Access method of exclusive equipment and related device

Abstract

An access method of exclusive equipment is applied to the technical field of computers. In the access method of the exclusive equipment, aiming at a scene with two independent operating systems, an access request which is sent by an application program in a first operating system and aims at the exclusive equipment is converted into an auxiliary access request sent to an application program in a second operating system; requesting an application program in the second operating system to assist in accessing the exclusive equipment; moreover, a controller is arranged in the second operating system to control the exclusive access of the application program in the second operating system to the exclusive device, and finally, the access requests for the exclusive device in the first operating system and the second operating system pass through the controller arranged in the second operating system. Concurrent access of the application program to the exclusive equipment can be limited in a dual-operating system scene, and normal use of the exclusive equipment is prevented from being affected.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method for accessing an exclusive device and a related device. Background Art

[0002] Security modules include Trusted Platform Module (TPM) and Trust Cryptography Module (TCM). Security modules are often used to protect the integrity of system boot firmware and the security of computer devices. Generally speaking, a security module is an exclusive device, which means that it can only be accessed by one application at a time. When multiple applications access the security module at the same time, the security module may have problems such as input parameters or output results being tampered with, or abnormal operation.

[0003] Based on this, related technologies usually limit concurrent access of multiple applications to an exclusive device to ensure that only one application accesses the exclusive device at the same time, thereby ensuring the normal operation of the exclusive device.

[0004] However, in some scenarios, the exclusive device is still prone to problems such as parameter tampering or abnormal operation during operation, which affects the normal use of the exclusive device. Summary of the invention

[0005] The present application provides a method for accessing an exclusive device, which can limit concurrent access of multiple applications to the exclusive device to avoid affecting the normal use of the exclusive device.

[0006] The first aspect of the present application provides a method for accessing an exclusive device, which is applied to a first controller. In the method, the first controller first obtains a first request message from a first application, and the first request message is used to request access to the exclusive device. The first controller and the first application both run in a first operating system, that is, the first controller and the first application are both software modules running in the first operating system. The first operating system runs on a processor other than the exclusive device. In addition, the processor running the first operating system and the exclusive device are located on the same network device (such as the same network device such as a computer, switch or gateway).

[0007] Secondly, in response to the second operating system being started, the first controller sends a second request message to the second application running in the second operating system based on the first request message, and the second request message is used to request the second application to assist in accessing the exclusive device. Since the second request message is used to request the second application to assist the first application in accessing the exclusive device, the process of the first application requesting access to the exclusive device is completed by the second application, and the first controller no longer forwards the first request message from the first application to the exclusive device.

[0008] The second operating system runs on a processor other than the exclusive device, the processors running the first operating system and the second operating system are connected to the exclusive device via a bus, and a second controller runs in the second operating system, which is used to control the exclusive access of applications in the second operating system to the exclusive device.

[0009] In this solution, in the case of two independent operating systems, an access request for an exclusive device sent by an application in the first operating system is converted into an assist access request sent to an application in the second operating system, thereby requesting the application in the second operating system to assist in accessing the exclusive device; and a controller is set in the second operating system to control the mutually exclusive access of the application in the second operating system to the exclusive device, ultimately achieving that the access requests for the exclusive device in the first operating system and the second operating system are all passed through the controller set in the second operating system, ensuring that in the dual operating system scenario, the concurrent access of the application to the exclusive device can be limited to avoid affecting the normal use of the exclusive device.

[0010] In a possible implementation, both the first operating system and the second operating system can operate independently. That is, the first operating system does not rely on the second operating system during normal operation, and the second operating system does not rely on the first operating system during normal operation. Specifically, when concurrent access restrictions on exclusive devices are not performed on applications in the first operating system and the second operating system, applications in the first operating system can independently access exclusive devices, and applications in the second operating system can also independently access exclusive devices.

[0011] In a possible implementation, the first operating system runs in a non-secure world, and the second operating system runs in a secure world. For example, the first operating system is a real-time operating system (RTOS), and the second operating system is an open portable trusted execution environment (OP-TEE).

[0012] In a possible implementation, the first operating system and the second operating system run on the same processor, and the processor is connected to the exclusive device.

[0013] In this solution, access requests to exclusive devices in different operating systems running in the non-secure world and the secure world are all passed through the controller set in the operating system in the secure world, thereby ensuring that concurrent access to exclusive devices by applications can be limited in specific scenarios where the device has a secure world and a non-secure world.

[0014] In one possible implementation, the processor includes a network processor (NP), a central processing unit (CPU), a graphics processing unit (GPU), a tensor processing unit (TPU), or a data processing unit (DPU).

[0015] In one possible implementation, the second controller belongs to the driver component of the exclusive device. For example, in the case where the exclusive device is a TPM, the second controller belongs to the driver component of the TPM, that is, the driver component of the TPM can implement the concurrent access restriction function performed by the second controller. Since the second controller runs in the second operating system, and the second operating system runs on a processor other than the exclusive device, and the software module on the second operating system needs to pass through the driver component of the exclusive device set in the second operating system when accessing the exclusive device, therefore, by setting the second controller in the driver component of the exclusive device, it can be ensured that the second controller obtains access request messages from all applications in the second operating system.

[0016] In a possible implementation, the exclusive device is any one of the following devices: a TPM, a TCM, or a storage chip, such as a NAND flash chip or a NOR flash chip.

[0017] In one possible implementation, the above-mentioned exclusive device access method also includes: the first controller obtains a first response message from the second application, the first response message includes feedback data returned by the exclusive device after the second application assists in accessing the exclusive device; then, the first controller forwards the first response message to the first application.

[0018] That is, the first controller returns the feedback data obtained from the exclusive device to the first application program in the original path, so that the first application program can obtain the feedback data returned by the exclusive device.

[0019] In one possible implementation, the above-mentioned exclusive device access method also includes: the first controller obtains a third request message from the first application, and the third request message is used to request access to the exclusive device; in response to the second operating system not being started, the first controller forwards the third request message to the third controller, the third controller runs in the first operating system, and the third controller is used to control the exclusive access of the application in the first operating system to the exclusive device.

[0020] That is to say, when the second operating system is not started, the request message for accessing the exclusive device received by the first controller from the application will be forwarded to the third controller, and the third controller will be further responsible for processing the request message to ensure that only one application accesses the exclusive device at the same time.

[0021] In a possible implementation, when the second operating system is not started, the first controller is also used to control the exclusive access of the application in the first operating system to the exclusive device. That is, the first controller is responsible for limiting the concurrent access of multiple applications to the exclusive device.

[0022] The second aspect of the present application provides a method for accessing an exclusive device, which is applied to a control module, the control module includes a first access port and a second access port, and the control module is connected to the exclusive device. Specifically, the method for accessing an exclusive device includes: first, the control module obtains a first access request message through the first access port and obtains a second access request message through the second access port, the first access request message comes from a first processing system connected to the first access port, the second access request message comes from a second processing system connected to the second access port, and both the first access request message and the second access request message are used to request access to the exclusive device.

[0023] Then, the control module sequentially forwards the first access request message and the second access request message to the exclusive device, so that the exclusive device processes only one access request message at a time.

[0024] In this solution, a control module is set between the exclusive device and multiple independent processing systems. The control module is used as a unified entrance for accessing the exclusive device. Access requests from multiple processing systems to the exclusive device can be processed by the control module, thereby achieving control of mutually exclusive access of multiple processing systems to the exclusive device.

[0025] In a possible implementation, the first processing system includes a first processor, and the second processing system includes a second processor, that is, the first processing system and the second processing system are composed of different processors.

[0026] In a possible implementation, the first processor and the second processor are deployed on the same system on chip (SoC). That is, the first processing system and the second processing system are deployed on the same SoC at the same time, and different processing systems on the SoC are composed of different processors. In addition, the first processing system and the second processing system respectively access the first access port and the second access port through different interfaces on the same SoC, thereby sending an access request message to the control module through the first access port and the second access port.

[0027] In a possible implementation, the control module is deployed on the SoC where the first processing system and the second processing system are located.

[0028] In this solution, by setting a control module on the same SoC to perform concurrent access control on multiple processing systems on the SoC, it can be ensured that the processing systems in the SoC can access exclusive devices normally without the situation where multiple processing systems concurrently access the exclusive devices and cause abnormal operation of the exclusive devices.

[0029] In one possible implementation, the control module is deployed on a processing device outside the SoC where the first processing system and the second processing system are located, and the processing device is connected to the first processor through a first access port, and the processing device is connected to the second processor through a second access port.

[0030] That is to say, the control module is no longer integrated into the SoC, but is connected to the SoC in the form of a separate processing device, and implements concurrent access control of multiple processing systems in the SoC. In this way, in actual applications, there is no need to adjust the structure of the SoC, but to design and manufacture a separate processing device connected between the SoC and the exclusive device, ensuring that the original SoC can also access the exclusive device normally.

[0031] In a possible implementation, the processing device is a processor, an application specific integrated circuit (ASIC) chip, or a programmable logic device.

[0032] According to a third aspect of the present application, there is provided an access device for an exclusive device, wherein the access device for the exclusive device is a first controller, and the access device for the exclusive device includes:

[0033] an acquisition unit, configured to acquire a first request message from a first application, the first request message being used to request access to an exclusive device, the first controller and the first application both running in a first operating system, and the first operating system running on a processor other than the exclusive device;

[0034] a sending unit, configured to send a second request message to a second application program running in the second operating system based on the first request message in response to the second operating system being started, wherein the second request message is used to request the second application program to assist in accessing the exclusive device;

[0035] The second operating system runs on a processor other than the exclusive device, the processors running the first operating system and the second operating system are connected to the exclusive device via a bus, and a second controller runs in the second operating system, which is used to control the exclusive access of applications in the second operating system to the exclusive device.

[0036] In a possible implementation, both the first operating system and the second operating system can run independently.

[0037] In a possible implementation, the first operating system runs in a non-secure world, and the second operating system runs in a secure world.

[0038] In a possible implementation, the first operating system and the second operating system run on the same processor, and the processor is connected to the exclusive device.

[0039] In a possible implementation, the processor includes an NP, a CPU, a GPU, a TPU, or a DPU.

[0040] In a possible implementation, the second controller belongs to a driving component of the exclusive device.

[0041] In a possible implementation manner, the exclusive device is any one of the following devices: a TPM, a TCM, or a storage chip.

[0042] In a possible implementation, the acquiring unit is further configured to acquire a first response message from the second application, the first response message including feedback data returned by the exclusive device after the second application assists in accessing the exclusive device;

[0043] The sending unit is further used to forward the first response message to the first application.

[0044] In a possible implementation, the acquiring unit is further configured to acquire a third request message from the first application, where the third request message is used to request access to the exclusive device;

[0045] The sending unit is also used for, in response to the second operating system not being started, the first controller forwarding a third request message to a third controller, the third controller running in the first operating system, and the third controller being used for controlling the mutually exclusive access of the application in the first operating system to the exclusive device.

[0046] In a possible implementation, the exclusive device access device further includes: a control unit, configured to control the exclusive access of an application in the first operating system to the exclusive device when the second operating system is not started.

[0047] A fourth aspect of the present application provides an access device for an exclusive device, the access device for an exclusive device is applied to a control module, the control module includes a first access port and a second access port, and the control module is connected to the exclusive device. The access device for an exclusive device includes:

[0048] an acquiring unit, configured to acquire a first access request message through a first access port and to acquire a second access request message through a second access port, wherein the first access request message comes from a first processing system connected to the first access port, and the second access request message comes from a second processing system connected to the second access port, and both the first access request message and the second access request message are used to request access to an exclusive device;

[0049] The sending unit is used to sequentially forward the first access request message and the second access request message to the exclusive device, so that the exclusive device only processes one access request message at a time.

[0050] In a possible implementation, the first processing system includes a first processor, the second processing system includes a second processor, and the first processor and the second processor are deployed on the same SoC.

[0051] In a possible implementation, the control module is deployed on a SoC.

[0052] In a possible implementation, the control module is deployed on a processing device, the processing device is connected to the first processor through a first access port, and the processing device is connected to the second processor through a second access port.

[0053] In a possible implementation, the processing device is a processor, an ASIC chip, or a programmable logic device.

[0054] A fifth aspect of the present application provides a network device, comprising a processor and a memory; wherein the memory is used to store program code, and the processor is used to call the program code in the memory so that the network device executes a method as in any one of the implementation methods of the first to second aspects.

[0055] In a sixth aspect, the present application provides a computer-readable storage medium storing instructions, which, when executed on a computer, enable the computer to execute a method as in any one of the embodiments of the first to second aspects.

[0056] The seventh aspect of the present application provides a computer program product, which, when executed on a computer, enables the computer to execute a method as in any one of the embodiments of the first to second aspects.

[0057] In an eighth aspect, the present application provides a chip, comprising one or more processors. Some or all of the processors are used to read and execute computer instructions stored in a memory to execute the method in any possible implementation of any of the above aspects. Optionally, the chip also includes a memory. Optionally, the chip also includes a communication interface, and the processor is connected to the communication interface. The communication interface is used to receive data and / or information to be processed, the processor obtains data and / or information from the communication interface, processes the data and / or information, and outputs the processing results through the communication interface. Optionally, the communication interface is an input / output interface or a bus interface. The method provided in the present application is implemented by a chip, or by multiple chips in collaboration.

[0058] The solutions provided in the third to eighth aspects are used to implement or cooperate with the methods provided in the first to second aspects, and therefore can achieve the same or corresponding beneficial effects as the first to second aspects, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 A schematic diagram of a system architecture provided for an embodiment of the present application;

[0060] Figure 2 A schematic diagram of a system architecture applied to a method for accessing an exclusive device provided in an embodiment of the present application;

[0061] Figure 3 A flowchart of a method for accessing an exclusive device provided in an embodiment of the present application;

[0062] Figure 4 Another schematic diagram of a system architecture applied to a method for accessing an exclusive device provided in an embodiment of the present application;

[0063] Figure 5 A schematic diagram of the architecture of a network device provided in an embodiment of the present application;

[0064] Figure 6 Another schematic diagram of the architecture of a network device provided in an embodiment of the present application;

[0065] Figure 7 A schematic diagram of a TPM access process provided in an embodiment of the present application;

[0066] Figure 8 The data flow of accessing the TPM when starting the operating system of a secure world provided in an embodiment of the present application;

[0067] Fig. 9 A data flow for accessing a TPM when an operating system of a secure world is not started provided in an embodiment of the present application;

[0068] Fig.10 A schematic diagram of an application architecture of a method for accessing an exclusive device provided in an embodiment of the present application;

[0069] Fig.11 A schematic diagram of the structure of a processing system provided in an embodiment of the present application;

[0070] Fig.12 A schematic diagram of a structure in which a control module provided in an embodiment of the present application is deployed on a SoC;

[0071] Fig.13 A schematic diagram of a structure in which a control module is deployed outside a SoC according to an embodiment of the present application;

[0072] Fig.14 A schematic diagram of the structure of a control module for implementing TPM concurrent access control provided in an embodiment of the present application;

[0073] Fig.15 A schematic diagram of the structure of an access device for an exclusive device provided in an embodiment of the present application;

[0074] Fig.16 A schematic diagram of the structure of another exclusive device access apparatus provided in an embodiment of the present application. DETAILED DESCRIPTION

[0075] In order to make the purpose, technical solutions and advantages of the present application more clear, the embodiments of the present application are described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. It is known to those skilled in the art that with the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0076] The terms "first", "second" and the like in the specification and claims of this application and the above drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0077] To facilitate understanding, some technical terms involved in this embodiment are introduced below.

[0078] (1) Exclusive equipment

[0079] An exclusive device is a device that allows an application to use it exclusively during its entire running period. That is, once an exclusive device is assigned to an application, it is used exclusively by the assigned application, and other applications are not allowed to access the exclusive device until the assigned application has finished using it and released the exclusive device.

[0080] (2) Trusted Platform Module (TPM)

[0081] TPM is a chip embedded in a computer to provide a root of trust for the computer. Specifically, TPM is a small chip containing cryptographic operations and storage components, which is used to securely store information used to verify the security of the platform (such as switches, personal computers and other network devices), such as passwords, certificates or encryption keys. Through built-in algorithms, TPM generates trusted keys and ensures the confidentiality and integrity of keys and other sensitive data through non-volatile random access memory (NVRAM) and storage root key (SRK).

[0082] (3) Trusted Cryptography Module (TCM)

[0083] TCM is similar to TPM, which is also a chip implanted inside the computer and provides a trusted root for the computer. The difference between TCP and TPM is that the cryptographic algorithms used by TCP and TPM are different.

[0084] (4) Secure world and non-secure world

[0085] In the related art, in order to provide a secure operating environment for applications or components in a computer, the ARM processor introduces the TrustZone technology. The ARM processor supporting the TrustZone technology divides hardware resources and software resources into a secure world and a non-secure world.

[0086] General operating systems and most applications run in the non-secure world. The development resources in the non-secure world are richer than those in the secure world, so the non-secure world is usually called the Rich Execution Environment (REE). Trusted operating systems run in the secure world, which is usually called the Trusted Execution Environment (TEE).

[0087] See also Figure 1 , Figure 1 A schematic diagram of a system architecture provided in an embodiment of the present application. Figure 1 As shown in the figure, the system architecture includes a trusted execution environment and a rich execution environment. The trusted execution environment is specially provided for highly security-sensitive applications, and can ensure the confidentiality of the resources and data of the application. The rich execution environment is provided for traditional operating systems and general applications. Applications executed on the rich execution environment side are called client applications (CA), such as third-party payment applications such as banking applications. Applications executed on the trusted execution environment side are called trusted applications (TA), such as applications that perform key services such as signing, encryption and decryption calculations.

[0088] Since TA runs in a trusted execution environment, the deployment / upgrade operation of TA needs to strictly follow the security verification specifications of the trusted execution environment issuer, such as using digital signatures and other measures to ensure that each link of the trusted execution environment is truly trusted. The trusted execution environment includes the trusted execution environment internal application programming interface (TEE Internal API) and the trusted operating system component. The main functions of the TEE Internal API are: providing the functions of the trusted operating system component to the upper layer, communicating with the client application CA, realizing TA-TA communication, and providing secure storage, cryptographic functions, and time functions. The trusted operating system components mainly include trusted device drivers and trusted execution environment TEE communication agents. The trusted execution environment communication agent provides a secure communication channel for TA and CA. For example, the trusted execution environment communication agent passes messages to the rich execution environment communication agent through the platform hardware to realize the interaction between TA and CA. In addition, the switching between REE and TEE is realized through the monitor.

[0089] The rich execution environment includes the trusted execution environment client application programming interface (TEE Client API) and the rich operating system. The rich operating system components mainly include public device drivers and rich execution environment communication agents. Among them, the rich execution environment communication agent is used to communicate with the trusted execution environment and provide a secure communication channel for CA and TA. The public device driver is used to drive the public devices in the platform hardware. CA uses TEE Client API and TEE Functional API to access the security services provided by TA.

[0090] (5) Mutually exclusive access

[0091] Mutually exclusive access means that when multiple applications try to access a shared resource at the same time, only one application is allowed to access the shared resource to ensure data consistency and reliability.

[0092] (6) Bus

[0093] The bus is a common communication trunk used to transmit information between various functional components in a network device. The bus is essentially a transmission line bundle composed of wires.

[0094] Generally speaking, due to the uniqueness of exclusive devices, related technologies usually limit concurrent access to exclusive devices by multiple applications when using exclusive devices, ensuring that only one application accesses the exclusive device at the same time, thereby ensuring the normal operation of the exclusive device.

[0095] However, the inventors have found through research that in the related art, multiple applications in the same operating system are usually restricted from accessing exclusive devices in a computer. In some special scenarios, the technical means used in the related art cannot completely guarantee that only one application accesses the exclusive device at the same time. The exclusive device is still prone to parameter tampering or abnormal operation during operation, which affects the normal use of the exclusive device.

[0096] Specifically, when multiple independently running operating systems are deployed in the same device, applications in different operating systems may access the exclusive device at the same time. Since the relevant technology cannot restrict concurrent access by applications in different operating systems, it is easy to cause the exclusive device to be unable to be used normally.

[0097] Based on this, an embodiment of the present application provides a method for accessing an exclusive device. When the same device has two independent operating systems, an access request for the exclusive device sent by an application in the first operating system is converted into an assistance access request sent to an application in the second operating system, thereby requesting the application in the second operating system to assist in accessing the exclusive device; and a controller is set in the second operating system to control the mutually exclusive access of the application in the second operating system to the exclusive device, ultimately achieving that the access requests for the exclusive device in the first operating system and the second operating system are passed through the controller set in the second operating system, ensuring that in the dual operating system scenario, the concurrent access of the application to the exclusive device can be limited to avoid affecting the normal use of the exclusive device.

[0098] See also Figure 2 , Figure 2 A schematic diagram of a system architecture used in a method for accessing an exclusive device provided in an embodiment of the present application. Figure 2 As shown, the system architecture includes a processor and an exclusive device, and the processor is connected to the exclusive device through a bus. The processor runs a first operating system and a second operating system. The first operating system runs a first application and a first controller, and the second operating system runs a second application and a second controller. Moreover, the applications in the first operating system and the second operating system can access the exclusive device through the bus.

[0099] In the first operating system, the access request sent by the first application to the exclusive device will pass through the first controller; in the second operating system, the access request sent by the second application to the exclusive device will pass through the second controller. When both the first operating system and the second operating system are started, the first controller will convert the access request sent by the first application to the exclusive device into an assisting access request sent to the second application, so that the second application assists the first application to access the exclusive device, thereby ensuring that the access requests for the exclusive device in the two operating systems will eventually pass through the second controller.

[0100] See also Figure 3 , Figure 3 A flowchart of a method for accessing an exclusive device provided in an embodiment of the present application. Figure 3 As shown, the exclusive device access method includes the following steps 301-308.

[0101] Step 301: A first controller obtains a first request message from a first application program, where the first request message is used to request access to an exclusive device.

[0102] In this embodiment, the first controller and the first application are both running in the first operating system, that is, the first controller and the first application are both software modules running in the first operating system. The first operating system runs on a processor other than the exclusive device. In addition, the processor running the first operating system and the exclusive device are located on the same network device (such as the same network device such as a computer, switch or gateway), and the processor running the first operating system is connected to the exclusive device through a bus. Therefore, the first application running in the first operating system can access the exclusive device through the bus.

[0103] When the first application needs to access the exclusive device, the first application will send a first request message for accessing the exclusive device, and the first request message will pass through the first controller. That is, the first application's access request for the exclusive device will pass through the first controller, and the first controller will process the access request sent by the first application.

[0104] The first request message sent by the first application includes the content that the first application requests the exclusive device to complete. For example, the first request message is used to request the exclusive device to generate a key for the first application.

[0105] Optionally, the exclusive device is, for example, a TPM, a TCM, or a storage chip that does not support simultaneous access by multiple applications, such as a NAND flash chip or a NOR flash chip. This embodiment does not specifically limit the type of the exclusive device.

[0106] Step 302: In response to the second operating system being started, the first controller sends a second request message to a second application running in the second operating system based on the first request message, where the second request message is used to request the second application to assist in accessing the exclusive device.

[0107] When the second operating system has been started, the first controller generates a second request message based on the first request message, and sends the second request message to the second application in the second operating system. Since the second request message is used to request the second application to assist the first application in accessing the exclusive device, the process of the first application requesting access to the exclusive device is completed by the second application, and the first controller no longer forwards the first request message from the first application to the exclusive device.

[0108] It should be noted that the specific content of the second request message generated by the first controller is related to the content of the first request message. For example, when the first request message is used to request the exclusive device to generate a key for the first application, the second request message sent by the first controller to the second application is used to instruct the second application to assist the first application in requesting the exclusive device to generate a key.

[0109] The second operating system runs on a processor other than the exclusive device, and the processor running the second operating system is connected to the exclusive device via a bus.

[0110] Optionally, both the first operating system and the second operating system can operate independently, that is, the first operating system does not rely on the second operating system during normal operation, and the second operating system does not rely on the first operating system during normal operation. Specifically, when concurrent access restrictions on exclusive devices are not performed on applications in the first operating system and the second operating system, applications in the first operating system can independently access exclusive devices, and applications in the second operating system can also independently access exclusive devices.

[0111] Exemplarily, the first operating system runs in the non-secure world, and the second operating system runs in the secure world. For example, the first operating system is a real-time operating system (RTOS), and the second operating system is an open portable trusted execution environment (OP-TEE). In addition, the first operating system and the second operating system run on the same processor connected to the exclusive device. In this way, the non-secure world and the secure world are actually two states of processor operation. The processor switches between the two states to independently run the first operating system and the second operating system. When the processor switches to the non-secure world state, the processor runs the first operating system; when the processor switches to the secure world state, the processor runs the second operating system.

[0112] Optionally, the processor running the first operating system and the second operating system includes, for example, a network processor (NP), a central processing unit (CPU), a graphics processing unit (GPU), a tensor processing unit (TPU) or a data processor (DPU). This embodiment does not specifically limit the type of processor.

[0113] In addition, in some possible examples, the first operating system and the second operating system are also respectively run on different processors. And there is a physical connection between the processor running the first operating system and the processor running the second operating system, so that the first controller in the first operating system and the second application in the second operating system can interact with each other.

[0114] Step 303: Based on the received second request message, the second application sends an access request message to the second controller, where the access request message is used to request access to the exclusive device.

[0115] In this embodiment, the specific content of the access request message sent by the second application to the second controller is related to the content of the second request message. For example, when the second request message is used to instruct the second application to assist the first application in requesting the exclusive device to generate a key, the access request message sent by the second application to the second controller is used to request the exclusive device to generate a key.

[0116] A second controller is also running in the second operating system, and the second controller is used to control the mutually exclusive access of the application program in the second operating system to the exclusive device.

[0117] That is to say, when all applications in the second operating system need to access the exclusive device, they need to access the exclusive device through the second controller. The second controller can obtain the access request messages sent by all applications in the second operating system to the exclusive device, and then forward the access request messages sent by these applications in an orderly manner to ensure that the exclusive device only processes one access request message at a time.

[0118] For example, when the second controller obtains access request messages sent by multiple applications in the second operating system at the same time, the second controller first forwards one of the access request messages to the exclusive device, and after the exclusive device completes processing one access request message, it forwards the next access request message to the exclusive device, thereby ensuring that the exclusive device does not obtain another access request message while processing one access request message.

[0119] In one possible implementation, the second controller belongs to the driver component of the exclusive device. For example, in the case where the exclusive device is a TPM, the second controller belongs to the driver component of the TPM, that is, the driver component of the TPM can implement the concurrent access restriction function performed by the second controller. Since the second controller runs in the second operating system, and the second operating system runs on a processor other than the exclusive device, and the software module on the second operating system needs to pass through the driver component of the exclusive device set in the second operating system when accessing the exclusive device, therefore, by setting the second controller in the driver component of the exclusive device, it can be ensured that the second controller obtains access request messages from all applications in the second operating system.

[0120] Exemplarily, the second controller controls the exclusive access of the application in the second operating system to the exclusive device through a software mutex mechanism. Specifically, the second controller is provided with a software mutex. The software mutex has two states, namely, an unlocked state and a locked state. When the second controller obtains an access request message from the application in the second operating system for the exclusive device, it applies for a software mutex for the obtained access request message. If any access request message successfully applies for a software mutex, the second controller forwards the access request message applied for the software mutex to the exclusive device, and the state of the software mutex changes from an unlocked state to a locked state, and the second controller can no longer apply for a software mutex for other access request messages. After the exclusive device completes processing the access request message, the state of the software mutex changes from a locked state to an unlocked state, and the second controller can continue to apply for a software mutex for the obtained access request message again to confirm the subsequent access request message that needs to be forwarded to the exclusive device.

[0121] The above describes that the second controller uses a software mutex lock mechanism to control the mutual exclusive access of applications in the second operating system to exclusive devices. In some embodiments, the second controller may also use other mechanisms to control the mutual exclusive access of applications in the second operating system to exclusive devices. This embodiment does not specifically limit this.

[0122] Step 304: The second controller forwards the access request message from the second application to the exclusive device.

[0123] In this embodiment, after the second controller obtains the access request message from the second application, if the exclusive device is not currently processing an access request message, the second controller forwards the access request message from the second application to the exclusive device; if the exclusive device is currently processing an access request message, the second controller waits for the exclusive device to complete processing the access request message, and then forwards the access request message from the second application to the exclusive device.

[0124] In general, by converting the access request sent by the application in the first operating system to the exclusive device into an assist access request sent to the application in the second operating system, the application in the second operating system assists the application in the first operating system to access the exclusive device, thereby ensuring that the access requests for the exclusive device in the two operating systems will eventually pass through the second controller in the second operating system for limiting concurrent access to the exclusive device.

[0125] Step 305: The exclusive device sends an access response message to the second controller.

[0126] After the exclusive device processes the access request message from the second application, the exclusive device generates an access response message and sends the access response message to the second controller.

[0127] The specific content of the access response message is related to the content requested to be executed by the exclusive device in the access request message, that is, the access response message includes feedback data returned by the exclusive device in response to the access request message. For example, if the access request message is used to request the exclusive device to generate a key, the access response message includes a key generated by the exclusive device.

[0128] Step 306: The second controller forwards the access response message to the second application.

[0129] Step 307: Based on the access response message, the second application sends a first response message to the first controller, where the first response message includes feedback data returned by the exclusive device after the second application assists in accessing the exclusive device.

[0130] In this embodiment, since the second application assists the first application to access the exclusive device, after the exclusive device returns an access response message to the second application, the second application needs to return the feedback data returned by the exclusive device in the access response message to the first application through the first controller.

[0131] Specifically, the first response message is generated by the second controller based on the obtained access response message, and is used to indicate the response result obtained after the second application assists the first application in accessing the exclusive device (i.e., the feedback data returned by the exclusive device through the access response message). For example, when the second request message is used to indicate that the second application assists the first application in requesting the exclusive device to generate a key, the first response message includes a key generated by the exclusive device.

[0132] Step 308: The first controller forwards the first response message to the first application.

[0133] In general, the path for the first application in the first operating system to request access to the exclusive device is: first application → first controller → second application → second controller → exclusive device; the path for the first application in the first operating system to obtain feedback data returned by the exclusive device is: exclusive device → second controller → second application → first controller → first application.

[0134] The above embodiment introduces the process of accessing an exclusive device by an application in the first operating system through an application in the second operating system when both the first operating system and the second operating system are started. In some cases, the first operating system has been started, and the second operating system may not have been started yet. Then, in this case where the first operating system has been started and the second operating system has not been started, there is no longer a phenomenon in which the applications in the two operating systems access the exclusive device at the same time, so the application in the first operating system no longer needs to access the exclusive device through the application in the second operating system.

[0135] For example, see Figure 4 , Figure 4 Another schematic diagram of a system architecture used in a method for accessing an exclusive device provided in an embodiment of the present application. Figure 4 As shown, in the system architecture, since the second operating system is not started, only the first operating system is running on the processor. In addition, the first operating system is running a first application and a first controller. Optionally, the first operating system is also running a third controller.

[0136] In the case where the first operating system does not run the third controller, the first controller is also used to control the mutually exclusive access of the application in the first operating system to the exclusive device. That is, the first controller is responsible for limiting the concurrent access of multiple applications to the exclusive device. The way in which the first controller controls the mutually exclusive access of the application in the first operating system to the exclusive device is similar to the way in which the second controller controls the mutually exclusive access of the application in the second operating system to the exclusive device in the above embodiment. Please refer to the above embodiment for details, which will not be repeated here.

[0137] In the case where the first operating system runs with the third controller, the first controller forwards the access request obtained from the application to the third controller, and the third controller controls the mutually exclusive access of multiple applications to the exclusive device. That is, the third controller is responsible for limiting the concurrent access of multiple applications to the exclusive device, ensuring that only one application accesses the exclusive device at the same time.

[0138] Exemplarily, when the second operating system is not started, the first controller obtains a third request message from the first application, and the third request message is used to request access to the exclusive device. The third request message is similar to the first request message introduced in the above embodiment. Please refer to the introduction of the first request message for details, which will not be repeated here.

[0139] In response to the second operating system not being started, the first controller forwards the third request message to the third controller. The third controller runs in the first operating system, and the third controller is used to control the mutually exclusive access of the application in the first operating system to the exclusive device. That is, when the second operating system is not started, the request message for accessing the exclusive device received by the first controller from the application will be forwarded to the third controller, and the third controller will be further responsible for processing the request message, thereby ensuring that only one application accesses the exclusive device at the same time.

[0140] For ease of understanding, the execution flow of the exclusive device access method provided in this embodiment in actual application will be described in detail below with reference to specific examples.

[0141] For example, see Figure 5 , Figure 5 The following is a schematic diagram of the architecture of a network device provided in an embodiment of the present application. Figure 5 As shown, in the same network device (such as a switch, gateway or computer and other network devices), a system on chip (SoC) and a TPM are included. The SoC includes a processor, and two operating systems can run on the processor, one operating system (such as RTOS) runs in the non-secure world, and the other operating system (such as OP-TEE) runs in the secure world. Among them, the processor in the SoC is connected to the serial peripheral interface (SPI) controller through an on-chip bus, and the SPI controller is connected to the TPM outside the SoC. The SPI controller is essentially a hardware interface on the SoC, which is used to realize the connection between the SoC and the TPM.

[0142] Applications in two operating systems running on the processor of the SoC can access the TPM. For example, when an application running in the operating system of the non-secure world sends a Platform Configuration Registers (PCR) extension command to the TPM, another application running in the operating system of the secure world may send a command to obtain a random number to the TPM, resulting in the phenomenon that the application in the non-secure world and the application in the secure world access the TPM at the same time.

[0143] The command for the application running in the operating system of the secure world to send a random number to the TPM may be triggered by the application running in the operating system of the non-secure world. For example, application 1 running in the non-secure world requests application 2 running in the secure world to generate a key under a specific key algorithm. At this time, application 2 running in the secure world will send a command to obtain a random number to the TPM in order to obtain the random number used to generate the key.

[0144] For example, see Figure 6 , Figure 6 Another schematic diagram of the architecture of a network device provided in an embodiment of the present application. Figure 6 As shown, Figure 6 The system architecture shown is Figure 5 A further refinement of the system architecture shown. Figure 6 In the SoC shown, a first application, a third application, and a first controller are running in the non-secure world. Optionally, a third controller is also running in the non-secure world. A second application, a fourth application, and a second controller are running in the secure world. The first application and the third application interact with the first controller, and the first controller also interacts with the third controller. The second application and the fourth application interact with the second controller. The third controller and the second controller are responsible for interacting with the SPI controller to access the TPM.

[0145] Optionally, the third controller is part of the TPM driver component in the non-secure world, and the second controller is part of the TPM driver component in the secure world. That is, the TPM driver component in the non-secure world is responsible for implementing the function of the third controller, and the TPM driver component in the secure world is responsible for implementing the function of the second controller.

[0146] In addition, a monitor is also running on the processor in the SoC, and the processor uses the monitor to switch between the two states of the non-secure world and the secure world. Specifically, the specific way in which the processor switches between the two states of the non-secure world and the secure world can refer to the existing related technologies, which will not be repeated here.

[0147] It should be noted that Figure 6 In the illustrated embodiment, the first application and the third application are run in the non-secure world, and the second application and the fourth application are run in the secure world. In actual applications, the non-secure world may run one or more applications, and the secure world may also run one or more applications. This embodiment does not specifically limit the number of applications run in the secure world and the non-secure world.

[0148] For example, see Figure 7 , Figure 7 A schematic diagram of a TPM access process provided by an embodiment of the present application. Figure 7 As shown, the process of an application in the non-secure world and an application in the secure world accessing the TPM includes the following steps 701-707.

[0149] Step 701: A first application sends a first access request to a first controller, and a second application sends a second access request to the first controller.

[0150] The first access request and the second access request are both used to request access to the TPM. Moreover, the first access request and the second access request are, for example, sent to the first controller at the same time. The first access request corresponds to, for example, the first request message in the above embodiment.

[0151] Step 702: The first controller determines whether the operating system in the secure world has been started.

[0152] Generally speaking, whether the SoC in the network device starts the operating system in the secure world is optional. The user can determine whether the SoC starts the operating system in the secure world when it is powered on by modifying the configuration parameters on the network device. For example, the configuration parameters of the network device include the operating system enable flag of the secure world. When the value of the operating system enable flag of the secure world is 0, it means that the SoC does not start the operating system in the secure world when it is powered on; when the value of the operating system enable flag of the secure world is 1, it means that the SoC starts the operating system in the secure world when it is powered on. Therefore, the first controller can determine whether the operating system in the secure world has been started by reading the value of the operating system enable flag of the secure world.

[0153] Step 703: When the operating system in the secure world is not started, the first controller forwards the first access request and the second access request to the third controller.

[0154] In this embodiment, the third controller is used to control the mutually exclusive access of the application program running in the operating system of the non-secure world to the TPM, so as to ensure that only one application program in the operating system of the non-secure world accesses the TPM at the same time.

[0155] In some other possible embodiments, when the third controller is not provided in the SoC, the first controller is used to control the mutually exclusive access of the application program in the operating system running in the non-secure world to the TPM.

[0156] Step 704: The third controller sequentially forwards the first access request and the second access request to the TPM through the SPI controller to ensure that the TPM processes only one access request at a time.

[0157] In this embodiment, the third controller is used to control the mutually exclusive access of the application program running in the non-secure world to the TPM.

[0158] Optionally, the third controller is provided with a software mutex, for example, and the third controller applies for a software mutex for each access request received, and when any access request successfully applies for the software mutex, the third controller forwards the access request that successfully applies for the software mutex to the TPM through the SPI controller. For access requests that do not successfully apply for the software mutex, the third controller caches these access requests and waits for the software mutex to be released until the software mutex is applied for each access request.

[0159] That is, the third controller forwards the first access request and the second access request in the order in which the software mutex is applied, so as to ensure that the TPM does not receive another access request during the process of processing one of the access requests. The order in which the third controller forwards the first access request and the second access request is determined based on the order in which the first access request and the second access request apply for the software mutex, and this embodiment does not specifically limit the forwarding order of the first access request and the second access request.

[0160] It should be noted that, in addition to performing access control processing on the first access request from the first application and the second access request from the second application, the third controller can also perform access control processing on access requests sent by other applications in the operating system of the non-secure world. That is, access requests sent by all applications in the operating system of the non-secure world will be processed by the access control of the third controller, thereby ensuring that multiple applications can achieve mutually exclusive access to the TPM.

[0161] Step 705 : When the operating system in the secure world has been started, the first controller sends a first assistance request to the second application in the secure world, and sends a second assistance request to the fourth application in the secure world.

[0162] The first assistance request is used to request the second application to assist the first application to access the TPM. The second assistance request is used to request the fourth application to assist the third application to access the TPM. The first assistance request corresponds to the second request message in the above embodiment, for example.

[0163] Optionally, a mapping relationship is pre-established between an application running in the secure world and an application running in the non-secure world, and the first controller can send an assistance request to the corresponding application in the secure world based on the mapping relationship between different applications in the secure world and the non-secure world.

[0164] For example, in this embodiment, a mapping relationship is established between the first application in the non-secure world and the second application in the secure world, and a mapping relationship is established between the third application in the non-secure world and the fourth application in the secure world. In this way, upon receiving a first access request from the first application, the first controller sends a first assistance request to the second application that has a mapping relationship with the first application, requesting the second application to assist the first application in accessing the TPM. Upon receiving a second access request from the third application, the first controller sends a second assistance request to the fourth application that has a mapping relationship with the third application, requesting the fourth application to assist the third application in accessing the TPM.

[0165] It should be noted that this embodiment is introduced by taking the mapping relationship between the first application and the second application, and the mapping relationship between the third application and the fourth application as examples. In actual applications, different applications in the non-secure world can establish a mapping relationship with the same application in the secure world, for example, the first application and the third application both establish a mapping relationship with the second application, and this embodiment does not specifically limit this.

[0166] Step 706: The second application sends a third access request to the second controller based on the first assistance request, and the fourth application sends a fourth access request to the second controller based on the second assistance request.

[0167] After receiving the first assistance request, the second application generates a third access request for requesting access to the TPM based on the content of the first assistance request, and sends the third access request to the second controller, thereby assisting the first application in accessing the TPM. Similarly, after receiving the second assistance request, the fourth application generates a fourth access request for requesting access to the TPM based on the content of the second assistance request, and sends the fourth access request to the second controller, thereby assisting the third application in accessing the TPM.

[0168] The third access request corresponds to the access request message in the above embodiment, for example.

[0169] Step 707: The second controller sends the third access request and the fourth access request to the TPM in order through the SPI controller to ensure that the TPM processes only one access request at a time.

[0170] In this embodiment, the second controller is used to control the mutually exclusive access of the application program running in the secure world to the TPM. The manner in which the second controller controls the mutually exclusive access of the application program in the secure world to the TPM is similar to the manner in which the third controller controls the mutually exclusive access of the application program in the non-secure world to the TPM. For details, please refer to the above step 704, which will not be described in detail here.

[0171] For example, see Figure 8 , Figure 8 The data flow of accessing the TPM when the operating system of a secure world is started is provided in an embodiment of the present application. Figure 8 As shown in the figure, when the operating system of the secure world is started, the data flow accessing the TPM first flows from the first application and the third application in the non-secure world to the first controller, then flows from the first controller to the second application and the fourth application in the secure world, and then continues to flow from the second application and the fourth application to the second controller in the secure world, and finally flows to the TPM through the SPI controller. In other words, the data flow of the application in the non-secure world accessing the TPM is all directed by the first controller to the application in the secure world, and is centrally controlled by the second controller for mutual exclusive access.

[0172] See also Fig. 9 , Fig. 9 The data flow of accessing the TPM when the operating system of a secure world is not started is provided in an embodiment of the present application. Fig. 9 As shown, when the operating system of the secure world is not started, the data flow accessing the TPM first flows from the first application and the third application in the non-secure world to the first controller, then flows from the first controller to the third controller in the non-secure world, and finally flows to the TPM through the SPI controller. In other words, when the operating system of the secure world is not started, the data flow of the application in the non-secure world accessing the TPM no longer needs to be directed by the first controller to the application in the secure world, but is centralized by the third controller in the non-secure world for mutual exclusive access control.

[0173] The above embodiments introduce the process of performing exclusive access control on exclusive devices for applications in two operating systems. The following will introduce the process of performing exclusive access control on exclusive devices for applications in different hardware systems.

[0174] See also Fig.10 , Fig.10 A schematic diagram of the application architecture of a method for accessing an exclusive device provided in an embodiment of the present application. Fig.10As shown, the application architecture includes a control module, a first processing system, a second processing system and an exclusive device. The control module includes a first access port and a second access port. The first processing system accesses the control module through the first access port, and the second processing system accesses the control module through the second access port. In addition, the first processing system and the second processing system have independent hardware processor resources, that is, the first processing system and the second processing system can run independently and independently initiate access to the exclusive device. In addition, the control module is also connected to the exclusive device.

[0175] exist Fig.10 In the application architecture shown, the control module is responsible for obtaining access request messages from different processing systems and performing concurrent control processing on the access request messages, so as to realize control of mutually exclusive access of multiple processing systems to exclusive devices.

[0176] by Fig.10 Taking the application architecture shown as an example, the process of the control module executing the exclusive device access method provided in this embodiment is as follows.

[0177] First, the control module obtains a first access request message through a first access port and obtains a second access request message through a second access port.

[0178] The first access request message comes from a first processing system connected to a first access port, the second access request message comes from a second processing system connected to a second access port, and both the first access request message and the second access request message are used to request access to an exclusive device.

[0179] Optionally, the control module obtains the first access request message and the second access request message simultaneously, or obtains the first access request message and the second access request message at different times. This embodiment does not limit the order in which the control module obtains the first access request message and the second access request message.

[0180] Then, the control module sequentially forwards the first access request message and the second access request message to the exclusive device, so that the exclusive device processes only one access request message at a time.

[0181] In this embodiment, the control module is responsible for concurrent control of access request messages requesting access to the exclusive device, ensuring that the access request message is forwarded to the exclusive device only when the exclusive device is idle (ie, the exclusive device has no access request message being processed).

[0182] For example, when the control module obtains the first access request message and the second access request message at the same time, the control module first forwards the first access request message to the exclusive device and caches the second access request message, and after the exclusive device processes the first access request message, the control module forwards the second access request message to the exclusive device, so that the exclusive device only processes one access request message at the same time.

[0183] For another example, when the control module first obtains the first access request message, the control module first forwards the first access request message to the exclusive device. And, while the exclusive device is processing the first access request message, the control module obtains the second access request message. At this time, the control module caches the obtained second access request message until the exclusive device completes processing the first access request message, and then forwards the second access request message to the exclusive device.

[0184] In addition, if the control module obtains other access request messages from the first processing system during the process of the exclusive device processing the first access request message, the control module also caches the other access request messages from the first processing system and triggers forwarding only when the exclusive device has no access request messages being processed.

[0185] It should be noted that the above describes that the control module is connected to the first processing system and the second processing system. In practical applications, the control module can be connected to two or more processing systems through different access ports, and concurrent control processing is performed on access request messages sent by these processing systems, thereby realizing mutually exclusive access control of multiple processing systems to exclusive devices. This embodiment does not specifically limit the number of processing systems connected to the control module.

[0186] Optionally, the first processing system includes a first processor, and the second processing system includes a second processor. That is, the first processing system and the second processing system are composed of different processors. Fig.11 , Fig.11 A schematic diagram of the structure of a processing system provided in an embodiment of the present application. The structures of the first processing system and the second processing system are, for example, Fig.11 The structure of the processing system is shown in FIG. Fig.11 As shown, the processing system is actually composed of a processor, which includes a physical core, an internal memory (such as an internal static random access memory (SRAM)) and a communication interface, and the physical core, the internal memory and the communication interface are connected to each other through a bus. Based on the physical core and the internal memory, the processing system can independently run the application program and communicate with the control module through the communication interface.

[0187] That is to say, since each processing system can independently run the application and actively initiate access to the exclusive device, it is actually impossible to control the concurrent access of each processing system to the exclusive device through the software module. Therefore, in this embodiment, a hardware module including multiple access ports (i.e., the above-mentioned control module) is used to control the concurrent access of multiple independent processing systems to the exclusive device, ensuring that the access request messages sent by multiple independent processing systems will all pass through a unified control module, ensuring that the control module can implement mutually exclusive access control of multiple processing systems to the exclusive device.

[0188] Optionally, the first processor and the second processor are deployed on the same SoC. That is, the first processing system and the second processing system are deployed on the same SoC at the same time, and different processing systems on the SoC are composed of different processors. In addition, the first processing system and the second processing system respectively access the first access port and the second access port through different interfaces on the same SoC, thereby sending access request messages to the control module through the first access port and the second access port.

[0189] Wherein, when the first processing system and the second processing system are deployed in the same SoC, there are multiple deployment modes of the control module.

[0190] In a possible implementation, the control module is deployed on the SoC where the first processing system and the second processing system are located.

[0191] For example, see Fig.12 , Fig.12 A schematic diagram of a control module deployed on a SoC according to an embodiment of the present application. Fig.12 As shown, a first processing system, a second processing system and a control module are deployed on the SoC, and the first processing system accesses the first access port on the control module, and the second processing system accesses the second access port on the control module. In addition, the control module is also connected to an exclusive device outside the SoC. By setting a control module on the same SoC to perform concurrent access control on multiple processing systems on the SoC, it can be ensured that the processing system in the SoC can access the exclusive device normally without the situation where multiple processing systems concurrently access the exclusive device and cause the exclusive device to operate abnormally.

[0192] In another possible implementation, the control module is deployed on a processing device, the processing device is connected to the first processor via a first access port, and the processing device is connected to the second processor via a second access port. Furthermore, the processing device deployed by the control module is located outside the SoC where the first processing system and the second processing system are located. In other words, the control module is no longer integrated into the SoC, but is connected to the SoC in the form of a separate processing device, and concurrent access control of multiple processing systems in the SoC is implemented. In this way, in actual applications, there is no need to adjust the structure of the SoC, but to design and manufacture a separate processing device connected between the SoC and the exclusive device, to ensure that the originally designed SoC can also access the exclusive device normally.

[0193] Optionally, the processing device deployed by the control module is, for example, a processor, an application specific integrated circuit (ASIC) chip or a programmable logic device (PLD). Among them, the programmable logic device includes, for example, any one or more of the following devices: a complex programmable logic device (CPLD), a field-programmable gate array (FPGA) and a generic array logic (GAL).

[0194] For example, see Fig.13 , Fig.13 A schematic diagram of a structure in which a control module is deployed outside a SoC according to an embodiment of the present application. Fig.13 As shown, a first processing system and a second processing system are deployed on the SoC. The control module is arranged outside the SoC. The first processing system accesses the first access port on the control module, and the second processing system accesses the second access port on the control module. In addition, the control module is also connected to an exclusive device outside the SoC. In other words, the SoC is connected to the exclusive device through the control module, and both the first processing system and the second processing system on the SoC need to access the exclusive device through the control module.

[0195] In another possible implementation, the control module is deployed on the exclusive device, that is, on the basis of the hardware module for realizing the original function of the exclusive device, the control module is additionally integrated, so that the exclusive device is additionally deployed with a control module for realizing concurrent access control.

[0196] For ease of understanding, the implementation method and workflow of the control module will be described in detail below with reference to specific examples.

[0197] See also Fig.14 , Fig.14 A schematic diagram of a control module for implementing TPM concurrent access control provided in an embodiment of the present application. Fig.14 The following description takes the deployment of a control module and multiple processing systems on the same SoC as an example. In actual applications, the control module can also be deployed outside the SoC, which will not be described in detail here.

[0198] like Fig.14 As shown, the SoC includes a first processing system, a second processing system, a third processing system and a control module, and the control module is also connected to the TPM outside the SoC. The first processing system accesses the first access port on the control module, the second processing system accesses the second access port on the control module, and the third processing system accesses the third access port on the control module. In other words, multiple processing systems in the SoC are connected one by one to multiple access ports on the control module, and different processing systems are connected to different access ports on the control module.

[0199] In addition, the control module includes an arbitrator, which includes a scheduling unit, a cache unit, and a transceiver unit. When the TPM needs to be accessed, any one of the first processing system, the second processing system, and the third processing system sends an access request message to the control module through the connected access port. In this way, the arbitrator in the control module can determine which processing system the access request message comes from according to which access port the access request message is received from.

[0200] The transceiver unit in the control module is used to forward the access request message to the TPM and receive the response data returned by the TPM.

[0201] The cache unit in the control module has a message queue and a response data queue. The command queue is used to store the access request message sent by each processing system; the response data queue is used to store the response data returned after the TPM processes the access request message.

[0202] The scheduling unit in the control module is responsible for scheduling and issuing access request messages. Specifically, the scheduling unit applies for a hardware mutex for the access request messages in the message queue through the hardware mutex mechanism; if a certain access request message successfully applies for a hardware mutex, the access request message is taken out of the message queue and forwarded to the TPM; if the access request message fails to apply for a hardware mutex, the scheduling unit waits for the hardware mutex to be released until the hardware mutex is successfully applied.

[0203] Exemplarily, please refer to Table 1, which is used to represent the access port number, message queue number, and response data queue number set by the control module for each processing system.

[0204] Table 1

[0205] Processing system number Access port number Message queue number Response data queue number First processing system 1 1 1 1 Second processing system 2 2 2 2 The third processing system 3 3 3 3

[0206] Specifically, the process of multiple processing systems on the SoC accessing the TPM includes, for example, the following multiple steps.

[0207] Step 1: The first processing system, the second processing system, and the third processing system respectively send access request messages to the control module to request access to the TPM.

[0208] Step 2: For each access request message received, the arbitrator in the control module determines which processing system sent the access request message based on which access port the access request message was received from, and puts the access request message into the message queue with the corresponding number. For example, the access request message sent by the first processing system is sent to the arbitrator through access port 1 in the control module. After the arbitrator receives the access request message from access port 1, it puts the access request message into message queue 1. Similarly, the access request message sent by the second processing system is put into message queue 2, and the access request message sent by the third processing system is put into message queue 3.

[0209] Step 3, the scheduling unit adopts a polling algorithm to poll the access request messages in message queue 1, message queue 2 and message queue 3 in turn, and schedules and sends the access request messages. The scheduling unit first determines whether there is an access request message in message queue 1. If there is an access request message in message queue 1, an access request message at the head of message queue 1 is selected to apply for a hardware mutex, and after the hardware mutex is successfully applied, the access request message is forwarded to the TPM; if the access request message fails to apply for a hardware mutex, the hardware mutex is released until the hardware mutex is successfully applied. After the access request message in message queue 1 is successfully sent, an access request message is taken from the head of message queue 2 for processing. After processing the access request message taken from message queue 2, an access request message is taken from the head of message queue 3 for processing, and the cycle is repeated.

[0210] Step 4: The transceiver unit sends the access request message selected by the scheduling unit to the TPM via the SPI bus.

[0211] Step 5: TPM parses and processes the access request message and returns response data.

[0212] Step 6: The transceiver unit receives the response data returned by the TPM and stores it in the response data queue with the corresponding number.

[0213] In step 7, each processing system in the SoC reads the response data returned by the TPM from the response data queue with the corresponding number.

[0214] The above describes the exclusive device access method provided in the embodiments of the present application. The following describes an apparatus for executing the exclusive device access method.

[0215] See also Fig.15 , Fig.15 A schematic diagram of a structure of an exclusive device access device provided in an embodiment of the present application. Fig.15 As shown, the access device of the exclusive device is a first controller, and the access device of the exclusive device includes:

[0216] The acquisition unit 1501 is used to acquire a first request message from a first application, where the first request message is used to request access to an exclusive device, where the first controller and the first application both run in a first operating system, and the first operating system runs on a processor other than the exclusive device;

[0217] A sending unit 1502 is configured to send a second request message to a second application program running in the second operating system based on the first request message in response to the second operating system being started, wherein the second request message is used to request the second application program to assist in accessing the exclusive device;

[0218] The second operating system runs on a processor other than the exclusive device, the processors running the first operating system and the second operating system are connected to the exclusive device via a bus, and a second controller runs in the second operating system, which is used to control the exclusive access of applications in the second operating system to the exclusive device.

[0219] In a possible implementation, both the first operating system and the second operating system can run independently.

[0220] In a possible implementation, the first operating system runs in a non-secure world, and the second operating system runs in a secure world.

[0221] In a possible implementation, the first operating system and the second operating system run on the same processor, and the processor is connected to the exclusive device.

[0222] In a possible implementation, the processor includes an NP, a CPU, a GPU, a TPU, or a DPU.

[0223] In a possible implementation, the second controller belongs to a driving component of the exclusive device.

[0224] In a possible implementation manner, the exclusive device is any one of the following devices: a TPM, a TCM, or a storage chip.

[0225] In a possible implementation, the acquiring unit 1501 is further configured to acquire a first response message from the second application, where the first response message includes feedback data returned by the exclusive device after the second application assists in accessing the exclusive device;

[0226] The sending unit 1502 is further configured to forward the first response message to the first application.

[0227] In a possible implementation, the acquiring unit 1501 is further configured to acquire a third request message from the first application, where the third request message is used to request access to the exclusive device;

[0228] The sending unit 1502 is also used for, in response to the second operating system not being started, the first controller forwarding a third request message to a third controller, the third controller running in the first operating system, and the third controller being used for controlling the exclusive access of the application in the first operating system to the exclusive device.

[0229] In a possible implementation, the exclusive device access device further includes: a control unit 1503, configured to control the exclusive access of the application program in the first operating system to the exclusive device when the second operating system is not started.

[0230] See also Fig.16 , Fig.16 A schematic diagram of the structure of another exclusive device access device provided in an embodiment of the present application. Fig.16 As shown, the access device of the exclusive device is applied to the control module, the control module includes a first access port and a second access port, and the control module is connected to the exclusive device. The access device of the exclusive device includes:

[0231] An acquiring unit 1601 is configured to acquire a first access request message through a first access port and acquire a second access request message through a second access port, wherein the first access request message comes from a first processing system connected to the first access port, and the second access request message comes from a second processing system connected to the second access port, and both the first access request message and the second access request message are used to request access to an exclusive device;

[0232] The sending unit 1602 is used to sequentially forward the first access request message and the second access request message to the exclusive device, so that the exclusive device only processes one access request message at a time.

[0233] In a possible implementation, the first processing system includes a first processor, the second processing system includes a second processor, and the first processor and the second processor are deployed on the same SoC.

[0234] In a possible implementation, the control module is deployed on a SoC.

[0235] In a possible implementation, the control module is deployed on a processing device, the processing device is connected to the first processor through a first access port, and the processing device is connected to the second processor through a second access port.

[0236] In a possible implementation, the processing device is a processor, an ASIC chip, or a programmable logic device.

[0237] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0238] A refers to B, which means that A is the same as B or A is a simple variant of B.

[0239] The terms "first" and "second" in the description and claims of the embodiments of the present application are used to distinguish different objects, rather than to describe the specific order of the objects, and cannot be understood as indicating or implying relative importance. For example, the first speed-limited channel and the second speed-limited channel are used to distinguish different speed-limited channels, rather than to describe the specific order of the speed-limited channels, and cannot be understood as the first speed-limited channel being more important than the second speed-limited channel.

[0240] In the embodiments of the present application, unless otherwise specified, “at least one” means one or more, and “plurality” means two or more.

[0241] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in accordance with the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk SolidState Disk (SSD)), etc.

[0242] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for accessing an exclusive device, characterized in that: include: The first controller obtains a first request message from a first application, the first request message being used to request access to an exclusive device, the first controller and the first application both running in a first operating system, and the first operating system running on a processor other than the exclusive device; In response to the second operating system being started, the first controller sends a second request message to a second application running in the second operating system based on the first request message, wherein the second request message is used to request the second application to assist in accessing the exclusive device; The second operating system runs on a processor other than the exclusive device, the processors running the first operating system and the second operating system are connected to the exclusive device via a bus, and a second controller runs in the second operating system, and the second controller is used to control the mutually exclusive access of the application in the second operating system to the exclusive device.

2. The method according to claim 1, characterized in that The first operating system runs in a non-secure world, and the second operating system runs in a secure world.

3. The method according to claim 1 or 2, characterized in that: The first operating system and the second operating system run on the same processor, and the processor is connected to the exclusive device.

4. The method according to claim 3, characterized in that The processor includes a network processor NP, a central processing unit CPU, a graphics processing unit GPU, a tensor processing unit TPU or a data processing unit DPU.

5. The method according to any one of claims 1 to 4, characterized in that: The second controller belongs to a driving component of the exclusive device.

6. The method according to any one of claims 1 to 5, characterized in that: The exclusive device is any one of the following devices: a trusted platform module TPM, a trusted cryptographic module TCM or a storage chip.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: The first controller obtains a first response message from the second application, where the first response message includes feedback data returned by the exclusive device after the second application assists in accessing the exclusive device; The first controller forwards the first response message to the first application.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: The first controller obtains a third request message from the first application, where the third request message is used to request access to an exclusive device; In response to the second operating system not being started, the first controller forwards the third request message to a third controller, where the third controller runs in the first operating system and is used to control exclusive access of an application in the first operating system to the exclusive device.

9. The method according to any one of claims 1 to 7, characterized in that: When the second operating system is not started, the first controller is further used to control the exclusive access of the application program in the first operating system to the exclusive device.

10. A method for accessing an exclusive device, characterized in that: The method is applied to a control module, the control module includes a first access port and a second access port, and the control module is connected to the exclusive device, and the method includes: The control module obtains a first access request message through the first access port and obtains a second access request message through the second access port, the first access request message comes from a first processing system connected to the first access port, the second access request message comes from a second processing system connected to the second access port, and both the first access request message and the second access request message are used to request access to the exclusive device; The control module forwards the first access request message and the second access request message to the exclusive device in order, so that the exclusive device processes only one access request message at a time.

11. The method according to claim 10, characterized in that The first processing system includes a first processor, the second processing system includes a second processor, and the first processor and the second processor are deployed on the same system on chip (SoC).

12. The method according to claim 11, characterized in that The control module is deployed on the SoC.

13. The method according to claim 11, characterized in that The control module is deployed on a processing device, the processing device is connected to the first processor via the first access port, and the processing device is connected to the second processor via the second access port.

14. The method according to claim 13, characterized in that The processing device is a processor, an application specific integrated circuit ASIC chip or a programmable logic device.

15. An access device for an exclusive device, characterized in that: The device is a first controller, and the device comprises: an acquiring unit, configured to acquire a first request message from a first application, wherein the first request message is used to request access to an exclusive device, wherein the first controller and the first application are both running in a first operating system, and the first operating system is running on a processor other than the exclusive device; a sending unit, configured to send, in response to the second operating system being started, a second request message to a second application running in the second operating system based on the first request message, wherein the second request message is used to request the second application to assist in accessing the exclusive device; The second operating system runs on a processor other than the exclusive device, the processors running the first operating system and the second operating system are connected to the exclusive device via a bus, and a second controller runs in the second operating system, and the second controller is used to control the mutually exclusive access of the application in the second operating system to the exclusive device.

16. The device according to claim 15, characterized in that The first operating system runs in a non-secure world, and the second operating system runs in a secure world.

17. The device according to claim 15 or 16, characterized in that The first operating system and the second operating system run on the same processor, and the processor is connected to the exclusive device.

18. The device according to claim 17, characterized in that The processor includes NP, CPU, GPU, TPU or DPU.

19. The device according to any one of claims 15 to 18, characterized in that: The acquisition unit is further used to acquire a first response message from the second application, wherein the first response message includes feedback data returned by the exclusive device after the second application assists in accessing the exclusive device; The sending unit is further used to forward the first response message to the first application.

20. The device according to any one of claims 15 to 19, characterized in that: The acquisition unit is further used to acquire a third request message from the first application, where the third request message is used to request access to an exclusive device; The sending unit is also used for, in response to the second operating system not being started, the first controller forwarding the third request message to a third controller, the third controller running in the first operating system, and the third controller being used for controlling the mutually exclusive access of the application in the first operating system to the exclusive device.

21. An access device for an exclusive device, characterized in that: The device is applied to a control module, the control module includes a first access port and a second access port, and the control module is connected to the exclusive device, and the device includes: an acquiring unit, configured to acquire a first access request message through the first access port and to acquire a second access request message through the second access port, wherein the first access request message comes from a first processing system connected to the first access port, and the second access request message comes from a second processing system connected to the second access port, and both the first access request message and the second access request message are used to request access to the exclusive device; The sending unit is used to forward the first access request message and the second access request message to the exclusive device in an orderly manner, so that the exclusive device only processes one access request message at a time.

22. The device according to claim 21, characterized in that The first processing system includes a first processor, the second processing system includes a second processor, and the first processor and the second processor are deployed on the same SoC.

23. The device according to claim 22, characterized in that The control module is deployed on the SoC.

24. A network device, comprising a processor and a memory, wherein the memory is used to store program codes, and the processor is used to call the program codes in the memory so that the network device executes the method according to any one of claims 1 to 14.

Images