CN114915499B

CN114915499B - Data transmission method, related device, system and computer readable storage medium

Info

Publication number: CN114915499B
Application number: CN202210828606.9A
Authority: CN
Inventors: 冯彦朝; 郭御风; 张明; 朱佳平; 马卓
Original assignee: Phytium Technology Co Ltd
Current assignee: Phytium Technology Co Ltd
Priority date: 2022-07-15
Filing date: 2022-07-15
Publication date: 2022-10-28
Anticipated expiration: 2042-07-15
Also published as: CN114915499A

Abstract

The application provides a data transmission method, a related device, a system and a computer readable storage medium, which are applied to the technical field of computing, wherein the method comprises the following steps: the method includes the steps of packaging and sending a first TLP (packet switching protocol) packet, wherein the TLP packet includes a first field indicating the security attribute of the packet, determining the corresponding security attribute when accessing the PCIe node through the first field, and further realizing differential processing of different packets through the security attribute.

Description

Data transmission method, related device, system and computer readable storage medium

Technical Field

The present application relates to the field of computer technologies, and in particular, to a data transmission method, a related apparatus, a system, and a computer-readable storage medium.

Background

PCIe (Peripheral Component Interconnect express) is a high-speed serial computer expansion bus standard, and is widely used in computer systems. PCIe bus belongs to high-speed serial point-to-point double-channel high-bandwidth transmission bus, and the connected devices distribute independent channel bandwidth without sharing bus bandwidth, thereby having the characteristic of high transmission rate.

A PCIe bus system is generally composed of PCIe nodes of types such as an RC (Root Complex device), a Switch device (Switch), and an EP (Endpoint) device. The RC device is a root of the bus, and a Memory (Memory), a processor (CPU), and the like may be connected to the bus through the RC device; the EP device is a generic name of various types of external devices, such as a PCIe network card, a PCIe graphics card, and the like, and the EP device may implement some specific functions according to requirements; switch is a PCIe Switch for extending the PCIe interface.

The EP device can be directly connected with the RC device in a communication mode or connected with the RC device in a communication mode through the switching device, and finally connected with the processor, the memory and other devices through the RC device to achieve data transmission between the processor and the memory. The inventor researches and discovers that data security in a communication process is not designed in a targeted mode in the PCIe bus standard, and therefore, when data transmission between a PCIe bus system and a CPU and a memory is involved, the data security problem exists.

Disclosure of Invention

In view of this, the present application is directed to provide a data transmission method, a related apparatus, a system, and a computer-readable storage medium, where a TLP includes a first field indicating a security attribute of the packet, and the first field is used to implement a targeted design of data security, so as to improve security of data transmission.

In a first aspect, the present application provides a data transmission method, applied to an endpoint EP device, where the method includes:

encapsulating the first TLP packet;

wherein the first TLP comprises a first field, and the first field indicates a security attribute of the first TLP;

and sending the first TLP packet.

In the application, the TLP includes the first field indicating the security attribute of the packet, and the corresponding security attribute is determined by the first field when the PCIe node is accessed, so that differential processing of different packets can be realized by the security attribute.

In one possible implementation, the first field includes one of a plurality of code values, and the plurality of code values includes a first code value and a second code value, wherein,

the first code value indicates that a security attribute of the first TLP is a first security attribute;

the second code value indicates that the security attribute of the first TLP is a second security attribute.

In this application, the code value of the first field may be any one of the first code value and the second code value, so that different security attributes corresponding to the first TLP are indicated by different code values, the security attribute of the first TLP can be indicated in a simple and clear manner, and the efficiency of data transmission is improved.

In a possible implementation manner, the security attribute of the first TLP is the first security attribute, and the first TLP is processed through a trusted execution environment TEE;

the security attribute of the first TLP is the second security attribute, and the first TLP is processed through a common execution environment REE.

In the application, the TLP is processed through the execution environment matched with the security attribute of the TLP, so that differentiated processing of the TLP is realized, for the TLP with higher data transmission security, a trusted execution environment can be selected for the TLP by setting the security attribute, and correspondingly, for the TLP with lower data transmission security, a common execution environment can be selected for the TLP with lower data transmission security by setting the security attribute, so that differentiated processing of the packets with different security requirements is realized, and the security of the data transmission process is improved.

In one possible implementation, the plurality of code values further includes a third code value, wherein,

the third code value indicates that the security attribute of the first TLP is a third security attribute.

In this application, on the basis of the first code value and the second code value, the code value of the first field may also be a third code value, that is, the first field includes one of the first code value, the second code value, and the third code value indicates that the security attribute of the first TLP is the third security attribute, so as to provide more options for implementing differentiated processing of packets with different security requirements.

In a possible implementation manner, the security attribute of the first TLP is the third security attribute, and the first TLP is processed through a secure element execution environment SE.

In the present application, on the basis of the TEE and the REE, another optional execution environment for processing the message is provided, so that the manner of processing the message in a differentiated manner is richer. Further, for the EP device, the SE is introduced, which helps to improve the security of the EP device in the data transmission process.

In a possible implementation manner, the first field includes a TC field in a TLP header of the first TLP.

In the application, the existing field in the TLP structure, that is, the TC field, is selected to carry the security attribute of the packet, and since the TLP structure defined in the PCIe protocol specification is not improved, the PCIe protocol expanded according to the application can still be compatible with the standard PCIe protocol, which is favorable for popularization and application of the data transmission method.

In a possible implementation manner, the encapsulating the first TLP includes:

acquiring an original message;

the original message comprises a second field, and the second field indicates the security attribute of the original message;

determining a code value of the first field corresponding to a code value of the second field;

repackaging the original packet based on the code value of the first field to obtain a first TLP.

In the present application, a specific implementation method for encapsulating a first TLP is provided, and through conversion between a second field of an original packet and a previous field of the first TLP, the first field carries security attributes of the original packet, so that effective transmission of the security attributes in a PCIe bus system is implemented, and security of data transmission is improved.

In some possible embodiments, the original packet is provided by an EP device;

the first TLP is used to be sent to other devices in communication connection with the EP device.

In the present application, the source of the original packet and the role of the first TLP are provided, which is helpful for defining the data transmission flow direction in the data transmission process.

In some possible embodiments, the original message further carries device identification information, where the device identification information is used to identify the EP device.

In the application, the TLP transmitted between the PCIe nodes mounted on the PCIe bus system carries the device identification information on the basis of the security attribute, so that the security attribute and the device identification information can be transmitted between the processor and the PCIe nodes, and not only differential processing in the data transmission process based on the security attribute can be implemented, but also the source of data can be effectively identified, so as to establish a uniform security view and effectively manage all PCIe nodes mounted on the PCIe bus system.

In some possible embodiments, the original packet is an AXI type packet, and the second field is an AxPROT field in the AXI type packet;

the determining a code value for the first field corresponding to a code value for the second field comprises:

and mapping the AxPROT field to the first field based on a preset mapping relation to obtain a code value of the first field corresponding to the code value of the AxPROT field.

In the data transmission method provided by the application, the existing field in the AXI packet structure is fully utilized, the security attribute is carried by the AxPROT field, the security attribute carried by the AxPROT field is reloaded in the first field of the first TLP based on the AxPROT field and the preset mapping relation, the transmission of the security attribute between the original packet and the first TLP is realized, and the transmission of the security attribute in the PCIe bus system is further realized by the first TLP.

In a second aspect, the present invention provides a data transmission method, applied to an endpoint EP device, the method including:

receiving a second TLP packet;

wherein the second TLP comprises a first field, and the first field indicates a security attribute of the second TLP;

the security attribute of the second TLP is used for processing the second TLP by an execution environment matched with the security attribute of the second TLP.

In a possible implementation manner, the receiving the second TLP includes:

extracting a code value of the first field in the second TLP;

mapping the first field to a second field of the original message based on a preset mapping relation to obtain a code value of the second field corresponding to the code value of the first field;

wherein the second field indicates a security attribute of the original packet.

In the data transmission method provided by the application, the second TLP indicates the security attribute through the first field, the code value of the second field in the original packet is further determined based on the code value of the first field by extracting the code value of the first field in the second TLP, and because the second field can indicate the security attribute of the original packet, the security attribute corresponding to the original packet can be recovered through the method, and further, the transmission of the security attribute in the PCIe bus system through the second TLP is realized.

In one possible embodiment, the original message is provided by an upstream device communicatively coupled to the EP device.

In the application, the source of the original message is provided, which is helpful for determining the data transmission flow direction in the data transmission process.

In a third aspect, the present application provides a computer device comprising:

a memory to store instructions;

a processor configured to execute the data transmission method according to any one of the first aspect or the second aspect of the present application according to the instructions stored in the memory.

In a fourth aspect, the present application provides a data transmission system, including: an endpoint EP device and other devices communicatively coupled to the EP device, wherein,

the EP device performs the data transmission method according to any one of the first aspect or the second aspect of the present application.

In a fifth aspect, the present application provides a computer readable storage medium storing a computer program which, when executed, implements a data transmission method as described in any one of the first or second aspects of the present application.

Based on the above content, according to the data transmission method provided by the present application, the TLP includes the first field indicating the security attribute of the packet, and the corresponding security attribute when accessing the PCIe node is determined through the first field, so that differentiated processing of different packets can be realized through the security attribute.

Drawings

In order to more clearly illustrate the embodiments or technical solutions of the present invention, the drawings used in the embodiments or technical solutions in the prior art are briefly introduced below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and it is obvious for those skilled in the art that other drawings can be obtained according to these drawings without creative efforts.

FIG. 1 is a block diagram of a topology of a PCIe bus system.

Fig. 2 is a schematic view of an application scenario of a PCIe bus system.

Fig. 3 is a flowchart of a data transmission method according to an embodiment of the present invention.

Fig. 4 is a schematic structural diagram of a TLP header in a TLP.

Fig. 5 is a flowchart illustrating another data transmission method according to an embodiment of the present invention.

Fig. 6 is a schematic diagram illustrating a PCIe bus hierarchy provided in the embodiment of the present invention.

Fig. 7 is a flowchart illustrating a further data transmission method according to an embodiment of the present invention.

Fig. 8 is a flowchart illustrating a further data transmission method according to an embodiment of the present invention.

FIG. 9 is a block diagram of another PCIe bus system topology.

Fig. 10 is a block diagram illustrating a data transmission system according to an embodiment of the present invention.

Detailed Description

The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.

PCIe (Peripheral Component Interconnect express) is a high-speed serial computer expansion bus standard, which is commonly used for communication between a processor and high-speed Peripheral devices, and in practical applications, a PCIe bus system includes a plurality of components connected to each other point-to-point. Referring to the topology diagram of the PCIe bus system shown in fig. 1, the PCIe bus system generally adopts a tree topology, and the aforementioned interconnected components mainly include PCIe nodes of types such as a CPU (processor or processor core), a Root Complex (RC) device, a Switch device (Switch), a PCIe-PCI Bridge (PCIe-PCI Bridge), and an Endpoint (EP) device. In addition, a Memory (Memory) may be included in the PCIe bus system.

In a typical CPU + accelerator heterogeneous computing system, the RC device is located between the CPU and the PCIe topology, is connected to the CPU via a bus from above, and manages nodes in each PCIe tree topology from below. As shown in fig. 1, PCIe nodes include switching devices, EP devices, and the like. The RC device and the CPU core are interconnected by an AXI (Advanced eXtensible Interface) bus. The RC equipment has the main function of completing address conversion from a memory domain to a PCIe bus domain, and is also the root of a PCIe bus system, the PCIe bus system and peripheral interfaces can be integrated into the RC equipment, a plurality of PCIe interfaces can be led out, and each interface can be connected with a PCIe node. The RC device can obtain the request information transmitted by the PCIe node, so as to access the memory, and correspondingly, the RC device can also send the request information of the processor to the EP device mounted on the system, thereby implementing communication between the processor and the EP device.

The main role of the switch device is to expand the PCIe link, and each data link of the PCIe bus only covers two devices, which inevitably cannot meet the requirement, so that the PCIe bus can be expanded through the switch device.

An EP device may be understood as a device that implements an independent function in a PCIe bus system, and different EP devices often support different functions, so that the PCIe bus system as a whole can support diverse application functions. In practical applications, EP devices having a typical meaning include a video card, a network card, and the like, and meanwhile, the EP devices are also an initiator and a responder of PCIe transactions.

The primary role of a PCIE-PCI bridge is to effectively comply with the second generation Peripheral Component Interconnect (PCI) standard, which can support two functions: 1. the PCIe bus system can be converted, so that a PCI bus is obtained, and the PCI bus is stably connected with the PCI equipment. 2. The PCI bus can be effectively converted, so that a PCIe bus is obtained and is connected with the PCIe nodes.

It is understood that fig. 1 is only a structural example of a system on chip, and in other examples, the system on chip may also include a switch device, or the switch device may also be disposed inside the system on chip, which is not described herein again.

Based on the above, referring to the application scenario of the PCIe bus system shown in fig. 2, the processor may be connected to multiple RC devices simultaneously, the RC devices may be numbered in advance according to a sequence, and the RC devices are directly connected to the EP device point-to-point, which is convenient for distinguishing and managing. On the basis of the application scenario shown in fig. 2, referring also to fig. 1, more EP devices are mounted by setting up a switching device, and will not be expanded in detail here.

In practical applications, the processor typically traverses the tree structure of the PCIe bus system using a depth First search (BFS) algorithm. During enumeration, firstly scanning a device on a Bus (Bus) 0; as shown in fig. 2, first, RC0 is scanned, for example, an Identity Document (ID), such as a Vendor ID, is read to determine whether a device currently exists, if so, the type of the device is determined by reading a specified register in a configuration space, that is, it is determined whether the current PCIe node is an EP device or an RC device, and after it is determined that the node is an RC device, a downstream BUS number of the RC0 device is set as a BUS (BUS) 1; continuing to scan downwards, and then scanning to find out EP0 equipment, because the EP equipment is terminal equipment, after the enumeration scanning of the branch is finished, returning to the upper-level bus (here, bus 0) for continuous scanning; this is repeated until all PCIe nodes mounted on the PCIe bus system are found.

After going through the standard process of PCIe node identification, the EP device may be directly connected in communication with the RC device or connected in communication with the RC device through the switch device, and finally connected to the processor, the memory, and the like through the RC device, so as to implement data transmission between the processor and the memory. The inventor researches and discovers that data security in a communication process is not designed in the PCIe bus standard, so that the data security problem exists when data transmission between a PCIe bus system and a CPU and a memory is involved.

In order to solve the problem, the invention provides a data transmission method, which is applied to an EP device in a PCIe bus system, wherein a message packaged by the EP device comprises a first field indicating the security attribute of the message, the corresponding security attribute when the PCIe node is accessed is determined through the first field, and then differential processing of different messages can be realized through the security attribute, so that the targeted design of data security is realized, meanwhile, the security isolation among different PCIe nodes is realized, and the improvement of the security of data transmission is facilitated.

Based on the above, referring to fig. 3, the flow of the data transmission method provided in this embodiment may include:

s100, encapsulating the first TLP packet.

Data transmission is performed between PCIe nodes in the PCIe bus system in the form of a Packet, and in general, the PCIe nodes encapsulate a TLP (Transaction Layer Packet) Packet according to the type and destination address of a communication request, specific data to be transmitted, and other related attributes.

The TLP mainly includes three parts, namely, a TLP Header (Header), a Data (Data) and a Cyclic Redundancy Check (CRC) field. A TLP header plays a very critical role in implementing a TLP, and the TLP header is mainly used for recording information such as relevant information of a sender, a destination address of a packet receiver, a TLP type, and a data length, and a typical TLP header structure can be seen in fig. 4.

In combination with the technical solution described in the present application, the processor (or the processor core) and the RC device are often disposed in a system on chip, and in a possible implementation, the system on chip may be loaded with a normal Execution Environment (REE) and a Trusted Execution Environment (TEE), which are disposed independently; in one possible implementation, the system-on-chip may be hosted only with a common execution environment.

Similarly, for the EP device, in a possible implementation, the EP device may be loaded with a normal execution environment and a trusted execution environment, which are set independently of each other; in one possible embodiment, the EP device may be loaded with only a common execution environment.

For a PCIe node that only mounts one execution environment, the hardware resources that any access request (i.e., data transfer process) can access and use are the same, and conversely, for a PCIe node that mounts two execution environments, different access requests need to be responded to by different execution environments. Generally, a security-critical access request needs to be responded to by the trusted execution environment, while a security-critical access request can be responded to by the normal execution environment. The data transmission method provided by the invention is mainly applied to EP equipment loaded with at least two execution environments.

Based on the above, the first TLP is carried in the access request sent by the EP device to the other device in communication connection with the EP device, so that the data transmission method provided in this embodiment implements the transfer of the security attribute by reloading the specified field in the first TLP, and further implements the selection of the execution environment in the PCIe node.

Specifically, the first TLP provided in this embodiment includes a first field used for indicating the security attribute of the first TLP, the code value of the first field may be any one of a plurality of code values, and when data transmission is performed, the actual code value of the first field needs to be selected in combination with an actual data transmission requirement. The first code value indicates that the security attribute of the first TLP is the first security attribute, and correspondingly, the second code value indicates that the security attribute of the first TLP is the second security attribute. Generally, the first security attribute is secure and corresponds to a data processing requirement with a stricter and higher security requirement, and the second security attribute is non-secure (or can be understood as a common one) and corresponds to a data processing requirement with a looser and lower security requirement.

When the security attribute of the first TLP is the first security attribute, the PCIe node receiving the first TLP may process the first TLP through the TEE, that is, may respond to the access request carrying the first TLP through the TEE; correspondingly, under the condition that the security attribute of the first TLP is the second security attribute, the PCIe node receiving the first TLP may process the first TLP by using an REE, that is, may respond to the access request carrying the first TLP by using the REE.

Further, in a possible embodiment, the PCIe node carries three execution environments, namely, an REE, a TEE, and a Secure Element execution environment (SE), in which case, the code value of the first field in the first TLP may be any one of a first code value, a second code value, and a third code value, and on the basis of the foregoing, the third code value is used to indicate that the security attribute of the first TLP is the third security attribute, and correspondingly, in the case that the security attribute of the first TLP is the third security attribute, the first TLP is processed through the SE. As to the specific implementation of processing a TLP by an SE, reference may be made to related technologies, and the present invention is not limited thereto.

Further, as shown in fig. 4, in an alternative embodiment, the first field may be implemented by selecting a TC field in the TLP header. Based on the related specification of the PCIe bus standard, in the existing application, the TC field in the TLP header is used to represent the transmission level of the TLP, and includes 3 bits, that is, 8 different transmission levels can be represented, which are TC0 to TC7, respectively, and the larger the code value of the field, the higher the transmission level of the TLP is represented. The data transmission method provided in this embodiment implements, on the basis of being compatible with the existing PCIe specification, the transmission of the security attribute through the TC field, and the specific implementation process will be developed in the subsequent content, which is not described in detail here.

Further, the first TLP encapsulated by the EP device further includes a third field, the Type of the first TLP is indicated by the third field, the packet carries data information and control information according to the different packet types, or the packet only carries control information, and specifically, the third field may include an Fmt field and a Type field.

S110, sending the first TLP packet.

After obtaining the first TLP, the EP device may send the first TLP to other devices communicatively connected to the EP device, such as an RC device, and of course, the EP device also includes a scenario sent to the RC device by the switching device.

For the specific process of sending the first TLP by the EP device, the specific process is also specifically expanded in the subsequent content, and will not be described in detail here.

In summary, in the data transmission method provided in this embodiment, the TLP includes the first field indicating the security attribute of the packet, and the corresponding security attribute when accessing the PCIe node is determined through the first field, so that differentiated processing of different packets can be realized through the security attribute.

Optionally, referring to fig. 5, fig. 5 is a flowchart of another data transmission method provided in the embodiment of the present invention, where the method is also applied to an EP device, and in this embodiment, the data transmission process may include:

s200, acquiring an original message.

Based on the setting of PCIe bus rules, the PCIe bus system includes two data transmission paths, namely, a Direct Memory Access (DMA) path and a programmable Input-Output (PIO) path, where a PIO path is generally used when a processor transmits data to an EP device through an RC device, and in the PIO path, a data transmission process is performed by the processor executing a PIO instruction to perform data transmission in bytes or larger data units. When the EP device writes data into the memory or feeds back information to the RC device, the DMA channel is usually used.

Based on the above, in the data transmission method provided in this embodiment, the EP device sends the first TLP to other devices, so that a DMA path is adopted, a device relationship is defined according to a data transmission flow direction, and other PCIe nodes connected to the EP device may be RC devices, and certainly, the data transmission method also includes an RC device connected to the EP device through a switching device.

In a possible implementation manner, before the EP device communicates with another device, a controller inside the EP device generates an AXI type packet, that is, an original packet, according to a communication requirement, in this embodiment, the EP device further repackages the original packet according to the following steps to finally obtain a first TLP, and therefore, the original packet mentioned in this embodiment is an AXI type packet generated by the EP itself.

Further, a second field may be included in the original packet, and the second field may indicate a security attribute of the original packet. Similar to the first field in the first TLP, the second field in the original packet may be any one of the first code value and the second code value, and specifically needs to be selected in combination with actual data transmission requirements. The first code value indicates that the security attribute of the original message is the first security attribute, and correspondingly, the second code value indicates that the security attribute of the original message is the second security attribute.

Of course, the code value of the second field in the original message may also be any one of the first code value, the second code value, and the third code value. It should be particularly noted that, when the code value of the second field in the original message is the third code value, the security attribute of the original message is the third security attribute.

Similarly, the security attribute of the original packet may also indicate an execution environment for processing the original packet, and reference may be made to the related content in S100, which is not repeated here.

And under the condition that the original message is the AXI message, a second field indicating the security attribute of the original message is an AxPROT field in an AXI message structure, the AXI bus specification specifies that the AXI message can indicate that the security attribute is safe or non-safe through the AxPROT field.

In particular, the definition of AxPROT field can be referred to as shown in table 1 below:

TABLE 1

As can be seen from the above table 1, in the AXI bus specification, the AxPROT field includes three bits in total, one of which is used to indicate the security attribute.

As an alternative implementation manner, in the case that there are many security attributes that need to be indicated, the security attributes may also be indicated by a plurality of bits of other fields in the original message, and without going beyond the core idea of the present invention, the security attributes also fall within the scope of protection of the present invention.

Based on the above content, before the EP device encapsulates the AXI message, the code value of the AxPROT field in the AXI message is set according to the security level of the data to be transmitted in the AXI message and the security requirement in the message transmission process, that is, the actual code value matched with the security requirement is selected to be written into the AxPROT field, so that the AXI message carries the security attribute.

And S210, determining the code value of the first field corresponding to the code value of the second field.

As described above, in the TLP in the prior art, there is no field related to the security attribute, and therefore, after obtaining the code value of the second field in the original packet, the code value of the first field corresponding to the code value of the second field needs to be determined, and the first TLP is enabled to carry the security attribute by setting the code value of the first field corresponding to the code value of the second field in the original packet in the first TLP.

In some possible embodiments, the original message is an AXI message, and correspondingly, the second field in the original message is an AxPROT field, and the security attribute of the corresponding message is indicated by setting a code value of a specified bit in the AxPROT field, specifically, see table 1.

In some possible embodiments, a preset mapping relationship may be established in the EP device, where the preset mapping relationship records a corresponding relationship between different code values of the AxPROT field and the first field, and in practical applications, the EP device may determine, based on the preset mapping relationship, a code value of the first field corresponding to any code value of the AxPROT field, and likewise, may determine, based on the preset mapping relationship, a code value of the AxPROT field corresponding to any code value of the first field.

Further, based on the above, it can be seen that the AxPROT field used for indicating the security attribute in the original packet may select any one of a plurality of code values, and different code values are configured to carry different security attributes, which is also the case for the first TLP, and the first field therein may also be configured as any one of a plurality of code values. In order to realize the function of the preset mapping relationship, a one-to-one correspondence relationship between each code value of the AxPROT field and each code value of the first field in the first TLP may be established according to requirements, and further, a correspondence relationship between different code values between the two fields is embodied through preset mapping relationship records. It can be understood that the one-to-one correspondence between each code value of the AxPROT field and each code value of the first field in the first TLP is generally determined and established according to transmission requirements before the data transmission method provided by this embodiment is applied.

After the code value of the second field of the original message, namely the AxPROT field, is determined through the steps, the EP device directly maps the AxPROT field to the first field through a preset mapping relation, and the code value of the first field corresponding to the code value of the AxPROT field is obtained.

S220, repackaging the original packet based on the code value of the first field to obtain a first TLP packet.

Through the foregoing conversion, the security attribute in the original packet may be reloaded in the first field of the first TLP, and it can be understood that, in order to implement effective transmission of data, other related information in the original packet needs to be synchronously acquired, where the information at least includes necessary information such as data to be transmitted, a destination address, and check data, and the code value of the first field and other information related to the data transmission process in the original packet are repackaged, so that the first TLP can be obtained.

It can be understood that the selection of other information in the original message is specifically realized by combining the related technologies on the premise of ensuring the complete transmission of the data to be transmitted, and the specific selection of other information related to data transmission in the message encapsulation process is not limited. Further, the first field itself is an original field in the TLP, and the method does not improve the structure of the TLP, and is compatible with the existing PCIe bus specification, so that a specific implementation process of re-encapsulating the original packet to obtain the first TLP may refer to a TLP encapsulation method in the related art, which is not specifically limited by the present invention.

It can be seen that the processes of S200 to S220 in the embodiment shown in fig. 5 are another alternative and more specific implementation manner for encapsulating the first TLP in the embodiment shown in fig. 3.

S230, sending the first TLP.

Referring to fig. 6, fig. 6 is a schematic diagram of a PCIe bus layered structure provided by an embodiment of the present invention, for two PCIe nodes (e.g., an RC device and an EP device) performing Data transmission through a PCIe bus, data transmission between the two PCIe nodes needs to pass through several protocol layers, where the relatively representative protocol layers include a Transaction Layer (Transaction Layer), a Data Link Layer (Data Link Layer), a Physical Layer (Physical Layer), and the like. In the PCIe bus, the data message passes through the transaction layer, the data link layer and the physical layer of the device and is finally sent out. The data packet received by the receiving end needs to pass through the physical layer, the data link layer and the transaction layer, and finally, the related data is obtained.

The transaction layer defines that the PCIe bus uses bus transactions that may be transmitted through a switching device or the like to an RC device or other PCIe node. The transaction layer receives data from a PCIe node core layer (not shown), encapsulates the data into a TLP, and sends the TLP to the data link layer. In addition, the transaction layer can also receive the data message from the data link layer and then forward the data message to the core layer of the PCIe node.

The data link layer ensures that the data message from the transaction layer of the sending end can be reliably and completely sent to the data link layer of the receiving end. When a message from the transaction Layer passes through the Data Link Layer, a Sequence Number prefix and a Cyclic Redundancy Check (CRC) suffix are added to the message to form a Data Link Layer Packet (DLLP).

The physical layer is the lowest layer of the PCIe bus system, and the specific implementation of the PCIe physical interface determines that the PCIe link can only use an end-to-end connection mode. The physical layer of the PCIe bus provides a transmission medium for data communication between PCIe nodes, and provides a reliable physical environment for data transmission. The physical layer of the PCIe bus defines an LTSSM (Link Training and Status State Machine) State Machine that is used by the PCIe Link to manage Link states, and to perform Link Training, link recovery, and power management.

Based on the above hierarchical structure of the PCIe node and the basic functions of each hierarchy, in some optional embodiments, a corresponding Intellectual Property core (IP core) is set in the EP device, for example, an encapsulating IP core, and the encapsulating IP core encapsulates the packet by performing the foregoing method to obtain the first TLP, and further, the PCIe node sends the first TLP to other devices (shown as RC devices in fig. 6) connected to the EP device according to a packet transmission process in the related art, where a specific sending process of the first TLP is not limited in the present invention.

Correspondingly, the EP device may further include an unpacking IP core, which reads relevant information such as security attribute carried in the TLP, and expands subsequent contents of processes of receiving and analyzing the TLP by the EP device, which will not be described in detail herein.

It should be noted that, in conjunction with the structural block diagram shown in fig. 6, for other devices connected to the EP device, the process of encapsulating and unpacking a TLP of the other devices may refer to the implementation process of the EP device, and is not described in detail here.

In summary, in the data transmission method provided in this embodiment, the EP device encapsulates the AXI packet (i.e., the original packet) first, the AxPROT field in the AXI packet carries the security attribute, and after the foregoing steps, the security attribute in the original packet is reloaded in the first field of the first TLP, so that the first TLP may also carry the security attribute, the priority level of packet transmission is divided into security levels, and the security attribute of the packet of a specific transmission level is given, thereby implementing transmission of the security attribute in the PCIe bus system, and meanwhile, the TLP transmitted between PCIe nodes may be further divided by whether the security attribute is included, thereby implementing a differentiated design of data transmission, and improving security of data transmission.

As described above, the PCIe bus system includes two data transmission paths, i.e., a PIO path and a DMA path, where the PIO path is usually used when the processor transmits data to the EP device through the RC device, and the DMA path is usually used when the EP device writes data into the memory or the RC device receives data uploaded by the EP device. It should be noted that, data is transmitted in the PIO path, and the device relationship is defined according to the data transmission flow, and the upstream device connected to the EP device is generally referred to as an RC device and a processor. With reference to the flowchart shown in fig. 7, a process of receiving a TLP by an EP device in a PIO path to complete data transmission is described below, where the data transmission process includes:

s300, receiving a second TLP packet.

For convenience of description, in this embodiment, a TLP sent to an EP device is defined as a second TLP. A process of encapsulating the second TLP by a device communicatively connected to the EP device, for example, an RC device located upstream in the data transmission stream, may be implemented by referring to a process of encapsulating the first TLP by the EP device in the foregoing embodiment, and details are not described here.

Similar to the first TLP, the second TLP includes a first field for indicating a security attribute of the second TLP. When data transmission is performed, the code value of the first field may be any one of a first code value and a second code value, where the first code value indicates that the security attribute of the second TLP is the first security attribute, and correspondingly, the second code value indicates that the security attribute of the second TLP is the second security attribute. Generally, the first security attribute is secure and corresponds to a data processing requirement with a stricter and higher security requirement, and the second security attribute is non-secure (or can be understood as a common one) and corresponds to a data processing requirement with a looser and lower security requirement.

In a possible implementation manner, the code value of the first field in the second TLP may be any one of the first code value, the second code value and the third code value, and on the basis of the foregoing, the third code value is used to indicate that the security attribute of the second TLP is the third security attribute, and correspondingly, the second TLP is processed through the SE when the security attribute of the second TLP is the third security attribute. As to the specific implementation of processing the TLP by the SE, the implementation may refer to a related technology, which is not limited in the present invention.

For the first field in the second TLP, the optional implementation manner and the functional role thereof may refer to the related content of the first field in the first TLP in the foregoing embodiment, and are not repeated here.

Further, as shown in fig. 4, in an alternative embodiment, the first field may be implemented by selecting a TC field in the TLP header.

Further, the second TLP received by the EP device also includes the third field, the Type of the first TLP is indicated by the third field, the packet carries data information and control information according to different packet types, or the packet only carries control information, and specifically, the third field may include an Fmt field and a Type field.

In some possible implementation manners, the specific process of receiving the second TLP may include the following steps shown in fig. 8:

s400, extracting the code value of the first field in the second TLP packet.

As described above, in order to ensure compatibility with the PCIe bus standard in the prior art, the specific structure of the TLP is not improved in any data transmission method provided in the present application, and therefore, after obtaining the second TLP sent by the upstream device, the EP device may determine the position of the first field based on the definition about the TLP structure in the related art, and further extract the code value of the first field.

In the case where the first field selects the TC field, the code value of the TC field is extracted.

S410, mapping the first field to a second field of the original message based on a preset mapping relation to obtain a code value of the second field corresponding to the code value of the first field.

In this embodiment, the original packet is provided by an upstream device communicatively connected to the EP device, and with reference to the system architecture shown in fig. 1, the upstream device may be a processor communicatively connected to the EP device via an RC device, or may be another PCIe node in the PCIe bus system. Further, in a normal case, the original message is an AXI type message, and an AxPROT field in the original message carries a security attribute of the original message, that is, the AxPROT field is a second field.

As described above, the preset mapping relationship records the corresponding relationship between the AxPROT field and different code values of the first field, and the code value of the first field corresponding to any code value of the AxPROT field may be determined based on the preset mapping relationship, and similarly, the code value of the AxPROT field corresponding to any code value of the first field may also be determined based on the preset mapping relationship.

After the code value of the first field is obtained, the first field is mapped to the AxPROT field of the original message based on a preset mapping relation, and the code value of the AxPROT field corresponding to the code value of the first field is obtained.

Further, after the security attribute of the second TLP is determined, different processing may be performed on the second TLP based on the difference in the security attribute of the second TLP. Specifically, when the security attribute of the second TLP is the first security attribute, the EP device may process the second TLP through the TEE, that is, may respond to the access request carrying the second TLP through the TEE; correspondingly, when the security attribute of the second TLP is the second security attribute, the EP device may process the second TLP through the REE, that is, may respond to the access request carrying the second TLP through the REE; when the security attribute of the second TLP is the third security attribute, the EP device may process the second TLP through the SE, that is, may respond to the access request carrying the second TLP through the SE.

It can be understood that the second TLP is obtained based on the original packet conversion, and the second TLP is processed in the execution environment matched with the security attribute of the second TLP, which can be understood as processing the data to be transmitted carried in the original packet according to the execution environment matched with the security attribute of the original packet, so that the differential processing requirement of the original packet sender for the data to be transmitted is met.

In summary, according to the data transmission method provided by the present application, the TLP includes the first field indicating the security attribute of the packet, and the first field determines the corresponding security attribute when accessing the PCIe node, so that differentiated processing of different packets can be implemented through the security attribute.

The embodiments respectively use the EP device as an execution subject to expand the processes of encapsulating the TLP and unpacking the TLP, and it should be noted that the data transmission method is also applicable to other PCIe nodes connected to the EP device.

For example, the EP device encapsulates the first TLP based on the AXI packet, then sends the first TLP to the RC device, and the process of the RC device unpacking the first TLP may be implemented by referring to the process of the EP device unpacking the TLP in the foregoing embodiment.

For another example, the EP device receives the second TLP sent by the RC device, and the process of encapsulating the second TLP by the RC device may be implemented by referring to the process of encapsulating the first TLP by the EP device.

It can be understood that, the PCIe nodes mounted on the PCIe bus system can communicate with each other only when supporting the same protocol specification, and therefore, in practical applications, any PCIe node in the same PCIe bus system should be able to execute the data transmission method, and the security of data transmission can be effectively improved. That is to say, all PCIe nodes participating in data transmission in the PCIe bus system should support the security attribute transfer process implemented based on the data transmission method, and then the security attribute can be reliably transferred in the PCIe bus system, a uniform security view is established, so that differentiated design of transmission packets and corresponding data is implemented, security isolation between different PCIe nodes is implemented, and the management granularity is finer.

In practical applications, a plurality of PCIe nodes are often mounted on a PCIe Bus system, and in order to effectively distinguish the PCIe nodes and ensure accuracy of data transmission, the PCIe Bus system allocates a unique Device identification information, that is, a BDF identification (BDF identification) to each Function of each PDIe Device mounted on the system.

Referring to the system architecture shown in fig. 9, each function of each PCIe node in the PCIe bus system is assigned a BDF identifier, and for the switch device, it may include multiple PCIe bridges, and accordingly, a BDF identifier needs to be assigned to each PCIe bridge.

For a specific configuration of BDF identification, the Bus (Bus) field consists of 8 bits, the Device (Dev) field consists of 5 bits, and the Function (Function) consists of 3 bits. Thus, the PCIe protocol supports 256 Bus in total, 32 devs per Bus, and 8 Func per Dev. Through the BDF identification, the differentiation and identification of any function of any PCIe node in the topology of the PCIe bus system can be realized.

Based on the above, the original message mentioned in any of the foregoing embodiments further carries device identification information, and the device identification information has different functions in different data transmission directions.

In the DMA path, the EP device sends data to the processor through the RC device, and both the original packet and the TLP encapsulated by the EP device include device identification information, where the device identification information is used to identify a sender of the data, so that the processor can determine a data source according to the device identification information included in the obtained packet. For an RC device, the obtained TLP also includes corresponding device identification information.

Correspondingly, in the PIO path, the processor sends data to the EP device through the RC device, where the original packet carries the device identification information, and certainly, the TLP is obtained by repackaging the original packet, and also contains the device identification information carried in the original packet under the condition of carrying the security attribute. Based on the relevant division of the function of a TLP in the existing PCIe bus protocol, the TLP includes a data packet used for data transmission and a configuration packet used for configuring a PCIe node, where in different types of TLPs, the function of device identification information is different, specifically, in the case that the first TLP is a configuration packet, the device identification information in the packet is used to identify a downstream device to which the first TLP needs to arrive, and in the case that the first TLP is a data packet, the device identification information in the packet is used to identify a packet source.

In summary, according to the data transmission method provided by the present invention, TLPs transmitted between PCIe nodes mounted on a PCIe bus system carry device identification information on the basis of security attributes, the security attributes and the device identification information can be transmitted between a processor and PCIe nodes, and not only differential processing of a data transmission process based on the security attributes can be implemented, but also sources and destinations of data can be effectively identified, so that a uniform security view is established, and all PCIe nodes mounted on the PCIe bus system are effectively managed.

In some embodiments, this embodiment further provides a data transmission system, a system structure of which can be seen from fig. 10, where the data transmission system at least includes: EP device 10 and other devices 20 communicatively coupled to EP device 10, wherein,

the EP device 10 performs the data transmission method as provided in any one of the preceding embodiments. It is understood that the other devices 20 include an RC device, a switch device, a processor, and the like in the PCIe bus system, and therefore, in practical applications, the data transmission system provided in the embodiment may also adopt the system architecture shown in fig. 1.

In some embodiments, the present embodiments also provide a computer device comprising:

a memory to store instructions;

a processor for executing the data transmission method provided by any one of the previous embodiments according to the instructions stored in the memory.

In some embodiments, the present embodiment also provides a computer-readable storage medium, such as a floppy disk, an optical disk, a hard disk, a flash Memory, a usb disk, an SD (Secure Digital Card) Card, an MMC (Multimedia Card) Card, etc., in which one or more instructions implementing the above steps are stored, and when executed by one or more processors, the one or more instructions cause the processors to execute the data transmission method described above. For related implementation, reference is made to the foregoing description, which is not repeated herein.

In addition to the above-described methods and apparatus, embodiments of the present application may also be a computer program product comprising computer program instructions that, when executed by a processor, cause the processor to perform the steps in the data transmission method according to various embodiments of the present application described in the above-mentioned content of the present specification.

The computer program product may include program code for carrying out operations for embodiments of the present application in any combination of one or more programming languages, including an object oriented programming language such as Java, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or server.

Those skilled in the art will appreciate that the disclosure of the present disclosure is susceptible to numerous variations and modifications. For example, the various devices or components described above may be implemented in hardware, or may be implemented in software, firmware, or a combination of some or all of the three.

Further, while the present disclosure makes various references to certain elements of a system according to embodiments of the present disclosure, any number of different elements may be used and run on a client and/or server. The units are merely illustrative and different aspects of the systems and methods may use different units.

Flowcharts are used in this disclosure to illustrate the steps of methods according to embodiments of the disclosure. It should be understood that the preceding and following steps are not necessarily performed in the exact order in which they are performed. Rather, various steps may be processed in reverse order or simultaneously. Also, other operations may be added to the processes.

It will be understood by those skilled in the art that all or part of the steps of the above methods may be implemented by instructing relevant hardware through a computer program, and the program may be stored in a computer readable storage medium, such as a read-only memory, etc. Alternatively, all or part of the steps of the above embodiments may be implemented using one or more integrated circuits. Accordingly, each module/unit in the above embodiments may be implemented in the form of hardware, and may also be implemented in the form of a software functional module. The present disclosure is not limited to any specific form of combination of hardware and software.

Unless otherwise defined, all terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein.

The foregoing is illustrative of the present disclosure and is not to be construed as limiting thereof. Although a few exemplary embodiments of this disclosure have been described, those skilled in the art will readily appreciate that many modifications are possible in the exemplary embodiments without materially departing from the novel teachings and advantages of this disclosure. Accordingly, all such modifications are intended to be included within the scope of this disclosure as defined in the claims. It is to be understood that the foregoing is illustrative of the present disclosure and is not to be construed as limited to the specific embodiments disclosed, and that modifications to the disclosed embodiments, as well as other embodiments, are intended to be included within the scope of the appended claims. The present disclosure is defined by the claims and their equivalents.

Claims

1. A data transmission method, applied to an end point EP device, the method comprising:

acquiring an original message; the original message comprises a second field, and the second field indicates the security attribute of the original message;

repackaging the original packet to obtain a first TLP packet;

the first TLP includes a first field, the first field indicates a security attribute of the first TLP, and the first field is a field obtained by mapping the second field by using a preset mapping relationship; if the security attribute of the first TLP is a first security attribute, processing the first TLP in a trusted execution environment TEE; if the security attribute of the first TLP is the second security attribute, processing the first TLP in a common execution environment REE;

and sending the first TLP packet.

2. The method of claim 1, wherein the first field comprises one of a plurality of code values, and the plurality of code values comprises a first code value and a second code value, wherein,

3. The method of claim 2, wherein the plurality of code values further comprises a third code value, wherein,

4. The method as recited in claim 3, wherein the security attribute of the first TLP packet is the third security attribute, and wherein the first TLP packet is processed in a secure element execution environment (SE).

5. The method of claim 1, wherein the first field comprises a TC field in a TLP header of the first TLP packet.

6. The method according to any one of claims 1 to 5, wherein the repackaging the original packet to obtain the first TLP comprises: determining a code value of the first field corresponding to a code value of the second field;

7. The method according to claim 6, wherein the original message is provided by the EP device;

8. The method according to claim 6, wherein the original message further carries device identification information, and the device identification information is used for identifying the EP device.

9. The method according to claim 6, wherein the original packet is an AXI type packet, and the second field is an AxPROT field in the AXI type packet;

10. A data transmission method, applied to an end point, EP, device, the method comprising:

extracting a first field in a second TLP message, and mapping the first field based on a preset mapping relation to obtain a second field of the original message;

wherein the first field indicates a security attribute of the second TLP, and the second TLP is processed in an execution environment matched with the security attribute of the second TLP;

the second field indicates a security attribute of the original packet.

11. The method of claim 10, wherein the extracting a first field in the second TLP and mapping the first field based on a preset mapping relationship to obtain a second field of the original packet comprises:

extracting a code value of the first field in the second TLP;

and mapping the first field to a second field of the original message based on a preset mapping relation to obtain a code value of the second field corresponding to the code value of the first field.

12. The method according to claim 11, wherein the original message is provided by an upstream device communicatively coupled to the EP device.

13. A computer device, comprising:

a memory to store instructions;

a processor for performing the data transmission method of any one of claims 1-9 or 10-12 in accordance with instructions stored in the memory.

14. A data transmission system, comprising: an endpoint EP device and other devices communicatively coupled to the EP device, wherein,

the EP device performs the data transmission method as claimed in any one of claims 1-9 or 10-12.

15. A computer-readable storage medium, characterized in that a computer program is stored which, when executed, implements the data transmission method of any one of claims 1-9 or 10-12.