Extended domain access controller, control method of domain access controller and chip system

Abstract

The invention discloses an extended domain access controller, a control method of the domain access controller and a chip system, and belongs to the technical field of computers. In the extended domain access controller, a host domain access control module is configured to modify an access permission of a bus transaction according to first configuration information to obtain the bus transaction after permission modification; the bus transaction after permission modification is sent to a slave domain access control module through a bus; the slave domain access control module is configured to perform permission check on the bus transaction after permission modification according to second configuration information if the bus transaction after permission modification does not carry the first privilege identifier; and if the checking result of the permission checking is that the checking is passed, sending the bus transaction after the permission modification to the slave equipment. Through the host domain access control module, the application can dynamically adapt to the access requirement of the master device, and through the slave domain access control module, the unauthorized access is strictly filtered, so that the risk caused by the unauthorized operation can be effectively avoided.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an extended domain access controller, a control method for the domain access controller, and a chip system. Background Technology

[0002] Secure and controllable access behavior is crucial for chip systems. Therefore, ensuring that authorized entities can access specific resources within the authorized scope can effectively prevent malicious behaviors such as unauthorized access and unauthorized operations, and guarantee the security and controllability of resource access in chip systems.

[0003] In related technologies, chip access control is usually a rough scheme based on security domains and non-security domains. Access subjects and access objects are binary classified and access controlled according to security domains and non-security domains. In some schemes, the access rules are also embedded in the hardware logic.

[0004] However, as chip integration continues to improve, while supporting more complex internal interactions and more external interfaces, the complexity of access behavior in chip systems also increases exponentially. Access control schemes based on security domains and non-security domains suffer from problems such as a single dimension of division and homogeneous access rules, posing a greater challenge to the security and controllability of access behavior. Summary of the Invention

[0005] This application provides an extended domain access controller, a control method for the domain access controller, and a chip system, which can effectively ensure the security and controllability of resource access in the chip system under scenarios with complex access behaviors. Specifically, it includes the following technical solutions.

[0006] In a first aspect, this application provides an extended domain access controller, comprising a host domain access control module and a slave domain access control module connected via a bus. The host domain access control module is connected to a master device, and the slave domain access control module is connected to a slave device. The host domain access control module is configured to receive a bus transaction initiated by the master device; modify the access permissions of the bus transaction according to first configuration information to obtain a bus transaction with modified permissions, the access permissions of the modified bus transaction being adapted to the access requirements of the master device; and send the bus transaction with modified permissions to the slave domain access control module via the bus, wherein the first configuration information indicates the modification rules of the bus transaction. The slave domain access control module is configured to perform a permission check on the bus transaction with modified permissions according to second configuration information if the bus transaction with modified permissions does not carry a first privilege identifier; and if the permission check result is a pass, send the bus transaction with modified permissions to the slave device, wherein the first privilege identifier indicates whether the permission check is allowed to be skipped, and the second configuration information indicates the check rules of the permission check.

[0007] In some possible implementations, the slave domain access control module is further configured to intercept the bus transaction with modified permissions if the permission check fails, generate and send a first feedback signal to the master device, the first feedback signal being used to indicate to the master device that the bus transaction with modified permissions failed the permission check.

[0008] In some possible implementations, the first configuration information includes a first matching item indicating whether the bus transaction meets the modification conditions of the first configuration information, and the first configuration information also includes a first attribute item for modifying the access permissions of the bus transaction. The host domain access control module is configured to: determine whether the bus transaction meets the modification conditions based on the first matching item; if the bus transaction meets the modification conditions of the first configuration information, modify the access permissions of the bus transaction based on the first attribute item.

[0009] In some possible implementations, the host domain access controller is further configured to: modify the access permissions of the bus transaction according to the configuration information of the master device if the bus transaction does not meet the modification conditions of the first configuration information.

[0010] In some possible implementations, there are multiple first configuration information entries, and each of these first configuration information entries is enabled independently. The host domain access control module is configured to: if any of the multiple first configuration information entries is enabled, determine the target first configuration information entry corresponding to the bus transaction among the multiple first configuration information entries; and modify the access permissions of the bus transaction according to the target first configuration information entry.

[0011] In some possible implementations, there are multiple second configuration information and each of the multiple second configuration information is enabled independently. The slave domain access control module is configured to: if any of the multiple second configuration information is enabled and the bus transaction with modified permissions does not carry the first privilege identifier, determine the target second configuration information corresponding to the bus transaction with modified permissions among the multiple second configuration information; and perform the permission check on the bus transaction with modified permissions according to the target second configuration information.

[0012] In some possible implementations, the slave domain access control module is further configured to: if the target second configuration information is not present among the plurality of second configuration information, the permission check result is a failure; or, if the target second configuration information is not present among the plurality of second configuration information, forward the bus transaction with modified permissions to the slave device, generate and send a second feedback signal to the master device, the second feedback signal being used to prompt the master device that the target second configuration information is not present among the plurality of second configuration information.

[0013] In some possible implementations, the host domain access control module is further configured to, upon receiving a first modification request to modify the first configuration information, reject the first modification request if the first configuration information is in a locked state and the first modification request does not carry a second privilege identifier; and / or, the slave domain access control module is further configured to, upon receiving a second modification request to modify the second configuration information, reject the second modification request if the second configuration information is in a locked state and the second modification request does not carry a second privilege identifier; wherein the second privilege identifier indicates a privilege identifier that allows modification of the first configuration information or the second configuration information in a locked state.

[0014] In some possible implementations, there are multiple first configuration information sets, and the locking states of the multiple first configuration information sets are independent of each other; there are multiple second configuration information sets, and the locking states of the multiple second configuration information sets are independent of each other.

[0015] Secondly, this application provides a chip system including a bus subsystem, the bus subsystem including an extended domain access controller as described in the first aspect of this application.

[0016] Thirdly, this application provides a control method for an extended domain access controller. The extended domain access controller includes a host domain access control module and a slave domain access control module connected via a bus. The host domain access control module is connected to a master device, and the slave domain access control module is connected to a slave device. The method includes: receiving a bus transaction initiated by the master device through the host domain access control module; modifying the access permissions of the bus transaction according to first configuration information to obtain a bus transaction with modified permissions, wherein the access permissions of the bus transaction with modified permissions are adapted to the access requirements of the master device; sending the bus transaction with modified permissions to the slave domain access control module through the bus; if the bus transaction with modified permissions does not carry a first privilege identifier, performing a permission check on the bus transaction with modified permissions according to second configuration information through the slave domain access control module; if the permission check result is a pass, sending the bus transaction with modified permissions to the slave device; wherein the first configuration information indicates the modification rules of the bus transaction, the first privilege identifier indicates whether the permission check is allowed to be skipped, and the second configuration information indicates the check rules of the permission check.

[0017] In some possible implementations, the method further includes: if the permission check result is a failure, intercepting the bus transaction with modified permissions, generating and sending a first feedback signal to the master device, the first feedback signal being used to indicate to the master device that the bus transaction with modified permissions failed the permission check.

[0018] In some possible implementations, the first configuration information includes a first matching item indicating whether the bus transaction meets the modification conditions of the first configuration information. The first configuration information also includes a first attribute item for modifying the bus transaction. Modifying the bus transaction according to the first configuration information includes: determining whether the bus transaction meets the modification conditions according to the first matching item; if the bus transaction meets the modification conditions of the first configuration information, modifying the bus transaction according to the first attribute item.

[0019] In some possible implementations, the method further includes: if the bus transaction does not meet the modification conditions of the first configuration information, the host domain access control module modifies the bus transaction according to the configuration information of the master device.

[0020] In some possible implementations, there are multiple first configuration information entries, and each of these first configuration information entries is enabled independently. Modifying the bus transaction based on the first configuration information includes: if any of the multiple first configuration information entries is enabled, determining the target first configuration information corresponding to the bus transaction among the multiple first configuration information entries; and modifying the access permissions of the bus transaction based on the target first configuration information.

[0021] In some possible implementations, there are multiple second configuration information entries, and these multiple second configuration information entries are enabled independently. If the bus transaction with modified permissions does not carry the first privilege identifier, the step of performing permission checks on the bus transaction with modified permissions through the slave domain access control module based on the second configuration information includes: if any of the multiple second configuration information entries is enabled and the bus transaction with modified permissions does not carry the first privilege identifier, determining the target second configuration information corresponding to the bus transaction with modified permissions among the multiple second configuration information entries; and performing the permission check on the bus transaction with modified permissions based on the target second configuration information.

[0022] In some possible implementations, the method further includes: if the target second configuration information is not present among the plurality of second configuration information, the result of the permission check is that the check fails; or, if the target second configuration information is not present among the plurality of second configuration information, the bus transaction with modified permissions is forwarded to the slave device, a second feedback signal is generated and sent to the master device, the second feedback signal being used to prompt the master device that the target second configuration information is not present among the plurality of second configuration information.

[0023] In some possible implementations, the method further includes: after receiving a first modification request to modify the first configuration information, the host domain access control module rejects the first modification request if the first configuration information is in a locked state and the first modification request does not carry a second privilege identifier; and / or, after receiving a second modification request to modify the second configuration information, the slave domain access control module rejects the second modification request if the second configuration information is in a locked state and the second modification request does not carry a second privilege identifier; wherein the second privilege identifier indicates a privilege identifier that allows modification of the first configuration information or the second configuration information in a locked state.

[0024] In some possible implementations, there are multiple first configuration information sets, and the locking states of the multiple first configuration information sets are independent of each other; there are multiple second configuration information sets, and the locking states of the multiple second configuration information sets are independent of each other.

[0025] Fourthly, this application provides an electronic device that includes a chip system as described in the second aspect of this application.

[0026] In some possible implementations, the electronic device is an electronic rearview mirror, which includes an electronic rearview mirror for a vehicle.

[0027] Fifthly, this application provides a computer-readable storage medium having stored thereon program instructions for controlling a domain access controller, which, when executed by one or more processors, cause the processors to implement the method described in any one of the third aspects of this application.

[0028] Sixthly, this application provides a computer program product comprising a computer program that is executed by a processor to enable the computer to perform the method described in any of the third aspects.

[0029] The beneficial effects of the technical solution provided in this application include at least the following: This application provides an extended domain access controller, including a host domain access control module and a slave domain access control module. By setting corresponding domain access control modules on the master and slave devices respectively, for example, the host domain access control module on the master device can modify the access permissions of bus transactions initiated by the master device based on the configured first configuration information, so that the access permissions of the bus transactions after permission modification can flexibly adapt to the access needs of the master device in different scenarios; and the slave domain access control module on the slave device can perform permission checks on the bus transactions after permission modification based on the configured second configuration information to ensure the security and compliance of access behavior in the system. At the same time, the second configuration information configured in the slave domain access control module allows the access resources on the slave device to be configured with different permission check rules for different access subjects, which greatly improves the granularity and flexibility of permission checks. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 This is a schematic diagram of the structure of the extended domain access controller provided in an embodiment of this application; Figure 2 This is a schematic diagram of an MstDAC structure provided in an embodiment of this application; Figure 3This is a schematic diagram of a process for modifying bus transactions in an MstDAC, provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of an SlvDAC provided in an embodiment of this application; Figure 5 This is a schematic diagram of a process provided in this application embodiment of SlvDAC to perform permission checks on bus transactions after permission modification; Figure 6 This is a schematic diagram of another SlvDAC process for performing permission checks on bus transactions with modified permissions, provided in an embodiment of this application. Figure 7 This is a schematic diagram of the AHB bus architecture based on the extended domain access controller provided in the embodiments of this application; Figure 8 This is a schematic diagram of the control method for the domain access controller provided in the embodiments of this application. Detailed Implementation

[0032] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0033] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0034] In chip systems, domain access control refers to the strict management of resource access between different domains within a chip through hardware or a combination of hardware and software mechanisms. This ensures that each domain can only access authorized resources, preventing unauthorized access or malicious attacks. It is a core mechanism for ensuring the security and reliability of access behavior in chip systems. For example, in the case of secure and insecure domains based on security attributes, access subjects in the secure domain are typically allowed to access resources in both the secure and insecure domains, while access subjects in the insecure domain are allowed to access resources in the insecure domain.

[0035] However, highly integrated chip systems incorporate more dedicated functional modules, each with unique access requirements. In this context, the types of domains requiring individual access control become more diverse, the number of domains increases significantly, and the interactions between domains become more complex, leading to a substantial increase in the complexity of domain access control. For example, in automotive chips, for accessing modules such as entertainment, navigation, and Bluetooth communication modules, which belong to the same non-security domain, there might be situations where the entertainment module needs to access the audio or video buffer, the navigation module needs to access the GPS data area, and the Bluetooth module needs to access the communication data area. Access control schemes based on a binary division of security and non-security domains cannot restrict a module to access only its own dedicated resources, easily leading to unauthorized access and resulting in poor granularity of access control. This makes them unsuitable for the independent access control needs of different functional modules in highly integrated chips.

[0036] Based on this, this application provides an extended domain access controller, which can separately manage bus transactions initiated by access requests from master devices through a host domain access control module, and separately manage bus transactions with modified permissions for entering slave devices through a slave domain access control module. This enables fine-grained, secure, and flexible management of access behaviors between different master and slave devices in highly integrated chip systems, ensuring the security, stability, and reliability of access resources in the chip system.

[0037] In this context, the master device refers to the hardware module in the chip system that can actively initiate access requests; it is also called the host or access subject. The slave device refers to the hardware module in the chip system that passively receives and responds to access requests; it is also called the slave, access resource, or access object. Access behavior refers to various operational interactions initiated by the master device to access the slave device through bus transactions, such as the master device accessing the slave device's address, reading a specific memory unit, writing to a peripheral register, data transfer, and executing control instructions.

[0038] Figure 1 This is a schematic diagram of the extended domain access controller provided in an embodiment of this application. See also... Figure 1The extended domain access controller (XDAC) provided in this application includes a master domain access controller (MstDAC) and a slave domain access controller (SlvDAC) connected via a bus. The master domain access controller is connected to a master device, and the slave domain access controller is connected to a slave device. For example, multiple MstDACs and SlvDACs may be included, with each MstDAC corresponding to a multiple master device and each SlvDAC corresponding to a multiple slave device, enabling separate management of bus transactions between the multiple master devices and the multiple slave devices.

[0039] MstDAC110 is configured to receive bus transactions initiated by the master device; modify the access permissions of the bus transactions according to the first configuration information to obtain the bus transactions with modified permissions, and the access permissions of the bus transactions with modified permissions are adapted to the access requirements of the master device; and send the bus transactions with modified permissions to the slave domain access control module through the bus, with the first configuration information indicating the modification rules of the bus transactions.

[0040] For example, a bus transaction (trans) is initiated by the master device to indicate the master device's intention to access the slave device. The bus transaction includes, for example, a control signal segment to determine the operation type, direction, and interaction rules of the bus transaction; an address signal segment to indicate the target address of the bus transaction, i.e., the location of the slave device to be accessed by the master device within the chip system; a data signal segment to carry the actual transmission content of the bus transaction; and extended attribute signal segments. The extended attribute signal segments are, for example, reserved custom fields used, but not limited to, selectively adding specific attribute tags, so that other relevant hardware and / or software structures in the chip system can determine the master device's access identity, security level, permission scope, and transmission characteristics, thereby supporting subsequent permission checks. Optionally, the attribute tags include one or more of the following: a security attribute tag indicating whether the master device belongs to a secure domain or a non-secure domain; a DID (device identifier) ​​attribute tag indicating the unique hardware identifier of the master device, such as the device number of a CPU, DMA, or GPU; and a mode attribute tag indicating the privilege level of the master device.

[0041] The first configuration information is used to indicate the modification rules of bus transactions pre-configured in MstDAC110 to adapt to the access requirements of the corresponding master device in different scenarios, indicating under what conditions what modifications should be made to the bus transactions of the master device. For example, under specific conditions, one or more of the following can be added to the extended attribute section of the bus transaction: security attribute, DID (device identifier) ​​attribute, and mode attribute, to change the access permissions of the bus transaction so that the access permissions of the bus transaction adapt to the access requirements of the master device. In some embodiments, the first configuration information is stored in MstDAC110, for example, in the form of a first table entry.

[0042] As described above, the first configuration information is used to indicate the modification rules when modifying a bus transaction, including but not limited to determining whether the bus transaction needs to be modified and how to modify the bus transaction. For example, the first configuration information may include a first matching item indicating whether the bus transaction meets the modification conditions of the first configuration information. The first configuration information may also include a first attribute item for modifying the access permissions of the bus transaction. MstDAC110 is configured to: determine whether the bus transaction meets the modification conditions based on the first matching item; if the bus transaction meets the modification conditions of the first configuration information, modify the access permissions of the bus transaction based on the first attribute item.

[0043] The first matching item includes, for example, a specified first address entry and an rw (read / write) attribute indicating the allowed operation type for the address corresponding to the first address entry. In this case, when the MstDAC110 determines whether a bus transaction meets the modification conditions based on the first matching item, it is configured to: if the address signal segment in the bus transaction matches the first address entry and the operation type in the bus transaction matches the rw attribute, then the bus transaction meets the modification conditions of the first address entry. At this time, if the first configuration information is enabled, the access permissions of the bus transaction are modified according to the first attribute item. For example, one or more of the security attributes, DID attributes, and mode attributes in the bus transaction are added or modified.

[0044] The first attribute item is, for example, a pre-configured set of attribute tags adapted to the access requirements of the master device corresponding to the MstDAC110, and bound to the first matching item. This set may include one or more of the following: security attributes, DID attributes, and mode attributes. Matching the address signal segment in the bus transaction with the first address item indicates that the address corresponding to the target address signal segment is the same as the address corresponding to the first address item. The first configuration information is enabled, also known as first configuration information enablement. If the first configuration information is not enabled or disabled, the modification process is skipped, allowing the first configuration information to inherit one or more of the master device's security attributes, DID attributes, and mode attributes.

[0045] In other words, when the first configuration information in MstDAC110 is enabled, MstDAC110 can determine whether to add attribute tags such as security attributes, DID attributes, and mode attributes to the bus transaction based on the first matching item, thereby modifying the permissions of the bus transaction. This allows the bus transaction initiated by the master device to have different permissions in different scenarios, which helps to improve the flexibility of the master device's permissions in different scenarios.

[0046] In some embodiments, the MstDAC110 is further configured to: modify the access permissions of the bus transaction according to the configuration information of the master device if the bus transaction does not meet the modification conditions of the first configuration information. For example, if the bus transaction does not match the first matching item, that is, the bus transaction does not hit the first table entry, the access permissions of the bus transaction are modified according to the configuration information of the master device.

[0047] In highly integrated chip systems, due to the complexity of inter-domain interactions, the master device may require different permissions when accessing different slave devices, in order to pass the permission checks of each slave device. Therefore, in some embodiments, multiple optional first configuration information are pre-configured in the MstDAC110, allowing the MstDAC110 to adaptively modify bus transactions according to the access requirements of the master device. For example, it may add or modify one or more of security attributes, DID attributes, and mode attributes within the bus transaction.

[0048] For example, if there are multiple first configuration information entries and each of the multiple first configuration information entries is independently enabled, MstDAC110 is configured to: if any one of the multiple first configuration information entries is enabled, determine the target first configuration information entry corresponding to the bus transaction among the multiple first configuration information entries; and modify the bus transaction according to the target first configuration information entry. The independent enabling of multiple first configuration information entries is also referred to as the independent enabling of multiple first configuration information entries. For example, all of the multiple first configuration information entries may be enabled, or any one, two, or four of the multiple first configuration information entries may be enabled, while the remaining entries are disabled. This application does not impose any restrictions in this regard.

[0049] When there are multiple first configuration information entries and each of them is independently enabled, the bus transaction determines whether to modify the bus transaction based on the enable signals of the multiple first configuration information entries before entering the modification process. For example, if all the enable signals are first signals indicating that the transaction is disabled, the bus transaction is not modified and can directly enter the bus for transmission. If the enable signal corresponding to any entry in the multiple first configuration information entries is a second signal indicating that the transaction is enabled, that is, if there is at least one second signal among the multiple enable signals, the bus transaction is modified according to the target first configuration information to improve the modification efficiency of the bus transaction.

[0050] When there are multiple first configuration information entries, and these multiple first configuration information entries are enabled independently, the modification conditions corresponding to these multiple first configuration information entries can be different, for example. In this case, any entry in the multiple first configuration information entries includes a first matching item and a first attribute item; that is, there are multiple first matching items and first attribute items, and there is a one-to-one correspondence between the multiple first matching items, the multiple first attribute items, and the multiple first configuration information entries. The multiple first matching items are used, but are not limited to, to filter target first configuration information, so that after filtering out the target first configuration information, the access permissions of the bus transaction can be modified according to the corresponding first attribute item.

[0051] For example, any one of the multiple first matching items includes a first address item and an rw attribute. The address signal segment and operation type in the bus transaction are compared with the multiple first matching items one by one. If multiple first matching items match, the matched first configuration information is determined as the target first configuration information. The matched address signal segment used to indicate the bus transaction matches the first address item corresponding to any matching item, and the operation type of the bus transaction matches the rw attribute.

[0052] Multiple first configuration information can be enabled independently, also known as independent enabling. For example, when multiple first configuration information includes first configuration information A, first configuration information B, and first configuration information C, MstDAC110 can enable any one of first configuration information A, first configuration information B, and first configuration information C individually, or it can enable multiple of first configuration information A, first configuration information B, and first configuration information C simultaneously.

[0053] In some embodiments, multiple first configuration information can be locked during the operation of MstDAC110, and the locking states of the multiple first configuration information are independent of each other. For example, when the multiple first configuration information includes first configuration information A, first configuration information B, and first configuration information C, any one of first configuration information A, first configuration information B, and first configuration information C can be locked individually, or multiple of first configuration information A, first configuration information B, and first configuration information C can be locked simultaneously, so as to prevent malicious tampering of multiple first configuration information during the operation of MstDAC110 and ensure the security and controllability of accessing resources in the chip system.

[0054] Figure 2 This is a schematic diagram of an MstDAC structure provided in an embodiment of this application.

[0055] Figure 3 This is a schematic diagram of a process for modifying bus transactions in an MstDAC provided in an embodiment of this application.

[0056] The following will combine Figure 2 and Figure 3The following is a further explanation of the content of modifying bus transactions in MstDAC involved in the embodiments of this application.

[0057] like Figure 2 As shown, the MstDAC stores, for example, a configuration table. This table is a collection of multiple first configuration pieces of information. Each first configuration piece includes a first matching item and a first attribute item; that is, the table is a collection of multiple one-to-one bound first matching items and multiple first attribute items. The first matching item includes a first address item and a read / write (rw) attribute. The storage format of the multiple first configuration pieces of information in the table is as follows: the first address item corresponding to any one of the first configuration pieces of information is stored separately for comparison with the address signal segment of the bus transaction; the read / write attribute and the first attribute item corresponding to any one of the first configuration pieces of information are stored together. This results in one-to-one bound address item 0 and attribute item 0, address item 1 and attribute item 1, and so on up to address item n and attribute item n.

[0058] MstDAC determines the target address of the bus transaction based on the address signal segment in the address signal bus (haddr) of the trans input from AHB (advanced high-performance bus), and determines the operation type of the bus transaction, such as a write operation or a read operation, based on the control signal segment in the control signal bus (hwrite) of the trans.

[0059] In some embodiments, MstDAC further includes an interaction interface for interacting with external hardware modules, such as the RAIF-IF interface for connecting to an APB (Advanced Peripheral Bus), so that the external hardware module can modify multiple first configuration information in MstDAC, the operating state of MstDAC, such as whether the multiple first configuration information can be modified; and MstDAC further includes a register module, which includes, for example, a configuration register (cfg), for, but not limited to, enabling the external hardware module to modify the multiple first configuration information or the operating state of MstDAC by modifying the value of the configuration register (cfg).

[0060] It should be noted that, Figure 2 The bus interfaces shown, such as AHB-S and AHB-M, and the interaction interfaces, such as RAIF-IF, are illustrative and not restrictive. For example, the bus interface can also be an AXI bus interface, which can be adjusted according to the needs of the actual application scenario.

[0061] like Figure 3As shown, when a transaction initiated by the master device (Mst) enters the MstDAC through the slave device interface (AHB-S), if at least one of the multiple first configuration information configured in the MstDAC is enabled (i.e., a first configuration information is enabled), the MstDAC compares the target address with each of the multiple first address entries, that is, it compares the target address with address entries 0, 1, ..., n in the table. If a first address entry matches (i.e., the target address matches any of the first address entries 0, 1, ..., n), and the rw attribute of that first address entry matches the operation type of the transaction), the corresponding first configuration information is determined to be the target first configuration information. At this time, if the target first configuration information is disabled, it is bypassed; if the target first configuration information is enabled, the transaction is modified according to the target first configuration information, and then the bus transaction with modified permissions is sent to the downstream device through the master device interface (AHB-M) of the AHB bus, for example, to the SlvDAC 120 via the bus.

[0062] If none of the first configuration information configured in MstDAC is enabled, i.e., all the first configuration information is disabled, then the user signal in trans outputs 0, the addr (address signal segment) signal remains unchanged, and the bus transaction with modified permissions is sent to the downstream device through the master device interface (AHB-M) of the AHB bus.

[0063] When the target's primary configuration information is disabled and a bypass is initiated, if the user signal of the master bus (Mst) contains security, DID, and mode attributes, the trans bus inherits these attributes and adds an offset to its addr signal, thus modifying the bus transaction. The modified bus transaction is then sent to the downstream device via the AHB bus's master interface (AHB-M).

[0064] If the first address entry is not found, and / or the rw attribute of the first address entry does not match the operation type of trans, and if the user signal of Mst itself has attributes such as security attributes, DID attributes, and mode attributes, trans inherits the attributes attached to the user signal, and the addr signal (address signal segment) of trans is incremented by an offset to complete the modification of the bus transaction. Then, the bus transaction with modified permissions is sent to the downstream device through the master device interface (AHB-M) of the AHB bus.

[0065] If the first address entry is not hit, and / or the rw attribute of the first address entry does not match the operation type of trans, and the user signal of Mst itself does not have security attributes, DID attributes, mode attributes, etc., then the user signal in trans outputs 0, the addr (address signal segment) signal remains unchanged, and the bus transaction with modified permissions is sent to the downstream device through the master device interface (AHB-M) of the AHB bus. In the above method, the access permissions of bus transactions can be selectively modified by the first configuration information configured in MstDAC110. This allows the master device to dynamically adapt to the corresponding access requirements when accessing different slave devices without modifying the hardware logic or basic configuration of the master device itself. Under the premise of ensuring the security and reliability of access resources in the chip system, the flexibility of inter-domain access in the chip system is greatly improved.

[0066] SlvDAC 120 is configured to perform a permission check on the bus transaction with modified permissions according to the second configuration information if the bus transaction with modified permissions does not carry the first privilege identifier; if the permission check result is that the check passes, the bus transaction with modified permissions is sent to the slave device. The first privilege identifier indicates whether the permission check is allowed to be skipped, and the second configuration information indicates the check rules for the permission check.

[0067] For example, the first privilege identifier is, for instance, a privilege identifier corresponding to any pre-configured privilege mode that allows skipping permission checks. The privilege mode is used to indicate the level of operation permission possessed by the initiating entity of the bus transaction, such as including high-level permissions and low-level permissions. In this case, the privilege identifier corresponding to high-level permissions can be determined as the first privilege identifier.

[0068] The second configuration information is used to indicate the pre-configured rules in SlvDAC 120 for performing permission checks on bus transactions with modified permissions. Specifically, it determines the conditions under which a bus transaction with modified permissions can pass or fail the permission check, and is used to determine whether a bus transaction initiated by MstDAC 110 has access rights to SlvDAC 120. Access rights indicate whether the initiator of the bus transaction is allowed to perform specific operations on the slave device, such as read, write, or configuration operations. In some embodiments, the second configuration information is stored in SlvDAC 120, for example, in the form of a second table entry.

[0069] In some embodiments, SlvDAC 120 is further configured to send the modified bus transaction to the slave device if the modified bus transaction carries a first privilege identifier, so that the bus transaction carrying the first privilege identifier can bypass the permission check of SlvDAC 120. This ensures that the initiator of high-level privileges, such as the system kernel or security monitoring module, can efficiently access the core resources of the slave device, avoid system performance loss due to frequent permission checks, and at the same time take into account the needs for operational efficiency and system control in high-level privilege scenarios.

[0070] In some embodiments, the second configuration information includes a second matching item indicating whether the bus transaction after permission modification meets the check conditions of the second configuration information. The second configuration information also includes a second attribute item for performing permission checks on the bus transaction after permission modification. SlvDAC 120 is configured to: determine whether the bus transaction after permission modification meets the check conditions of permission check based on the second matching item; if the bus transaction after permission modification meets the check conditions of the second configuration information, perform permission checks on the bus transaction after permission modification based on the second attribute item.

[0071] When the second configuration information includes the second matching item and the second attribute item, the SlvDAC 120 is configured to perform permission checks on the bus transaction after permission modification according to the second configuration information as follows: if the address signal segment in the bus transaction after permission modification matches the second matching item, it is determined that the bus transaction after permission modification meets the check conditions of the second configuration information. At this time, permission checks on the bus transaction after permission modification are continued according to the second attribute item.

[0072] For example, the second matching item includes a second address item. If the target address corresponding to the address signal segment in the bus transaction after permission modification matches the address indicated by the second address item, it means that the address signal segment in the bus transaction after permission modification matches the second matching item, and the bus transaction after permission modification satisfies the check condition of the second configuration information, indicating that the slave device corresponding to SlvDAC120 is the target to be accessed by the bus transaction after permission modification; otherwise, the bus transaction after permission modification does not satisfy the check condition of the second configuration information, indicating that the slave device corresponding to SlvDAC120 is not the target to be accessed by the bus transaction after permission modification. The second attribute item is, for example, a set of attribute tags pre-configured to match the access rules of the slave device corresponding to SlvDAC120 and bound to the second matching item, such as one or more of security attributes, DID attributes, and mode attributes.

[0073] After determining that the bus transaction with modified permissions meets the check conditions of the second configuration information, if the security attributes, DID attributes, and privilege level attributes in the bus transaction with modified permissions are consistent with the security attributes, DID attributes, and privilege level attributes indicated by the second attribute item, then the result of the permission check on the bus transaction with modified permissions is that the check passes. This indicates that the master device corresponding to MstDAC110 has access rights to the slave device corresponding to SlvDAC120. Therefore, the bus transaction with modified permissions can be sent to the slave device corresponding to SlvDAC120.

[0074] In some embodiments, the SlvDAC 120 is further configured to intercept the bus transaction with modified permissions if the permission check fails, generate and send a first feedback signal to the master device, the first feedback signal being used to indicate to the master device that the bus transaction with modified permissions failed the permission check.

[0075] For example, if the address signal segment of the bus transaction after permission modification matches the second address entry in the second matching item, but the security attribute, DID attribute, privilege level attribute in the bus transaction after permission modification is inconsistent with the security attribute, DID attribute, privilege level attribute, etc. indicated by the second attribute item, then the permission check result is that the check fails, indicating that the bus transaction after permission modification does not have access rights to the slave device corresponding to SlvDAC 120. In this case, the bus transaction after permission modification is intercepted, and a first feedback signal is generated and sent to the master device.

[0076] In some implementation instances, SlvDAC 12 is also configured to: if the target second configuration information is not present among the multiple second configuration information, the permission check result is a failure; or, if the target second configuration information is not present among the multiple second configuration information, forward the bus transaction with modified permissions to the slave device, generate and send a second feedback signal to the master device, the second feedback signal being used to prompt the master device that the target second configuration information is not present among the multiple second configuration information.

[0077] For example, if the address signal segment of the bus transaction after permission modification does not match the second address entry in the second matching item, it means that the target second configuration information does not exist among the multiple second configuration information. In this case, the result of the permission check is determined to be that the check fails, the bus transaction after permission modification is intercepted, and a first feedback signal is generated and sent to the master device.

[0078] Alternatively, the bus transaction with modified permissions can still be forwarded to the slave device, but a second feedback signal can be generated and sent to the master device to mark and track the forwarding behavior for subsequent processing.

[0079] In highly integrated chip systems, due to the diversity of master device types and complex access scenarios—such as different master devices having different access requirements for the same slave device, or the same master device having different access requirements for the same slave device in different scenarios—it is desirable for slave devices to switch between multiple different access rules to meet the needs of fine-grained access control. Therefore, the SlvDAC120 is pre-configured with multiple optional second configuration information, enabling the SlvDAC120 to flexibly switch between different access rules through multiple second configuration information, achieving precise control over access behavior in different scenarios.

[0080] For example, there are multiple second configuration information and each of the multiple second configuration information is enabled independently. The slave domain access control module is configured to: if any of the multiple second configuration information is enabled and the bus transaction with modified permissions does not carry the first privilege identifier, determine the target second configuration information corresponding to the bus transaction with modified permissions among the multiple second configuration information; and perform permission checks on the bus transaction with modified permissions according to the target second configuration information.

[0081] In some embodiments, when there are multiple second configuration information items and each of the multiple second configuration information items is independently enabled, any one of the multiple second configuration information items includes a second matching item and a second attribute item. In other words, the SlvDAC120 is pre-configured with multiple second matching items and multiple second attribute items that are bound one-to-one. If the multiple second matching items are multiple second address items, in this case, if the target address corresponding to the address signal segment in the bus transaction after permission modification matches any one of the multiple second address items, that is, the target address corresponding to the address signal segment in the bus transaction after permission modification is the same as the address corresponding to any one of the second address items, it indicates that the bus transaction after permission modification satisfies the check condition corresponding to any one of the second address items, and the second configuration information corresponding to any one of the second address items is determined as the target second configuration information.

[0082] After determining the target second configuration information, the bus transaction with modified permissions is checked for permissions based on the second attribute item corresponding to the target second configuration information. If the security attribute, DID attribute, mode attribute and the security attribute, DID attribute and mode attribute indicated by the second attribute item are the same in the bus transaction with modified permissions, the bus transaction with modified permissions passes the permission check; otherwise, the bus transaction with modified permissions fails the permission check.

[0083] Among them, multiple second configuration information can be enabled independently, also known as independent enablement. For example, when multiple second configuration information includes second configuration information A, second configuration information B, and second configuration information C, SlvDAC 120 can enable any one of second configuration information A, second configuration information B, and second configuration information C individually, or it can enable multiple of second configuration information A, second configuration information B, and second configuration information C simultaneously.

[0084] In some embodiments, multiple second configuration information can be locked during the operation of SlvDAC 120, and the locking states of the multiple second configuration information are independent of each other. For example, when the multiple second configuration information includes second configuration information A, second configuration information B, and second configuration information C, any one of second configuration information A, second configuration information B, and second configuration information C can be locked individually, or multiple of second configuration information A, second configuration information B, and second configuration information C can be locked simultaneously, so as to prevent malicious tampering of multiple second configuration information during the operation of SlvDAC 120 and ensure the security and controllability of accessing resources in the chip system.

[0085] Figure 4 This is a schematic diagram of the structure of an SlvDAC provided in an embodiment of this application.

[0086] Figure 5 This is a schematic diagram of a process provided in this application embodiment of SlvDAC to perform permission checks on bus transactions after permission modification.

[0087] Figure 6 This is a schematic diagram illustrating another SlvDAC process for performing permission checks on bus transactions with modified permissions, provided in an embodiment of this application.

[0088] The following will combine Figures 4-6 The following is a further explanation of the permission check performed on bus transactions with modified permissions as described in the embodiments of this application.

[0089] like Figure 4As shown, the SlvDAC includes, for example, a register module (register), which includes, for example, an entry register (entry). The entry stores multiple pre-configured second configuration information entries. Each of these second configuration information entries includes a second matching item and a second attribute item, i.e., multiple second matching items and multiple second attribute items bound one-to-one. The SlvDAC determines the target address of the permission-modified bus transaction received by the SlvDAC based on the address signal in the address signal bus (haddr) of the trans input from AHB-S. It also determines the operation type, security attribute, DID attribute, mode attribute, etc., of the permission-modified bus transaction received by the SlvDAC based on the control signal in the control signal bus (hwrite) of the trans.

[0090] In some embodiments, the SlvDAC also includes an interaction interface for interacting with external hardware modules, such as a RAIF-IF interface for connecting to the APB bus, so that the external hardware module can modify multiple second configuration information in the SlvDAC; an asynchronous module for processing asynchronous signals to enable state synchronization or notification across clock domains; and a delay module for adjusting the transmission timing of trans to ensure the synchronicity of signals on the bus.

[0091] In other embodiments, the register in the SlvDAC also includes a configuration register (cfg), used, but not limited to, allowing an external hardware module to modify multiple second configuration information or modify the operating state of the SlvDAC by modifying the values ​​in the configuration register (cfg), such as whether multiple second configuration information is enabled; and an error address register (error_addr), used, but not limited to, recording the trans that triggers an exception, such as recording the target address carried by the trans after the permission modification when the permission check result is a failure; and an error status register (error_status), used, but not limited to, recording the type of the exception that triggers an exception, such as recording the reason for the exception when the permission check result of the trans after the permission modification is a failure, such as the target address carried by the trans after the permission modification not matching the second address item, or the operation type of the trans after the permission modification not matching the second attribute item, etc.

[0092] It should be noted that, Figure 4 The bus interfaces shown, such as AHB-S and AHB-M, and the interaction interfaces, such as RAIF-IF, are illustrative and not restrictive. For example, the bus interface can also be an AXI bus interface, which can be adjusted according to the needs of the actual application scenario.

[0093] like Figure 5 As shown, when the slave device corresponding to the SlvDAC is a memory resource, the SlvDAC is also called the MemDAC. When a bus transaction with modified permissions enters the MemDAC through the slave device interface (AHB-S) of the AHB bus, if at least one of the multiple second configuration information in the MemDAC is enabled (i.e., a second configuration information is enabled), and the transaction with modified permissions does not carry a first privilege identifier, then the transaction with modified permissions and the multiple second configuration information are compared one by one to determine whether the multiple second configuration information matches, i.e., whether the target second configuration information exists among the multiple second configuration information. If the target second configuration information exists, a permission check is performed on the transaction with modified permissions based on the target second configuration information. If the permission check result is a pass, the transaction with modified permissions is sent to the corresponding slave device through the master device interface (AHB-M) of the AHB bus.

[0094] If none of the second configuration information in MemDAC is enabled (i.e., no second configuration information is enabled in MemDAC), and / or the modified trans carries the first privilege identifier, then the modified trans will be sent to the corresponding slave device through the master device interface (AHB-M) of the AHB bus.

[0095] If the permission check fails, for example, if the second address entry is not found, or if the security attributes, DID attributes, and mode attributes of the modified trans entry are different from those indicated by the second attribute entry, then a bus error signal is returned, i.e., a first feedback signal is generated and sent to the master device.

[0096] If multiple second configuration information misses (i.e., the target second configuration information is not found among the multiple second configuration information), determine whether to intercept the transaction with modified permissions. If the missed transaction with modified permissions is intercepted, a bus error signal is returned. If the missed transaction with modified permissions is not intercepted, the missed transaction with modified permissions is sent to the corresponding slave device through the master device interface (AHB-M) of the AHB bus, and the status bit indicating that the second address entry is missed is set, i.e., a second feedback signal is generated and sent to the master device.

[0097] like Figure 6As shown, when the slave device corresponding to the SlvDAC is another peripheral resource, the SlvDAC is also called the regionDAC. When a bus transaction with modified permissions enters the regionDAC through the slave interface (AHB-S) of the AHB bus, if a second configuration information in the regionDAC is enabled (i.e., the second configuration information configured in the regionDAC is enabled), and the modified transaction does not carry the first privilege identifier, then a permission check is performed on the modified transaction according to the target second configuration information. If the permission check passes, the bus transaction with modified permissions is sent to the corresponding slave device through the master interface (AHB-M) of the AHB bus. If the permission check fails, a bus error signal is returned, i.e., a new transaction is generated.

[0098] If the second configuration information in regionDAC is not enabled, and / or the modified trans carries the first privilege identifier, the modified trans will be sent to the corresponding slave device through the master device interface (AHB-M) of the AHB bus.

[0099] If the permission check fails, a bus error signal is returned, i.e., generation is not performed.

[0100] As described above, the first configuration information and / or the second configuration information may be locked during hardware operation. In this case, the host domain access control module is further configured to, upon receiving a first modification request to modify the first configuration information, reject the first modification request if the first configuration information is locked and the first modification request does not carry a second privilege identifier; and / or, the slave domain access control module is further configured to, upon receiving a second modification request to modify the second configuration information, reject the second modification request if the second configuration information is locked and the second modification request does not carry a second privilege identifier; wherein, the second privilege identifier indicates a privilege identifier that allows modification of the first or second configuration information in a locked state.

[0101] In some embodiments, the host domain access control module further includes a first configuration interface, such as an APB or other bus interface, for a first modification request to modify first configuration information to be allowed through the first configuration interface if it carries a second privilege identifier; otherwise, it is not allowed through the first configuration interface. Similarly, the slave domain access control module further includes a second configuration interface, such as an APB or other bus interface, for a second modification request to modify second configuration information to be allowed through the second configuration interface if it carries a second privilege identifier; otherwise, it is not allowed through the second configuration interface.

[0102] In some embodiments, the extended domain access controller further includes a reset module, which is configured to reset the locking state of the first configuration information and the second configuration information upon detection of a reset signal, wherein the reset signal is used for hardware reset.

[0103] Figure 7 This is a schematic diagram of an AHB bus architecture based on an extended domain access controller provided in an embodiment of this application. (Reference) Figure 7 The AHB bus architecture based on an extended domain access controller provided in this application embodiment includes multiple master devices Mst0 and Mst1, and multiple slave devices Mem0, Mem1, and IP0. The interface conversion module AHB2RAFI can be used to adapt the AHB bus protocol to the RAIF interface standard, and the decoding module RAIF decoder can be used to parse the signals of the RAIF interface.

[0104] like Figure 7 As shown, any one of the multiple master devices connects to the host interface M in the bus interface through the host domain access control module. This allows the host domain access control module to modify the access permissions of any master device's initiated transact before it enters the bus for transmission and is routed to the corresponding slave device. For example, before transacting Mst0 enters the bus for transmission, the access permissions of transacting Mst0 are modified through MstDAC0; similarly, before transacting Mst1 enters the bus for transmission, the access permissions of transacting Mst1 are modified through MstDAC1.

[0105] Any one of the multiple slave devices is connected to the slave interface S in the bus interface through the slave domain access control module. This allows the slave domain access control module to perform permission checks on the modified trans that is about to enter any slave device, and determine whether to send the modified trans to the slave device based on the check result. For example, before the modified trans enters Mem0 through MemDAC0, permission checks are performed on the modified trans through MemDAC0; before the modified trans enters Mem1 through MemDAC1, permission checks are performed on the modified trans through MemDAC1; and before the modified trans enters IP0 through RegDAC0, permission checks are performed on the modified trans through RegDAC0. Exemplarily, the slave device may be a memory resource for storing data, such as Mem0 or Mem1, or a peripheral resource with a specific function, such as IP0. This application does not impose any limitations in this regard.

[0106] In some embodiments, the domain access control module further includes an interaction module for interacting with external hardware modules, enabling the external hardware modules to modify relevant configurations in the MstDAC and / or SlvDAC, such as multiple first configuration information in the MstDAC and multiple second configuration information in the SlvDAC. The interaction module may include, for example, an interface conversion module AHB2RAFI for adapting the AHB bus protocol to the RAIF interface standard, and a decoding module RAIF decoder for parsing signals from the RAIF interface.

[0107] It should be noted that, Figure 7 The bus types shown, such as AHB type, and the interaction interfaces, such as RAIF interface, are illustrative and not restrictive, and can be adjusted according to the needs of the actual application scenario.

[0108] This application provides an extended domain access controller, including a host domain access control module and a slave domain access control module. By setting corresponding domain access control modules on the master and slave devices respectively, for example, the host domain access control module on the master device can modify the access permissions of bus transactions initiated by the master device based on the configured first configuration information, so that the access permissions of the bus transactions after permission modification can flexibly adapt to the access needs of the master device in different scenarios; and the slave domain access control module on the slave device can perform permission checks on the bus transactions after permission modification based on the configured second configuration information to ensure the security and compliance of access behavior in the system. At the same time, the second configuration information configured in the slave domain access control module allows the access resources on the slave device to be configured with different permission check rules for different access subjects, which greatly improves the granularity and flexibility of permission checks.

[0109] In another possible implementation, this application also provides a control method for a domain access controller. Figure 8 This is a schematic diagram of the control method for a domain access controller provided in an embodiment of this application. The extended domain access controller includes a host domain access control module and a slave domain access control module connected via a bus. The host domain access control module is connected to the master device, and the slave domain access control module is connected to the slave device. (Refer to...) Figure 8 The control method for the domain access controller provided in this application includes the following steps S510-S520.

[0110] Step S510: Receive the bus transaction initiated by the master device through the host domain access control module; modify the access permissions of the bus transaction according to the first configuration information to obtain the bus transaction with modified permissions, and the access permissions of the bus transaction with modified permissions are adapted to the access requirements of the master device; send the bus transaction with modified permissions to the slave domain access control module through the bus.

[0111] Step S520: If the bus transaction with modified permissions does not carry the first privilege identifier, the slave domain access control module performs a permission check on the bus transaction with modified permissions based on the second configuration information; if the permission check result is a pass, the bus transaction with modified permissions is sent to the slave device.

[0112] The first configuration information indicates the modification rules for bus transactions, the first privilege identifier indicates whether skipping permission checks is allowed, and the second configuration information indicates the check rules for permission checks.

[0113] In some possible implementations, the method further includes: if the permission check result is that the check fails, intercepting the bus transaction with modified permissions, generating and sending a first feedback signal to the master device, the first feedback signal being used to indicate to the master device that the bus transaction with modified permissions failed the permission check.

[0114] In some possible implementations, the first configuration information includes a first matching item indicating whether a bus transaction meets the modification conditions of the first configuration information. The first configuration information also includes a first attribute item for modifying the bus transaction. Modifying the bus transaction according to the first configuration information includes: determining whether the bus transaction meets the modification conditions according to the first matching item; if the bus transaction meets the modification conditions of the first configuration information, modifying the bus transaction according to the first attribute item.

[0115] In some possible implementations, the method further includes: if the bus transaction does not meet the modification conditions of the first configuration information, the host domain access control module modifies the bus transaction according to the configuration information of the master device.

[0116] In some possible implementations, there are multiple first configuration information and each of the multiple first configuration information is enabled independently. Modifying the bus transaction according to the first configuration information includes: if any of the multiple first configuration information is enabled, determining the target first configuration information corresponding to the bus transaction among the multiple first configuration information; and modifying the access permissions of the bus transaction according to the target first configuration information.

[0117] In some possible implementations, there are multiple second configuration information entries, and these multiple second configuration information entries are enabled independently. If the bus transaction with modified permissions does not carry the first privilege identifier, the slave domain access control module performs a permission check on the bus transaction with modified permissions based on the second configuration information, including: if any of the multiple second configuration information entries is enabled and the bus transaction with modified permissions does not carry the first privilege identifier, determining the target second configuration information corresponding to the bus transaction with modified permissions among the multiple second configuration information entries; and performing a permission check on the bus transaction with modified permissions based on the target second configuration information.

[0118] In some possible implementations, the method further includes: if the target second configuration information is not present among the multiple second configuration information, the result of the permission check is that the check fails; or, if the target second configuration information is not present among the multiple second configuration information, the bus transaction with modified permissions is forwarded to the slave device, a second feedback signal is generated and sent to the master device, the second feedback signal being used to prompt the master device that the target second configuration information is not present among the multiple second configuration information.

[0119] In some possible implementations, the method further includes: after receiving a first modification request to modify the first configuration information, the host domain access control module rejects the first modification request if the first configuration information is in a locked state and the first modification request does not carry a second privilege identifier; and / or, after receiving a second modification request to modify the second configuration information, the slave domain access control module rejects the second modification request if the second configuration information is in a locked state and the second modification request does not carry a second privilege identifier; wherein the second privilege identifier indicates a privilege identifier that allows modification of the first configuration information or the second configuration information in a locked state.

[0120] In some possible implementations, there are multiple first configuration information sets, and the locking states of the multiple first configuration information sets are independent of each other; there are multiple second configuration information sets, and the locking states of the multiple second configuration information sets are independent of each other.

[0121] The above Figure 8 The principle of the control method for the domain access controller shown can be referred to the above. Figure 1 The relevant descriptions of the extended domain access controller in the above embodiments are not repeated here. The control method embodiments of the domain access controller provided above and the extended domain access controller embodiments belong to the same concept, and their specific implementation process can be found in the memory copy method.

[0122] In other possible implementations, this application also provides a chip system, the chip system including a bus subsystem, the bus subsystem including... Figure 1 The extension and access controller described in several embodiments thereof.

[0123] In other possible embodiments, this application also provides an electronic device including the chip system described above. In some embodiments, the electronic device is an electronic rearview mirror, which includes an electronic rearview mirror for a vehicle.

[0124] In other possible embodiments, this application also provides a computer-readable storage medium storing program instructions for controlling a domain access controller, which, when executed by one or more processors, cause the processors to implement the above-described combination. Figure 8The steps of the described method and its various embodiments are described. The computer-readable storage medium can be a readable signal medium or a readable storage medium. A readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0125] This application also provides a computer program product, which includes a computer program that is executed by a processor to cause the computer to combine with Figure 5 The steps of the described method and its various embodiments.

[0126] It should also be noted that the terms "first," "second," etc. (if applicable) in the specification and claims of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0127] The term "and / or" in the embodiments of this application is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B currently exist, and B exists alone.

[0128] The above description is only for the purpose of enabling those skilled in the art to understand the technical solution of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application shall be included within the scope of protection of this application.

Claims

1. An extended domain access controller, characterized by, The extended domain access controller comprises a host domain access control module and a slave domain access control module connected through a bus, the host domain access control module is connected with a master device, and the slave domain access control module is connected with a slave device; The host domain access control module is configured to receive a bus transaction initiated by the master device; According to the first configuration information, the access permission of the bus transaction is modified to obtain a permission-modified bus transaction, and the access permission of the permission-modified bus transaction is adapted to the access requirement of the master device; The permission-modified bus transaction is sent to the slave domain access control module through the bus, and the first configuration information indicates the modification rule of the bus transaction; The slave domain access control module is configured to perform permission checking on the permission-modified bus transaction according to second configuration information if the permission-modified bus transaction does not carry a first privilege identifier; If the checking result of the permission checking is checking passed, the permission-modified bus transaction is sent to the slave device, the first privilege identifier indicates whether to allow skipping the permission checking, and the second configuration information indicates the checking rule of the permission checking.

2. The extended domain access controller of claim 1, wherein, The slave domain access control module is further configured to intercept the permission-modified bus transaction, generate and send a first feedback signal to the master device if the checking result of the permission checking is checking failed, and the first feedback signal is used to prompt the master device that the permission-modified bus transaction does not pass the permission checking.

3. The extended domain access controller of claim 1 or 2, wherein, The first configuration information comprises a first matching item indicating whether the bus transaction satisfies the modification condition of the first configuration information, and the first configuration information further comprises a first attribute item used for modifying the access permission of the bus transaction, and the host domain access control module is configured to: Determine whether the bus transaction satisfies the modification condition according to the first matching item; If the bus transaction satisfies the modification condition of the first configuration information, modify the access permission of the bus transaction according to the first attribute item.

4. The extended domain access controller of claim 3, wherein, The host domain access controller is further configured to: If the bus transaction does not satisfy the modification condition of the first configuration information, modify the access permission of the bus transaction according to the configuration information of the master device.

5. The extended domain access controller of claim 1 or 2, wherein, The first configuration information is multiple and multiple first configuration information is independently enabled, and the host domain access control module is configured to: If any first configuration information in the multiple first configuration information is enabled, determine a target first configuration information corresponding to the bus transaction in the multiple first configuration information; According to the target first configuration information, the access permission of the bus transaction is modified.

6. The extended domain access controller of claim 1 or 2, wherein, The second configuration information is multiple and multiple second configuration information is independently enabled, and the slave domain access control module is configured to: If any second configuration information in the multiple second configuration information is enabled and the permission-modified bus transaction does not carry the first privilege identifier, determine a target second configuration information corresponding to the permission-modified bus transaction in the multiple second configuration information; performing the permission check on the bus transaction with the modified permission according to the target second configuration information.

7. The extended domain access controller of claim 6, wherein, The slave domain access control module is further configured to: if the target second configuration information does not exist in the plurality of second configuration information, the check result of the permission check is check failure; or, if the target second configuration information does not exist in the plurality of second configuration information, forwarding the bus transaction with the modified permission to the slave device, generating and sending a second feedback signal to the master device, the second feedback signal being used to prompt the master device that the target second configuration information does not exist in the plurality of second configuration information.

8. The extended domain access controller according to claim 1 or 2, wherein the master domain access control module is further configured to, after receiving a first modification request for modifying the first configuration information, if the first configuration information is in a locked state and the first modification request does not carry a second privilege identifier, rejecting the first modification request; and / or, the slave domain access control module is further configured to, after receiving a second modification request for modifying the second configuration information, if the second configuration information is in a locked state and the second modification request does not carry the second privilege identifier, rejecting the second modification request; wherein the second privilege identifier indicates a privilege identifier that allows modification of the first configuration information or the second configuration information in the locked state.

9. The extended domain access controller according to claim 8, wherein the first configuration information is a plurality of first configuration information, and the locked states of the plurality of first configuration information are independent of each other; the second configuration information is a plurality of second configuration information, and the locked states of the plurality of second configuration information are independent of each other.

10. A chip system, characterized by The chip system comprises a bus subsystem, and the bus subsystem comprises the extended domain access controller according to any one of claims 1 to 9.

11. A control method of an extended domain access controller, characterized by, The extended domain access controller comprises a master domain access control module and a slave domain access control module connected through a bus, the master domain access control module is connected with a master device, and the slave domain access control module is connected with a slave device, and the method comprises: receiving, by the master domain access control module, a bus transaction initiated by the master device; modifying the access permission of the bus transaction according to first configuration information to obtain a bus transaction with a modified permission, the access permission of the bus transaction with the modified permission being adapted to the access demand of the master device; and sending the bus transaction with the modified permission to the slave domain access control module through the bus; if the bus transaction with the modified permission does not carry a first privilege identifier, performing, by the slave domain access control module, a permission check on the bus transaction with the modified permission according to second configuration information; and if the check result of the permission check is check success, sending the bus transaction with the modified permission to the slave device. wherein the first configuration information indicates a modification rule of the bus transaction, the first privilege identifier indicates whether to allow skipping the permission check, and the second configuration information indicates a check rule of the permission check.

12. The method of claim 11, wherein, The method further comprises: If the check result of the permission check is a check failure, the bus transaction after the permission modification is intercepted, a first feedback signal is generated and sent to the host device, and the first feedback signal is used to prompt the host device that the bus transaction after the permission modification fails to pass the permission check.

13. The method according to claim 11 or 12, characterized in that, The first configuration information includes a first matching item indicating whether the bus transaction satisfies a modification condition of the first configuration information, and the first configuration information further includes a first attribute item used for modifying the bus transaction, and the modification of the bus transaction according to the first configuration information includes: determining whether the bus transaction satisfies the modification condition according to the first matching item; if the bus transaction satisfies the modification condition of the first configuration information, modifying the bus transaction according to the first attribute item.

14. The method of claim 13, wherein, The method further includes: if the bus transaction does not satisfy the modification condition of the first configuration information, the host domain access control module modifies the bus transaction according to the configuration information of the host device.

15. The method of claim 11 or 12, wherein, The first configuration information is multiple and multiple first configuration information is independently enabled, and the modification of the bus transaction according to the first configuration information includes: if any first configuration information in the multiple first configuration information is enabled, determining a target first configuration information corresponding to the bus transaction in the multiple first configuration information; modifying the access permission of the bus transaction according to the target first configuration information.

16. The method of claim 11 or 12, wherein, The second configuration information is multiple and multiple second configuration information is independently enabled, and if the bus transaction after the permission modification does not carry the first privilege identifier, the permission check of the bus transaction after the permission modification by the slave domain access control module according to the second configuration information includes: if any second configuration information in the multiple second configuration information is enabled and the bus transaction after the permission modification does not carry the first privilege identifier, determining a target second configuration information corresponding to the bus transaction after the permission modification in the multiple second configuration information; performing the permission check on the bus transaction after the permission modification according to the target second configuration information.

17. The method of claim 16, wherein, The method further includes: if the target second configuration information does not exist in the multiple second configuration information, the check result of the permission check is a check failure; or, if the target second configuration information does not exist in the multiple second configuration information, forwarding the bus transaction after the permission modification to the slave device, generating and sending a second feedback signal to the host device, and the second feedback signal is used to prompt the host device that the target second configuration information does not exist in the multiple second configuration information.

18. The method of claim 11 or 12, wherein, The method further includes: after receiving a first modification request for modifying the first configuration information, if the first configuration information is in a locked state and the first modification request does not carry a second privilege identifier, the first modification request is rejected. And / or, the slave domain access control module, after receiving a second modification request for modifying the second configuration information, rejects the second modification request if the second configuration information is in the locked state and the second modification request does not carry the second privilege identifier; The second privilege identifier indicates a privilege identifier that is allowed to modify the first configuration information or the second configuration information in the locked state.

19. The method of claim 18, wherein, The first configuration information is multiple, and the locked states of the multiple first configuration information are independent of each other; The second configuration information is multiple, and the locked states of the multiple second configuration information are independent of each other.

Images