DMA access method and device, electronic equipment, storage medium and program product
By setting a security filter register in the DMA request, the scope of memory access for untrusted requests is restricted based on device identity information, thus solving the security problem of malware accessing memory via DMA and achieving higher memory access security.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- LOONGSON TECH CORP
- Filing Date
- 2025-12-25
- Publication Date
- 2026-05-08
AI Technical Summary
Malware can indirectly gain access to arbitrary memory by configuring the target address of DMA, leading to security issues.
Set a security filter register, match the target security filter register with the identity information of the device that issued the DMA request, and restrict untrusted DMA requests to access non-secure memory ranges to prevent them from accessing memory that needs protection.
It improves the security of memory access, prevents untrusted DMA requests from accessing the safe memory range, and avoids potential security risks.
Smart Images
Figure CN121996591A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer technology, and in particular to a DMA access method, a DMA access device, an electronic device, a storage medium, and a computer program product. Background Technology
[0002] DMA (Direct Memory Access) technology allows any external device to directly read and write to the computer system's physical memory, which speeds up data transfer efficiency.
[0003] However, malicious software can indirectly gain access to arbitrary memory by configuring the target address of DMA, leading to security issues. Summary of the Invention
[0004] In view of the above problems, embodiments of the present invention are proposed to provide a DMA access method that overcomes or at least partially solves the above problems, thereby improving the security of memory access.
[0005] In a first aspect, the present invention provides a DMA access method, the method comprising: Receive a DMA request; the DMA request includes: the identity information of the sending device, and the target address to be accessed; In the case that the DMA request is an untrusted DMA request, a target security filter register is matched according to the identity information; the target security filter register specifies a preset memory segment in memory, and the target security filter register stores the security attributes of the preset memory segment; the security attributes include: secure or insecure; When the security attribute is insecure: only untrusted DMA requests with the target address within the preset memory range are allowed to access the preset memory; for untrusted DMA requests with the target address outside the preset memory range, the untrusted DMA requests are remapped to an insecure memory range. When the security attribute is secure: only untrusted DMA requests whose target address is not within the preset memory range are allowed to access; for untrusted DMA requests whose target address is within the preset memory range, the DMA requests are remapped to an unsecured memory range.
[0006] In a second aspect, the present invention provides a DMA access device, comprising: A receiving module is used to receive DMA requests; the DMA request includes: the identity information of the sending device, and the target address to be accessed; A matching module is used to match a target security filter register based on the identity information when the DMA request is an untrusted DMA request; the target security filter register specifies a preset memory segment in memory, and the target security filter register stores the security attributes of the preset memory segment; the security attributes include: secure or insecure; The DMA first access module is configured to, when the security attribute is insecure, only allow untrusted DMA requests with the target address within the preset memory range to access the preset memory, and for untrusted DMA requests with the target address outside the preset memory range, remap the untrusted DMA requests to an insecure memory range. The second DMA access module is configured to, when the security attribute is secure, only allow access to untrusted DMA requests whose target address is not within the preset memory range, and for untrusted DMA requests whose target address is within the preset memory range, remap the DMA request to a non-secure memory range.
[0007] Thirdly, the present invention provides an electronic device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-described DMA access method when executing the program.
[0008] Fourthly, the present invention provides a readable storage medium that, when the instructions in the storage medium are executed by the processor of an electronic device, enables the electronic device to perform the above-described DMA access method.
[0009] Fifthly, the present invention provides a computer program product, comprising: a computer program, wherein when the computer program is executed by a processor, it implements the steps of the above-described DMA access method.
[0010] This invention has the following advantages: In this invention, a security filter register is provided. Upon receiving an untrusted DMA request, it does not directly allow the untrusted DMA request to access the computer system's physical memory. Instead, it matches a target security filter register based on the identity information of the issuing device included in the untrusted DMA request. This target security filter register specifies a preset memory segment in memory and stores the security attributes of this preset memory segment. If the security attribute of the preset memory segment is "insecure," it means that the preset memory segment is not memory that needs protection. Therefore, only untrusted DMA requests whose target address is within the preset memory range are allowed to access the preset memory. For untrusted DMA requests whose target address is outside the preset memory range, it means that this untrusted DMA request may want to access memory that needs protection or secure memory. Therefore, this untrusted DMA request is remapped to an insecure memory range, so this untrusted DMA request can only access the insecure memory range, thus preventing untrusted DMA requests from accessing secure memory. If the security attribute of the preset memory segment is "secure," it means that the preset memory segment is memory that needs protection or secure memory. Therefore, only untrusted DMA requests whose target address is outside the preset memory range are allowed to access the preset memory. An untrusted DMA request whose target address is outside the preset memory range indicates that it is attempting to access unprotected memory, not protected memory. Allowing such a request would result in it accessing unprotected memory, meaning it would not access protected memory. Conversely, untrusted DMA requests with target addresses within the preset memory range are not permitted to access this preset memory. For such requests, the request is remapped to a non-safe memory range, thus restricting access to safe memory. In summary, this application prevents untrusted DMA requests from accessing protected or safe memory, improving memory access security. Attached Figure Description
[0011] Figure 1 A flowchart illustrating the steps of an embodiment of the DMA access method of the present invention is shown; Figure 2 A flowchart illustrating the steps of another embodiment of the DMA access method of the present invention is shown; Figure 3 and Figure 4 A flowchart illustrating an embodiment of the DMA access method of the present invention is shown. Figure 5 A structural block diagram of an embodiment of the DMA access device of the present invention is shown; Figure 6 This is a structural diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation
[0012] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.
[0013] Figure 1 A flowchart illustrating the steps of an embodiment of the DMA access method of the present invention is shown below. Figure 1 The DMA access method may specifically include the following steps.
[0014] Step 101: Receive DMA request; the DMA request includes: the identity information of the sending device, and the target address to be accessed.
[0015] The issuing device's identity information here refers to information that identifies the device issuing the DMA request. For example, the issuing device's identity information may include the ID of the device issuing the DMA request. The target address to be accessed refers to the memory address that the DMA request aims to access.
[0016] Step 102: If the DMA request is an untrusted DMA request, match the target security filter register according to the identity information; the target security filter register specifies a preset memory segment in memory, and the target security filter register stores the security attributes of the preset memory segment; the security attributes include: secure or insecure.
[0017] Untrusted DMA requests here refer to DMA requests that may pose security risks, such as malicious software attempting to attack protected memory.
[0018] One or more security filter registers (SFs) can be set. These registers are used to detect untrusted DMA requests. Referring to Table 1 below, the security filter register contains DMA ID matching rules. This ID is used to identify DMA requests from different devices. The security filter register specifies a preset memory range in memory. In the example in Table 1, this preset memory range is the memory space with addresses from BASE to (BASE|(~MASK)). This preset memory range is the memory range accessible to the DMA. For untrusted DMAs that match the ID, their accessible memory is limited to the non-secure address range specified by the target security filter register. The size of this preset memory range is not limited here.
[0019] In this application: BASE refers to the base address, MASK refers to the mask, TID refers to the device identity information (ID), which is the process address space identifier (PCIe PASID) or a device identification number defined by other hardware platforms, and Tdomain refers to the trusted domain identity information (ID). TID_mask / TID_base is used to identify devices within a set of ID ranges. policy refers to the device identification policy, and the value of policy can be 0 or 1. For example, when policy=0, the device with Dev_ID=TID is identified as a trusted device, and when policy=1, the device with Dev_ID&TID_mask=TID_base is identified as a trusted device. Tdomain_valid means that the trusted domain is valid. For example, when Tdomain_valid=1, Tdomain cannot be mapped by any untrusted device. TID_valid means that the trusted device is valid. For example, when TID_valid=1, trusted devices with matching IDs can only be mapped to Tdomain. In this application, MMAP refers to memory mapping.
[0020] In Table 1, the security filter register is a 64-bit register. In Table 1, BASE (base address) refers to the starting address of the preset memory segment specified by the security filter register in memory, and MASK (mask) refers to the mask specified by the security filter register in memory for the aforementioned starting address offset. BASE and MASK are mainly used to set the address range of the preset memory segment in memory. Table 1 is only an example of a 64-bit security filter register; the security filter register can also be 128-bit, 256-bit, etc. This application does not limit the number of bits in the security filter register.
[0021]
[0022] The specific description of the security filter register is not limited. For example, referring to Table 1, BASE to (BASE|(~MASK)) refers to the address range of a preset memory segment specified by the security filter register in memory. The security filter register stores the security attributes of the preset memory. For example, in Table 1, when mode
[61] =0, it means that the security attribute of the preset memory segment specified by the target security filter register in memory is secure or whitelist mode. At this time, the preset memory segment with address range BASE to (BASE|(~MASK)) in memory is a protected memory address range, and untrusted DMA requests are prohibited from accessing this segment of memory. When mode
[61] =1, it means that the security attribute of the preset memory segment specified by the target security filter register in memory is unsecure or blacklist mode. At this time, the preset memory segment with address range BASE to (BASE|(~MASK)) in memory is an unprotected memory address range, and untrusted DMA requests can only access this segment of memory. Step 103: When the security attribute is insecure: only untrusted DMA requests with the target address within the preset memory range are allowed to access the preset memory; for untrusted DMA requests with the target address outside the preset memory range, the untrusted DMA requests are remapped to an insecure memory range.
[0023] If the target security filter register specifies a predefined memory segment with a non-secure security attribute, it means that the predefined memory segment specified by the target security filter register is not memory that needs protection. Therefore, only untrusted DMA requests with target addresses within this predefined memory segment are allowed to access that memory. For untrusted DMA requests with target addresses outside this predefined memory segment, it indicates that the untrusted DMA request may be trying to access memory that needs protection or secure memory. Therefore, the untrusted DMA request is remapped to a non-secure memory segment, thus preventing untrusted DMA requests from accessing secure memory and improving memory access security. The remapped address simply needs to be an unprotected memory address.
[0024] For example, regarding Table 1 above, mode
[61] =1 indicates that the security attribute of a preset memory segment specified by the target security filter register in memory is non-secure or blacklisted. At this time, the preset memory segment from address range BASE to (BASE|(~MASK)) is an unprotected memory address range, and untrusted DMA requests can only access this memory segment. If the address check finds that the target address range of the untrusted DMA request exceeds its allowed range, the target address of the untrusted DMA request is remapped. That is, if the target address range of the untrusted DMA request exceeds this range, the target security filter register forcibly modifies the target address of the DMA request, thereby restricting the access of the untrusted device DMA request. The mapped address can be: (addr&(~MASK))|(MMAP&MASK), where (addr&(~MASK))|(MMAP&MASK) refers to an unprotected memory space in memory. Under non-secure or blacklisted conditions, MMAP=BASE.
[0025] Step 104: When the security attribute is secure: only allow access to untrusted DMA requests whose target address is not within the preset memory range; for untrusted DMA requests whose target address is within the preset memory range, remap the DMA request to an unsecured memory range.
[0026] If the target security filter register specifies a predefined memory segment as "safe," it means that this predefined memory segment is either protected memory or safe memory. In this case, only untrusted DMA requests with target addresses outside this predefined memory range are allowed access; untrusted DMA requests with target addresses within this range are not permitted. For untrusted DMA requests with target addresses outside this range, since the target address is outside the range, it means the request is trying to access unprotected memory. Therefore, allowing this request will result in it accessing unprotected memory, meaning it will not access the protected predefined memory. For untrusted DMA requests with target addresses within this range, the target security filter register remaps the request to a non-safe memory range. This restricts access to non-safe memory, preventing untrusted DMA requests from accessing safe memory and improving memory access security. The remapped address here can be any unprotected memory.
[0027] For example, regarding Table 1 above, when mode
[61] =0, it indicates that the security attribute of a preset memory segment specified by the target security filter register in memory is either secure or whitelisted. At this time, the preset memory segment from address range BASE to (BASE|(~MASK)) is a protected memory address range, prohibiting untrusted DMA requests from accessing this memory segment. If the address check finds that the target address range of the untrusted DMA request is within the range of this preset memory segment, then the target address of the untrusted DMA request is remapped. That is, if the target address range of the untrusted DMA request is within the range of this preset memory segment, the target security filter register forcibly corrects the target address of the untrusted DMA request, thereby restricting the access of untrusted device DMA requests. In secure or whitelisted mode, MMAP&MASK is an unprotected memory range, and the remapping here can remap it to this address range. In summary, this invention incorporates a security filter register. Upon receiving an untrusted DMA request, it does not directly allow the request to access the computer system's physical memory. Instead, it matches the target security filter register based on the identity information of the issuing device included in the untrusted DMA request. Then, by using the security attributes of a preset memory segment specified by the target security filter register, it restricts the untrusted DMA request to access only the non-secure memory range, thereby preventing untrusted DMA requests from accessing the secure memory range. This avoids untrusted DMA requests accessing memory that needs protection or secure memory, thus improving the security of memory access.
[0028] Optionally, the aforementioned security filter register, or target security filter register, can only be configured by the Trusted Computing Base (TCB), or in other words, the aforementioned security filter register, or target security filter register, is protected by the TCB. Therefore, its security attributes cannot be arbitrarily altered by malicious software, further ensuring the security of memory access. The TCB is a high-security protection device or mechanism for computer information systems.
[0029] Optionally, when the aforementioned security attributes are secure, the target security filter register here specifies a predefined memory segment in memory, including: the memory domain of the Confidential Virtual Machine (CVM); the aforementioned insecure memory range includes: the memory range outside the memory domain of the Confidential Virtual Machine. Specifically, in common confidential computing systems, there are multiple Confidential Virtual Machines that need protection. Each Confidential Virtual Machine is isolated from the others, or in other words, each Confidential Virtual Machine needs to be provided with a hardware-isolated operating environment. A Confidential Virtual Machine can add an I / O device (input device, output device) to its trusted boundary through integrity verification, allowing that device to directly read and write to the memory of the Confidential Virtual Machine via DMA. Other untrusted devices cannot access the memory of the Confidential Virtual Machine, thus protecting its private memory from untrusted entities. DMA technology allows any external device to directly read and write to the physical memory of the computer system. Malicious system software can indirectly obtain access to the private memory of the CVM by configuring the target address of the DMA. This invention achieves protection of the private memory of the CVM, allowing trusted external devices to access the private pages of the CVM via DMA, while untrusted devices cannot access the private pages of the CVM. Through a hardware-software co-design, we have achieved memory isolation protection to prevent malicious DMA from corrupting the CVM in an untrusted operating system kernel.
[0030] Figure 2 A flowchart illustrating the steps of another embodiment of the DMA access method of the present invention is shown, with reference to... Figure 2 The DMA access method may specifically include the following steps.
[0031] Step 201: Divide the devices into trusted devices and untrusted devices.
[0032] The term "device" here refers to any device capable of initiating a DMA request. There is no specific limitation on whether a device is classified as trusted or untrusted. For example, one could first determine the probability that a device typically attacks secure memory. If this probability is higher than a threshold, the device can be classified as untrusted; if the probability is lower than or equal to the threshold, the device can be classified as trusted.
[0033] Step 202: Bind the trusted device to at least one confidential virtual machine.
[0034] Typically, a confidential virtual machine can be bound to at least one or more trusted devices, and a trusted device can be bound to one or more confidential virtual machines. The confidential virtual machine that a trusted device binds to is generally the confidential virtual machine it will subsequently access. The specific binding method is not limited. Binding a trusted device to at least one confidential virtual machine establishes a binding relationship between the trusted device, the confidential virtual machine bound to it, and the mapping domain of the confidential virtual machine bound to it.
[0035] Step 203: Store the correspondence between the trusted device, the confidential virtual machine bound to the trusted device, and the mapping domain of the confidential virtual machine bound to the trusted device in the security mapping table.
[0036] The memory domain and mapping domain of a confidential virtual machine are typically trusted domains. This step involves storing the binding relationship between the trusted device, the confidential virtual machine bound to the trusted device, and the mapping domain of the confidential virtual machine bound to the trusted device in a secure mapping table (TID2DOM table). In this application, a memory domain refers to a segment of physical addresses in memory.
[0037] In this application, the mapping domain mainly contains two types of information: one type is the device's identity information, and the other type is the correspondence between virtual addresses and physical addresses in memory. In one example, it can refer to the binding relationship between the aforementioned trusted device, the confidential virtual machine bound to the trusted device, and the mapping domain of the confidential virtual machine bound to the trusted device.
[0038] Referring to Tables 2 and 3 below, each entry in the TID2DOM table specifies a mapping from a trusted device to a trusted domain. Table 2 below shows an example of a 47-bit TID2DOM table; the number of bits in a TID2DOM table can also be 64 bits, 128 bits, etc., and there is no limitation on the number of bits in a TID2DOM table.
[0039]
[0040] Through the above binding, the DMA request of the trusted device must be mapped to the memory domain of the CVM. This memory domain is regarded as the trusted domain. The DMA request of the trusted device completes address translation in the trusted domain and obtains the ability to access the CVM memory. After the translation is completed, the DMA request can be directly sent to memory, realizing the trusted device's fast access to the CVM.
[0041] Optionally, the entity executing step 203 may include a trusted computing base, that is, the trusted computing base stores the correspondence between the aforementioned trusted device, the confidential virtual machine bound to the trusted device, and the mapping domain of the confidential virtual machine bound to the trusted device in the secure mapping table. By storing the above correspondence through the trusted computing base, the correspondence stored in the secure mapping table can be prevented from being attacked or modified by malicious software.
[0042] It should be noted that the trusted computing base mentioned in this application is the overall protection device within a computer system, including hardware, firmware, software, and a combination responsible for implementing security policies. It establishes a basic protection environment and provides the additional user services required by a trusted computing system to prevent interference and tampering by untrusted entities.
[0043] Step 204: Receive DMA request; the DMA request includes: the identity information of the sending device, and the target address to be accessed.
[0044] Step 205: If the identity information corresponding to the DMA request is outside the security mapping table, the DMA request is determined to be an untrusted DMA request.
[0045] Because the security mapping table stores the binding relationships between trusted devices, their bound confidential virtual machines, and the mapping domains of those confidential virtual machines, if the identity information corresponding to a DMA request is outside the security mapping table, it indicates that the device issuing the DMA request is not a trusted device. In this case, the DMA request can still be marked as an untrusted DMA request. If the identity information corresponding to a DMA request is within the security mapping table, it indicates that the device issuing the DMA request is a trusted device. In this case, the DMA request can still be marked as a trusted DMA request.
[0046] This security mapping table allows for a convenient and accurate determination of whether a DMA request is issued by a trusted or untrusted device, thus enabling a convenient and accurate distinction between trusted and untrusted DMA requests.
[0047] Step 206: If the DMA request is an untrusted DMA request, match the target security filter register according to the identity information; the target security filter register specifies a preset memory segment in memory, and the target security filter register stores the security attributes of the preset memory segment; the security attributes include: secure or insecure.
[0048] Step 207: When the security attribute is insecure: only untrusted DMA requests with the target address within the preset memory range are allowed to access the preset memory; for untrusted DMA requests with the target address outside the preset memory range, the untrusted DMA requests are remapped to an insecure memory range.
[0049] Step 208: When the security attribute is secure: only allow access to untrusted DMA requests whose target address is not within the preset memory range; for untrusted DMA requests whose target address is within the preset memory range, remap the DMA request to an unsecured memory range.
[0050] Steps 206 to 208 can be referred to the relevant records in steps 102 to 104 above, and will not be repeated here to avoid repetition.
[0051] Step 209: If the identity information corresponding to the DMA request is located in the security mapping table, map the DMA request to the mapping domain of the confidential virtual machine bound to the issuing device based on the security mapping table.
[0052] Because this security mapping table stores the binding relationships between trusted devices, their bound confidential virtual machines, and the mapping domains of those confidential virtual machines, the presence of the identity information corresponding to the DMA request within the security mapping table indicates that the device issuing the DMA request is a trusted device. In this case, the DMA request can be identified as a trusted DMA request, and the security mapping table can be used to map the DMA request to the mapping domain of the confidential virtual machine bound to the issuing device.
[0053] Step 210: In the mapping domain of the confidential virtual machine, perform address translation on the DMA request and access the memory domain of the confidential virtual machine.
[0054] For trusted DMA requests from the confidential virtual machine, the address of the DMA request is translated in the mapping domain of the confidential virtual machine, and the memory domain of the confidential virtual machine is accessed. Only trusted DMA requests from the confidential virtual machine are allowed to access the memory domain of the confidential virtual machine, while untrusted DMA requests from the confidential virtual machine are not allowed to access the memory domain of the confidential virtual machine, thereby protecting the private memory of the confidential virtual machine.
[0055] Optionally, this application may further include: setting the address of the first-level directory table of the mapping domain of the confidential virtual machine to be located in memory protected by the trusted computing base and binding it to the confidential virtual machine; setting the modification permission of the address of the first-level directory table of the mapping domain of the confidential virtual machine to only allow modification by the trusted computing base, so that the integrity of the address translation of the mapping domain of the confidential virtual machine can be guaranteed through the protection of the trusted computing base.
[0056] Optionally, this application may also include: setting the traversal configuration of page tables at all levels in the mapping domain of the confidential virtual machine to allow modification only by a trusted computing base. The traversal configuration of page tables at all levels here may include index width, big page configuration, etc. The trusted computing base can prevent malicious software from modifying page tables at all levels in the mapping domain of the confidential virtual machine, thus ensuring the integrity of the address translation of the mapping domain of the confidential virtual machine.
[0057] The Translation Lookaside Buffer (TLB) is a special buffer installed in the processor to accelerate virtual-physical address translation. The TLB stores a portion of the page table, and each entry in the TLB is a page table entry, which can include the following parts: a virtual address and process ID (ASID) section, representing the index of the page table entry, used for comparison with the virtual address to be translated and the ASID input to the TLB; a physical address section, which is the result of the page table entry; when the virtual address to be translated input to the TLB matches the page table entry, its physical address is output; and a page attribute section, including various attributes such as whether the page is valid, writable, readable, and executable. After traversing the page directory table, the hardware fills the page table entries into the TLB to facilitate subsequent accelerated address translation. The TLB of the trusted domain or the mapping domain of the confidential virtual machine is prohibited from being directly modified by software. It can only be automatically filled in by the hardware based on the page table content obtained by PTW (Page Table Walk). This can prevent the TLB of the trusted domain or the mapping domain of the confidential virtual machine from being modified by malicious software, and can ensure the integrity and security of address translation.
[0058] It should be noted that steps 201 to 210 can be performed by the same execution entity, or steps 201 to 205 can be performed by one execution entity, while steps 206 to 210 can be performed by another execution entity. For example, steps 201 to 210 can all be performed by the Input Output Memory Management Unit (IOMMU). Alternatively, steps 201 to 205 can be performed by the IOMMU, while steps 206 to 210 can be performed by the on-chip network. Furthermore, the execution order of steps 206 and 209 is not limited here.
[0059] Optionally, after step 205 and before step 206, the method may further include: if the untrusted DMA request exists in a mapping domain and is mapped to an untrusted mapping domain based on an Input / Output Virtualization Address Mapping Table (IOV table), then in the untrusted mapping domain, address translation is performed on the untrusted DMA request; the untrusted mapping domain includes mapping domains outside the mapping domain of the confidential virtual machine; if the untrusted DMA request exists in a mapping domain and is mapped to the mapping domain of the confidential virtual machine based on an Input / Output Virtualization Address Mapping Table, then the mapping result of the untrusted DMA request is forcibly modified to a reserved domain, and address translation is performed on the untrusted DMA request in the reserved domain; the reserved domain includes mapping domains outside the mapping domain of the confidential virtual machine.
[0060] Specifically, the IOV table may be modified by malware, therefore, the IOV table can refer to an unprotected or insecure table. Here, "untrusted mapping domain" and "reserved domain" both refer to unprotected or insecure mapping domains. That is, for a DMA request from an untrusted device, if a domain mapping exists and is mapped to an untrusted mapping domain through the IOV table, then address translation is performed in the untrusted mapping domain. If a domain mapping exists and is mapped to a trusted mapping domain through the IOV table, then the mapping is problematic, possibly due to malware modifying the IOV table. This could lead to an untrusted device accessing a protected memory domain, which is not allowed. In this case, the mapping result of the untrusted DMA request is forcibly modified to a reserved domain, where address translation is performed. In short, for untrusted DMA requests, address translation can only be performed in untrusted mapping domains. Hardware must ensure that the mapped domain is not a trusted domain, and hardware can be used to determine and mark the request as an untrusted DMA request. Combining with step 205 above, this means that for a DMA request, the security mapping table is used to directly determine whether the DMA request is a trusted DMA request or an untrusted DMA request, and then address translation is performed for untrusted DMA requests.
[0061] In this application, as mentioned earlier, the mapping domain mainly contains two types of information: device identification information and the mapping relationship between virtual addresses and physical addresses in memory. A DMA request includes the identification information of the issuing device and may also contain a virtual address. Domain mapping refers to the process by which, upon receiving a DMA request, the DMA system first matches the mapping domain using the identification information of the issuing device. If a mapping domain is matched, the system then uses the mapping relationship between virtual addresses and physical addresses defined in that mapping domain to match the physical address corresponding to the virtual address contained in the DMA request. Optionally, after step 205 and before step 206, the method may further include: if the untrusted DMA request exists in a mapping domain and is mapped to an untrusted mapping domain based on an input / output virtualization address mapping table, then performing address translation on the untrusted DMA request in the untrusted mapping domain; the untrusted mapping domain includes mapping domains outside the mapping domain of the confidential virtual machine; if the untrusted DMA request exists in a mapping domain and is mapped to the mapping domain of the confidential virtual machine based on an input / output virtualization address mapping table, then forcibly modifying the mapping result of the untrusted DMA request to a reserved domain, then performing address translation on the untrusted DMA request in the reserved domain; the reserved domain includes mapping domains outside the mapping domain of the confidential virtual machine.
[0062] Specifically, IOV tables may be modified by malware, therefore, IOV tables can refer to unprotected or insecure tables. Here, "untrusted mapping domain" and "reserved domain" both refer to unprotected or insecure mapping domains. These can correspond to the same unprotected mapping domain in terms of virtual address range and physical address range, or both can be unprotected mapping domains, but their corresponding virtual address ranges and physical address ranges may partially correspond, partially correspond, or be completely different; all of these are within the scope of protection of this application. In other words, for DMA requests from untrusted devices, if there is a mapping in the existing domain and the request is mapped to an untrusted mapping domain through the IOV table, then address translation is performed in the untrusted mapping domain. If there is a mapping in the existing domain and the request is mapped to a trusted mapping domain through the IOV table, then the mapping is problematic, possibly due to malware modifying the IOV table. This could lead to untrusted devices accessing protected memory domains, which is not allowed. In this case, the mapping result of the untrusted DMA request is forcibly modified to a reserved domain, where address translation is performed. Essentially, for untrusted DMA requests, address translation can only be performed in the untrusted mapping domain. Hardware must ensure that the mapped domain is not a trusted domain, and hardware can be used to mark the request as an untrusted DMA request. Combining this with step 205 above, for a DMA request, the security mapping table is used to directly determine whether the DMA request is trusted or untrusted, and then address translation is performed for untrusted DMA requests with existing domain mappings.
[0063] Optionally, step 205 includes: when the identity information corresponding to the DMA request is outside the security mapping table, and the untrusted DMA request has a domain mapping, and the untrusted DMA request is mapped to an untrusted mapping domain based on the input / output virtualization address mapping table, in the untrusted mapping domain, address translation is performed on the untrusted DMA request, and the DMA request is determined to be still marked as an untrusted DMA request; the untrusted mapping domain includes: mapping domains outside the mapping domain of the confidential virtual machine; when the identity information corresponding to the DMA request is outside the security mapping table, and the untrusted DMA request has a domain mapping, and the untrusted DMA request is mapped to the mapping domain of the confidential virtual machine based on the input / output virtualization address mapping table, the mapping result of the untrusted DMA request is forcibly modified to a reserved domain, address translation is performed on the untrusted DMA request in the reserved domain, and the DMA request is determined and marked as an untrusted DMA request; the reserved domain includes: mapping domains outside the mapping domain of the confidential virtual machine.
[0064] Specifically, for DMA requests with domain mappings that are untrusted, and following the previous approach of first determining them as untrusted DMA requests before address translation, this approach first performs address translation on untrusted DMA requests with domain mappings, and then determines that they can still be marked as untrusted DMA requests. This method is relatively simple to implement in code. The address translation process is the same as described above, requiring that the mapping of the untrusted DMA request be placed in an untrusted mapping domain, i.e., a mapping domain outside the confidential virtual machine's mapping domain. Then, address translation is performed on the untrusted DMA request within the untrusted mapping domain.
[0065] It should be noted that for DMA requests from untrusted devices, in the absence of domain mapping, the IOMMU can directly identify and mark the request as an untrusted DMA request. Untrusted DMA requests will also need to be further checked and filtered in subsequent accesses, and will be restricted to accessing only a specific range of non-secure memory, such as non-CVM memory.
[0066] It should be noted that for untrusted DMA requests with domain mapping, whether the DMA request is first determined to be trustworthy or untrustworthy before address translation is performed, or address translation is performed first before identifying and marking it as an untrustworthy DMA request, if it is mapped to the mapping domain of a confidential virtual machine through the IOV table, it is a problematic mapping and an interrupt message needs to be generated to notify the monitor of this unsafe behavior.
[0067] It should be noted that for untrusted DMA requests with domain mappings, regardless of whether the DMA request is first determined to be trustworthy or untrustworthy before address translation is performed, or address translation is performed first before identifying and marking it as an untrustworthy DMA request, the mapping to the confidential virtual machine's mapping domain via the IOV table is problematic. This application does not directly interrupt the continued execution of the DMA request, but instead forcibly modifies the mapping result of the untrusted DMA request to a reserved domain, and continues address translation and subsequent execution, thus avoiding the blocking of subsequent requests or tasks caused by interrupting the continued execution of the DMA request.
[0068] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.
[0069] The present application will be further explained below with reference to specific embodiments.
[0070] Reference Figure 3 , Figure 3 The execution entity is the IOMMU. The format of the security mapping table (TID2DOM) entries is shown in Table 2, and the descriptions of the TID2DOM entries are shown in Table 3. When the IOMMU receives a DMA request, the DMA request includes: the identity information of the issuing device (the ID of the issuing device), and the target address to be accessed. Upon receiving a DMA request, the system first performs an ID match on the issuing device in the TID2DOM. If a matching TID2DOM entry is found, it indicates that the issuing device is a trusted device, and the DMA request is directly mapped to the Tdomain fields in Tables 2 and 3, or the mapping domain of the confidential virtual machine bound to the issuing device, for address translation. If no matching TID2DOM entry is found, it indicates that the issuing device is an untrusted device, and the DMA request is untrusted. The system then checks the IOV mapping table to see if it can be mapped to a memory domain. If no mappable memory domain is found, the request is directly identified and marked as untrusted and sent to the on-chip network. If a mappable domain is found, it is necessary to check whether the mappable domain is a domain marked as trusted in the TID2DOM. If it is a trusted domain, the hardware forcibly corrects the mapping result to a reserved domain, uses the reserved domain's page table for mapping, and generates an interrupt message. If it is not a trusted domain, address translation can be performed, and the request is identified and marked as untrusted.
[0071] Reference Figure 4 , Figure 4 The execution entity is the on-chip network (BTC), and the BTC's network interface contains a set of security filtering (SF) registers. The description of the SF registers is shown in Table 1. After receiving a DMA request, the BTC first... Figure 3The marking result determines whether the DMA request is trusted or untrusted. For trusted DMA requests, since they originate from trusted devices, they are directly sent to memory for access. For untrusted DMA requests, a target security filter register is matched based on their identity information. This target security filter register specifies a preset memory segment in memory with security attributes; these security attributes include: secure (whitelist) or insecure (blacklist). For untrusted DMA requests, after matching the target security filter register, if the security attribute of the preset memory segment specified by the target security filter register in memory is insecure (…), then… Figure 4 Whitelist mode? Branch where N is located): Only untrusted DMA requests with the target address within the preset memory range are allowed to access the preset memory. For untrusted DMA requests with the target address outside the preset memory range, the untrusted DMA requests are remapped to an insecure memory range; if the security attribute of the preset memory range specified by the target security filter register in memory is secure ( Figure 4 Whitelist mode? (Branch where Y is located): Only untrusted DMA requests whose target address is not within the preset memory range are allowed to access. For untrusted DMA requests whose target address is within the preset memory range, the DMA request is remapped to a non-safe memory range.
[0072] This application supports efficient data transfer via DMA within a secure model for confidential computing, while protecting the secure memory data of confidential virtual machines from being corrupted or leaked by untrusted devices through DMA. More specifically, confidential computing technology requires protecting the confidentiality and integrity of the memory of confidential virtual machines. DMA without memory access checks can lead to the leakage or corruption of data within trusted applications. IOMMU technology is a technique for isolating DMA in virtualization environments; however, because its configuration is usually controlled by untrusted privileged software, malicious privileged software can still bypass the IOMMU or directly exploit it to attack protected programs. This application extends the security functions of the IOMMU, preventing it from being maliciously used to attack CVMs, and also extends the security functions of on-chip networking to prevent operations that bypass the IOMMU from threatening protected memory.
[0073] Figure 5 A structural block diagram of an embodiment of the DMA access device of the present invention is shown, with reference to... Figure 5 The device may specifically include the following modules.
[0074] The receiving module 301 is used to receive a DMA request; the DMA request includes: the identity information of the sending device, and the target address to be accessed; The matching module 302 is used to match a target security filter register according to the identity information when the DMA request is an untrusted DMA request; the target security filter register specifies a preset memory segment in memory, and the target security filter register stores the security attributes of the preset memory segment; the security attributes include: secure or insecure; The DMA first access module 303 is configured to, when the security attribute is insecure, only allow untrusted DMA requests with the target address within the preset memory range to access the preset memory, and for untrusted DMA requests with the target address outside the preset memory range, remap the untrusted DMA requests to an insecure memory range. The DMA second access module 304 is configured to, when the security attribute is secure, only allow access to untrusted DMA requests whose target address is not within the preset memory range, and for untrusted DMA requests whose target address is within the preset memory range, remap the DMA request to a non-secure memory range.
[0075] Optionally, the DMA access device may further include: a determination module, configured to determine the DMA request as an untrusted DMA request if the identity information corresponding to the DMA request is outside the security mapping table.
[0076] Optionally, the device further includes: The first translation module is used to perform address translation on the untrusted DMA request in the untrusted mapping domain when the untrusted DMA request exists in the mapping domain and is mapped to an untrusted mapping domain based on the input / output virtualization address mapping table; the untrusted mapping domain includes mapping domains other than the mapping domain of the confidential virtual machine. The second translation module is used to forcibly modify the mapping result of the untrusted DMA request to a reserved domain when the untrusted DMA request exists in the mapping domain and is mapped to the mapping domain of the confidential virtual machine based on the input / output virtualization address mapping table. In the reserved domain, the untrusted DMA request is address translated. The reserved domain includes mapping domains other than the mapping domain of the confidential virtual machine.
[0077] Optionally, the determining module includes: The first determining and marking unit is configured to, when the identity information corresponding to the DMA request is located outside the security mapping table and the DMA request has a domain mapping, and the DMA request is mapped to an untrusted mapping domain based on the input / output virtualization address mapping table, perform address translation on the DMA request in the untrusted mapping domain, and determine and mark the DMA request as an untrusted DMA request; the untrusted mapping domain includes: mapping domains outside the mapping domain of the confidential virtual machine; The second determination and marking unit is configured to, when the identity information corresponding to the DMA request is located outside the security mapping table and the DMA request has a domain mapping, and the DMA request is mapped to the mapping domain of the confidential virtual machine based on the input / output virtualization address mapping table, forcibly modify the mapping result of the DMA request to a reserved domain, perform address translation on the DMA request in the reserved domain, and determine and mark the DMA request as an untrusted DMA request; the reserved domain includes: mapping domains outside the mapping domain of the confidential virtual machine; The third determination and marking unit is used to determine and mark the DMA request as an untrusted DMA request when the identity information corresponding to the DMA request is outside the security mapping table and the DMA request does not have a domain mapping.
[0078] Optionally, the device further includes: A mapping module is used to map the DMA request to the mapping domain of the confidential virtual machine bound to the issuing device based on the security mapping table, when the identity information corresponding to the DMA request is located in the security mapping table. The DMA third access module is used to perform address translation on the DMA request in the mapping domain of the confidential virtual machine and access the memory domain of the confidential virtual machine.
[0079] Optionally, the device further includes: The first setting module is used to set the address of the first-level directory table of the mapping domain of the confidential virtual machine to be located in the memory protected by the trusted computing base, and to bind it to the confidential virtual machine; The second setting module is used to set the address modification permission of the first-level directory table of the mapping domain of the confidential virtual machine to only allow modification by the trusted computing base.
[0080] Optionally, the device further includes: The third setting module is used to set the traversal configuration of page tables at all levels in the mapping domain of the confidential virtual machine to be modified only by the trusted computing base; The fourth setting module is used to set the modification permission of the translation backup buffer in the mapping domain of the confidential virtual machine to allow only hardware modification.
[0081] Optionally, the device further includes: The partitioning module is used to classify devices into trusted devices and untrusted devices; A binding module is used to bind the trusted device to at least one confidential virtual machine; The storage module is used to store the correspondence between the trusted device, the confidential virtual machine bound to the trusted device, and the mapping domain of the confidential virtual machine bound to the trusted device in the security mapping table.
[0082] Optionally, the storage module includes: The storage submodule is used by the trusted computing base to store the correspondence between the trusted device, the confidential virtual machine bound to the trusted device, and the mapping domain of the confidential virtual machine bound to the trusted device in the security mapping table.
[0083] Optionally, the target security filtering register may be configured by a trusted computing base.
[0084] Optionally, if the security attribute is secure, the preset memory includes: the memory domain of the confidential virtual machine; The non-secure memory range includes the memory range outside the memory domain of the confidential virtual machine.
[0085] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.
[0086] Figure 6 This is a structural diagram of an electronic device provided in an embodiment of the present invention. (Refer to...) Figure 6 The present invention also provides an electronic device, see [link to relevant documentation]. Figure 6 It includes: a processor 401, a memory 402, and a computer program 4021 stored in the memory and executable on the processor. When the processor executes the program, it implements the steps of the various embodiments of the DMA access method described above.
[0087] The present invention also provides a readable storage medium, wherein when the instructions in the storage medium are executed by the processor of an electronic device, the electronic device is able to perform the steps of the embodiments of the DMA access method described above.
[0088] The present invention also provides a computer program product, comprising: a computer program, which, when executed by a processor, implements the steps of the various embodiments of the DMA access method described above.
[0089] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.
[0090] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, electronic devices, readable storage media, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0091] Embodiments of the present invention are described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0092] These computer program instructions may also be stored in a computer-readable storage medium capable of directing a computer or other programmable data processing terminal device to operate in a predictive manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0093] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0094] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.
[0095] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.
[0096] The foregoing has provided a detailed description of a DMA access method and apparatus, an electronic device, a storage medium, and a computer program product provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, based on the ideas of the present invention, there will be variations in specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.
Claims
1. A DMA access method, characterized in that, The method includes: Receive a DMA request; the DMA request includes: the identity information of the sending device, and the target address to be accessed; In the case that the DMA request is an untrusted DMA request, a target security filter register is matched according to the identity information; the target security filter register specifies a preset memory segment in memory, and the target security filter register stores the security attributes of the preset memory segment; the security attributes include: secure or insecure; When the security attribute is insecure: only untrusted DMA requests with the target address within the preset memory range are allowed to access the preset memory; for untrusted DMA requests with the target address outside the preset memory range, the untrusted DMA requests are remapped to an insecure memory range. When the security attribute is secure: only untrusted DMA requests whose target address is not within the preset memory range are allowed to access; for untrusted DMA requests whose target address is within the preset memory range, the DMA requests are remapped to an unsecured memory range.
2. The DMA access method according to claim 1, characterized in that, Before matching the target security filter register based on the identity information in the case that the DMA request is an untrusted DMA request, the method further includes: If the identity information corresponding to the DMA request is outside the security mapping table, the DMA request is determined to be an untrusted DMA request.
3. The DMA access method according to claim 2, characterized in that, Before matching the target security filter register based on the identity information, the method further includes: In the case where the untrusted DMA request exists in a domain mapping and is mapped to an untrusted mapping domain based on the input / output virtualization address mapping table, the untrusted DMA request is address translated in the untrusted mapping domain; the untrusted mapping domain includes mapping domains outside the mapping domain of the confidential virtual machine. If the untrusted DMA request has a domain mapping and is mapped to the mapping domain of the confidential virtual machine based on the input / output virtualization address mapping table, the mapping result of the untrusted DMA request is forcibly modified to a reserved domain, in which address translation is performed on the untrusted DMA request; the reserved domain includes mapping domains outside the mapping domain of the confidential virtual machine.
4. The DMA access method according to claim 2, characterized in that, The step of determining the DMA request as an untrusted DMA request when the identity information corresponding to the DMA request is outside the security mapping table includes: If the identity information corresponding to the DMA request is located outside the security mapping table, the DMA request has a domain mapping, and the DMA request is mapped to an untrusted mapping domain based on the input / output virtualization address mapping table, then the DMA request is address translated in the untrusted mapping domain, and the DMA request is identified and marked as an untrusted DMA request; the untrusted mapping domain includes mapping domains outside the mapping domain of the confidential virtual machine. If the identity information corresponding to the DMA request is located outside the security mapping table, and the DMA request has a domain mapping, and the DMA request is mapped to the mapping domain of the confidential virtual machine based on the input / output virtualization address mapping table, the mapping result of the DMA request is forcibly modified to a reserved domain. In the reserved domain, the DMA request is address translated, and the DMA request is identified and marked as an untrusted DMA request. The reserved domain includes mapping domains outside the mapping domain of the confidential virtual machine. If the identity information corresponding to the DMA request is outside the security mapping table and the DMA request does not have a domain mapping, the DMA request is identified and marked as an untrusted DMA request.
5. The DMA access method according to claim 2, characterized in that, The method further includes: If the identity information corresponding to the DMA request is located in the security mapping table, the DMA request is mapped to the mapping domain of the confidential virtual machine bound to the issuing device based on the security mapping table; In the mapping domain of the confidential virtual machine, the DMA request is address translated, and the memory domain of the confidential virtual machine is accessed.
6. The DMA access method according to claim 5, characterized in that, The method further includes: Set the address of the first-level directory table of the mapping domain of the confidential virtual machine to be located in the memory protected by the trusted computing base, and bind it to the confidential virtual machine; Set the address modification permission of the first-level directory table of the mapping domain of the confidential virtual machine to allow modification only by the trusted computing base.
7. The DMA access method according to claim 5, characterized in that, The method further includes: Configure the traversal of page tables at all levels in the mapping domain of the confidential virtual machine to allow modification only by the trusted computing base; Set the modification permissions for the translation backup buffer in the mapping domain of the confidential virtual machine to allow only hardware modifications.
8. The DMA access method according to any one of claims 2 to 7, characterized in that, The method further includes: The devices are classified into trusted devices and untrusted devices; Bind the trusted device to at least one confidential virtual machine; The mapping relationship between the trusted device, the confidential virtual machine bound to the trusted device, and the mapping domain of the confidential virtual machine bound to the trusted device is stored in the security mapping table.
9. The DMA access method according to claim 8, characterized in that, The step of storing the correspondence between the trusted device, the confidential virtual machine bound to the trusted device, and the mapping domain of the confidential virtual machine bound to the trusted device in the security mapping table includes: The trusted computing base stores the correspondence between the trusted device, the confidential virtual machine bound to the trusted device, and the mapping domain of the confidential virtual machine bound to the trusted device in the security mapping table.
10. The DMA access method according to any one of claims 1 to 7, characterized in that, The target security filtering register is configured by the trusted computing base.
11. The DMA access method according to any one of claims 1 to 7, characterized in that, When the security attribute is secure, the preset memory includes: the memory domain of the confidential virtual machine; The non-secure memory range includes the memory range outside the memory domain of the confidential virtual machine.
12. A DMA access device, characterized in that, The device includes: A receiving module is used to receive DMA requests; the DMA request includes: the identity information of the sending device, and the target address to be accessed; A matching module is used to match a target security filter register based on the identity information when the DMA request is an untrusted DMA request; the target security filter register specifies a preset memory segment in memory, and the target security filter register stores the security attributes of the preset memory segment; the security attributes include: secure or insecure; The DMA first access module is configured to, when the security attribute is insecure, only allow untrusted DMA requests with the target address within the preset memory range to access the preset memory, and for untrusted DMA requests with the target address outside the preset memory range, remap the untrusted DMA requests to an insecure memory range. The second DMA access module is configured to, when the security attribute is secure, only allow access to untrusted DMA requests whose target address is not within the preset memory range, and for untrusted DMA requests whose target address is within the preset memory range, remap the DMA request to a non-secure memory range.
13. An electronic device, characterized in that, include: A processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the program, it implements the steps of the DMA access method as described in any one of claims 1 to 11.
14. A readable storage medium, characterized in that, When the instructions in the storage medium are executed by the processor of the electronic device, the electronic device is able to perform the steps of the DMA access method according to any one of claims 1 to 11.
15. A computer program product, characterized in that, include: A computer program, when executed by a processor, implements the steps of the DMA access method according to any one of claims 1 to 11.