOPMP unit is determined; the memory access request is verified in at least one IOPMP entry to obtain at least one verification result; based on the verification result, the access permission result corresponding to the memory access request is generated; if the access permission result is to allow the device to access the data in the memory address, the memory access request is transmitted to the memory address to access the data; if the access permission result is to prohibit the device from accessing the data in the memory address, the memory access request is prohibited from being transmitted to the memory address to access the data. Thus, the purpose of reducing the overhead of secure access to the device is achieved, and the technical effect of effectively determining the memory access permission of the device is achieved, and the technical problem of being unable to effectively determine the memory access permission of the device is solved.

[0186] Example 2

[0187] According to an embodiment of the present application, an embodiment of a system for determining memory access rights of a device is also provided. Figure 4 is a schematic diagram of a system for determining memory access rights of a device according to an embodiment of the present application, such as Figure 4 As shown, a system 400 for determining memory access rights of a device may include: an IOPMP unit 401 and an output terminal 402 .

[0188] The IOPMP unit 401 is used to obtain a memory access request of a device and determine at least one IOPMP entry that matches the device in the IOPMP unit, wherein the memory access request is used to enable the device to request access to data stored in a memory address corresponding to the IOPMP unit, and the IOPMP entry is used to represent the data structure of the IOPMP unit; the memory access request is verified in at least one IOPMP entry to obtain at least one verification result, wherein the verification result is used to indicate whether the device has access rights in the corresponding IOPMP entry; based on the verification result, an access rights result corresponding to the memory access request is generated, wherein the access rights result is used to indicate whether the device is allowed to access the data stored in the memory address.

[0189] In this embodiment, in 401 of the IOPMP unit, a memory access request of the device can be obtained. Then the IOPMP can be used to check the memory access request. During the checking process, the memory access request can be used to make the device request to access the data stored in the memory address corresponding to the IOPMP unit. And the IOPMP entry that the device matches in the IOPMP unit can be determined. The memory access request can be verified in the IOPMP entry to determine whether the device has access rights in the corresponding IOPMP entry, and obtain the corresponding verification result. And based on whether the IOPMP entry has access rights, it is determined whether the current memory access request is allowed to access the data in the memory address in the device.

[0190] Optionally, if the user needs to access the data stored in the memory address of the computer system, the corresponding operation can be performed on the user's client device, for example, the request data to be accessed can be input, and the memory address where the request data is stored can be input, and the corresponding memory access request can be written through the request data and memory data required by the user. The memory access request can be transmitted to the IOPMP unit 401 in the server through the network. The above-mentioned memory access request can be obtained by using IOPMP, and the IOPMP entry matching the device currently issuing the memory access request can be screened out from the entry array in the IOPMP unit.

[0191] Optionally, after determining the IOPMP entry that matches the device, for the memory access request, each matched IOPMP entry may be verified separately to verify whether the device has access rights to the corresponding IOPMP entry.

[0192] Optionally, after determining the verification results of the current memory access request under each IOPMP entry, the verification results of the above IOPMP entries may be combined to comprehensively determine whether the memory access request has the authority to access the data in the memory address in the system.

[0193] Optionally, after the access permission result is determined, the access permission result may be transmitted to the output terminal 402 .

[0194] The output terminal 402 is used to output the access permission result.

[0195] In this embodiment, after the output terminal 402 receives the access permission result transmitted from the IOPMP unit 401 , the access permission result can be outputted via the output terminal 402 .

[0196] Optionally, if it is determined that the access permission result allows the device to access data in the memory address of the system, a memory access request may be transmitted to the memory address to access corresponding data.

[0197] Optionally, if it is determined that the access permission result prohibits the device from accessing data in the memory address of the system, then the transmission of the memory access request to the memory address to access the data may be prohibited.

[0198] In this embodiment, a system for determining memory access rights of a device is provided. The memory access request of the device is obtained through the input and output physical memory protection IOPMP unit 401, and at least one IOPMP entry that the device matches in the IOPMP unit is determined; the memory access request is verified in at least one IOPMP entry to obtain at least one verification result; based on the verification result, an access right result corresponding to the memory access request is generated, wherein the access right result is used to indicate whether the device is allowed to access the data stored in the memory address; the access right result is output through the output terminal 402, thereby achieving the technical effect of effectively performing memory access on the device and solving the technical problem of being unable to effectively perform memory access on the device.

[0199] The above system of this embodiment is further introduced below.

[0200] As an optional implementation, the system includes: a masker, configured to determine, in an IOPMP entry set of the IOPMP unit, at least one IOPMP entry corresponding to the hardware identification information of the device.

[0201] In this embodiment, the system may include a masker, wherein the masker may be used to determine at least one IOPMP entry corresponding to the hardware identification information of the device in the IOPMP entry set of the IOPMP unit.

[0202] Optionally, the masker can be used to filter the IOPMP entries and select the entry corresponding to the current device ID. This helps to reduce the number of entries that need to be checked and improves the efficiency of the check.

[0203] As an optional implementation, the IOPMP unit includes: an IOPMP checker, configured to verify the memory access request in at least one IOPMP entry, obtain at least one verification result, and generate an access permission result corresponding to the memory access request based on the verification result.

[0204] In this embodiment, the IOPMP unit may include an IOPMP checker, wherein the IOPMP checker may be used to verify the memory access request in at least one IOPMP entry to obtain a verification result, and may generate an access permission result corresponding to the memory access request based on the verification result.

[0205] Optionally, the IOPMP checker takes the memory address, request data, and IOPMP entry as input. The above data will be used to perform multi-stage I / O access control checks. There are multiple pipeline stages in the IOPMP checker, each of which verifies its own IOPMP entry and stores the intermediate results in registers. This staged setting improves the parallelism and throughput of the entire I / O check. After passing the I / O permission check, the IOPMP checker generates a final decision to determine whether the memory access is authorized. This ensures security verification of each access request.

[0206] As an optional implementation, the IOPMP checker includes: a sub-checking module, used to verify the memory access request in the IOPMP entry by using the first tree arbitration circuit to obtain a verification result; and a register, used to write the verification result.

[0207] In this embodiment, the IOPMP checker may include a sub-check module, wherein the sub-check module may be used to verify the memory access request in the IOPMP entry using the first tree arbitration circuit to obtain a verification result. The IOPMP checker may also include a register, which may be used to write the verification result.

[0208] Optionally, the IOPMP checker includes multiple sub-check modules, which are connected through pipeline registers. This setting can realize parallel processing of multiple sub-check modules, and connecting through pipeline registers helps to improve the overall inspection processing speed. Each sub-check module uses a tree arbitration circuit to check the permissions of multiple IOPMP entries in parallel. This parallel processing helps to improve the overall inspection efficiency and throughput.

[0209] As an optional implementation, the system further includes: a security monitor, configured to maintain a blocking state between the bus of the IOPMP unit and the IOPMP checker.

[0210] In this embodiment, the system may further include a security monitor, wherein the security monitor may be used to maintain a blocking state between the bus of the IOPMP unit and the IOPMP checker.

[0211] Optionally, the secure monitor can obtain the corresponding IOPMP entry in the mountable IOPMP segment table, and load the eSID and memory domain into the on-chip eSRCMD register, and the additional IOPMP entry into the last memory domain in the on-chip IOPMP entry table. This means that the secure monitor will handle the interrupt and perform the corresponding operations, including obtaining the corresponding IOPMP entry in the mountable IOPMP segment table, loading the eSID and memory domain into the on-chip eSRCMD register, and loading the additional IOPMP entry into the last memory domain in the on-chip IOPMP entry table.

[0212] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application, for example, the data for inspection, are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0213] Example 3

[0214] At present, with the rapid development of information technology and the increasing complexity of computer systems, data security and privacy protection have become the focus of common concern in the industry and academia. Among them, using devices to attack confidential data stored in the system has become an important topic of current system security. In many scenarios such as cloud computing, the Internet of Things, and smart phones, it is necessary to finely isolate and protect device access in the system to prevent potential security risks and data leakage.

[0215] The hardware I / O isolation mechanism is a hardware-level device security solution that aims to effectively isolate data access between different devices in the system and prevent malicious devices from stealing or tampering with confidential data in the system. Among them, IOMMU and TEE are two common hardware I / O isolation mechanisms.

[0216] IOMMU is used to manage I / O device access to system memory. Through IOMMU, system administrators can allocate independent memory address space to each device to limit its direct access to system memory. This isolation can effectively prevent malicious devices from reading or tampering with sensitive data through DMA and other methods, enhancing the security and reliability of the system. IOMMU plays an important role in virtualization environments, helping to isolate virtual machines and prevent data sharing and interference between virtual machines.

[0217] Another important I / O isolation mechanism is to use the I / O isolation mechanism in TEE. TEE is a secure execution environment, usually located inside the chip, with independent security processing units, storage space and isolated I / O address space. TEE provides a protected execution environment that can perform key security tasks such as data encryption, authentication and digital signature. By placing key applications and data in TEE, malware and malicious devices can be effectively prevented from reading confidential data in secure memory. For example, ARM's Trust Zone technology is widely used in mobile devices to protect personal privacy data (such as biometric information) on mobile terminals. TEE mainly uses two technologies for I / O protection. One is a coarse-grained segment isolation mechanism, which limits the continuous internal coarse area that the device can access; the other is to use memory encryption and integrity protection technology, so that the device can only read ciphertext data, and tampering with secure memory can be discovered in time.

[0218] The above-mentioned hardware I / O isolation mechanism provides a solid foundation for system security, and also provides important protection for data privacy and information security. However, with the continuous enhancement of current device capabilities, the bandwidth of devices has increased to hundreds of GB per second. Using IOMMU to isolate I / O will incur a large performance overhead (greater than 20%). The use of TEE technology to achieve I / O isolation will limit the number of supported devices. For example, only <16 security devices can be supported in the Trust Zone. Currently, based on device virtualization technology, there may be hundreds of virtual devices in a single machine, so the I / O isolation mechanism of TEE cannot adapt to the current device virtualization scenario.

[0219] In the related art, the IOMMU is not set up just for pure security considerations, it also supports address and interrupt remapping. Therefore, due to its inherent defects, it is inappropriate to include the entire IOMMU in the Trusted Comput ing Base (TCB) of the TEE system. First, the IOMMU has performance issues under heavy workloads due to expensive IOTLB invalidations using asynchronous command queues. Previous studies have shown that IOTLB refreshes may result in an overhead of 20% to 30% increase in I / O throughput. Second, the IOMMU only supports page-level isolation, which is insufficient for DMA scenarios because the memory buffer may be of arbitrary size. In the network stack, there are many sub-page network packets that are difficult to isolate through the IOMMU, requiring additional copy operations. Third, the IOMMU requires complex page tables and I / O virtual addresses (IOVAs) configurations, which expose vulnerabilities for malicious devices. For example, the IOMMU check was bypassed by exploiting a vulnerability in a shared data structure and a descriptor ring. Finally, the poor scalability of IOMMU settings, such as IOVA allocation and IOTLB, can become a bottleneck in multi-device and tenant scenarios. Due to the above limitations, current TEEs do not use (or only partially use) IOMMU as a basic I / O protection mechanism due to performance degradation and the necessity of a small TCB.

[0220] In another related technology, TEE tends to use zone-based I / O isolation, memory encryption, or a combination of the two to defend against DMA attacks. In the Trust Zone, all hardware resources are divided into the secure world and the normal world, and only components in the secure world can access secure hardware resources. This prevents devices in the normal world from accessing secure memory through DMA requests. However, this zone-based isolation mechanism is subject to the number of memory regions (up to 16 regions) and the number of devices. Other TEE systems, such as SEV, use encrypted memory to prevent malicious DMA access. Because the data in secure memory is encrypted, the device cannot decrypt the ciphertext to plaintext without the encryption key. However, using memory encryption alone (without an integrity tree) cannot defend against replay attacks, which can roll back old memory regions to the same address. Some TEEs use both memory encryption and I / O isolation, such as TDX, SGX, SEV-SNP, and CCA. SEV-SNP and CCA propose page-based I / O isolation mechanisms: RMP and GPC, which are new components within the IOMMU or sMMU. However, they still face the same problems as IOMMU, such as asynchronous IOTLB entry flushing, page-level isolation, and lack of scalability. In addition, memory encryption also blocks legitimate DMA requests, which requires additional memory copies and degrades I / O performance.

[0221] However, the above method still has the technical problem of being unable to effectively determine the memory access rights of the device.

[0222] Furthermore, the present application provides a dynamically scalable I / O isolation mechanism and proposes a series of innovative technologies and methods to address the limitations of traditional I / O isolation technologies. The phased tree-like IOPMP checker proposes a pipeline-style inspection method and implements tree-like parallel permission checks, so that DMA requests can be efficiently checked, improving the performance and scalability of the system. The mountable IOPMP segment table structure introduces a mountable IOPMP segment table structure to support an unlimited number of devices. At the same time, for cold devices, the corresponding inspection metadata can be stored in secure memory when not in use, and loaded into on-chip registers and tables when in use, thereby achieving efficient management of cold devices. The IOPMP remapping technology uses CAM technology to achieve efficient switching between cold devices and hot devices, improving the system's processing efficiency for device state transitions.

[0223] The IOPMP hardware resource management mechanism based on "capabilities" abstracts the ownership of IOPMP hardware resources into capabilities, realizes the transfer and scaling of I / O access rights, and improves the system's management flexibility for hardware resources. The security monitor is set up to handle cold device switching and monitor the access frequency of different devices to realize the active switching function of hot and cold devices, and enhances the system's dynamic management capabilities of device status. Overall, this dynamically scalable I / O isolation mechanism introduces a number of innovative technologies and methods, thereby improving the system's flexibility, performance and security of I / O isolation, and is expected to bring significant improvements to the TEE system. Thereby achieving the purpose of reducing the overhead of secure access to devices, and then achieving the technical effect of effectively determining the memory access rights of devices, and solving the technical problem of being unable to effectively determine the memory access rights of devices.

[0224] The above method of this embodiment is further introduced below.

[0225] In an embodiment of the present application, an extensible I / O isolation domain mechanism is provided so that the number of isolation domains is not limited. This means that the method can effectively handle large-scale device isolation requirements and support a large number of dynamically changing I / O isolation domains. This scalability is very important for modern large-scale systems and cloud computing environments. A dynamic I / O isolation domain mechanism is provided to ensure the performance of I / O isolation. This means that the method can adapt to dynamically changing I / O task loads and ensure that efficient I / O isolation performance can still be maintained in a constantly changing environment. This is particularly important for I / O task management in dynamic environments such as cloud computing. An efficient hot and cold device switching mechanism is provided to ensure that it can adapt to changing I / O task loads. This means that the method can effectively switch hot and cold devices to adapt to constantly changing I / O task loads. This efficient switching mechanism helps to maintain the stability and performance of the system.

[0226] The above problems are key challenges in the current dynamic and high-load cloud I / O scenarios, and this method provides innovative solutions to the above challenges. Through this method, effective management of large-scale device isolation can be achieved, and efficient I / O isolation performance can be maintained in a dynamic environment, thereby meeting system security and performance requirements.

[0227] Optionally, the pipelined I / O check module can ensure efficient multi-cycle checks on memory access requests to the device without affecting the clock frequency. This is critical to ensuring the security and privacy of device access. The mechanism of mountable I / O check segment table can realize on-demand loading of hot and cold device permissions, which helps to speed up the permission check process for hot devices. Such a mechanism can improve the efficiency of device access, especially for dynamically changing I / O loads. The mechanism of high-speed switching between hot and cold devices ensures real-time response to dynamically changing I / O loads, and the switching overhead does not affect I / O throughput. This is critical to maintaining system stability and performance. The software module that configures the I / O check logic can respond to I / O interrupt requests, handle I / O exceptions, set device hot and cold attributes, etc. This helps to achieve comprehensive management and control of device access. The end-to-end I / O protection mechanism can adapt to the current mainstream bus protocols and achieve SoC-level I / O security. This is very important to ensure the security and reliability of end-to-end I / O access in the system.

[0228] The combination of the above technical points can build a comprehensive and efficient I / O isolation mechanism, which solves the key problems in the current dynamic and high-load cloud I / O scenarios and provides important guarantees for system security and performance.

[0229] In this embodiment, a standard IOPMP isolation mechanism is provided.

[0230] Optionally, IOPMP aims to regulate accesses issued by bus masters and guard against malicious DMA attacks. In the IOPMP setting, each master or a group of masters with the same bus access rights has a unique identifier called SID. In particular, if a device has multiple channels with different permissions that can operate in different privilege modes, such as under a processor, each channel or privilege mode should have its own SID. In addition to SID, IOPMP uses MD to organize the physical memory that each device can access. A memory domain contains several consecutive memory regions, and each memory region can have different access permissions. For example, a NIC device can be associated with a memory domain that contains three memory regions: an RX region, a TX region, and a control register region.

[0231] FIG. 5 is a schematic diagram of the internal structure of an IOPMP according to an embodiment of the present application. The internal structure may include an SRC2MD table, an IOPMP entry table, and an MDCFG table.

[0232] Optionally, FIG. 5(a) is a schematic diagram of a source identifier to memory domain mapping table according to an embodiment of the present application. As shown in FIG. 5(a), it is the SRC2MD table inside the IOPMP. The SRC2MD table identifies the memory domain associated with a given SID. This table consists of multiple groups of SRC S MD registers, such as SRC0MD, SRC1MD up to SRC n MD. Each register has a 64-bit space and two fields: SRC S MD.L and SRC S MD.MD. SRC S MD.L is the lock bit flag of this register, and SRCsMD.MD is a bitmap field that shows whether the memory domain m, the index m in the figure, is associated with this SID.

[0233] Optionally, FIG. 5(b) is a schematic diagram of a memory domain configuration table according to an embodiment of the present application. As shown in FIG. 5(b), it defines the relationship between IOPMP entries and memory domains. This table has a series of configuration registers, where the register MD m CFG is for memory domain m. In the MD m CFG register, MD m CFG.T indicates the last index of the IOPMP entry belonging to memory domain m. More specifically, if MD m-1 CFG.T ≤ j < MD m CFG.T, then the IOPMP entry with index j belongs to memory domain m, where m > 0. Memory domain 0 owns the IOPMP entries with index j < MD0CFG.T.

[0234] Optionally, FIG. 5( c ) is a schematic diagram of an input / output physical memory protection entry table according to an embodiment of the present application. As shown in FIG. 5( c ), the entry array of IOPMP is the most basic structure of IOPMP. Each IOPMP entry is indexed from zero and defines a rule when checking a transaction. The entry includes a memory area and read / write permissions for the area. Each IOPMP entry belongs to only one memory domain, and a memory domain may contain multiple IOPMP entries. Any SID associated with an MD is also associated with all IOPMP entries belonging to the memory domain. IOPMP entries have static priorities, where entries with smaller numbers have higher priorities, such as Entry 0 has higher priorities, and as the number increases, Entry x, Entry x+1, etc. have lower and lower priorities. When a transaction is issued, IOPMP checks the matching of the transaction with the IOPMP entry in order of priority. If the transaction matches the IOPMP entry, IOPMP checks the read / write permissions within the IOPMP entry. For example, assume that memory domain 0, that is, MD0, has two IOPMP entries: the first entry and the second entry. The first entry has no permissions on the memory address, while the second entry has read permissions. Based on the priority, the device associated with memory domain 0 ends up having no access permissions on the address.

[0235] In this embodiment, a multi-stage tree-like IOPMP checker is proposed.

[0236] FIG6(a) is a schematic diagram of a pipelined I / O check logic according to an embodiment of the present application. As shown in FIG6(a), the I / O check of the IOPMP pipeline is bandwidth sensitive rather than delay sensitive, such as a DMA request of a device. The IOPMP can be checked in stages in the form of a pipeline. The IOPMP checker takes the memory address, request data, and IOPMP entries in the IOPMP entry table as input. The masker is used to filter the IOPMP entries and select the entry corresponding to the current device ID; there are multiple pipeline stages in the IOPMP checker, such as the first pipeline stage and the second pipeline stage, and the respective IOPMP entries are verified in different pipeline stages, and the intermediate results are stored in registers; finally, after passing all I / O permission checks in the memory translator checker (MT checker for short), the IOPMP checker generates a final decision to determine whether the memory access is authorized.

[0237] Optionally, as shown in Figure 6(a), the IOPMP pipeline setting needs to solve some new problems. For example, if you want to block DMA transactions, the blocking status between the bus and the IOPMP checker may be inconsistent. Although the DMA task can be blocked on the bus, there may still be residual DMA tasks in the IOPMP checker due to the multi-stage pipeline. Therefore, a monitor is added to maintain the consistency of the blocking status between the bus and the IOPMP checker.

[0238] Optionally, the IOPMP checker takes the memory address, request data, and IOPMP entry as input. The above data will be used to perform multi-stage I / O access control checks. The masker can filter the IOPMP entries and select the entries corresponding to the current device ID. This helps reduce the number of entries that need to be checked and improves the efficiency of the check. There are multiple pipeline stages in the IOPMP checker, each of which verifies its own IOPMP entry and stores the intermediate results in registers. This staged setting improves the parallelism and throughput of the entire I / O check. After passing all I / O permission checks, the IOPMP checker generates a final decision to determine whether the memory access is authorized. This ensures security verification for each access request. Regarding the pipeline setting, some new issues do need to be addressed, especially the state consistency between the bus and the IOPMP checker. To solve this problem, the addition of a monitor helps to maintain the consistency of the blocking state between the bus and the IOPMP checker. This setting helps ensure the effectiveness of I / O access control and system performance.

[0239] Figure 6(b) is a schematic diagram of an IOPMP tree arbitration circuit according to an embodiment of the present application. As shown in Figure 6(b), in order to implement prioritized I / O permission checks, the IOPMP tree arbitration circuit proposes an I / O permission check scheme in an embodiment of the present application: based on the tree arbitration logic, the check delay is reduced to the log(N) level.

[0240] Optionally, as shown in FIG6(b), based on the tree arbitration logic: the IOPMP checker compares the permissions of each IOPMP entry pair by pair according to the priority and generates an intermediate result; then, the intermediate result is reduced in the tree structure circuit. Unlike other methods that may use back-end EDA tools to optimize the inspection circuit, tree-based arbitration is implemented at the RTL level, with more information and manual optimization. For example, the embodiment of the present application can use different tree structures to meet different requirements of timing (binary tree) and area (N-ary tree); all permission check results are reduced to the final root node according to the priority, and the permission of the root node is the final I / O memory access permission.

[0241] Optionally, the IOPMP tree arbitration circuit uses a tree structure to implement prioritized I / O permission checks, aiming to reduce the delay of the check. This solution can effectively reduce the check delay to a logarithmic level (log(N)), thereby improving the efficiency and performance of the system's I / O access.

[0242] Optionally, the IOPMP tree arbitration circuit adopts a tree structure, each node represents an IOPMP entry, and the leaf node represents the final access authorization decision. This tree structure can effectively implement parallel checks on multiple IOPMP entries. The hierarchical structure of the tree allows the check of I / O permissions to be divided into multiple stages, each stage processing part of the IOPMP entries. Such hierarchical checks help reduce the latency of the overall check. The tree structure allows multiple I / O requests to be checked in parallel, thereby improving the processing efficiency of the entire system for I / O access. In general, the IOPMP tree arbitration circuit adopts an efficient tree structure to achieve effective management of I / O permissions through hierarchical checks and parallelism. This novel solution helps to improve the system's efficiency in checking I / O access rights, is suitable for bandwidth-sensitive application scenarios, and can significantly reduce the latency of the overall check.

[0243] Optionally, the IOPMP checker based on the tree arbitration logic has the following characteristics: Pairwise comparison, the IOPMP checker compares the permissions of each IOPMP entry pairwise according to the priority and generates an intermediate result. The above intermediate results will be processed in the subsequent reduction stage. Tree structure reduction, the intermediate results are reduced in the tree structure circuit. Unlike other methods that may use back-end EDA tools to optimize the check circuit, the tree-based arbitration is implemented at the RTL level, with more information and manual optimization. This method can use different tree structures according to actual needs to meet different requirements of timing (binary tree) and area (N-ary tree) to achieve a balance between different setting goals. Permission check result, all permission check results are reduced to the final root node according to the priority, and the permission of the root node is the final I / O memory access permission. Through the reduction of the tree structure, the combination and final decision of I / O permissions can be efficiently realized. In summary, the IOPMP checker based on the tree arbitration logic uses the tree structure to achieve the reduction and final decision of I / O permissions. This method is highly flexible and optimizable, can perform different levels of optimization according to actual needs, and can efficiently manage I / O permissions.

[0244] Figure 6(c) is a schematic diagram of an IOPMP linear arbitration circuit according to an embodiment of the present application. As shown in Figure 6(c), an IOPMP linear arbitration circuit is proposed. In an embodiment of the present application, the overhead of permission checking is further reduced by combining the IOPMP pipeline and the IOPMP tree arbitration circuit. The IOPMP checker includes multiple sub-check modules, which are connected through pipeline registers; each sub-check module uses a tree arbitration circuit to check the permissions of multiple IOPMP entries in parallel; the final permission results obtained by the tree arbitration circuit are written into the pipeline register; the permissions in each level of pipeline checking are used to generate the final I / O access rights according to the pipeline priority as the final access rights for this DMA request.

[0245] Optionally, compared to the entry table or SRC2MD table in IOPMP, the mountable IOPMP segment table is retained in protected memory. This means that the above-mentioned mountable segment table is stored in a protected memory area, such as in the PMP protected memory in RISC-V. Such a setting can ensure that unauthorized software or devices cannot directly access the above-mentioned segment table, thereby enhancing security. Since the mountable IOPMP segment table is retained in protected memory, unauthorized software or devices cannot directly access the above-mentioned table. Such a setting provides an effective security mechanism to ensure that access rights to the above-mentioned table are controlled. Based on the above setting, assuming that the physical memory is sufficient, there is no hardware limit on the size of the mountable IOPMP segment table. This means that with sufficient physical memory support, the size of the mountable IOPMP segment table can be expanded as needed without being restricted by hardware. In summary, this setup of keeping the mountable IOPMP segment table in protected memory provides an effective security mechanism to ensure that access to the above table is controlled and there is no hardware limit on the size of the mountable segment table with sufficient physical memory support.

[0246] Optionally, the IOPMP pipeline and the tree arbitration circuit are combined to reduce the overhead of permission checking. The IOPMP checker includes multiple sub-check modules, which are connected through pipeline registers. This means that multiple sub-check modules can perform permission checks at the same time without waiting for the previous permission check to be completed. Each sub-check module adopts a tree arbitration circuit, which means that they can check the permissions of multiple IOPMP entries in parallel. The tree arbitration circuit can effectively handle multiple permission checking requirements and improve efficiency. The final permission result obtained by the tree arbitration circuit is written into the pipeline register. In this way, the permission check result can be temporarily saved in the register for subsequent processing. The permissions in each level of pipeline check are generated according to the pipeline priority to generate the final I / O access permission as the final access permission of the DMA request. This means that the final access permission is generated by the pipeline priority to determine the final access permission of the DMA request. In summary, by combining the IOPMP pipeline and the tree arbitration circuit, multiple permission checking requirements can be processed in parallel, and the intermediate results are saved through the pipeline register, and the final access permission of the DMA request is finally generated, thereby reducing the overhead of permission checking.

[0247] In this embodiment, a mountable IOPMP segment table structure may be set.

[0248] Figure 7 is a schematic diagram of a mountable IOPMP segment table structure according to an embodiment of the present application, such as Figure 7As shown, unlike the entry or SRC2MD table in IOPMP, the mountable IOPMP segment table is retained in protected memory, for example, in the PMP protected memory in RISC-V, which is inaccessible to unauthorized software or devices. Therefore, assuming that the physical memory is sufficient, there is no hardware limit on the size of the mountable IOPMP segment table. The embodiment of the present application can expand the results of the existing IOPMP entry table. eSRCMD indicates that the original SRC2MD register is extended to support new functions or attributes. The extended register eSRCMD may be used to store more information about devices or I / O resources in order to more comprehensively manage the access rights of the above resources. eSID indicates that the device identifier has been extended, which may be to support more types or more complex device identifications in order to more finely manage the permission control of the above devices. The memory domain index associated with the cold device, that is, MD, indicates that the memory domain index associated with the cold device is extended to more flexibly manage the memory access rights associated with the above devices. The permissions of the additional IOPMP entries for cold devices, Extend IOPMP Entry, indicate that permissions for additional IOPMP entries for cold devices are extended, possibly to support more types or more complex permission control requirements. In summary, the above extensions extend the existing IOPMP entry table in terms of functionality and permissions to support more types or more complex devices and permission management requirements.

[0249] Alternatively, if Figure 7 As shown, when the device identifier SID is not in the on-chip SRC2MD table, the embodiment of the present application sets a process called cold device switching. The IOPMP checker generates a SID missing interrupt signal; the security monitor processes this interrupt, obtains the corresponding IOPMP entry in the mountable IOPMP segment table, and loads the eSID and memory domain into the on-chip eSRCMD register, and the additional IOPMP entry is loaded into the last memory domain in the on-chip IOPMP entry table, which is set to MD62 in the embodiment of the present application, and the value is not fixed.

[0250] Alternatively, if Figure 7As shown in the figure, once the eSID corresponding to the cold device is loaded into the eSRCMD register in SRC2MD, sIOPMP can continue to perform further checks on this DMA request. The eSID in the SRCMD table is compared with the device ID in the DMA data packet; when the eSID matches the device ID in the DMA request successfully, the interrupted DMA request is allowed to continue; the IOPMP checker selects the IOPMP entry related to the cold device, that is, the IOPMP entry located in the last memory domain and other memory domains associated with the device; finally, based on the selected IOPMP entry, enter the multi-stage tree-like IOPMP checker for staged permission checks to generate the final device I / O memory access permissions; since the cold device switch only occurs in the first DMA request. Subsequent DMA requests will not require additional operations and can directly obtain all permission check information from the on-chip hardware, so the cold device switch provides a fast check path for cold devices.

[0251] In this embodiment, an IOPMP remapping mechanism may be set.

[0252] Figure 8 is a schematic diagram of an IOPMP remapping and device identification information table according to an embodiment of the present application, such as Figure 8 As shown, since the I / O task load is constantly changing, in order to adapt to dynamic I / O tasks, the embodiment of the present application introduces the DeviceID2SID table and adds an IOPMP remapping mechanism. DeviceID2SID records the mapping relationship between the actual device ID and the SID used in sIOPMP. If a device changes from a cold state to a hot state, the device state can be switched by resetting the mapping in the DeviceID2SID table and assigning it a new hot SID. In order to ensure a fast and efficient SID lookup process, the embodiment of the present application utilizes an observation that although the range of device IDs may be large, the number of SIDs of hot devices is limited, which is set to less than 63 in the embodiment of the present application. Therefore, content-addressable memory is very suitable for the DeviceID2SID table. CAM compares the input search data with the storage data table and returns the address of the matching data. In the DeviceID2SID table, the number of SIDs is fixed. Therefore, the SID is regarded as an address and the device ID is regarded as content, which can be any value.

[0253] Alternatively, if Figure 8As shown, the I / O check process after adding the DeviceID2SID table may include the following process: After receiving a DMA request, the device ID will be searched in the device identifier to source identifier mapping table. If the match is successful, the retrieved SID will be used to index the subsequent SRC2MD table, and the device is a hot device. Otherwise, this device ID will be considered to be an eSID, that is, the device is a cold device. The eSID is matched with the value in the eSRCMD register. If the match is successful, it means that the cold device is being used, that is, a cold device switch has occurred. If the match is unsuccessful, it means that the cold device is being used for the first time, and a cold device switch interrupt will be generated, which can be solved by the relevant technology in the above-mentioned extensible IOPMP segment table.

[0254] Alternatively, if Figure 8 As shown, sIOPMP also adopts different strategies for hot and cold device switching. Generally speaking, there are two main methods: explicit switching and implicit switching. In explicit switching, one knows in advance which devices are in hot state and which are not. Therefore, it can explicitly set the mapping of device ID to SID. In implicit switching, a clock algorithm (LRU approximation algorithm) is implemented in the DeviceID2SID table with an additional LRU bit. When the security monitor frequently loads a device ID into the eSID bit in the eSRCMD register, the device should be regarded as a hot device. The security monitor evicts a relatively inactive device from the DeviceID2SID table based on the LRU bit and assigns its SID to the new device, thereby realizing the switching of the hot and cold states of the device. Using the above different strategies, the I / O isolation scheme of the embodiment of the present application can adapt to dynamic I / O workloads and can adaptively adjust the hot and cold states of the device.

[0255] In this embodiment, IOPMP has software architecture support.

[0256] Fig. 9 is a schematic diagram of a software architecture of IOPMP according to an embodiment of the present application, such as Fig. 9As shown in the figure, in order to securely manage the hardware resources of IOPMP, an abstraction based on "capabilities" is adopted. Each capability controls a specific hardware resource, and only the owner has the right to operate the relevant hardware. Capabilities have two basic operations: derive and transfer. The owner can derive a new capability from an existing capability, but the permissions will be reduced or the scope will be smaller. For example, an I / O memory access capability can be derived from an existing I / O memory access capability, but with a narrower scope or restricted permissions. As for capability transfer, the owner can send ownership or a copy, that is, with only read permissions, to another entity. At system startup, all capabilities are owned by the secure monitor. The secure monitor can optionally transfer the ownership of the above capabilities to the booting system. When the user intends to create a TEE, it uses the ownership-based interface, such as Create_TEE(), to transfer the ownership of the device and memory to the TEE. Afterwards, the TEE can call Device_map() to map a memory area for a specific device. Using the ownership-based interface, the secure monitor can easily verify the device mapping operation of the TEE.

[0257] Alternatively, if Fig. 9 As shown, in order to improve the modularity of the security monitor, the functions are divided into two parts: the hardware controller and the capability layer. Hardware-related controllers include interrupt controllers for interrupt isolation, IOPMP controllers for device isolation, and PMP controllers for memory isolation. The "capability" layer abstracts all hardware resources into "capabilities". Only owners of specific capabilities are granted access to the corresponding hardware resources. The device manager and memory manager retain a linked list of ownership transfers for each device and memory area, while the TEE manager saves the mapping from "capabilities" to hardware, that is, which hardware resources the TEE can access.

[0258] In an embodiment of the present application, a dynamically scalable IO isolation mechanism is proposed and set to implement, thereby greatly reducing the overhead caused by I / O isolation checks in high-load scenarios. The present invention sets up a micro-architecture for IO checks: a multi-stage tree-like IOPMP checker, which allows more IO isolation domains (>1000) to be checked without sacrificing clock frequency. At the same time, it can also support an unlimited number of I / O devices, and provide corresponding block / slow check paths according to the hot and cold states of the I / O devices, thereby resolving the conflict between the number of devices and resource overhead. Finally, in order to cope with dynamically changing I / O loads, an efficient device state switching mechanism is set to achieve hot and cold device conversion close to cold overhead. The SID and device ID in IOPMP are allowed to be remapped, so that the total SID and device ID of IOPMP do not need to be hard-bound.

[0259] In an embodiment of the present application, if it is necessary to access the memory in the system, the memory access rights of the device can be determined first. In the process of determining the memory access rights, in order to reduce the overhead of secure access to the device, an IOPMP unit is set. If a memory access request that requires access to the memory of the system is obtained, the memory access request can be checked using IOPMP. During the inspection process, the memory access request can be used to make the device request access to the data stored in the memory address corresponding to the IOPMP unit. And the IOPMP entry that the device matches in the IOPMP unit can be determined. The memory access request can be verified in the IOPMP entry to determine whether the device has access rights in the corresponding IOPMP entry, and a corresponding verification result is obtained. And based on whether the IOPMP entry has access rights, it is determined whether the current memory access request is allowed to access the data in the memory address in the device. In the embodiment of the present application, a pipelined I / O check module, i.e., an IOPMP unit, is provided to perform pipelined and efficient checks on memory access requests, ensuring that the memory access requests of the device can be checked in multiple stages, i.e., multiple IOPMP entries are checked to reduce the overhead of permission checks without affecting the clock frequency. Thus, the purpose of reducing the overhead of secure access to the device is achieved, and the technical effect of effectively determining the memory access rights of the device is achieved, solving the technical problem of being unable to effectively determine the memory access rights of the device.

[0260] Example 4

[0261] According to an embodiment of the present application, there is also provided a method for implementing the above Figure 2 The method for determining the memory access rights of a device shown is a device for determining the memory access rights of a device.

[0262] Fig.10 is a schematic diagram of a device for determining memory access rights of a device according to an embodiment of the present application, such as Fig.10 As shown, the device 1000 for determining memory access rights of the apparatus may include: a first obtaining unit 1002 , a first verifying unit 1004 and a first generating unit 1006 .

[0263] The first acquisition unit 1002 is used to acquire a memory access request of a device and determine at least one IOPMP entry that matches the device in the IOPMP unit, wherein the memory access request is used to enable the device to request access to data stored in a memory address corresponding to the IOPMP unit, and the IOPMP entry is used to represent the data structure of the IOPMP unit.

[0264] The first verification unit 1004 is used to verify the memory access request in at least one IOPMP entry to obtain at least one verification result, wherein the verification result is used to indicate whether the device has access rights in the corresponding IOPMP entry.

[0265] The first generating unit 1006 is used to generate an access permission result corresponding to the memory access request based on the verification result, wherein the access permission result is used to indicate whether the device is allowed to access the data stored in the memory address.

[0266] Here, the first acquisition unit 1002, the first verification unit 1004 and the first generation unit 1006 correspond to steps S202 to S206 in Example 1, and the three units and the corresponding steps implement the same examples and application scenarios, but are not limited to the contents disclosed in the above-mentioned Example 1. It should be noted that the above-mentioned units can be hardware components or software components stored in a memory (e.g., memory 1204) and processed by one or more processors (e.g., processors 1202a, 1202b..., 1202n), and the above-mentioned units can also be run in the computer terminal A provided in Example 5 as part of the device.

[0267] According to an embodiment of the present application, there is also provided a method for implementing the above Figure 3 The device memory access method shown is a device memory access device.

[0268] Fig.11 is a schematic diagram of a memory access device of a device according to an embodiment of the present application, such as Fig.11 As shown, the memory access device 1100 of the apparatus may include: a second acquisition unit 1102 , a second verification unit 1104 , a second generation unit 1106 , a first transmission unit 1108 and a second transmission unit 1110 .

[0269] The second acquisition unit 1102 is used to obtain a memory access request of the device and determine at least one IOPMP entry that matches the device in the IOPMP unit, wherein the memory access request is used to enable the device to request access to data stored in a memory address corresponding to the IOPMP unit, and the IOPMP entry is used to represent the data structure of the IOPMP unit.

[0270] The second verification unit 1104 is used to verify the memory access request in at least one IOPMP entry to obtain at least one verification result, wherein the verification result is used to indicate whether the device has access rights in the corresponding IOPMP entry.

[0271] The second generating unit 1106 is used to generate an access permission result corresponding to the memory access request based on the verification result.

[0272] The first transmission unit 1108 is configured to transmit the memory access request to access the data in the memory address if the access permission result is to allow the device to access the data in the memory address.

[0273] The second transmission unit 1110 is configured to prohibit the transmission of the memory access request to the memory address for accessing the data if the access permission result prohibits the device from accessing the data in the memory address.

[0274] It should be noted that the second acquisition unit 1102, the second verification unit 1104, the second generation unit 1106, the first transmission unit 1108 and the second transmission unit 1110 correspond to steps S302 to S310 in Example 1, and the five units and the corresponding steps implement the same examples and application scenarios, but are not limited to the contents disclosed in the above-mentioned Example 1. It should be noted that the above-mentioned units can be hardware components or software components stored in a memory (e.g., memory 1204) and processed by one or more processors (e.g., processors 1202a, 1202b..., 1202n), and the above-mentioned units can also be run in the computer terminal A provided in Example 5 as part of the device.

[0275] In the device for determining the memory access rights of the device, if it is necessary to access the memory in the system, the memory access rights of the device can be determined first. In the process of determining the memory access rights, in order to reduce the overhead of secure access to the device, an IOPMP unit is set. If a memory access request that requires access to the system's memory is obtained, the memory access request can be checked using IOPMP. During the inspection process, the memory access request can be used to make the device request access to the data stored in the memory address corresponding to the IOPMP unit. And the IOPMP entry that the device matches in the IOPMP unit can be determined. The memory access request can be verified in the IOPMP entry to determine whether the device has access rights in the corresponding IOPMP entry, and obtain a corresponding verification result. And based on whether the IOPMP entry has access rights, it is determined whether the current memory access request is allowed to access the data in the memory address in the device. In the embodiment of the present application, a pipelined I / O check module, i.e., an IOPMP unit, is provided to perform pipelined and efficient checks on memory access requests, ensuring that the memory access requests of the device can be checked in multiple stages, i.e., multiple IOPMP entries are checked to reduce the overhead of permission checks without affecting the clock frequency. Thus, the purpose of reducing the overhead of secure access to the device is achieved, and the technical effect of effectively determining the memory access rights of the device is achieved, solving the technical problem of being unable to effectively determine the memory access rights of the device.

[0276] Example 5

[0277] The embodiment of the present application may provide a computer terminal, which may be any computer terminal device in a computer terminal group. Optionally, in this embodiment, the computer terminal may also be replaced by a terminal device such as a mobile terminal.

[0278] Optionally, in this embodiment, the computer terminal may be located in at least one network device among a plurality of network devices of the computer network.

[0279] In this embodiment, the above-mentioned computer terminal can execute the program code of the following steps in the method for determining the memory access rights of the device: obtaining a memory access request of the device, and determining at least one IOPMP entry that matches the device in the IOPMP unit, wherein the memory access request is used to enable the device to request access to the data stored in the memory address corresponding to the IOPMP unit, and the IOPMP entry is used to represent the data structure of the IOPMP unit; verifying the memory access request in at least one IOPMP entry to obtain at least one verification result, wherein the verification result is used to indicate whether the device has access rights in the corresponding IOPMP entry; based on the verification result, generating an access rights result corresponding to the memory access request, wherein the access rights result is used to indicate whether the device is allowed to access the data stored in the memory address.

[0280] Optionally, Fig.12 is a structural block diagram of a computer terminal according to an embodiment of the present application. Fig.12 As shown, the computer terminal A may include: one or more (only one is shown in the figure) processors 1202 , a memory 1204 and a transmission device 1206 .

[0281] Among them, the memory can be used to store software programs and modules, such as the method for determining the memory access rights of the device in the embodiment of the present application and the program instructions / modules corresponding to the device. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, the method for determining the memory access rights of the above-mentioned device is realized. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and the above-mentioned remote memory may be connected to the computer terminal A via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0282] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: determine the priority order of at least one IOPMP entry; verify the memory access request in at least one IOPMP entry according to the priority order to obtain at least one verification result.

[0283] Optionally, the processor may also execute program code of the following steps: determining a first IOPMP entry in at least one IOPMP entry in order of priority; verifying a memory access request in the first IOPMP entry to obtain a first verification result, wherein the verification result includes the first verification result; if at least one IOPMP entry includes a second IOPMP entry that is the next IOPMP entry in the priority order of the first IOPMP entry, verifying the first verification result in the second IOPMP entry to obtain a second verification result, wherein the verification result includes the second verification result.

[0284] Optionally, the processor may also execute the following program code: if at least one IOPMP entry includes the third IOPMP entry that is next to the second IOPMP entry in the priority order, the third IOPMP entry is determined as the second IOPMP entry, the second verification result is determined as the first verification result, and the following steps are returned to execute until at least one IOPMP entry does not include the third IOPMP entry that is next to the second IOPMP entry in the priority order: the first verification result is verified in the second IOPMP entry to obtain a second verification result.

[0285] Optionally, the processor may also execute program code of the following steps: in the IOPMP unit, determine a sub-check module corresponding to the second IOPMP entry; in the sub-check module, use the first tree arbitration circuit to perform parallel verification on the first verification result and the second IOPMP entry to obtain a second verification result.

[0286] Optionally, the processor may further execute program code of the following steps: writing the second verification result output by the first tree arbitration circuit into a register.

[0287] Optionally, the processor may further execute program code of the following steps: determining a time period corresponding to the second IOPMP entry; and verifying the first verification result in the second IOPMP entry within the time period to obtain a second verification result.

[0288] Optionally, the processor may also execute program code of the following steps: in the IOPMP unit, determining a second tree-like arbitration circuit; in the second tree-like arbitration circuit, reducing at least one verification result in order of priority to obtain an access permission result, wherein the verification result corresponds to a node of the second tree-like arbitration circuit.

[0289] Optionally, the processor may also execute program code of the following steps: determining a root node of the second tree arbitration circuit; reducing at least one verification result to the root node in order of priority to obtain an access permission result.

[0290] Optionally, the processor may also execute the program code of the following steps: in the case where the source identification information of the device is missing, a missing interrupt signal is generated, wherein the missing interrupt signal is used to indicate that the source identification information is missing; in response to the missing interrupt signal, the execution of a memory access request is interrupted, and extended source identification information of the device is obtained; the extended source identification information is loaded into an extended register table corresponding to the register table of the IOPMP unit, wherein the register table corresponds to a source identification information set, and is used to identify a memory domain associated with the source identification information in the source identification information set, and the extended register table is obtained by extending the registers in the register table.

[0291] Optionally, the processor may also execute the following program code: when loading the extended source identification information into the extended register table, matching the extended source identification information with the hardware identification information of the device in the memory access request; if the extended source identification information and the hardware identification information of the device in the memory access request match successfully, canceling the interrupt execution of the memory access request.

[0292] Optionally, the processor may further execute program code of the following steps: determining, in an IOPMP entry set of the IOPMP unit, at least one IOPMP entry corresponding to the hardware identification information of the device.

[0293] Optionally, the processor may also execute the following program code: if the hardware identification information of the device corresponding to the memory access request is found in the device identification information table, then in the device identification information table, the source identification information of the device corresponding to the hardware identification information of the device is determined, wherein the device identification information table is used to represent the mapping relationship between the source identification information of the device and the hardware identification information of the device; based on the source identification information of the device, the register table is indexed, and it is determined that the device is in a hot state.

[0294] Optionally, the processor may also execute the following program code: if the hardware identification information of the device is not found in the device identification information table, it is determined that the hardware identification information of the device is the extended source identification information, and it is determined that the device is in a cold state; the extended source identification information is matched with the value in the extended register table; if the extended source identification information and the value in the extended register table match successfully, it is determined that the device is in use; if the extended source identification information and the value in the extended register table fail to match, a missing interrupt signal is triggered.

[0295] Optionally, the processor may also execute program code of the following steps: if the device switches from a cold state to a hot state, a mapping relationship between source identification information of the device in the hot state and hardware identification information of the device in the hot state is established in the device identification information table.

[0296] Optionally, the processor may also execute the program code of the following steps: obtaining the frequency at which the security monitor of the IOPMP unit loads the hardware identification information of the device into the extended register table; if the frequency is greater than a frequency threshold, determining that the device is in a hot state, and controlling the security monitor to replace the source device identification information of the device in the hot state with the source device identification information of the original device in the cold state in the device identification information table.

[0297] Optionally, the processor may also execute program code for the following steps: determining the hardware resources of the IOPMP unit; determining the initial type of operation allowed to be performed on the hardware resources; determining a target type of operation based on the initial type of operation, wherein the scope of operation authority of the target type of operation on the hardware resources is smaller than the scope of operation authority of the initial type of operation on the hardware resources; and / or transferring the operation authority allowed to perform the initial type of operation on the hardware resources from the initial operation object to the target operation object.

[0298] Optionally, the processor may also execute program code for the following steps: transferring the operating permissions that allow initial type operations to be performed on hardware resources from the security monitor of the IOPMP unit to the boot system corresponding to the initial type operations, wherein the initial operation object includes the security monitor and the target operation object includes the boot system.

[0299] Optionally, the processor can call the information and application stored in the memory through the transmission device to perform the following steps: obtain a memory access request of the device, and determine at least one IOPMP entry that matches the device in the IOPMP unit, wherein the memory access request is used to enable the device to request access to data stored in the memory address corresponding to the IOPMP unit, and the IOPMP entry is used to represent the data structure of the IOPMP unit; verify the memory access request in at least one IOPMP entry to obtain at least one verification result, wherein the verification result is used to indicate whether the device has access rights in the corresponding IOPMP entry; based on the verification result, generate an access rights result corresponding to the memory access request; if the access rights result is to allow the device to access the data in the memory address, transmit the memory access request to the memory address to access the data; if the access rights result is to prohibit the device from accessing the data in the memory address, prohibit the memory access request from being transmitted to the memory address to access the data.

[0300] By adopting the embodiment of the present application, a method for determining the memory access rights of a device is provided. In the embodiment of the present application, if it is necessary to access the memory in the system, the memory access rights of the device can be determined first. In the process of determining the memory access rights, in order to reduce the overhead of secure access to the device, an IOPMP unit is set. If a memory access request that needs to access the memory of the system is obtained, the memory access request can be checked using the IOPMP. During the checking process, the memory access request can be used to make the device request to access the data stored in the memory address corresponding to the IOPMP unit. And the IOPMP entry that the device matches in the IOPMP unit can be determined. The memory access request can be verified in the IOPMP entry to determine whether the device has access rights in the corresponding IOPMP entry, and obtain a corresponding verification result. And based on whether the IOPMP entry has access rights, it is determined whether the current memory access request is allowed to access the data in the memory address in the device. In the embodiment of the present application, a pipelined I / O check module, i.e., an IOPMP unit, is provided to perform pipelined and efficient checks on memory access requests, ensuring that the memory access requests of the device can be checked in multiple stages, i.e., multiple IOPMP entries are checked to reduce the overhead of permission checks without affecting the clock frequency. Thus, the purpose of reducing the overhead of secure access to the device is achieved, and the technical effect of effectively determining the memory access rights of the device is achieved, solving the technical problem of being unable to effectively determine the memory access rights of the device.

[0301] It can be understood by those skilled in the art that Fig.12 The structure shown is for illustration only, and the computer terminal A may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, referred to as MID), a PAD, or other terminal devices. Fig.12 It does not limit the structure of the above-mentioned computer terminal A. For example, the computer terminal A may also include Fig.12 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Fig.12 Different configurations are shown.

[0302] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0303] Example 6

[0304] The embodiment of the present application further provides a computer-readable storage medium. Optionally, in this embodiment, the computer-readable storage medium can be used to store the program code executed by the method for determining the memory access rights of the device provided in the first embodiment.

[0305] Optionally, in this embodiment, the computer-readable storage medium may be located in any one of the computer terminals in a computer terminal group in a computer network, or in any one of the mobile terminals in a mobile terminal group.

[0306] Optionally, in this embodiment, a computer-readable storage medium is configured to store program code for performing the following steps: obtaining a memory access request of a device, and determining at least one IOPMP entry that matches the device in the IOPMP unit, wherein the memory access request is used to enable the device to request access to data stored in a memory address corresponding to the IOPMP unit, and the IOPMP entry is used to represent the data structure of the IOPMP unit; verifying the memory access request in at least one IOPMP entry to obtain at least one verification result, wherein the verification result is used to indicate whether the device has access rights in the corresponding IOPMP entry; and generating an access rights result corresponding to the memory access request based on the verification result, wherein the access rights result is used to indicate whether the device is allowed to access the data stored in the memory address.

[0307] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: determine the priority order of at least one IOPMP entry; verify the memory access request in at least one IOPMP entry according to the priority order to obtain at least one verification result.

[0308] Optionally, the above-mentioned computer-readable storage medium can also execute program code of the following steps: determine a first IOPMP entry in at least one IOPMP entry in order of priority; verify the memory access request in the first IOPMP entry to obtain a first verification result, wherein the verification result includes the first verification result; if at least one IOPMP entry includes a second IOPMP entry next to the first IOPMP entry in the priority order, verify the first verification result in the second IOPMP entry to obtain a second verification result, wherein the verification result includes the second verification result.

[0309] Optionally, the above-mentioned computer-readable storage medium can also execute the program code of the following steps: if at least one IOPMP entry includes the next third IOPMP entry of the second IOPMP entry in the priority order, then determine the third IOPMP entry as the second IOPMP entry, determine the second verification result as the first verification result, and return to execute the following steps until at least one IOPMP entry does not include the next third IOPMP entry of the second IOPMP entry in the priority order: verify the first verification result in the second IOPMP entry to obtain the second verification result.

[0310] Optionally, the computer-readable storage medium may also execute program code of the following steps: in the IOPMP unit, determining a sub-check module corresponding to the second IOPMP entry; in the sub-check module, using a first tree arbitration circuit to perform parallel verification on the first verification result and the second IOPMP entry to obtain a second verification result.

[0311] Optionally, the computer-readable storage medium may also execute program code of the following steps: writing the second verification result output by the first tree arbitration circuit into a register.

[0312] Optionally, the computer-readable storage medium may also execute program code for the following steps: determining a time period corresponding to the second IOPMP entry; and verifying the first verification result in the second IOPMP entry within the time period to obtain a second verification result.

[0313] Optionally, the computer-readable storage medium may also execute program code of the following steps: in the IOPMP unit, determining a second tree-like arbitration circuit; in the second tree-like arbitration circuit, reducing at least one verification result in order of priority to obtain an access permission result, wherein the verification result corresponds to a node of the second tree-like arbitration circuit.

[0314] Optionally, the computer-readable storage medium may also execute program code for the following steps: determining a root node of the second tree-like arbitration circuit; reducing at least one verification result to the root node in order of priority to obtain an access permission result.

[0315] Optionally, the computer-readable storage medium may also execute program code for the following steps: in the event that source identification information of the device is missing, generating a missing interrupt signal, wherein the missing interrupt signal is used to indicate that source identification information is missing; in response to the missing interrupt signal, interrupting execution of a memory access request, and obtaining extended source identification information of the device; loading the extended source identification information into an extended register table corresponding to the register table of the IOPMP unit, wherein the register table corresponds to a source identification information set, and is used to identify a memory domain associated with the source identification information in the source identification information set, and the extended register table is obtained by extending the registers in the register table.

[0316] Optionally, the above-mentioned computer-readable storage medium can also execute the program code of the following steps: when the extended source identification information is loaded into the extended register table, the extended source identification information is matched with the hardware identification information of the device in the memory access request; if the extended source identification information and the hardware identification information of the device in the memory access request match successfully, then the interruption of the execution of the memory access request is canceled.

[0317] Optionally, the computer-readable storage medium may also execute program code for the following steps: determining, in an IOPMP entry set of the IOPMP unit, at least one IOPMP entry corresponding to the hardware identification information of the device.

[0318] Optionally, the computer-readable storage medium may also execute the following program code: if the hardware identification information of the device corresponding to the memory access request is found in the device identification information table, then in the device identification information table, the source identification information of the device corresponding to the hardware identification information of the device is determined, wherein the device identification information table is used to represent the mapping relationship between the source identification information of the device and the hardware identification information of the device; based on the source identification information of the device, the register table is indexed, and it is determined that the device is in a hot state.

[0319] Optionally, the computer-readable storage medium may also execute the following program code: if the hardware identification information of the device is not found in the device identification information table, determining that the hardware identification information of the device is the extended source identification information, and determining that the device is in a cold state; matching the extended source identification information with the value in the extended register table; if the extended source identification information and the value in the extended register table match successfully, determining that the device is in use; if the extended source identification information and the value in the extended register table fail to match, triggering a missing interrupt signal.

[0320] Optionally, the computer-readable storage medium may also execute program code of the following steps: if the device switches from a cold state to a hot state, a mapping relationship between source identification information of the device in the hot state and hardware identification information of the device in the hot state is established in the device identification information table.

[0321] Optionally, the computer-readable storage medium may also execute the program code of the following steps: obtaining the frequency at which the security monitor of the IOPMP unit loads the hardware identification information of the device into the extended register table; if the frequency is greater than a frequency threshold, determining that the device is in a hot state, and controlling the security monitor to replace the source device identification information of the device in the hot state with the source device identification information of the original device in the cold state in the device identification information table.

[0322] Optionally, the computer-readable storage medium may also execute program code for the following steps: determining the hardware resources of the IOPMP unit; determining the initial type of operation allowed to be performed on the hardware resources; determining the target type of operation based on the initial type of operation, wherein the scope of operation authority of the target type of operation on the hardware resources is smaller than the scope of operation authority of the initial type of operation on the hardware resources; and / or transferring the operation authority allowed to perform the initial type of operation on the hardware resources from the initial operation object to the target operation object.

[0323] Optionally, the computer-readable storage medium may also execute program code for the following steps: transferring the operating permissions that allow initial type operations to be performed on hardware resources from the security monitor of the IOPMP unit to the boot system corresponding to the initial type operations, wherein the initial operation object includes the security monitor and the target operation object includes the boot system.

[0324] Optionally, the computer-readable storage medium may also execute program code for the following steps: obtaining a memory access request of a device, and determining at least one IOPMP entry that matches the device in the IOPMP unit, wherein the memory access request is used to enable the device to request access to data stored in a memory address corresponding to the IOPMP unit, and the IOPMP entry is used to represent the data structure of the IOPMP unit; verifying the memory access request in at least one IOPMP entry to obtain at least one verification result, wherein the verification result is used to indicate whether the device has access rights in the corresponding IOPMP entry; generating an access rights result corresponding to the memory access request based on the verification result; if the access rights result is to allow the device to access the data in the memory address, transmitting the memory access request to the memory address to access the data; if the access rights result is to prohibit the device from accessing the data in the memory address, prohibiting the memory access request from being transmitted to the memory address to access the data.

[0325] Example 7

[0326] An embodiment of the present application may provide an electronic device, which may include a memory and a processor.

[0327] Fig.13It is a block diagram of an electronic device according to a method for determining memory access rights of a device according to an embodiment of the present application. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0328] like Fig.13 As shown, the device 1300 includes a computing unit 1301, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 1302 or a computer program loaded from a storage unit 1308 into a random access memory (RAM) 1303. In the RAM 1303, various programs and data required for the operation of the device 1300 can also be stored. The computing unit 1301, the ROM 1302, and the RAM 1303 are connected to each other via a bus 1304. An input / output (I / O) interface 1305 is also connected to the bus 1304.

[0329] A number of components in the device 1300 are connected to the I / O interface 1305, including: an input unit 1306, such as a keyboard, a mouse, etc.; an output unit 1304, such as various types of displays, speakers, etc.; a storage unit 1308, such as a disk, an optical disk, etc.; and a communication unit 1309, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 1309 allows the device 1300 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0330] The computing unit 1301 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 1301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSP), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 1301 performs the various methods and processes described above, such as a method for determining the memory access rights of a device. For example, in some embodiments, the method for determining the memory access rights of a device may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 1308. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 1300 via the ROM 1302 and / or the communication unit 1309. When the computer program is loaded into the RAM 1303 and executed by the computing unit 1301, one or more steps of the method for determining the memory access rights of the device described above may be executed. Alternatively, in other embodiments, the computing unit 1301 may be configured to execute the method for determining the memory access rights of the device in any other appropriate manner (for example, by means of firmware).

[0331] Example 8

[0332] The embodiment of the present application also provides a computer program product. Optionally, in this embodiment, the computer program product may include a computer program, and when the computer program is executed by a processor, the method for determining the memory access rights of the device of the embodiment of the present application is implemented.

[0333] According to an embodiment of the present application, a method for determining memory access permissions of a device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0334] The method embodiment provided in Example 8 of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Fig.14 is a hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for determining memory access rights of a device according to an embodiment of the present application, such as Fig.14As shown, the computer terminal 140 (or mobile device) may include one or more (shown in the figure as 1402a, 1402b, ..., 1402n) processors 1402 (the processor 1402 may include but is not limited to a processing device such as a microprocessor (Microcontroller Unit, referred to as MCU) or a programmable logic device (Field Programmable Gate Array, referred to as FPGA)), a memory 1404 for storing data, and a transmission device 1406 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a Universal Serial Bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Fig.14 The structure shown is only for illustration and does not limit the structure of the above electronic device. Fig.14 More or fewer components as shown, or with Fig.14 Different configurations are shown.

[0335] Fig.14 The hardware structure block diagram shown can be used not only as an exemplary block diagram of the above-mentioned computer terminal 140 (or mobile device), but also as an exemplary block diagram of the above-mentioned server. In an optional embodiment, Fig.14 The block diagram shows the use of the above Fig.14 The computer terminal 140 (or mobile device) is shown as an embodiment of a computing node in the computing environment 1501.

[0336] Fig.15 is a structural block diagram of a computing environment of a method for determining memory access rights of a device according to an embodiment of the present application, such as Fig.15 As shown, computing environment 1501 includes multiple computing nodes (such as servers) running on a distributed network (illustrated by 1510-1, 1510-2, ..., in the figure). The computing nodes all contain local processing and memory resources, and end users 1502 can remotely run applications or store data in computing environment 1501. Applications can be provided as multiple services 1520-1, 1520-2, 1520-3 and 1520-4 in computing environment 1501, representing services "F", "G", "I" and "H" respectively.

[0337] The end user 1502 can provide and access services through a web browser or other software application on the client, and in some embodiments, the end user 1502's provision and / or request can be provided to the entry gateway 1530. The entry gateway 1530 may include a corresponding agent to handle the provision and / or request for services (one or more services provided in the computing environment 1501).

[0338] Services are provided or deployed based on various virtualization technologies supported by computing environment 1501. In some embodiments, services can be provided based on virtual machine (VM)-based virtualization, container-based virtualization, and / or similar methods. Virtual machine-based virtualization can be to simulate a real computer by initializing a virtual machine, and execute programs and applications without directly contacting any actual hardware resources. While the virtual machine virtualizes the machine, according to container-based virtualization, a container can be started to virtualize the entire operating system so that multiple workloads can run on a single operating system instance.

[0339] In an embodiment based on container virtualization, several containers of a service can be assembled into a Pod (e.g., a Kubernetes Pod). Fig.15 As shown, service 1520-2 can be equipped with one or more Pods 1540-1, 1540-2, ..., 1540-N (collectively referred to as Pods). Pods can include a proxy 1545 and one or more containers 1542-1, 1542-2, ..., 1542-M (collectively referred to as containers). One or more containers in the Pod process requests related to one or more corresponding functions of the service, and the proxy 1545 generally controls network functions related to the service, such as routing, load balancing, etc. Other services can also be equipped with Pods similar to Pods.

[0340] During operation, executing a user request from end user 1502 may require invoking one or more services in computing environment 1501, and executing one or more functions of a service may require invoking one or more functions of another service. Fig.15 As shown, service "F" 1520-1 receives a user request from end user 1502 from ingress gateway 1530, service "F" 1520-1 may call service "G" 120-2, and service "G" 1520-2 may request service "I" 1520-3 to perform one or more functions.

[0341] The computing environment described above can be a cloud computing environment, where the allocation of resources is managed by the cloud service provider, allowing the development of functions without considering the implementation, adjustment or expansion of servers. The computing environment allows developers to execute code in response to events without building or maintaining complex infrastructure. Services can be divided into a set of functions that can be automatically and independently scaled, rather than expanding a single hardware device to handle potential loads.

[0342] Various embodiments of the systems and techniques described above herein may be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard parts (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. The various embodiments described above may include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0343] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. The above program code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0344] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. The various implementations described above can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0345] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. The above program code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0346] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory for short), an optical fiber, a portable compact disk read-only memory (CD-ROM for short), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0347] To provide interaction with a user, the systems and techniques described herein may be implemented on a computer having: a display device (e.g., a cathode ray tube (CRT) or a liquid crystal display (LCD), a monitor for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a path ball), through which the user may provide input to the computer. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0348] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a Local Area Network (LAN), a Wide Area Network (WAN), and the Internet.

[0349] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0350] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.

[0351] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0352] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic, for example, the division of units is only a logical function division, and there may be other division methods in actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0353] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0354] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0355] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, read-only memories, random access memories, mobile hard disks, magnetic disks or optical disks.

[0356] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. The above improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for determining memory access rights of a device, characterized in that: Applied to an input-output physical memory protection (IOPMP) unit, the method comprises: Obtaining a memory access request of a device, and determining at least one IOPMP entry matched by the device in the IOPMP unit, wherein the memory access request is used to enable the device to request access to data stored in a memory address corresponding to the IOPMP unit, and the IOPMP entry is used to represent a data structure of the IOPMP unit; Verifying the memory access request in at least one of the IOPMP entries to obtain at least one verification result, wherein the verification result is used to indicate whether the device has access rights in the corresponding IOPMP entry; Based on the verification result, an access permission result corresponding to the memory access request is generated, wherein the access permission result is used to indicate whether the device is allowed to access the data stored in the memory address.

2. The method according to claim 1, characterized in that: Verifying the memory access request in at least one of the IOPMP entries to obtain at least one verification result, including: Determining a priority order of at least one of the IOPMP entries; According to the priority order, the memory access request is verified in at least one of the IOPMP entries to obtain at least one of the verification results.

3. The method according to claim 2, characterized in that According to the priority order, the memory access request is verified in at least one of the IOPMP entries to obtain at least one verification result, including: Determine a first IOPMP entry in at least one of the IOPMP entries according to the priority order; Verifying the memory access request in the first IOPMP entry to obtain a first verification result, wherein the verification result includes the first verification result; If at least one of the IOPMP entries includes a second IOPMP entry next to the first IOPMP entry in the priority order, the first verification result is verified in the second IOPMP entry to obtain a second verification result, wherein the verification results include the second verification result.

4. The method according to claim 3, characterized in that The method further comprises: If at least one of the IOPMP entries includes the third IOPMP entry that is next to the second IOPMP entry in the priority order, the third IOPMP entry is determined as the second IOPMP entry, the second verification result is determined as the first verification result, and the following steps are performed again until at least one of the IOPMP entries does not include the third IOPMP entry that is next to the second IOPMP entry in the priority order: The first verification result is verified in the second IOPMP entry to obtain a second verification result.

5. The method according to claim 3, characterized in that: Verifying the first verification result in the second IOPMP entry to obtain a second verification result includes: In the IOPMP unit, determining a sub-check module corresponding to the second IOPMP entry; In the sub-checking module, the first verification result and the second IOPMP entry are verified in parallel using a first tree arbitration circuit to obtain the second verification result.

6. The method according to claim 5, characterized in that The method further comprises: The second verification result output by the first tree arbitration circuit is written into a register.

7. The method according to claim 3, characterized in that Verifying the first verification result in the second IOPMP entry to obtain a second verification result includes: Determining a time period corresponding to the second IOPMP entry; Within the time period, the first verification result is verified in the second IOPMP entry to obtain the second verification result.

8. The method according to claim 2, characterized in that: Based on the verification result, generating an access permission result corresponding to the memory access request, including: In the IOPMP unit, determining a second tree arbitration circuit; In the second tree-like arbitration circuit, at least one of the verification results is reduced according to the priority order to obtain the access permission result, wherein the verification result corresponds to a node of the second tree-like arbitration circuit.

9. The method according to claim 8, characterized in that In the second tree arbitration circuit, reducing at least one of the verification results according to the priority order to obtain the access permission result includes: Determining a root node of the second tree-like arbitration circuit; According to the priority order, at least one of the verification results is reduced to the root node to obtain the access permission result.

10. The method according to claim 1, characterized in that The method further comprises: In the case where the source identification information of the device is missing, generating a missing interrupt signal, wherein the missing interrupt signal is used to indicate that the source identification information is missing; In response to the missing interrupt signal, interrupting execution of the memory access request and acquiring extended source identification information of the device; The extended source identification information is loaded into an extended register table corresponding to the register table of the IOPMP unit, wherein the register table corresponds to a source identification information set and is used to identify a memory domain associated with the source identification information in the source identification information set, and the extended register table is obtained by extending the registers in the register table.

11. The method according to claim 10, characterized in that The method further comprises: When the extended source identification information is loaded into the extended register table, matching the extended source identification information with the hardware identification information of the device in the memory access request; If the extended source identification information matches the hardware identification information of the device in the memory access request successfully, the interruption of executing the memory access request is cancelled.

12. The method according to claim 11, characterized in that Determining at least one IOPMP entry matched by the device in the IOPMP unit includes: In the IOPMP entry set of the IOPMP unit, at least one of the IOPMP entries corresponding to the hardware identification information of the device is determined.

13. The method according to claim 10, characterized in that The method further comprises: If the hardware identification information of the device corresponding to the memory access request is found in the device identification information table, then the source identification information of the device corresponding to the hardware identification information of the device is determined in the device identification information table, wherein the device identification information table is used to indicate a mapping relationship between the source identification information of the device and the hardware identification information of the device; Based on the source identification information of the device, the register table is indexed and it is determined that the device is in a hot state.

14. The method according to claim 13, characterized in that The method further comprises: If the hardware identification information of the device is not found in the device identification information table, determining that the hardware identification information of the device is the extended source identification information, and determining that the device is in a cold state; Matching the extension source identification information with a value in the extension register table; If the extension source identification information matches the value in the extension register table successfully, it is determined that the device is in use; If the extension source identification information fails to match the value in the extension register table, the missing interrupt signal is triggered.

15. The method according to claim 14, characterized in that The method further comprises: If the device is switched from the cold state to the hot state, a mapping relationship between the source identification information of the device in the hot state and the hardware identification information of the device in the hot state is established in the device identification information table.

16. The method according to claim 14, characterized in that The method further comprises: Acquire the frequency at which the security monitor of the IOPMP unit loads the hardware identification information of the device into the extended register table; If the frequency is greater than the frequency threshold, it is determined that the device is in the hot state, and the security monitor is controlled to replace the source device identification information of the device in the hot state with the source device identification information of the original device in the cold state in the device identification information table.

17. The method according to any one of claims 1 to 16, characterized in that The method further comprises: Determining hardware resources of the IOPMP unit; determining an initial type of operation permitted to be performed on the hardware resource; Based on the initial type operation, determining a target type operation, wherein the scope of the target type operation's operating authority for the hardware resource is smaller than the scope of the initial type operation's operating authority for the hardware resource; and / or The operation permission allowing the initial type of operation to be performed on the hardware resource is transferred from the initial operation object to the target operation object.

18. The method according to claim 17, characterized in that Transferring the operation permission for performing the initial type of operation on the hardware resource from the initial operation object to the target operation object includes: The operation permission allowing the initial type operation to be performed on the hardware resource is transferred from the security monitor of the IOPMP unit to the boot system corresponding to the initial type operation, wherein the initial operation object includes the security monitor and the target operation object includes the boot system.

19. A memory access method for a device, characterized in that: Applied to an input-output physical memory protection (IOPMP) unit, the method comprises: Obtaining a memory access request of a device, and determining at least one IOPMP entry matched by the device in the IOPMP unit, wherein the memory access request is used to enable the device to request access to data stored in a memory address corresponding to the IOPMP unit, and the IOPMP entry is used to represent a data structure of the IOPMP unit; Verifying the memory access request in at least one of the IOPMP entries to obtain at least one verification result, wherein the verification result is used to indicate whether the device has access rights in the corresponding IOPMP entry; Based on the verification result, generating an access permission result corresponding to the memory access request; If the access permission result is to allow the device to access the data in the memory address, transmitting the memory access request to the memory address to access the data; If the access permission result prohibits the device from accessing the data in the memory address, transmitting the memory access request to the memory address to access the data is prohibited.

20. A system for determining memory access rights of a device, characterized in that: include: Input and output physical memory protection IOPMP unit and output port, where: The IOPMP unit is used to obtain a memory access request of a device and determine at least one IOPMP entry matched by the device in the IOPMP unit, wherein the memory access request is used to enable the device to request access to data stored in a memory address corresponding to the IOPMP unit, and the IOPMP entry is used to represent a data structure of the IOPMP unit; the memory access request is verified in at least one of the IOPMP entries to obtain at least one verification result, wherein the verification result is used to represent whether the device has access rights in the corresponding IOPMP entry; based on the verification result, an access rights result corresponding to the memory access request is generated, wherein the access rights result is used to represent whether the device is allowed to access the data stored in the memory address; The output end is used to output the access permission result.

21. The system according to claim 20, characterized in that The system comprises: A masker is used to determine at least one IOPMP entry corresponding to the hardware identification information of the device in the IOPMP entry set of the IOPMP unit.

22. The system according to claim 20, characterized in that The IOPMP unit comprises: The IOPMP checker is used to verify the memory access request in at least one of the IOPMP entries to obtain at least one verification result, and based on the verification result, generate the access permission result corresponding to the memory access request.

23. The system according to claim 22, characterized in that The IOPMP checker includes: A sub-checking module, configured to verify the memory access request in the IOPMP entry by using the first tree arbitration circuit to obtain the verification result; The register is used to write the verification result.

24. The system according to claim 20, characterized in that The system further comprises: A security monitor is used to maintain a blocking state between a bus of the IOPMP unit and the IOPMP checker.

25. An electronic device, characterized in that: include: A memory storing an executable program; A processor, configured to run the program, wherein the program executes the method according to any one of claims 1 to 19 when running.

26. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored executable program, wherein when the executable program is run, the device where the storage medium is located is controlled to execute the method according to any one of claims 1 to 19.

27. A computer program product, characterized in that It comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 19.

Images