Method for accessing exclusive device, and related apparatus

Abstract

A method for accessing an exclusive device, applied in the technical field of computers. In the method for accessing an exclusive device, for a scenario with two independent operating systems, an access request for an exclusive device sent by an application in a first operating system is converted into an access assistance request sent to an application in a second operating system, so as to request the application in the second operating system to assist in accessing the exclusive device; and a controller is configured in the second operating system to control mutually exclusive access of the application in the second operating system to the exclusive device, and finally the access requests for the exclusive device in the first operating system and the second operating system are both passed through the controller configured in the second operating system, so that concurrent access of applications to an exclusive device can be limited in a scenario with double operating systems, and normal use of the exclusive device is prevented from being affected.

Description

A method for accessing exclusive equipment and related device

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office on September 28, 2023, with application number 202311288407.4 and application name “A method for accessing an exclusive device and related devices”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of computer technology, and in particular to a method for accessing an exclusive device and related apparatus. Background Art

[0003] Security modules include the Trusted Platform Module (TPM) and the Trusted Cryptography Module (TCM). They are commonly used to protect the integrity of system boot firmware and the security of computer devices. Generally speaking, a security module is a monopoly device, meaning it can only be accessed by one application at a time. If multiple applications access the security module simultaneously, the module may experience tampering with input parameters or output results, or may experience operational anomalies.

[0004] Based on this, related technologies usually limit concurrent access of multiple applications to exclusive devices to ensure that only one application accesses the exclusive device at the same time, thereby ensuring the normal operation of the exclusive device.

[0005] However, in some scenarios, exclusive devices are still prone to problems such as parameter tampering or abnormal operation during operation, affecting the normal use of exclusive devices.

[0006] Summary of the Invention

[0007] The present application provides a method for accessing an exclusive device, which can limit the concurrent access of multiple applications to the exclusive device, thereby avoiding affecting the normal use of the exclusive device.

[0008] The first aspect of the present application provides a method for accessing an exclusive device, which is applied to a first controller. In this method, the first controller first obtains a first request message from a first application, and the first request message is used to request access to the exclusive device. The first controller and the first application both run in a first operating system, that is, the first controller and the first application are both software modules running in the first operating system. The first operating system runs on a processor other than the exclusive device. In addition, the processor running the first operating system and the exclusive device are located on the same network device (such as the same network device such as a computer, switch or gateway).

[0009] Next, in response to the second operating system being started, the first controller sends a second request message to a second application running in the second operating system based on the first request message. The second request message is used to request the second application to assist the first application in accessing the exclusive device. Because the second request message is used to request the second application to assist the first application in accessing the exclusive device, the process of the first application requesting access to the exclusive device is completed by the second application, and the first controller no longer forwards the first request message from the first application to the exclusive device.

[0010] In which, the second operating system runs on a processor outside the exclusive device, the processors running the first operating system and the second operating system are connected to the exclusive device through a bus, and a second controller runs in the second operating system, and the second controller is used to control the mutually exclusive access of the application in the second operating system to the exclusive device.

[0011] In this solution, when there are two independent operating systems, the access request for the exclusive device sent by the application in the first operating system is converted into an assistance access request sent to the application in the second operating system, thereby requesting the application in the second operating system to assist in accessing the exclusive device; and a controller is set in the second operating system to control the mutually exclusive access of the application in the second operating system to the exclusive device, so that the access requests for the exclusive device in the first operating system and the second operating system are finally achieved through the controller set in the second operating system, ensuring that the concurrent access of the application to the exclusive device can be limited in the dual operating system scenario to avoid affecting the normal use of the exclusive device.

[0012] In one possible implementation, both the first operating system and the second operating system can operate independently. That is, the first operating system does not rely on the second operating system during normal operation, and the second operating system does not rely on the first operating system during normal operation. Specifically, when concurrent access restrictions on exclusive devices are not enforced on applications in the first and second operating systems, applications in the first operating system can independently access exclusive devices, and applications in the second operating system can also independently access exclusive devices.

[0013] In one possible implementation, the first operating system runs in the non-secure world and the second operating system runs in the secure world. For example, the first operating system is a real-time operating system (RTOS) and the second operating system is an open portable trusted execution environment (OP-TEE).

[0014] In a possible implementation, the first operating system and the second operating system run on the same processor, and the processor is connected to the exclusive device.

[0015] In this solution, access requests to exclusive devices in different operating systems running in the non-secure world and the secure world are all passed through the controller set in the operating system in the secure world, ensuring that concurrent access to exclusive devices by applications can be limited in specific scenarios where the device has a secure world and a non-secure world.

[0016] In one possible implementation, the processor includes a network processor (NP), a central processing unit (CPU), a graphics processing unit (GPU), a tensor processing unit (TPU), or a data processing unit (DPU).

[0017] In one possible implementation, the second controller belongs to the driver component of the exclusive device. For example, in the case where the exclusive device is a TPM, the second controller belongs to the driver component of the TPM, that is, the driver component of the TPM can implement the concurrent access restriction function performed by the second controller. Since the second controller runs in the second operating system, and the second operating system runs on a processor other than the exclusive device, and the software modules on the second operating system need to pass through the driver component of the exclusive device set in the second operating system when accessing the exclusive device, therefore, by setting the second controller in the driver component of the exclusive device, it can be ensured that the second controller obtains access request messages from all applications in the second operating system.

[0018] In a possible implementation, the exclusive device is any one of the following devices: a TPM, a TCM, or a storage chip, such as a NAND flash chip or a NOR flash chip.

[0019] In one possible implementation, the above-mentioned method for accessing an exclusive device also includes: the first controller obtains a first response message from the second application, the first response message including feedback data returned by the exclusive device after the second application assists in accessing the exclusive device; then, the first controller forwards the first response message to the first application.

[0020] That is, the first controller returns the feedback data obtained from the exclusive device to the first application program in the original path, so that the first application program can obtain the feedback data returned by the exclusive device.

[0021] In one possible implementation, the above-mentioned method for accessing an exclusive device also includes: the first controller obtains a third request message from the first application, and the third request message is used to request access to the exclusive device; in response to the second operating system not being started, the first controller forwards the third request message to the third controller, the third controller runs in the first operating system, and the third controller is used to control the mutual exclusive access of the application in the first operating system to the exclusive device.

[0022] That is to say, when the second operating system is not started, the request message received by the first controller from the application requesting access to the exclusive device will be forwarded to the third controller, and the third controller will be further responsible for processing the request message to ensure that only one application accesses the exclusive device at the same time.

[0023] In a possible implementation, when the second operating system is not started, the first controller is further configured to control mutually exclusive access of applications in the first operating system to the exclusive device. That is, the first controller is responsible for limiting concurrent access of multiple applications to the exclusive device.

[0024] A second aspect of the present application provides a method for accessing an exclusive device. The method is applied to a control module, the control module including a first access port and a second access port, and the control module is connected to the exclusive device. Specifically, the method for accessing the exclusive device includes: first, the control module obtains a first access request message through the first access port and obtains a second access request message through the second access port, the first access request message originating from a first processing system connected to the first access port, and the second access request message originating from a second processing system connected to the second access port, and both the first access request message and the second access request message are used to request access to the exclusive device.

[0025] Then, the control module sequentially forwards the first access request message and the second access request message to the exclusive device, so that the exclusive device only processes one access request message at a time.

[0026] In this solution, a control module is set between the exclusive device and multiple independent processing systems, and the control module serves as a unified entrance for accessing the exclusive device. This allows the access requests of multiple processing systems to the exclusive device to be processed by the control module, thereby achieving control of the mutually exclusive access of multiple processing systems to the exclusive device.

[0027] In one possible implementation, the first processing system includes a first processor, and the second processing system includes a second processor, that is, the first processing system and the second processing system are composed of different processors.

[0028] In one possible implementation, the first processor and the second processor are deployed on the same system on a chip (SoC). That is, the first processing system and the second processing system are deployed simultaneously on the same SoC, and the different processing systems on the SoC are composed of different processors. Furthermore, the first processing system and the second processing system access the first access port and the second access port, respectively, through different interfaces on the same SoC, and thus send access request messages to the control module through the first access port and the second access port.

[0029] In a possible implementation, the control module is deployed on the SoC where the first processing system and the second processing system are located.

[0030] In this solution, by setting a control module on the same SoC to control concurrent access to multiple processing systems on the SoC, it can be ensured that the processing systems in the SoC can access exclusive devices normally without the situation where multiple processing systems concurrently access exclusive devices and cause abnormal operation of the exclusive devices.

[0031] In one possible implementation, the control module is deployed on a processing device outside the SoC where the first processing system and the second processing system are located, and the processing device is connected to the first processor through a first access port, and the processing device is connected to the second processor through a second access port.

[0032] In other words, the control module is no longer integrated into the SoC. Instead, it is connected to the SoC as a separate processing device, enabling concurrent access control to multiple processing systems within the SoC. This eliminates the need to adjust the SoC's structure in practical applications. Instead, a separate processing device is designed and manufactured to connect between the SoC and the dedicated device, ensuring that the original SoC can still access the dedicated device normally.

[0033] In one possible implementation, the processing device is a processor, an application specific integrated circuit (ASIC) chip, or a programmable logic device.

[0034] A third aspect of the present application provides an access device for an exclusive device, wherein the access device for the exclusive device is a first controller, and the access device for the exclusive device includes:

[0035] an acquiring unit, configured to acquire a first request message from a first application, the first request message being used to request access to an exclusive device, the first controller and the first application both running in a first operating system, and the first operating system running on a processor other than the exclusive device;

[0036] a sending unit, configured to send, in response to the second operating system being started, a second request message to a second application running in the second operating system based on the first request message, wherein the second request message is used to request the second application to assist in accessing the exclusive device;

[0037] In which, the second operating system runs on a processor outside the exclusive device, the processors running the first operating system and the second operating system are connected to the exclusive device through a bus, and a second controller runs in the second operating system, and the second controller is used to control the mutually exclusive access of the application in the second operating system to the exclusive device.

[0038] In a possible implementation, both the first operating system and the second operating system can run independently.

[0039] In a possible implementation, the first operating system runs in a non-secure world, and the second operating system runs in a secure world.

[0040] In a possible implementation, the first operating system and the second operating system run on the same processor, and the processor is connected to the exclusive device.

[0041] In one possible implementation, the processor includes an NP, a CPU, a GPU, a TPU, or a DPU.

[0042] In a possible implementation, the second controller belongs to a driving component of the exclusive device.

[0043] In a possible implementation, the exclusive device is any one of the following devices: a TPM, a TCM, or a memory chip.

[0044] In a possible implementation, the acquiring unit is further configured to acquire a first response message from the second application, the first response message including feedback data returned by the exclusive device after the second application assists in accessing the exclusive device;

[0045] The sending unit is further configured to forward the first response message to the first application.

[0046] In a possible implementation, the acquiring unit is further configured to acquire a third request message from the first application, where the third request message is used to request access to the exclusive device;

[0047] The sending unit is further configured to forward a third request message from the first controller to a third controller in response to the second operating system not being started. The third controller runs in the first operating system and is configured to control exclusive access of applications in the first operating system to the exclusive device.

[0048] In a possible implementation, the apparatus for accessing the exclusive device further includes: a control unit configured to control exclusive access of an application in the first operating system to the exclusive device when the second operating system is not started.

[0049] A fourth aspect of the present application provides an access device for an exclusive device, the access device for the exclusive device being applied to a control module, the control module including a first access port and a second access port, and the control module being connected to the exclusive device. The access device for the exclusive device includes:

[0050] an acquiring unit, configured to acquire a first access request message through a first access port and a second access request message through a second access port, wherein the first access request message comes from a first processing system connected to the first access port, and the second access request message comes from a second processing system connected to the second access port, and both the first access request message and the second access request message are used to request access to the exclusive device;

[0051] The sending unit is used to sequentially forward the first access request message and the second access request message to the exclusive device, so that the exclusive device only processes one access request message at a time.

[0052] In one possible implementation, the first processing system includes a first processor, the second processing system includes a second processor, and the first processor and the second processor are deployed on the same SoC.

[0053] In a possible implementation, the control module is deployed on the SoC.

[0054] In a possible implementation, the control module is deployed on a processing device, the processing device is connected to the first processor through a first access port, and the processing device is connected to the second processor through a second access port.

[0055] In a possible implementation, the processing device is a processor, an ASIC chip, or a programmable logic device.

[0056] In a fifth aspect, the present application provides a network device comprising a processor and a memory; wherein the memory is used to store program code, and the processor is used to call the program code in the memory so that the network device executes a method as in any one of the implementation methods of the first to second aspects.

[0057] In a sixth aspect, the present application provides a computer-readable storage medium storing instructions. When the instructions are executed on a computer, the computer executes a method as in any one of the embodiments of the first to second aspects.

[0058] In a seventh aspect, the present application provides a computer program product, which, when executed on a computer, enables the computer to execute a method as in any one of the embodiments of the first to second aspects.

[0059] In an eighth aspect, the present application provides a chip comprising one or more processors. Part or all of the processors are used to read and execute computer instructions stored in a memory to execute the method in any possible implementation of any of the above aspects. Optionally, the chip also includes a memory. Optionally, the chip also includes a communication interface, and the processor is connected to the communication interface. The communication interface is used to receive data and / or information to be processed, the processor obtains data and / or information from the communication interface, processes the data and / or information, and outputs the processing results through the communication interface. Optionally, the communication interface is an input / output interface or a bus interface. The method provided in the present application is implemented by one chip, or by multiple chips working together.

[0060] The solutions provided in the third to eighth aspects are used to implement or cooperate with the methods provided in the first to second aspects, and therefore can achieve the same or corresponding beneficial effects as the first to second aspects, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] FIG1 is a schematic diagram of a system architecture provided in an embodiment of the present application;

[0062] FIG2 is a schematic diagram of a system architecture used in a method for accessing an exclusive device provided in an embodiment of the present application;

[0063] FIG3 is a flow chart of a method for accessing an exclusive device provided in an embodiment of the present application;

[0064] FIG4 is another schematic diagram of a system architecture used in a method for accessing an exclusive device provided in an embodiment of the present application;

[0065] FIG5 is a schematic diagram of the architecture of a network device provided in an embodiment of the present application;

[0066] FIG6 is another schematic diagram of the architecture of a network device provided in an embodiment of the present application;

[0067] FIG7 is a schematic diagram of a TPM access process provided by an embodiment of the present application;

[0068] FIG8 illustrates the data flow of accessing the TPM when the operating system of a secure world is started according to an embodiment of the present application;

[0069] FIG9 illustrates the data flow for accessing the TPM when the operating system of a secure world is not started, according to an embodiment of the present application;

[0070] FIG10 is a schematic diagram of an application architecture of a method for accessing an exclusive device provided in an embodiment of the present application;

[0071] FIG11 is a schematic diagram of the structure of a processing system provided in an embodiment of the present application;

[0072] FIG12 is a schematic diagram of a structure in which a control module is deployed on a SoC according to an embodiment of the present application;

[0073] FIG13 is a schematic diagram of a structure in which a control module is deployed outside a SoC according to an embodiment of the present application;

[0074] FIG14 is a schematic diagram of the structure of a control module for implementing TPM concurrent access control according to an embodiment of the present application;

[0075] FIG15 is a schematic structural diagram of an access device for an exclusive device provided in an embodiment of the present application;

[0076] FIG16 is a schematic structural diagram of another exclusive device access device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0077] In order to make the purpose, technical solutions and advantages of this application more clearly understood, the following describes the embodiments of this application in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this application, rather than all the embodiments. It is known to those skilled in the art that with the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0078] The terms "first", "second" and the like in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0079] To facilitate understanding, some technical terms involved in this embodiment are introduced below.

[0080] (1) Exclusive equipment

[0081] An exclusive device is a device that allows a single application to use it exclusively during its entire runtime. That is, once an exclusive device is assigned to an application, it becomes the exclusive use of that application, and other applications are prohibited from accessing the exclusive device until the assigned application has finished using it and released it.

[0082] (2) Trusted Platform Module (TPM)

[0083] A TPM is a chip embedded in a computer that provides a root of trust. Specifically, a TPM is a small chip containing cryptographic processing and storage components that securely stores information used to verify the security of a platform (e.g., network devices like switches and personal computers), such as passwords, certificates, or encryption keys. Using built-in algorithms, the TPM generates trusted keys and ensures the confidentiality and integrity of these keys and other sensitive data through its Non-Volatile Random Access Memory (NVRAM) and Storage Root Key (SRK).

[0084] (3) Trusted Cryptography Module (TCM)

[0085] Similar to TPM, TCM is a chip embedded in a computer that provides a root of trust. The difference between TCP and TPM is that they use different cryptographic algorithms.

[0086] (4) Secure world and non-secure world

[0087] To provide a secure operating environment for computer applications or components, ARM processors have introduced TrustZone technology. ARM processors supporting TrustZone divide hardware and software resources into a secure and non-secure world.

[0088] General operating systems and most applications run in the non-secure world. The non-secure world has more development resources than the secure world, so it is often called a rich execution environment (REE). Trusted operating systems run in the secure world, which is often called a trusted execution environment (TEE).

[0089] Please refer to Figure 1, which is a schematic diagram of a system architecture provided in an embodiment of the present application. As shown in Figure 1, the system architecture includes a trusted execution environment and a rich execution environment. The trusted execution environment is specially provided for highly security-sensitive applications and can ensure the confidentiality of the resources and data of the application. The rich execution environment is provided for traditional operating systems and general applications. Applications executed on the rich execution environment side are called client applications (CA), such as third-party payment applications such as banking applications. Applications executed on the trusted execution environment side are called trusted applications (TA), such as applications that perform key services such as signing, encryption and decryption calculations.

[0090] Because the TA runs within a trusted execution environment (TEE), its deployment and upgrade operations must strictly adhere to the security verification specifications of the TEE issuer, such as the use of digital signatures, to ensure that every aspect of the TEE is truly trustworthy. The TEE includes the Trusted Execution Environment (TEE) internal application programming interface (API) and trusted operating system components. The TEE Internal API primarily provides trusted operating system component functionality, communicates with client applications (CAs), enables TA-TA communication, and provides secure storage, cryptographic, and time functions. Trusted operating system components primarily include trusted device drivers and the Trusted Execution Environment (TEE) communication agent. The TEE communication agent provides a secure communication channel between the TA and the CA. For example, the TEE communication agent passes messages to the Rich Execution Environment (TEE) communication agent via platform hardware, enabling interaction between the TA and the CA. Furthermore, a monitor is used to facilitate handover between the REE and the TEE.

[0091] The rich execution environment includes the trusted execution environment client application programming interface (TEE Client API) and a rich operating system. The rich operating system components primarily include public device drivers and a rich execution environment communication agent. The rich execution environment communication agent is used to communicate with the trusted execution environment, providing a secure communication channel between the CA and the trusted agent. The public device driver is used to drive public devices in the platform hardware. The CA uses the TEE Client API and TEE Functional API to access the security services provided by the trusted agent.

[0092] (5) Mutually exclusive access

[0093] Mutually exclusive access means that when multiple applications try to access a shared resource at the same time, only one application is allowed to access the shared resource to ensure data consistency and reliability.

[0094] (6) Bus

[0095] A bus is a common communication trunk used to transmit information between various functional components in a network device. A bus is essentially a transmission bundle composed of wires.

[0096] Generally speaking, due to the uniqueness of exclusive devices, related technologies usually limit concurrent access to exclusive devices by multiple applications when using exclusive devices, ensuring that only one application accesses the exclusive device at the same time, thereby ensuring the normal operation of the exclusive device.

[0097] However, the inventors' research has revealed that related techniques typically restrict access to exclusive devices by multiple applications within the same operating system. In some specific scenarios, these techniques cannot fully guarantee that only one application can access an exclusive device at a time. Exclusive devices are still susceptible to parameter tampering and operational anomalies during operation, impacting their normal use.

[0098] Specifically, when multiple independently running operating systems are deployed on the same device, applications running on different operating systems may access the exclusive device simultaneously. Since related technologies cannot restrict concurrent access by applications running on different operating systems, this can easily cause the exclusive device to become unusable.

[0099] Based on this, an embodiment of the present application provides a method for accessing an exclusive device. When the same device has two independent operating systems, the access request for the exclusive device sent by the application in the first operating system is converted into an assistance access request sent to the application in the second operating system, thereby requesting the application in the second operating system to assist in accessing the exclusive device; and, a controller is set in the second operating system to control the mutually exclusive access of the application in the second operating system to the exclusive device, and finally, the access requests for the exclusive device in the first operating system and the second operating system are all passed through the controller set in the second operating system, ensuring that in the dual operating system scenario, the concurrent access of the application to the exclusive device can be limited to avoid affecting the normal use of the exclusive device.

[0100] Please refer to Figure 2, which is a schematic diagram of a system architecture used in a method for accessing an exclusive device provided in an embodiment of the present application. As shown in Figure 2, the system architecture includes a processor and an exclusive device, and the processor is connected to the exclusive device via a bus. A first operating system and a second operating system are running on the processor. A first application and a first controller are running on the first operating system, and a second application and a second controller are running on the second operating system. Furthermore, the applications in both the first operating system and the second operating system can access the exclusive device via the bus.

[0101] In the first operating system, access requests sent by the first application to the exclusive device will pass through the first controller; in the second operating system, access requests sent by the second application to the exclusive device will pass through the second controller. When both the first and second operating systems are activated, the first controller will convert the access request sent by the first application to the exclusive device into an assist access request sent to the second application, allowing the second application to assist the first application in accessing the exclusive device. This ensures that access requests for the exclusive device from both operating systems ultimately pass through the second controller.

[0102] Please refer to Figure 3, which is a flow chart of a method for accessing an exclusive device provided by an embodiment of the present application. As shown in Figure 3, the method for accessing an exclusive device includes the following steps 301-308.

[0103] Step 301: A first controller obtains a first request message from a first application program, where the first request message is used to request access to an exclusive device.

[0104] In this embodiment, the first controller and the first application both run in the first operating system, that is, the first controller and the first application are software modules running in the first operating system. The first operating system runs on a processor outside the exclusive device. In addition, the processor running the first operating system and the exclusive device are located on the same network device (such as the same computer, switch, or gateway), and the processor running the first operating system is connected to the exclusive device via a bus. Therefore, the first application running in the first operating system can access the exclusive device via the bus.

[0105] When a first application needs to access an exclusive device, it sends a first request message requesting access to the exclusive device. This first request message passes through the first controller. That is, all access requests from the first application to the exclusive device pass through the first controller, which then processes the request.

[0106] The first request message sent by the first application includes content that the first application requests the exclusive device to complete. For example, the first request message is used to request the exclusive device to generate a key for the first application.

[0107] Optionally, the exclusive device is, for example, a TPM, a TCM, or a storage chip that does not support simultaneous access by multiple applications, such as a NAND flash chip or a NOR flash chip. This embodiment does not impose any specific restrictions on the type of the exclusive device.

[0108] Step 302: In response to the second operating system being started, the first controller sends a second request message to a second application running in the second operating system based on the first request message, where the second request message is used to request the second application to assist in accessing the exclusive device.

[0109] If the second operating system has already been started, the first controller generates a second request message based on the first request message and sends the second request message to the second application in the second operating system. Since the second request message is used to request the second application to assist the first application in accessing the exclusive device, the process of the first application requesting access to the exclusive device is completed by the second application, and the first controller no longer forwards the first request message from the first application to the exclusive device.

[0110] It should be noted that the specific content of the second request message generated by the first controller is related to the content of the first request message. For example, if the first request message is used to request the exclusive device to generate a key for the first application, the second request message sent by the first controller to the second application is used to instruct the second application to assist the first application in requesting the exclusive device to generate a key.

[0111] The second operating system runs on a processor other than the exclusive device, and the processor running the second operating system is connected to the exclusive device via a bus.

[0112] Optionally, both the first operating system and the second operating system can operate independently, i.e., the first operating system does not rely on the second operating system during normal operation, and the second operating system does not rely on the first operating system during normal operation. Specifically, when concurrent access restrictions on exclusive devices are not enforced on applications in the first and second operating systems, applications in the first operating system can independently access exclusive devices, and applications in the second operating system can also independently access exclusive devices.

[0113] Exemplarily, the first operating system runs in the non-secure world, and the second operating system runs in the secure world. For example, the first operating system is a real-time operating system (RTOS), and the second operating system is an open portable trusted execution environment (OP-TEE). Moreover, the first operating system and the second operating system run on the same processor connected to the exclusive device. In this way, the non-secure world and the secure world are actually two states of processor operation. The processor switches between the two states to independently run the first operating system and the second operating system. When the processor switches to the non-secure world state, the processor runs the first operating system; when the processor switches to the secure world state, the processor runs the second operating system.

[0114] Optionally, the processor running the first operating system and the second operating system includes, for example, a network processor (NP), a central processing unit (CPU), a graphics processing unit (GPU), a tensor processing unit (TPU) or a data processing unit (DPU). This embodiment does not specifically limit the type of processor.

[0115] Furthermore, in some possible examples, the first operating system and the second operating system also run on different processors, and a physical connection is established between the processor running the first operating system and the processor running the second operating system, so that the first controller in the first operating system and the second application in the second operating system can interact with each other.

[0116] Step 303: Based on the received second request message, the second application sends an access request message to the second controller, where the access request message is used to request access to the exclusive device.

[0117] In this embodiment, the specific content of the access request message sent by the second application to the second controller is related to the content of the second request message. For example, if the second request message is used to instruct the second application to assist the first application in requesting the exclusive device to generate a key, the access request message sent by the second application to the second controller is used to request the exclusive device to generate a key.

[0118] The second operating system also runs a second controller, which is used to control the mutually exclusive access of the application program in the second operating system to the exclusive device.

[0119] In other words, all applications in the second operating system must access the exclusive device through the second controller when they need to access the exclusive device. The second controller can obtain access request messages sent by all applications in the second operating system to the exclusive device and then forward and process the access request messages sent by these applications in an orderly manner, ensuring that the exclusive device only processes one access request message at a time.

[0120] For example, when the second controller obtains access request messages sent by multiple applications in the second operating system at the same time, the second controller first forwards one of the access request messages to the exclusive device, and after the exclusive device processes one access request message, it forwards the next access request message to the exclusive device, thereby ensuring that the exclusive device will not obtain another access request message when processing one access request message.

[0121] In one possible implementation, the second controller belongs to the driver component of the exclusive device. For example, in the case where the exclusive device is a TPM, the second controller belongs to the driver component of the TPM, that is, the driver component of the TPM can implement the concurrent access restriction function performed by the second controller. Since the second controller runs in the second operating system, and the second operating system runs on a processor other than the exclusive device, and the software modules on the second operating system need to pass through the driver component of the exclusive device set in the second operating system when accessing the exclusive device, therefore, by setting the second controller in the driver component of the exclusive device, it can be ensured that the second controller obtains access request messages from all applications in the second operating system.

[0122] Exemplarily, the second controller uses a software mutex mechanism to control exclusive access to the exclusive device by applications in the second operating system. Specifically, the second controller is provided with a software mutex. The software mutex has two states: unlocked and locked. When the second controller receives an access request message from an application in the second operating system for the exclusive device, it applies for a software mutex for the access request message received. If any access request message successfully applies for the software mutex, the second controller forwards the access request message that applied for the software mutex to the exclusive device, and the state of the software mutex changes from unlocked to locked. The second controller can no longer apply for a software mutex for other access request messages. After the exclusive device completes processing the access request message, the state of the software mutex changes from locked to unlocked, and the second controller can continue to apply for a software mutex for the access request message received to confirm subsequent access request messages that need to be forwarded to the exclusive device.

[0123] The above describes how the second controller uses a software mutex lock mechanism to control the exclusive access of applications in the second operating system to exclusive devices. In some embodiments, the second controller may also use other mechanisms to control the exclusive access of applications in the second operating system to exclusive devices. This embodiment does not specifically limit this.

[0124] Step 304: The second controller forwards the access request message from the second application to the exclusive device.

[0125] In this embodiment, after the second controller obtains the access request message from the second application, if the exclusive device is not currently processing an access request message, the second controller forwards the access request message from the second application to the exclusive device; if the exclusive device is currently processing an access request message, the second controller waits for the exclusive device to complete processing the access request message before forwarding the access request message from the second application to the exclusive device.

[0126] In general, by converting the access request sent by the application in the first operating system to the exclusive device into an assist access request sent to the application in the second operating system, the application in the second operating system assists the application in the first operating system to access the exclusive device, thereby ensuring that the access requests for the exclusive device in the two operating systems will eventually pass through the second controller in the second operating system for limiting concurrent access to the exclusive device.

[0127] Step 305: The exclusive device sends an access response message to the second controller.

[0128] After the exclusive device processes the access request message from the second application, the exclusive device generates an access response message and sends the access response message to the second controller.

[0129] The specific content of the access response message is related to the content requested by the exclusive device in the access request message. That is, the access response message includes the feedback data returned by the exclusive device in response to the access request message. For example, if the access request message is for requesting the exclusive device to generate a key, the access response message will include the key generated by the exclusive device.

[0130] Step 306: The second controller forwards the access response message to the second application.

[0131] Step 307: Based on the access response message, the second application sends a first response message to the first controller. The first response message includes feedback data returned by the exclusive device after the second application assists in accessing the exclusive device.

[0132] In this embodiment, since the second application assists the first application to access the exclusive device, after the exclusive device returns an access response message to the second application, the second application needs to return the feedback data returned by the exclusive device in the access response message to the first application through the first controller.

[0133] Specifically, the first response message is generated by the second controller based on the obtained access response message, and is used to instruct the second application to assist the first application in accessing the exclusive device and obtain a response result (i.e., feedback data returned by the exclusive device through the access response message). For example, if the second request message is used to instruct the second application to assist the first application in requesting the exclusive device to generate a key, the first response message includes a key generated by the exclusive device.

[0134] Step 308: The first controller forwards the first response message to the first application.

[0135] In general, the path for the first application in the first operating system to request access to the exclusive device is: first application → first controller → second application → second controller → exclusive device; the path for the first application in the first operating system to obtain feedback data returned by the exclusive device is: exclusive device → second controller → second application → first controller → first application.

[0136] The above embodiment describes a process in which an application in the first operating system accesses an exclusive device through an application in the second operating system, when both the first operating system and the second operating system are activated. In some cases, the first operating system is already activated, but the second operating system may not yet be activated. In this case, when the first operating system is already activated and the second operating system is not, the application in the two operating systems no longer has to access the exclusive device simultaneously. Therefore, the application in the first operating system no longer needs to access the exclusive device through the application in the second operating system.

[0137] For example, please refer to Figure 4, which is another schematic diagram of a system architecture applicable to an exclusive device access method provided in an embodiment of the present application. As shown in Figure 4, in the system architecture, since the second operating system is not started, only the first operating system is running on the processor. Furthermore, the first operating system runs a first application and a first controller. Optionally, the first operating system also runs a third controller.

[0138] When the first operating system is not running the third controller, the first controller is also used to control mutually exclusive access to exclusive devices by applications in the first operating system. That is, the first controller is responsible for limiting concurrent access to exclusive devices by multiple applications. The manner in which the first controller controls mutually exclusive access to exclusive devices by applications in the first operating system is similar to the manner in which the second controller controls mutually exclusive access to exclusive devices by applications in the second operating system in the aforementioned embodiment. For details, please refer to the aforementioned embodiment and will not be repeated here.

[0139] When the first operating system runs with a third controller, the first controller forwards access requests received from applications to the third controller, which then controls mutually exclusive access to the exclusive device by multiple applications. Specifically, the third controller is responsible for limiting concurrent access to the exclusive device by multiple applications, ensuring that only one application can access the exclusive device at a time.

[0140] For example, when the second operating system is not started, the first controller receives a third request message from the first application, where the third request message is used to request access to the exclusive device. The third request message is similar to the first request message described in the above embodiment. For details, please refer to the description of the first request message and will not be repeated here.

[0141] In response to the second operating system not being started, the first controller forwards a third request message to a third controller. The third controller runs within the first operating system and is configured to control mutually exclusive access to the exclusive device by applications within the first operating system. In other words, if the second operating system is not started, any request messages received by the first controller from applications requesting access to the exclusive device will be forwarded to the third controller, which will then process the request message to ensure that only one application can access the exclusive device at a time.

[0142] To facilitate understanding, the execution flow of the exclusive device access method provided by this embodiment in actual application will be described in detail below with reference to specific examples.

[0143] Exemplarily, please refer to Figure 5, which is a schematic diagram of the architecture of a network device provided in an embodiment of the present application. As shown in Figure 5, in the same network device (such as a network device such as a switch, a gateway or a computer), a system on chip (SoC) and a TPM are included. The SoC includes a processor, and two operating systems can be run on the processor, one operating system (such as RTOS) runs in a non-secure world, and the other operating system (such as OP-TEE) runs in a secure world. Among them, the processor in the SoC is connected to a serial peripheral interface (SPI) controller via an on-chip bus, and the SPI controller is connected to the TPM outside the SoC. The SPI controller is essentially a hardware interface on the SoC for realizing the connection between the SoC and the TPM.

[0144] Applications running in both operating systems on the SoC's processor can access the TPM. For example, an application running in the non-secure world's operating system could send a Platform Configuration Registers (PCR) extension command to the TPM while another application running in the secure world's operating system could send a command to obtain a random number. This could result in both applications in the non-secure world and the secure world accessing the TPM simultaneously.

[0145] The command sent by an application running in the secure world's operating system to obtain a random number from the TPM can be triggered by an application running in the non-secure world's operating system. For example, if application 1 running in the non-secure world requests application 2 running in the secure world to generate a key using a specific key algorithm, application 2 running in the secure world will then send a command to the TPM to obtain the random number used to generate the key.

[0146] For example, please refer to Figure 6, which is another architectural diagram of a network device provided in an embodiment of the present application. As shown in Figure 6, the system architecture shown in Figure 6 is a further concretization of the system architecture shown in Figure 5. In the SoC shown in Figure 6, a first application, a third application, and a first controller are running in the non-secure world. Optionally, a third controller is also running in the non-secure world. A second application, a fourth application, and a second controller are running in the secure world. Among them, the first application and the third application interact with the first controller, and the first controller also interacts with the third controller. The second application and the fourth application interact with the second controller. The third controller and the second controller are responsible for interacting with the SPI controller to achieve access to the TPM.

[0147] Optionally, the third controller is part of the TPM driver component in the non-secure world, and the second controller is part of the TPM driver component in the secure world. That is, the TPM driver component in the non-secure world is responsible for implementing the functions of the third controller, while the TPM driver component in the secure world is responsible for implementing the functions of the second controller.

[0148] Furthermore, the processor in the SoC also runs a monitor, which the processor uses to switch between the non-secure and secure worlds. The specific method for switching between the non-secure and secure worlds can be found in existing related technologies and will not be further described here.

[0149] It should be noted that the embodiment shown in Figure 6 uses an example in which the first and third applications are running in the non-secure world, and the second and fourth applications are running in the secure world. In actual applications, the non-secure world may run one or more applications, and the secure world may also run one or more applications. This embodiment does not specifically limit the number of applications running in the secure and non-secure worlds.

[0150] For example, please refer to Figure 7, which is a schematic diagram of a TPM access process provided by an embodiment of the present application. As shown in Figure 7, the process of an application in the non-secure world and an application in the secure world accessing the TPM includes the following steps 701-707.

[0151] Step 701: A first application sends a first access request to a first controller, and a second application sends a second access request to the first controller.

[0152] The first access request and the second access request are both used to request access to the TPM. Furthermore, the first access request and the second access request are, for example, sent to the first controller at the same time. The first access request corresponds to, for example, the first request message in the above embodiment.

[0153] Step 702: The first controller determines whether the operating system in the secure world has been started.

[0154] Generally speaking, whether the SoC in a network device boots the operating system in the secure world is optional. Users can determine whether the SoC boots the operating system in the secure world upon power-up by modifying the configuration parameters on the network device. For example, the network device's configuration parameters include a secure world operating system enable flag. When the secure world operating system enable flag has a value of 0, the SoC does not boot the secure world operating system upon power-up; when the secure world operating system enable flag has a value of 1, the SoC boots the secure world operating system upon power-up. Therefore, the first controller can determine whether the secure world operating system has been booted by reading the value of the secure world operating system enable flag.

[0155] Step 703: When the operating system in the secure world is not started, the first controller forwards the first access request and the second access request to the third controller.

[0156] In this embodiment, the third controller is used to control the mutually exclusive access of applications running in the operating system of the non-secure world to the TPM, so as to ensure that only one application in the operating system of the non-secure world accesses the TPM at the same time.

[0157] In some other possible embodiments, when the third controller is not provided in the SoC, the first controller is used to control the mutually exclusive access of the application program in the operating system running in the non-secure world to the TPM.

[0158] In step 704 , the third controller sequentially forwards the first access request and the second access request to the TPM via the SPI controller to ensure that the TPM processes only one access request at a time.

[0159] In this embodiment, the third controller is used to control mutually exclusive access of applications running in the non-secure world to the TPM.

[0160] Optionally, the third controller is provided with a software mutex, for example. The third controller applies for a software mutex for each access request it receives. When a software mutex is successfully obtained for any access request, the third controller forwards the access request with the software mutex to the TPM via the SPI controller. For access requests that do not successfully obtain the software mutex, the third controller caches these access requests and waits for the software mutex to be released until a software mutex is obtained for each access request.

[0161] In other words, the third controller forwards the first and second access requests in the order in which they apply for the software mutex, ensuring that the TPM does not receive an access request while processing one access request. The order in which the third controller forwards the first and second access requests is determined based on the order in which the software mutexes are applied for. This embodiment does not specifically limit the order in which the first and second access requests are forwarded.

[0162] It should be noted that, in addition to performing access control processing on the first access request from the first application and the second access request from the second application, the third controller can also perform access control processing on access requests sent by other applications in the non-secure world operating system. In other words, access requests sent by all applications in the non-secure world operating system will be processed by the third controller, thus ensuring mutually exclusive access to the TPM by multiple applications.

[0163] Step 705 : When the operating system in the secure world has been started, the first controller sends a first assistance request to the second application in the secure world, and sends a second assistance request to the fourth application in the secure world.

[0164] The first assistance request is used to request the second application to assist the first application in accessing the TPM. The second assistance request is used to request the fourth application to assist the third application in accessing the TPM. The first assistance request corresponds to the second request message in the above embodiment, for example.

[0165] Optionally, a mapping relationship is pre-established between the application running in the secure world and the application running in the non-secure world. The first controller can send an assistance request to the corresponding application in the secure world based on the mapping relationship between different applications in the secure world and the non-secure world.

[0166] For example, in this embodiment, a first application in the non-secure world is mapped to a second application in the secure world, and a third application in the non-secure world is mapped to a fourth application in the secure world. Thus, upon receiving a first access request from the first application, the first controller sends a first assistance request to the second application, which is mapped to the first application, requesting that the second application assist the first application in accessing the TPM. Upon receiving a second access request from the third application, the first controller sends a second assistance request to the fourth application, which is mapped to the third application, requesting that the fourth application assist the third application in accessing the TPM.

[0167] It should be noted that this embodiment uses the examples of establishing mapping relationships between a first application and a second application, and between a third application and a fourth application. In practice, different applications in the non-secure world can establish mapping relationships with the same application in the secure world, for example, both the first application and the third application can establish mapping relationships with the second application. This embodiment does not specifically limit this.

[0168] Step 706: The second application sends a third access request to the second controller based on the first assistance request, and the fourth application sends a fourth access request to the second controller based on the second assistance request.

[0169] After receiving the first assistance request, the second application generates a third access request for TPM access based on the first assistance request and sends the third access request to the second controller, thereby assisting the first application in accessing the TPM. Similarly, after receiving the second assistance request, the fourth application generates a fourth access request for TPM access based on the second assistance request and sends the fourth access request to the second controller, thereby assisting the third application in accessing the TPM.

[0170] The third access request corresponds to the access request message in the above embodiment, for example.

[0171] In step 707 , the second controller sequentially sends the third access request and the fourth access request to the TPM through the SPI controller to ensure that the TPM processes only one access request at a time.

[0172] In this embodiment, the second controller is used to control mutually exclusive access to the TPM by applications running in the secure world. The second controller controls mutually exclusive access to the TPM by applications in the secure world in a manner similar to the third controller controls mutually exclusive access to the TPM by applications in the non-secure world. For details, please refer to step 704 above and will not be repeated here.

[0173] For example, please refer to Figure 8, which shows the data flow for accessing the TPM when the operating system of a secure world is started, provided by an embodiment of the present application. As shown in Figure 8, when the operating system of the secure world is started, the data flow for accessing the TPM first flows from the first application and the third application in the non-secure world to the first controller, then flows from the first controller to the second application and the fourth application in the secure world, and then continues to flow from the second application and the fourth application to the second controller in the secure world, and finally flows to the TPM through the SPI controller. In other words, the data flow of the application in the non-secure world accessing the TPM is all directed by the first controller to the application in the secure world, and is centrally controlled by the second controller for mutual exclusive access.

[0174] Please refer to Figure 9, which shows the data flow for accessing the TPM when the operating system of the secure world is not started, according to an embodiment of the present application. As shown in Figure 9, when the operating system of the secure world is not started, the data flow for accessing the TPM first flows from the first application and the third application in the non-secure world to the first controller, then flows from the first controller to the third controller in the non-secure world, and finally flows to the TPM through the SPI controller. In other words, when the operating system of the secure world is not started, the data flow of the application in the non-secure world accessing the TPM no longer needs to be directed by the first controller to the application in the secure world, but is instead centralized by the third controller in the non-secure world for mutual exclusive access control.

[0175] The above embodiment describes the process of performing exclusive access control on exclusive devices for applications in two operating systems. The following describes the process of performing exclusive access control on exclusive devices for applications in different hardware systems.

[0176] Please refer to Figure 10, which is a schematic diagram of the application architecture of a method for accessing an exclusive device provided in an embodiment of the present application. As shown in Figure 10, the application architecture includes a control module, a first processing system, a second processing system and an exclusive device. Among them, the control module includes a first access port and a second access port. The first processing system accesses the control module through the first access port, and the second processing system accesses the control module through the second access port. In addition, the first processing system and the second processing system have independent hardware processor resources, that is, the first processing system and the second processing system can operate independently and independently initiate access to the exclusive device. In addition, the control module is also connected to the exclusive device.

[0177] In the application architecture shown in FIG10 , the control module is responsible for obtaining access request messages from different processing systems and performing concurrent control processing on the access request messages, so as to realize mutually exclusive access control of multiple processing systems to exclusive devices.

[0178] Taking the application architecture shown in FIG10 as an example, the process of the control module executing the exclusive device access method provided in this embodiment is as follows.

[0179] First, the control module obtains a first access request message through the first access port and obtains a second access request message through the second access port.

[0180] The first access request message comes from a first processing system connected to a first access port, and the second access request message comes from a second processing system connected to a second access port. Both the first access request message and the second access request message are used to request access to an exclusive device.

[0181] Optionally, the control module obtains the first access request message and the second access request message simultaneously, or obtains the first access request message and the second access request message at different times. This embodiment does not limit the order in which the control module obtains the first access request message and the second access request message.

[0182] Then, the control module sequentially forwards the first access request message and the second access request message to the exclusive device, so that the exclusive device only processes one access request message at a time.

[0183] In this embodiment, the control module is responsible for concurrently controlling access request messages requesting access to the exclusive device, ensuring that access request messages are forwarded to the exclusive device only when the exclusive device is idle (ie, the exclusive device has no access request message being processed).

[0184] For example, when the control module obtains the first access request message and the second access request message at the same time, the control module first forwards the first access request message to the exclusive device and caches the second access request message. After the exclusive device processes the first access request message, the control module forwards the second access request message to the exclusive device, so that the exclusive device only processes one access request message at the same time.

[0185] For another example, if the control module first receives a first access request message, it forwards the first access request message to the exclusive device. Then, while the exclusive device is processing the first access request message, the control module receives a second access request message. The control module then caches the second access request message until the exclusive device has finished processing the first access request message, at which point it forwards the second access request message to the exclusive device.

[0186] In addition, if the control module obtains other access request messages from the first processing system while the exclusive device is processing the first access request message, the control module will also cache the other access request messages from the first processing system and trigger forwarding only when the exclusive device has no access request messages being processed.

[0187] It should be noted that the above description describes a control module connected to two processing systems: a first processing system and a second processing system. In actual applications, the control module can be connected to two or more processing systems via different access ports, and concurrently control access request messages sent by these processing systems, thereby implementing mutually exclusive access control for multiple processing systems to an exclusive device. This embodiment does not specifically limit the number of processing systems to which the control module can be connected.

[0188] Optionally, the first processing system includes a first processor, and the second processing system includes a second processor. That is, the first processing system and the second processing system are composed of different processors. For example, please refer to Figure 11, which is a structural diagram of a processing system provided in an embodiment of the present application. The structure of the first processing system and the second processing system is, for example, the structure of the processing system shown in Figure 11. As shown in Figure 11, the processing system is actually composed of processors, and the processing system includes a physical core, an internal memory (such as an internal static random access memory (SRAM)) and a communication interface, and the physical core, the internal memory and the communication interface are connected to each other through a bus. Based on the physical core and the internal memory, the processing system can independently run the application and communicate with the control module through the communication interface.

[0189] That is to say, since each processing system can independently run applications and actively initiate access to exclusive devices, it is actually impossible to control the concurrent access of each processing system to the exclusive device through a software module. Therefore, in this embodiment, a hardware module including multiple access ports (i.e., the above-mentioned control module) is used to control the concurrent access of multiple independent processing systems to the exclusive device, ensuring that the access request messages sent by multiple independent processing systems will all pass through a unified control module, ensuring that the control module can implement mutual exclusive access control of multiple processing systems to the exclusive device.

[0190] Optionally, the first processor and the second processor are deployed on the same SoC. That is, the first processing system and the second processing system are simultaneously deployed on the same SoC, and the different processing systems on the SoC are composed of different processors. Furthermore, the first processing system and the second processing system respectively access the first access port and the second access port through different interfaces on the same SoC, thereby sending access request messages to the control module through the first access port and the second access port.

[0191] Wherein, when the first processing system and the second processing system are deployed in the same SoC, there are multiple deployment modes of the control module.

[0192] In a possible implementation, the control module is deployed on the SoC where the first processing system and the second processing system are located.

[0193] For example, please refer to Figure 12, which is a structural diagram of a control module provided in an embodiment of the present application deployed on a SoC. As shown in Figure 12, a first processing system, a second processing system and a control module are deployed on the SoC, and the first processing system accesses the first access port on the control module, and the second processing system accesses the second access port on the control module. In addition, the control module is also connected to an exclusive device outside the SoC. By setting a control module on the same SoC to perform concurrent access control on multiple processing systems on the SoC, it can be ensured that the processing system in the SoC can access the exclusive device normally without the situation where multiple processing systems concurrently access the exclusive device and cause the exclusive device to operate abnormally.

[0194] In another possible implementation, the control module is deployed on a processing device, which is connected to the first processor via a first access port, and the processing device is connected to the second processor via a second access port. Furthermore, the processing device deployed by the control module is located outside the SoC where the first processing system and the second processing system are located. In other words, the control module is no longer integrated into the SoC, but is connected to the SoC in the form of a separate processing device, and implements concurrent access control to multiple processing systems in the SoC. In this way, in actual applications, there is no need to adjust the structure of the SoC. Instead, a separate processing device is designed and manufactured to connect between the SoC and the exclusive device, ensuring that the originally designed SoC can also access the exclusive device normally.

[0195] Optionally, the processing device deployed by the control module is, for example, a processor, an application specific integrated circuit (ASIC) chip, or a programmable logic device (PLD). The programmable logic device includes, for example, any one or more of the following devices: a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), and a generic array logic (GAL).

[0196] For example, please refer to Figure 13, which is a structural diagram of a control module deployed outside the SoC provided in an embodiment of the present application. As shown in Figure 13, a first processing system and a second processing system are deployed on the SoC. The control module is arranged outside the SoC. The first processing system accesses the first access port on the control module, and the second processing system accesses the second access port on the control module. In addition, the control module is also connected to an exclusive device outside the SoC. In other words, the SoC is connected to the exclusive device through the control module, and both the first processing system and the second processing system on the SoC need to access the exclusive device through the control module.

[0197] In another possible implementation, the control module is deployed on the exclusive device. That is, based on the hardware module used to implement the original function of the exclusive device, the control module is additionally integrated, so that the exclusive device is additionally deployed with a control module for implementing concurrent access control.

[0198] To facilitate understanding, the following will describe in detail the implementation method and workflow of the control module with reference to specific examples.

[0199] Please refer to Figure 14, which is a schematic diagram of the structure of a control module for implementing TPM concurrent access control according to an embodiment of the present application. Figure 14 illustrates an example in which the control module and multiple processing systems are deployed on the same SoC. In actual applications, the control module can also be deployed outside the SoC, which is not further described here.

[0200] As shown in Figure 14, the SoC includes a first processing system, a second processing system, a third processing system, and a control module, and the control module is also connected to the TPM outside the SoC. The first processing system accesses the first access port on the control module, the second processing system accesses the second access port on the control module, and the third processing system accesses the third access port on the control module. In other words, the multiple processing systems in the SoC are connected one-to-one to the multiple access ports on the control module, and different processing systems are connected to different access ports on the control module.

[0201] The control module also includes an arbiter, which includes a scheduling unit, a cache unit, and a transceiver unit. When access to the TPM is required, any of the first, second, and third processing systems sends an access request message to the control module via its connected access port. The arbiter in the control module can then determine which processing system the access request message originated from based on the access port from which it was received.

[0202] The transceiver unit in the control module is used to forward access request messages to the TPM and receive response data returned by the TPM.

[0203] The cache unit in the control module contains a message queue and a response data queue. The command queue is used to store access request messages sent by each processing system; the response data queue is used to store the response data returned after the TPM processes the access request message.

[0204] The scheduling unit in the control module is responsible for dispatching access request messages. Specifically, it uses the hardware mutex mechanism to apply for a hardware mutex lock for each access request message in the message queue. If a hardware mutex lock application succeeds for an access request message, the scheduling unit removes the access request message from the message queue and forwards it to the TPM. If the hardware mutex lock application fails, the scheduling unit waits for the hardware mutex lock to be released until the hardware mutex lock application succeeds.

[0205] For example, please refer to Table 1, which is used to represent the access port number, message queue number, and response data queue number set by the control module for each processing system.

[0206] Table 1

[0207] Specifically, the process of multiple processing systems on the SoC accessing the TPM includes, for example, the following steps.

[0208] Step 1: The first processing system, the second processing system, and the third processing system respectively send access request messages to the control module to request access to the TPM.

[0209] In step 2, for each received access request message, the arbitrator in the control module determines which processing system sent the access request message based on the access port from which the access request message was received. The arbitrator then places the access request message into the corresponding message queue. For example, an access request message sent by the first processing system is sent to the arbitrator via access port 1 in the control module. Upon receiving the access request message from access port 1, the arbitrator places the access request message into message queue 1. Similarly, an access request message sent by the second processing system is placed into message queue 2, and an access request message sent by the third processing system is placed into message queue 3.

[0210] In step 3, the scheduling unit uses a polling algorithm to sequentially poll the access request messages in message queue 1, message queue 2, and message queue 3 to schedule and distribute the access request messages. The scheduling unit first determines whether there is an access request message in message queue 1. If there is an access request message in message queue 1, it selects an access request message at the head of message queue 1 to apply for a hardware mutex lock. After the hardware mutex lock application is successful, the access request message is forwarded to the TPM. If the access request message fails to apply for a hardware mutex lock, it waits for the hardware mutex lock to be released until the hardware mutex lock is successfully applied. After the access request message in message queue 1 is successfully distributed, an access request message is taken from the head of message queue 2 for processing. After processing the access request message taken from message queue 2, an access request message is taken from the head of message queue 3 for processing, and the cycle continues.

[0211] Step 4: The transceiver unit sends the access request message selected by the scheduling unit to the TPM via the SPI bus.

[0212] Step 5: The TPM parses and processes the access request message and returns the response data.

[0213] Step 6: The transceiver unit receives the response data returned by the TPM and stores it in the response data queue with the corresponding number.

[0214] In step 7, each processing system in the SoC reads the response data returned by the TPM from the response data queue with the corresponding number.

[0215] The above describes the exclusive device access method provided by the embodiment of the present application. The following describes an apparatus for executing the exclusive device access method.

[0216] Please refer to Figure 15, which is a schematic diagram of the structure of an access device for an exclusive device provided in an embodiment of the present application. As shown in Figure 15, the access device for the exclusive device is a first controller, and the access device for the exclusive device includes:

[0217] An acquiring unit 1501 is configured to acquire a first request message from a first application, the first request message being used to request access to an exclusive device, the first controller and the first application both running on a first operating system, and the first operating system running on a processor other than the exclusive device;

[0218] A sending unit 1502 is configured to send, in response to the second operating system being started, a second request message to a second application running in the second operating system based on the first request message, wherein the second request message is used to request the second application to assist in accessing the exclusive device;

[0219] In which, the second operating system runs on a processor outside the exclusive device, the processors running the first operating system and the second operating system are connected to the exclusive device through a bus, and a second controller runs in the second operating system, and the second controller is used to control the mutually exclusive access of the application in the second operating system to the exclusive device.

[0220] In a possible implementation, both the first operating system and the second operating system can run independently.

[0221] In a possible implementation, the first operating system runs in a non-secure world, and the second operating system runs in a secure world.

[0222] In a possible implementation, the first operating system and the second operating system run on the same processor, and the processor is connected to the exclusive device.

[0223] In one possible implementation, the processor includes an NP, a CPU, a GPU, a TPU, or a DPU.

[0224] In a possible implementation, the second controller belongs to a driving component of the exclusive device.

[0225] In a possible implementation, the exclusive device is any one of the following devices: a TPM, a TCM, or a memory chip.

[0226] In a possible implementation, the acquiring unit 1501 is further configured to acquire a first response message from the second application, where the first response message includes feedback data returned by the exclusive device after the second application assists in accessing the exclusive device.

[0227] The sending unit 1502 is further configured to forward the first response message to the first application.

[0228] In a possible implementation, the acquiring unit 1501 is further configured to acquire a third request message from the first application, where the third request message is used to request access to the exclusive device;

[0229] The sending unit 1502 is also used to forward the third request message to the third controller in response to the second operating system not being started. The third controller runs in the first operating system, and the third controller is used to control the mutual exclusive access of the application in the first operating system to the exclusive device.

[0230] In a possible implementation, the apparatus for accessing the exclusive device further includes: a control unit 1503, configured to control the mutually exclusive access of the application in the first operating system to the exclusive device when the second operating system is not started.

[0231] Please refer to Figure 16, which is a schematic diagram of the structure of another exclusive device access device provided in an embodiment of the present application. As shown in Figure 16, the exclusive device access device is applied to a control module, the control module includes a first access port and a second access port, and the control module is connected to the exclusive device. The exclusive device access device includes:

[0232] an acquiring unit 1601 configured to acquire a first access request message through a first access port and a second access request message through a second access port, wherein the first access request message originates from a first processing system connected to the first access port and the second access request message originates from a second processing system connected to the second access port, and both the first access request message and the second access request message are used to request access to an exclusive device;

[0233] The sending unit 1602 is configured to sequentially forward the first access request message and the second access request message to the exclusive device, so that the exclusive device processes only one access request message at a time.

[0234] In one possible implementation, the first processing system includes a first processor, the second processing system includes a second processor, and the first processor and the second processor are deployed on the same SoC.

[0235] In a possible implementation, the control module is deployed on the SoC.

[0236] In a possible implementation, the control module is deployed on a processing device, the processing device is connected to the first processor through a first access port, and the processing device is connected to the second processor through a second access port.

[0237] In a possible implementation, the processing device is a processor, an ASIC chip, or a programmable logic device.

[0238] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0239] A refers to B, which means that A is the same as B or A is a simple variant of B.

[0240] The terms "first" and "second" in the description and claims of the embodiments of this application are used to distinguish different objects, not to describe a specific order of objects, and should not be construed as indicating or implying relative importance. For example, the terms "first speed-limited channel" and "second speed-limited channel" are used to distinguish different speed-limited channels, not to describe a specific order of speed-limited channels, and should not be construed as implying that the first speed-limited channel is more important than the second speed-limited channel.

[0241] In the embodiments of the present application, unless otherwise specified, “at least one” means one or more, and “a plurality of” means two or more.

[0242] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in accordance with the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0243] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for accessing an exclusive device, characterized in that: include: The first controller obtains a first request message from a first application, the first request message being used to request access to an exclusive device, the first controller and the first application both running in a first operating system, and the first operating system running on a processor other than the exclusive device; In response to the second operating system being started, the first controller sends a second request message to a second application running in the second operating system based on the first request message, wherein the second request message is used to request the second application to assist in accessing the exclusive device; The second operating system runs on a processor other than the exclusive device, the processors running the first operating system and the second operating system are connected to the exclusive device via a bus, and a second controller runs in the second operating system, and the second controller is used to control the mutually exclusive access of the application in the second operating system to the exclusive device.

2. The method according to claim 1, characterized in that The first operating system runs in a non-secure world, and the second operating system runs in a secure world.

3. The method according to claim 1 or 2, characterized in that: The first operating system and the second operating system run on the same processor, and the processor is connected to the exclusive device.

4. The method according to claim 3, characterized in that The processor includes a network processor NP, a central processing unit CPU, a graphics processing unit GPU, a tensor processing unit TPU or a data processing unit DPU.

5. The method according to any one of claims 1 to 4, characterized in that: The second controller belongs to a driving component of the exclusive device.

6. The method according to any one of claims 1 to 5, characterized in that: The exclusive device is any one of the following devices: a trusted platform module TPM, a trusted cryptographic module TCM or a storage chip.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: The first controller obtains a first response message from the second application, where the first response message includes feedback data returned by the exclusive device after the second application assists in accessing the exclusive device; The first controller forwards the first response message to the first application.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: The first controller obtains a third request message from the first application, where the third request message is used to request access to an exclusive device; In response to the second operating system not being started, the first controller forwards the third request message to a third controller, where the third controller runs in the first operating system and is used to control exclusive access of an application in the first operating system to the exclusive device.

9. The method according to any one of claims 1 to 7, characterized in that: When the second operating system is not started, the first controller is further used to control the exclusive access of the application program in the first operating system to the exclusive device.

10. A method for accessing an exclusive device, characterized in that: The method is applied to a control module, the control module includes a first access port and a second access port, and the control module is connected to the exclusive device, and the method includes: The control module obtains a first access request message through the first access port and obtains a second access request message through the second access port an access request message, wherein the first access request message comes from a first processing system connected to the first access port, and the second access request message comes from a second processing system connected to the second access port, and both the first access request message and the second access request message are used to request access to the exclusive device; The control module forwards the first access request message and the second access request message to the exclusive device in order, so that the exclusive device processes only one access request message at a time.

11. The method according to claim 10, characterized in that The first processing system includes a first processor, the second processing system includes a second processor, and the first processor and the second processor are deployed on the same system on chip (SoC).

12. The method according to claim 11, characterized in that The control module is deployed on the SoC.

13. The method according to claim 11, characterized in that The control module is deployed on a processing device, the processing device is connected to the first processor via the first access port, and the processing device is connected to the second processor via the second access port.

14. The method according to claim 13, characterized in that The processing device is a processor, an application specific integrated circuit ASIC chip or a programmable logic device.

15. An access device for an exclusive device, characterized in that: The device is a first controller, and the device comprises: an acquiring unit, configured to acquire a first request message from a first application, wherein the first request message is used to request access to an exclusive device, wherein the first controller and the first application are both running in a first operating system, and the first operating system is running on a processor other than the exclusive device; a sending unit, configured to send, in response to the second operating system being started, a second request message to a second application running in the second operating system based on the first request message, wherein the second request message is used to request the second application to assist in accessing the exclusive device; The second operating system runs on a processor other than the exclusive device, the processors running the first operating system and the second operating system are connected to the exclusive device via a bus, and a second controller runs in the second operating system, and the second controller is used to control the mutually exclusive access of the application in the second operating system to the exclusive device.

16. The device according to claim 15, characterized in that The first operating system runs in a non-secure world, and the second operating system runs in a secure world.

17. The device according to claim 15 or 16, characterized in that The first operating system and the second operating system run on the same processor, and the processor is connected to the exclusive device.

18. The device according to claim 17, characterized in that The processor includes NP, CPU, GPU, TPU or DPU.

19. The device according to any one of claims 15 to 18, characterized in that: The acquisition unit is further used to acquire a first response message from the second application, wherein the first response message includes feedback data returned by the exclusive device after the second application assists in accessing the exclusive device; The sending unit is further used to forward the first response message to the first application.

20. The device according to any one of claims 15 to 19, characterized in that: The acquisition unit is further used to acquire a third request message from the first application, where the third request message is used to request access to an exclusive device; The sending unit is also used for, in response to the second operating system not being started, the first controller forwarding the third request message to a third controller, the third controller running in the first operating system, and the third controller being used for controlling the mutually exclusive access of the application in the first operating system to the exclusive device.

21. An access device for an exclusive device, characterized in that: The device is applied to a control module, the control module includes a first access port and a second access port, and the control module is connected to the exclusive device, and the device includes: an acquiring unit, configured to acquire a first access request message through the first access port and to acquire a second access request message through the second access port, wherein the first access request message comes from a first processing system connected to the first access port, and the second access request message comes from a second processing system connected to the second access port, and both the first access request message and the second access request message are used to request access to the exclusive device; The sending unit is used to forward the first access request message and the second access request message to the exclusive device in an orderly manner, so that the exclusive device only processes one access request message at a time.

22. The device according to claim 21, characterized in that The first processing system includes a first processor, the second processing system includes a second processor, and the first processor and the second processor are deployed on the same SoC.

23. The device according to claim 22, characterized in that The control module is deployed on the SoC.

24. A network device, comprising a processor and a memory, wherein the memory is used to store program codes, and the processor is used to call the program codes in the memory so that the network device executes the method according to any one of claims 1 to 14.

Images