WO2024017311A1 - 访问控制方法、装置、计算机可读存储介质及电子设备 - Google Patents

访问控制方法、装置、计算机可读存储介质及电子设备 Download PDF

Info

Publication number
WO2024017311A1
WO2024017311A1 PCT/CN2023/108252 CN2023108252W WO2024017311A1 WO 2024017311 A1 WO2024017311 A1 WO 2024017311A1 CN 2023108252 W CN2023108252 W CN 2023108252W WO 2024017311 A1 WO2024017311 A1 WO 2024017311A1
Authority
WO
WIPO (PCT)
Prior art keywords
virtual machine
access
address
physical address
target virtual
Prior art date
Application number
PCT/CN2023/108252
Other languages
English (en)
French (fr)
Inventor
张斌
许圣建
Original Assignee
地平线征程(杭州)人工智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 地平线征程(杭州)人工智能科技有限公司 filed Critical 地平线征程(杭州)人工智能科技有限公司
Publication of WO2024017311A1 publication Critical patent/WO2024017311A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/02—Addressing or allocation; Relocation
    • G06F12/08—Addressing or allocation; Relocation in hierarchically structured memory systems, e.g. virtual memory systems
    • G06F12/0802—Addressing of a memory level in which the access to the desired data or data block requires associative addressing means, e.g. caches
    • G06F12/0877—Cache access modes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/02—Addressing or allocation; Relocation
    • G06F12/08—Addressing or allocation; Relocation in hierarchically structured memory systems, e.g. virtual memory systems
    • G06F12/10—Address translation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45583—Memory management, e.g. access or allocation

Definitions

  • the present disclosure relates to chip technology, and in particular, to an access control method, device, computer-readable storage medium and electronic equipment.
  • a virtualization manager Using a virtualization manager, multiple virtual machines can run on one chip at the same time; the chip can include a Direct Memory Access (DMA) controller, and the chip can also be equipped with a system memory management unit (System Memory). Management Unit, SMMU).
  • DMA Direct Memory Access
  • System Memory System Memory Management Unit
  • Embodiments of the present disclosure provide an access control method, device, computer-readable storage medium, and electronic device.
  • an access control method including:
  • the physical address is configured in the direct memory access controller through the target virtual machine.
  • an access permission control device including:
  • a generation module configured to generate an address translation request through the target virtual machine, where the address translation request includes an intermediate physical address
  • a conversion module configured to convert the intermediate physical address included in the address conversion request generated by the generation module into a physical address through a memory management unit;
  • a determining module configured to determine, through a virtualization manager, the access permission information of the target virtual machine to the physical address converted by the conversion module;
  • a configuration module configured to configure the physical address for direct memory access through the target virtual machine in response to the access permission information determined by the determination module indicating that the target virtual machine has access permission to the physical address. in the controller.
  • a computer-readable storage medium stores a computer program, and the computer program is used to execute the above access control method.
  • an electronic device including:
  • memory for storing instructions executable by the processor
  • the processor is configured to read the executable instructions from the memory and execute the instructions to implement the above access control method.
  • a computer program product is provided. When instructions in the computer program product are executed by a processor, the above access control method is implemented.
  • an address translation request can be generated through the target virtual machine, and the intermediate physical address in the address translation request can be converted into The physical address, and if the access permission information determined by the virtualization manager indicates that the target virtual machine has access permission to the physical address, configure the physical address in the direct memory access controller through the target virtual machine.
  • the direct memory access controller is configured with a physical address instead of an intermediate physical address
  • the direct memory access controller can perform data copy processing based on the physical address, and after configuring the physical address to Before the direct memory access controller, a judgment related to access rights has been made (that is, determining whether the target virtual machine has access rights to the physical address), thereby determining the area that the target virtual machine can access through the direct memory access controller.
  • the direct memory access controller does not need to obtain the physical address through the system memory management unit, nor does it need to make judgments related to access rights through the system memory management unit. Therefore, the chip does not need to be equipped with system memory. management unit (see the chip structure in Figure 7 for details), thereby reducing the manufacturing cost of the chip.
  • Figure 1 is a schematic structural diagram of a chip in the related art.
  • Figure 2 is a schematic diagram of the working principle of a chip in the related art.
  • FIG. 3 is a schematic diagram of another working principle of a chip in the related art.
  • Figure 4 is a schematic flowchart of an access control method provided by an exemplary embodiment of the present disclosure.
  • Figure 5 is a working principle diagram of a chip in an embodiment of the present disclosure.
  • Figure 6 is another working principle diagram of a chip in an embodiment of the present disclosure.
  • Figure 7 is a schematic structural diagram of a chip in an embodiment of the present disclosure.
  • Figure 8-1 is a schematic flowchart of an access control method provided by another exemplary embodiment of the present disclosure.
  • Figure 8-2 is a schematic flowchart of an access control method provided by yet another exemplary embodiment of the present disclosure.
  • Figure 9-1 is a schematic flowchart of an access control method provided by yet another exemplary embodiment of the present disclosure.
  • Figure 9-2 is a schematic flowchart of an access control method provided by yet another exemplary embodiment of the present disclosure.
  • Figure 10-1 is a schematic flowchart of an access control method provided by yet another exemplary embodiment of the present disclosure.
  • Figure 10-2 is a schematic flowchart of an access control method provided by yet another exemplary embodiment of the present disclosure.
  • Figure 11 is a schematic flowchart of an access control method provided by yet another exemplary embodiment of the present disclosure.
  • Figure 12 is a schematic flowchart of an access control method provided by yet another exemplary embodiment of the present disclosure.
  • Figure 13 is a schematic flowchart of an access control method provided by yet another exemplary embodiment of the present disclosure.
  • Figure 14 is a schematic structural diagram of an access control device provided by an exemplary embodiment of the present disclosure.
  • Figure 15-1 is a schematic structural diagram of an access control device provided by another exemplary embodiment of the present disclosure.
  • Figure 15-2 is a schematic structural diagram of an access control device provided by yet another exemplary embodiment of the present disclosure.
  • Figure 16 is a schematic structural diagram of an access control device provided by yet another exemplary embodiment of the present disclosure.
  • Figure 17 is a schematic structural diagram of an access control device provided by yet another exemplary embodiment of the present disclosure.
  • FIG. 18 is a structural diagram of an electronic device provided by an exemplary embodiment of the present disclosure.
  • the chip can be a System on Chip (SOC), as shown in Figure 1, Figure 2, and Figure 3.
  • the chip can include: Memory Management Unit (MMU), memory module, external Design module, direct memory access controller, system memory management unit and chip bus module.
  • MMU Memory Management Unit
  • memory module memory module
  • external Design module direct memory access controller
  • system memory management unit chip bus module.
  • a basic function of the memory management unit is virtual memory management, including but not limited to converting virtual address (Virtual Address) to physical address (Physical Address, PA), converting virtual address to intermediate physical address (Intermediate Physical Address, IPA), Convert intermediate physical addresses to physical addresses, etc.
  • the direct memory access controller is used for data copying, that is, copying data from one address space to another.
  • the system memory management unit can be responsible for the management of chip peripherals.
  • multiple virtual machines can be run on one chip at the same time by using the virtualization manager (or virtualization manager module) shown in Figure 1, Figure 2, and Figure 3. ; Wherein, the virtualization manager and multiple virtual machines can both be software modules running on the chip.
  • the virtual machine can indirectly operate the hardware through the virtualization manager.
  • the source address and destination address of the data can be configured in the direct memory access controller in the form of IPA.
  • IPA direct memory access controller
  • Guest OS A when the virtual machine Guest OS A does not exclusively occupy the direct memory access controller, but shares the direct memory access controller with other virtual machines (in this case, the virtualization manager is responsible for implementing Mutual exclusion when each virtual machine accesses the direct memory access controller), Guest OS A can configure the source address and destination address in the form of IPA into the direct memory access controller through the virtualization manager.
  • the source address and destination address in the IPA form can be converted into the source address and destination address in the PA form.
  • the direct memory access controller can perform data copy processing based on the source address and target address in the PA form, that is, control the relevant module (such as the memory module or peripheral module) to copy the data from the address space corresponding to the source address in the PA form to the PA form.
  • the target address corresponds to address space.
  • Figure 4 is a schematic flowchart of an access control method provided by an exemplary embodiment of the present disclosure.
  • the method shown in Figure 4 may include step 410, step 420, step 430 and step 440. Each step will be described below.
  • Step 410 Generate an address translation request through the target virtual machine, where the address translation request includes the intermediate physical address.
  • step 410 may be performed by the processor calling corresponding instructions stored in the memory, or may be performed by a generation module run by the processor.
  • target virtual machine can be any virtual machine among multiple virtual machines running on the chip, such as Guest OS A in Figure 2, Figure 3, Figure 5, and Figure 6. " Target” does not constitute a limitation on the target virtual machine.
  • the target virtual machine Before generating an address translation request, the target virtual machine can obtain the virtual address and call the memory management unit to translate the virtual address to an intermediate physical address. Next, the target virtual machine may generate an address translation request including the intermediate physical address, and the address translation request is used to request translation of the intermediate physical address into a physical address.
  • Step 420 Convert the intermediate physical address into a physical address through the memory management unit.
  • step 420 may be performed by the processor calling corresponding instructions stored in the memory, or may be performed by a conversion module run by the processor.
  • the target virtual machine can forward the address translation request to the memory management unit, and the memory management unit can respond to the address translation request, translate the intermediate physical address included in the address translation request into a physical address, and send the physical address to the virtualization Manager.
  • the target virtual machine may forward the address translation request to the virtualization manager, and the virtualization manager may respond to the address translation request by calling the memory management unit to translate the intermediate physical address included in the address translation request into a physical address.
  • Step 430 Determine the access permission information of the target virtual machine to the physical address through the virtualization manager.
  • step 430 may be executed by the processor calling corresponding instructions stored in the memory, or may be executed by a determination module run by the processor.
  • the virtualization manager can determine the access permission information of the target virtual machine to the physical address according to the predetermined access permission control policy, and the access permission information can be used to characterize whether the target virtual machine has access permission to the physical address.
  • Step 440 In response to the access permission information indicating that the target virtual machine has access permission to the physical address, configure the physical address in the direct memory access controller through the target virtual machine.
  • step 440 may be executed by the processor calling corresponding instructions stored in the memory, or may be executed by a configuration module run by the processor.
  • the virtualization manager can send the physical address to the target virtual machine, and the target virtual machine can configure the physical address in direct memory access control In the memory, the direct memory access controller can perform data copy processing based on the physical address.
  • the access permission information is "0" it means that the target virtual machine does not have access permission to the physical address.
  • the virtualized manager does not need to send the physical address to the target virtual machine, and the target virtual machine does not configure the physical address.
  • the address translation request may be generated by the target virtual machine, the intermediate physical address in the address translation request may be converted into a physical address by the memory management unit, and the access permission information determined by the virtualization manager may represent the target virtual machine. If the virtual machine has access rights to the physical address, configure the physical address in the direct memory access controller through the target virtual machine.
  • the direct memory access controller is configured with a physical address instead of an intermediate physical address
  • the direct memory access controller can perform data copy processing based on the physical address, and after configuring the physical address to Before the direct memory access controller, a judgment related to access rights has been made (that is, determining whether the target virtual machine has access rights to the physical address), thereby determining the area that the target virtual machine can access through the direct memory access controller.
  • the direct memory access controller does not need to obtain the physical address through the system memory management unit, nor does it need to make judgments related to access rights through the system memory management unit. Therefore, the chip does not need to be equipped with system memory. management unit (see the chip structure in Figure 7 for details), thereby reducing the manufacturing cost of the chip.
  • step 430 includes the steps shown in Figure 8-1 4301 or step 4303 shown in Figure 8-2.
  • Step 4301 In response to the identification information of the target virtual machine being in the access whitelist, the virtualization manager determines that the access permission information indicates that the target virtual machine has access permission to the physical address.
  • step 4301 may be executed by the processor calling corresponding instructions stored in the memory, or may be executed by the first determination sub-module in the determination module run by the processor.
  • Step 4303 In response to the identification information of the target virtual machine not being in the access whitelist, the virtualization manager determines that the access permission information indicates that the target virtual machine does not have access permission to the physical address.
  • step 4303 may be executed by the processor calling corresponding instructions stored in the memory, or may be executed by the second determination sub-module in the determination module run by the processor.
  • the correspondence between the physical address and the access whitelist can be stored in advance. After converting the intermediate physical address included in the address translation request into a physical address through the memory management unit, the virtualization manager can determine the access whitelist corresponding to the physical address based on the pre-stored correspondence, and compile the access whitelist corresponding to the physical address. Traverse to determine whether the identification information of the target virtual machine is in the access whitelist corresponding to the physical address.
  • the access permission information determined by the virtualization manager can be expressed as "1" to indicate that the target virtual machine has access permission to the physical address. If the identification information of the target virtual machine is not in the access whitelist corresponding to the physical address, the access permission information determined by the virtualization manager may be expressed as "0" to indicate that the target virtual machine does not have access permission to the physical address.
  • the access whitelist due to the setting of the access whitelist, by determining whether the identification information of the target virtual machine is in the access whitelist corresponding to the physical address, it can be efficiently and reliably determined whether the target virtual machine has access rights to the physical address.
  • a corresponding access blacklist can also be set for the physical address. If the identification information of the target virtual machine is in the access blacklist, the access permission information can indicate that the target virtual machine does not have access permission to the physical address. , and if the identification information of the target virtual machine is not in the access blacklist, the access permission information can represent The target virtual machine has access to the physical address.
  • step 420 includes step 4201.
  • Step 4201 In response to the fact that the intermediate physical address does not exist in the recorded address, convert the intermediate physical address into a physical address through the memory management unit.
  • step 4201 may be executed by the processor calling corresponding instructions stored in the memory, or may be executed by a conversion sub-module in the conversion module run by the processor.
  • step 430 the method further includes step 450.
  • Step 450 In response to the access permission information indicating that the target virtual machine does not have access permission to the physical address, add the intermediate physical address to the recorded address.
  • step 450 may be executed by the processor calling corresponding instructions stored in the memory, or may be executed by the first adding module run by the processor.
  • the recorded addresses can be represented in the form of an address table.
  • the target virtual machine is Guest OS A. It is assumed that after Guest OS A generates an address translation request including the intermediate physical address IPA0, Guest OS A sends the address translation request to the virtualization manager. The virtualization manager can traverse the recorded addresses to determine whether IPA0 exists in the recorded addresses.
  • the virtualization manager can deny Guest OS A's address translation request if IPA0 is present in the recorded address.
  • the virtualization manager can call the memory management unit to convert IPA0 into a physical address.
  • the converted physical address can be PA0.
  • the virtualization manager can also determine the access permission information of Guest OS A to PA0. . If the access permission information indicates that Guest OS A does not have access permission to PA0, the virtualization manager can add IPA0 to the recorded address; if the access permission information indicates that Guest OS A has access permission to PA0, the virtualization manager may not By adding IPA0 to the recorded address, the virtualization manager can also send PA0 to Guest OS A so that Guest OS A configures PA0 in the direct memory access controller.
  • the virtualization manager can determine that IPA0 exists in the recorded address by traversing the recorded addresses. At this time, the virtualization manager can reject the address translation of Guest OS A. request without calling the memory management unit to convert IPA0 into a physical address, and without performing the access permission information determination step and the physical address configuration step based on the physical address, which is beneficial to saving computing resources.
  • the method further includes step 460 and step 470.
  • Step 460 In response to the target virtual machine generating more than a preset number of address translation requests within a preset time period, and the access permission information corresponding to each address translation request indicating that the target virtual machine does not have access permission to the physical address, output permission confirmation.
  • Prompt information among which, the permission confirmation prompt information includes the identification information and physical address of the target virtual machine.
  • step 460 can be executed by the processor calling corresponding instructions stored in the memory, or it can Executed by the output module run by the processor.
  • the preset duration can be 30 seconds, 1 minute, 2 minutes, etc.
  • the preset number can be 30, 40, 50, 60, 100, etc., which will not be listed here.
  • the virtualization manager determines that the access permission information corresponding to each address translation request indicates that the target virtual machine does not If you have access permission to the physical address, you can output the permission confirmation prompt information including the identification information of the target virtual machine and the physical address through voice, text, etc. For example, you can say through voice "Please confirm whether Guest OS A has access to PA0 "Access Permissions", for another example, you can display "Please confirm whether Guest OS A has access permissions to PA0" through a pop-up window on the screen to prompt manual confirmation whether Guest OS A has access permissions to PA0.
  • Step 470 In response to the triggering operation for the permission confirmation prompt information, add the identification information of the target virtual machine to the access whitelist.
  • step 470 may be performed by the processor calling corresponding instructions stored in the memory, or may be performed by a second added module run by the processor.
  • “yes” or “no” can be output in a voice mode. If a "yes” instruction of voice output is obtained, If it is considered that a trigger operation for permission confirmation prompt information has been received, then the name of Guest OS A can be added to the access whitelist; or, in another optional implementation, "Yes” can be displayed below the pop-up window on the screen. " and "No” two selection buttons.
  • the target virtual machine if the target virtual machine generates a large number of address translation requests including the same intermediate physical address in a short period of time, and the access permission information corresponding to these address translation requests indicates that the target virtual machine does not have access to the physical address permission, you can output the permission confirmation prompt information to prompt the user to confirm whether the target virtual machine has access permission to the physical address. If the user confirms that the target virtual machine has access permission to the physical address, the target can be added to the access whitelist. Identification information of the virtual machine to ensure the accuracy of the information recorded in the access whitelist.
  • the intermediate physical address includes an intermediate physical source address and an intermediate physical destination address
  • the physical address includes a physical source address translated from the intermediate physical source address, and a physical destination address translated from the intermediate physical destination address.
  • step 440 includes step 4401.
  • Step 4401 In response to the access permission information indicating that the target virtual machine has access permissions to both the physical source address and the physical target address in the physical address, configure the physical address in the direct memory access controller through the target virtual machine.
  • step 4401 may be executed by the processor calling corresponding instructions stored in the memory, or may be executed by the first configuration sub-module in the configuration module run by the processor.
  • the physical address can include PA1 and PA2.
  • PA1 and PA2 can have corresponding access whitelists respectively. If the identification information of the target virtual machine is the same, is located in the access whitelist corresponding to PA1 and the access whitelist corresponding to PA2. It can be considered that the target virtual machine has access rights to both PA1 and PA2. Then, the target virtual machine can configure the physical addresses including PA1 and PA2 in direct storage. In the access controller, the direct memory access controller can subsequently copy the data from the address space corresponding to PA1 to the address space corresponding to PA2.
  • the target virtual machine may not be configured including the physical addresses of PA1 and PA2.
  • access permission-related judgments can be made respectively for the physical source address and the physical target address in the physical address, and combined with the judgment results, it is decided whether to configure the physical address in the direct memory access controller to effectively Ensure the security of direct memory access controller access to memory.
  • the method further includes step 432 and step 434.
  • Step 432 Obtain the occupancy mode of the direct memory access controller by the target virtual machine.
  • step 432 may be executed by the processor calling corresponding instructions stored in the memory, or may be executed by the first acquisition module run by the processor.
  • Step 434 Obtain control information for the direct memory access controller.
  • step 434 may be executed by the processor calling corresponding instructions stored in the memory, or may be executed by the second acquisition module run by the processor.
  • control information obtained in step 434 may also be called DMA control information, and the DMA control information may include at least one of the following: copy speed information, copy mode information, and data verification mode.
  • Step 440 includes step 4403 and step 4405.
  • Step 4403 Determine the configuration mode that matches the occupancy mode.
  • step 4403 may be executed by the processor calling corresponding instructions stored in the memory, or may be executed by the fourth determination sub-module in the configuration module run by the processor.
  • the configuration method matching the occupancy mode can be: direct configuration; if the occupancy mode is non-exclusive mode, the configuration method matching the occupancy mode can be: configuration through the virtualization manager.
  • Step 4405 Configure the physical address and control information in the direct memory access controller according to the configuration mode through the target virtual machine.
  • step 4405 may be executed by the processor calling corresponding instructions stored in the memory, or may be executed by the second configuration sub-module in the configuration module run by the processor.
  • the target virtual machine can directly configure the physical address and control information in the direct memory access controller; if the occupancy mode is non-exclusive mode, the target virtual machine can configure the physical address and control information through the virtualization manager. on the direct memory access controller.
  • an appropriate configuration method can be used to configure the physical address and control information in the direct memory access controller, so that the direct memory access controller refers to the physical address and control information, and perform data copy processing.
  • the access control method provided by the embodiment of the present disclosure may include the following steps:
  • Step 1201 Guest OS A uses the MMU to convert the virtual source address VA1 and the virtual target address VA2 into the intermediate physical source address IPA1 and the intermediate physical target address IPA2;
  • Step 1203 Guest OS A requests the virtualization manager to use the MMU to convert the intermediate physical source address IPA1 and the intermediate physical target address IPA2 into the physical source address PA1 and the physical target address PA2;
  • Step 1205 The virtualization manager determines whether Guest OS A has access rights to both the physical source address PA1 and the physical target address PA2; if so, execute step 1207; if not, end;
  • Step 1207 the virtualization manager returns the physical source address PA1 and the physical target address PA2 to Guest OS A;
  • Step 1209 Guest OS A configures the physical source address PA1, physical target address PA2, and control information into the DMA controller (suitable for the case where Guest OS A exclusively occupies the DMA controller); or, Guest OS A configures the physical source address PA1 , physical target address PA2, and control information are configured into the DMA controller through the virtualization manager (suitable for the case where Guest OS A shares the DMA controller with other virtual machines).
  • the physical source address PA1 can be either an address in the memory or the address of a peripheral on the bus;
  • the physical target address PA2 can be either an address in the memory or an address of a peripheral on the bus.
  • the data copy processing at the DMA controller can have the following four situations: address in memory ⁇ address in memory; address in memory ⁇ address of peripheral; address of peripheral ⁇ address of peripheral; address ⁇ address in memory.
  • embodiments of the present disclosure can implement virtualization of the DMA controller on a chip without SMMU, so that the permissions of multiple virtual machines running on the chip can be controlled when using the DMA controller, which is beneficial to reducing chip costs. Also, virtual machines can access the DMA controller faster.
  • Any access control method provided by the embodiments of the present disclosure can be executed by any appropriate device with data processing capabilities, including but not limited to: terminal devices and servers.
  • any of the access control methods provided by the embodiments of the present disclosure can be executed by the processor.
  • the processor executes any of the access control methods mentioned in the embodiments of the present disclosure by calling corresponding instructions stored in the memory. No further details will be given below.
  • the aforementioned program can be stored in a computer-readable storage medium.
  • the execution includes the above Steps of method embodiments; the aforementioned storage media include: read-only memory (ROM), random access memory (RAM), magnetic disks or optical disks and other media that can store program codes.
  • Figure 14 is a schematic structural diagram of an access control device provided by an exemplary embodiment of the present disclosure.
  • the device shown in Figure 14 can be used to implement any of the above method embodiments of the present disclosure.
  • the device shown in Figure 14 includes a generation module 1410, a conversion module 1420, a determination module 1430 and a configuration module 1440.
  • Generating module 1410 configured to generate an address translation request through the target virtual machine, where the address translation request includes an intermediate physical address
  • the conversion module 1420 is configured to convert the intermediate physical address included in the address conversion request generated by the generation module 1410 into a physical address through the memory management unit;
  • the determination module 1430 is configured to determine, through the virtualization manager, the access permission information of the target virtual machine to the physical address converted by the conversion module 1420;
  • the configuration module 1440 is configured to configure the physical address in the direct memory access controller through the target virtual machine in response to the access permission information determined by the determination module 1430 indicating that the target virtual machine has access permission to the physical address.
  • the physical address has a corresponding access whitelist
  • the access whitelist includes multiple virtual machine identification information.
  • the determination module 1430 includes the first determination sub-module 14301 shown in Figure 15-1 or Figure 15-2 The second determination sub-module 14303 shown;
  • the first determination sub-module 14301 is configured to determine, through the virtualization manager, that the access permission information indicates that the target virtual machine has access permission to the physical address in response to the identification information of the target virtual machine being in the access whitelist; or,
  • the second determination sub-module 14303 is configured to, in response to the identification information of the target virtual machine not being in the access whitelist, determine through the virtualization manager that the access permission information indicates that the target virtual machine does not have access permission to the physical address.
  • the conversion module 1420 includes:
  • the conversion submodule 14201 is configured to convert the intermediate physical address included in the address translation request generated by the generation module 1410 into a physical address through the memory management unit in response to the absence of an intermediate physical address included in the address translation request generated by the generation module 1410 in the recorded address. address;
  • the device also includes:
  • the first adding module 1450 is configured to characterize the target virtual machine in response to the access permission information determined by the determination module 1430 after the determination module 1430 determines, through the virtualization manager, the access permission information of the target virtual machine to the physical address converted by the conversion module 1420 Without access rights to the physical address converted by the conversion sub-module 14201, the intermediate physical address included in the address conversion request generated by the generation module 1410 is added to the recorded address.
  • the device also includes:
  • the output module 1460 is configured to respond to the target virtual machine generating more than a preset number of address translation requests within a preset time period, and the access permission information corresponding to each address translation request determined by the determination module 1430 indicates that the target virtual machine does not have the ability to perform the translation.
  • Module 1420 converts the access permission of the obtained physical address and outputs permission confirmation prompt information; wherein the permission confirmation prompt information includes the identification information and physical address of the target virtual machine;
  • the second adding module 1470 is configured to add the identification information of the target virtual machine to the access whitelist in response to the triggering operation of the permission confirmation prompt information output by the output module 1460 .
  • the intermediate physical address includes an intermediate physical source address and an intermediate physical destination address
  • the physical address includes a physical source address translated from the intermediate physical source address, and a physical destination address translated from the intermediate physical destination address
  • the configuration module 1440 includes:
  • the third determination sub-module 14401 is used to determine whether the access permission information determined by the determination module 1430 represents that the target virtual machine has access permissions to both the physical source address and the physical target address in the physical address;
  • the first configuration sub-module 14403 is configured to respond to the access permission information determined by the third determination sub-module 14401 to represent that the target virtual machine has access permissions to both the physical source address and the physical target address in the physical address, through the target virtual machine.
  • the virtual machine configures the physical address in the direct memory access controller.
  • the device further includes:
  • the first acquisition module 1432 is used to acquire the occupancy mode of the direct memory access controller by the target virtual machine before configuring the physical address in the direct memory access controller through the virtual machine;
  • the second acquisition module 1434 is used to acquire control information for the direct memory access controller
  • Configuration module 1440 including:
  • the fourth determination sub-module 14405 is used to determine the configuration mode that matches the occupancy pattern obtained by the first acquisition module 1432;
  • the second configuration sub-module 14407 is configured to configure the physical address and the control information obtained by the second acquisition module 1434 in the direct memory access controller through the target virtual machine according to the configuration method determined by the fourth determination sub-module 14405.
  • Figure 18 illustrates a block diagram of an electronic device according to an embodiment of the present disclosure.
  • Electronic device 1800 includes one or more processors 1810 and memory 1820 .
  • the processor 1810 may be a central processing unit (CPU) or other form of processing unit having data processing capabilities and/or instruction execution capabilities, and may control other components in the electronic device 1800 to perform desired functions.
  • CPU central processing unit
  • the processor 1810 may be a central processing unit (CPU) or other form of processing unit having data processing capabilities and/or instruction execution capabilities, and may control other components in the electronic device 1800 to perform desired functions.
  • Memory 1820 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and/or non-volatile memory.
  • Volatile memory may include, for example, random access memory (RAM) and/or cache memory (cache), etc.
  • Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc.
  • One or more computer program instructions may be stored on a computer-readable storage medium, and the processor 1810 may execute the one or more computer program instructions to implement the access control method of any method embodiment of the present disclosure described above and /or other desired functionality.
  • the electronic device 1800 may further include an input device 1830 and an output device 1840, these components being interconnected through a bus system and/or other forms of connection mechanisms (not shown).
  • the input device 1830 may also include, for example, a keyboard, a mouse, and the like.
  • the output device 1840 can output various information to the outside.
  • the output device 1840 may include, for example, a display, a speaker, a printer, a communication network and remote output devices connected thereto, and the like.
  • the electronic device 1800 may also include any other appropriate components depending on the specific application.
  • embodiments of the present disclosure may also be a computer program product, which includes computer program instructions that, when executed by a processor, cause the processor to perform the “exemplary method” described above in this specification
  • the steps in the access control method according to any method embodiment of the present disclosure are described in the section.
  • the computer program product may be written with program code for performing operations of embodiments of the present disclosure in any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, etc. , also includes conventional procedural programming languages, such as the "C" language or similar programming languages.
  • the program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or server execute on.
  • embodiments of the present disclosure may also be a computer-readable storage medium having computer program instructions stored thereon.
  • the computer program instructions when executed by a processor, cause the processor to execute the above-mentioned “example method” part of this specification.
  • the computer-readable storage medium may be any combination of one or more readable media.
  • the readable medium may be a readable signal medium or a readable storage medium.
  • the readable storage medium may include, for example, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: electrical connection with one or more conductors, portable disk, hard disk, random access memory (RAM), read only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Storage Device Security (AREA)

Abstract

本公开的实施例公开了一种访问控制方法、装置、计算机可读存储介质及电子设备。其中，该方法包括：通过目标虚拟机生成地址转换请求，地址转换请求包括中间物理地址；通过内存管理单元将中间物理地址转换为物理地址；通过虚拟化管理器确定目标虚拟机对物理地址的访问权限信息；响应于访问权限信息表征目标虚拟机具有对物理地址的访问权限，通过目标虚拟机将物理地址配置于直接存储器访问控制器中。本公开的实施例能够降低芯片的制造成本。

Description

访问控制方法、装置、计算机可读存储介质及电子设备
本公开要求在2022年07月22日提交中国专利局、申请号为CN202210868546.3、发明名称为“访问控制方法、装置、计算机可读存储介质及电子设备”的中国专利申请的优先权，其全部内容通过引用结合在本公开中。
技术领域
本公开涉及芯片技术，尤其涉及一种访问控制方法、装置、计算机可读存储介质及电子设备。
背景技术
使用虚拟化管理器可以实现多个虚拟机同时在一颗芯片上运行；其中，芯片中可以包括直接存储器访问(Direct Memory Access，DMA)控制器，芯片中还可以配备系统内存管理单元(System Memory Management Unit，SMMU)。
发明内容
本公开的实施例提供了一种访问控制方法、装置、计算机可读存储介质及电子设备。
根据本公开实施例的一个方面，提供了一种访问控制方法，包括：
通过目标虚拟机生成地址转换请求，所述地址转换请求包括中间物理地址；
通过内存管理单元将所述中间物理地址转换为物理地址；
通过虚拟化管理器确定所述目标虚拟机对所述物理地址的访问权限信息；
响应于所述访问权限信息表征所述目标虚拟机具有对所述物理地址的访问权限，通过所述目标虚拟机将所述物理地址配置于直接存储器访问控制器中。
根据本公开实施例的另一个方面，提供了一种访问权限控制装置，包括：
生成模块，用于通过目标虚拟机生成地址转换请求，所述地址转换请求包括中间物理地址；
转换模块，用于通过内存管理单元将所述生成模块生成的所述地址转换请求包括的所述中间物理地址转换为物理地址；
确定模块，用于通过虚拟化管理器确定所述目标虚拟机对所述转换模块转换得到的所述物理地址的访问权限信息；
配置模块，用于响应于所述确定模块确定的所述访问权限信息表征所述目标虚拟机具有对所述物理地址的访问权限，通过所述目标虚拟机将所述物理地址配置于直接存储器访问控制器中。
根据本公开实施例的再一个方面，提供了一种计算机可读存储介质，所述存储介质存储有计算机程序，所述计算机程序用于执行上述访问控制方法。
根据本公开实施例的又一个方面，提供了一种电子设备，包括：
处理器；
用于存储所述处理器可执行指令的存储器；
所述处理器，用于从所述存储器中读取所述可执行指令，并执行所述指令以实现上述访问控制方法。
根据本公开实施例的又一个方面，提供了一种计算机程序产品，当所述计算机程序产品中的指令被处理器执行时，实现上述访问控制方法。
基于本公开上述实施例提供的访问控制方法、装置、计算机可读存储介质、电子设备及产品，可以通过目标虚拟机生成地址转换请求，通过内存管理单元将地址转换请求中的中间物理地址转换为物理地址，并在通过虚拟化管理器确定的访问权限信息表征目标虚拟机具有对物理地址的访问权限的情况下，通过目标虚拟机将物理地址配置于直接存储器访问控制器中。由于本公开的实施例中，配置至直接存储器访问控制器中的是物理地址，而不是中间物理地址，直接存储器访问控制器基于物理地址即可执行数据拷贝处理，并且，在将物理地址配置至直接存储器访问控制器中之前，已经进行了访问权限相关的判断(即确定目标虚拟机是否具有对物理地址的访问权限)，由此对目标虚拟机通过直接存储器访问控制器所能访问到的区域进行了限制，这样，本公开的实施例中，直接存储器访问控制器无需通过系统内存管理单元获取物理地址，也无需通过系统内存管理单元进行访问权限相关的判断，因此，芯片中无需配备系统内存管理单元(具体可参见图7中的芯片结构)，从而能够降低芯片的制造成本。
下面通过附图和实施例，对本公开的技术方案做进一步的详细描述。
附图说明
图1是相关技术中芯片的结构示意图。
图2是相关技术中芯片的工作原理示意图。
图3是相关技术中芯片的另一工作原理示意图。
图4是本公开一示例性实施例提供的访问控制方法的流程示意图。
图5是本公开的实施例中芯片的工作原理图。
图6是本公开的实施例中芯片的另一工作原理图。
图7是本公开的实施例中芯片的结构示意图。
图8-1是本公开另一示例性实施例提供的访问控制方法的流程示意图。
图8-2是本公开再一示例性实施例提供的访问控制方法的流程示意图。
图9-1是本公开又一示例性实施例提供的访问控制方法的流程示意图。
图9-2是本公开又一示例性实施例提供的访问控制方法的流程示意图。
图10-1是本公开又一示例性实施例提供的访问控制方法的流程示意图。
图10-2是本公开又一示例性实施例提供的访问控制方法的流程示意图。
图11是本公开又一示例性实施例提供的访问控制方法的流程示意图。
图12是本公开又一示例性实施例提供的访问控制方法的流程示意图。
图13是本公开又一示例性实施例提供的访问控制方法的流程示意图。
图14是本公开一示例性实施例提供的访问控制装置的结构示意图。
图15-1是本公开另一示例性实施例提供的访问控制装置的结构示意图。
图15-2是本公开再一示例性实施例提供的访问控制装置的结构示意图。
图16是本公开又一示例性实施例提供的访问控制装置的结构示意图。
图17是本公开又一示例性实施例提供的访问控制装置的结构示意图。
图18是本公开一示例性实施例提供的电子设备的结构图。
具体实施方式
为了解释本公开，下面将参考附图详细地描述本公开的示例实施例，显然，所描述的实施例仅是本公开的一部分实施例，而不是全部实施例，应理解，本公开不受示例性实施例的限制。
应注意到：除非另外具体说明，否则在这些实施例中阐述的部件和步骤的相对布置、数字表达式和数值不限制本公开的范围。
申请概述
芯片可以为系统级芯片(System on Chip，SOC)，如图1、图2、图3所示，相关技术中，芯片中可以包括：内存管理单元(Memory Management Unit，MMU)、内存模块、外设模块、直接存储器访问控制器、系统内存管理单元和芯片总线模块。
内存管理单元的一个基本功能是虚拟内存管理，包括但不限于将虚拟地址(Virtual Address)转换为物理地址(Physical Address，PA)，将虚拟地址转换为中间物理地址(Intermediate Physical Address，IPA)，将中间物理地址转换为物理地址等。
直接存储器访问控制器用于数据拷贝，即实现数据从一个地址空间至另一个地址空间的复制。
系统内存管理单元可以负责芯片外设的管理。
需要说明的是，可以通过使用图1、图2、图3所示的虚拟化管理器(或者称为虚拟化管理器模块)，实现多个虚拟机(Guest OS)同时在一颗芯片上运行；其中，虚拟化管理器和多个虚拟机均可以是运行在芯片上的软件模块。
实际工作时，虚拟机可以通过虚拟化管理器来间接操作硬件。当虚拟机使用直接存储器访问控制器时，可以将数据的源地址和目标地址以IPA形式配置到直接存储器访问控制器中。例如，如图2所示，当Guest OS A这一虚拟机独占直接存储器访问控制器时，Guest OS A可以将IPA形式的源地址和目标地址直接配置到直接存储器访问控制器中。再例如，如图3所示，当Guest OS A这一虚拟机未独占直接存储器访问控制器，而是与其他虚拟机共享直接存储器访问控制器时(这种情况下，虚拟化管理器负责实现各个虚拟机访问直接存储器访问控制器时的互斥)，Guest OS A可以通过虚拟化管理器将IPA形式的源地址和目标地址配置到直接存储器访问控制器中。
在IPA形式的源地址和目标地址配置到直接存储器访问控制器中之后，IPA形式的源地址和目标地址可以被转换为PA形式的源地址和目标地址。直接存储器访问控制器可以基于PA形式的源地址和目标地址，执行数据拷贝处理，即控制相关模块(例如内存模块或外设模块)将数据从PA形式的源地址对应的地址空间复制到PA形式的目标地址对应的 地址空间。
示例性方法
图4是本公开一示例性实施例提供的访问控制方法的流程示意图。图4所示的方法可以包括步骤410、步骤420、步骤430和步骤440，下面分别对各步骤进行说明。
步骤410，通过目标虚拟机生成地址转换请求，地址转换请求包括中间物理地址。
在一个可选示例中，步骤410可以由处理器调用存储器存储的相应指令执行，也可以由被处理器运行的生成模块执行。
需要说明的是，目标虚拟机可以为芯片上运行的多个虚拟机中的任一虚拟机，例如为图2、图3、图5、图6中的Guest OS A，目标虚拟机中的“目标”并不构成对目标虚拟机的限定。
在生成地址转换请求之前，目标虚拟机可以获得虚拟地址，并调用内存管理单元将虚拟地址转换为中间物理地址。接下来，目标虚拟机可以生成包括中间物理地址的地址转换请求，地址转换请求用于请求将中间物理地址转换为物理地址。
步骤420，通过内存管理单元将中间物理地址转换为物理地址。
在一个可选示例中，步骤420可以由处理器调用存储器存储的相应指令执行，也可以由被处理器运行的转换模块执行。
可选地，目标虚拟机可以将地址转换请求转发给内存管理单元，内存管理单元可以响应于地址转换请求，将地址转换请求包括的中间物理地址转换为物理地址，并将物理地址发送给虚拟化管理器。
可选地，目标虚拟机可以将地址转换请求转发给虚拟化管理器，虚拟化管理器可以响应于地址转换请求，调用内存管理单元将地址转换请求包括的中间物理地址转换为物理地址。
步骤430，通过虚拟化管理器确定目标虚拟机对物理地址的访问权限信息。
在一个可选示例中，步骤430可以由处理器调用存储器存储的相应指令执行，也可以由被处理器运行的确定模块执行。
可选地，虚拟化管理器可以按照预定的访问权限控制策略，确定目标虚拟机对物理地址的访问权限信息，访问权限信息可以用于表征目标虚拟机是否具有对物理地址的访问权限。
步骤440，响应于访问权限信息表征目标虚拟机具有对物理地址的访问权限，通过目标虚拟机将物理地址配置于直接存储器访问控制器中。
在一个可选示例中，步骤440可以由处理器调用存储器存储的相应指令执行，也可以由被处理器运行的配置模块执行。
如果访问权限信息表示为“1”，这说明目标虚拟机具有对物理地址的访问权限，虚拟化管理器可以将物理地址发送至目标虚拟机，目标虚拟机可以将物理地址配置于直接存储器访问控制器中，这样，直接存储器访问控制器可以基于物理地址，执行数据拷贝处理。
如果访问权限信息表示为“0”，这说明目标虚拟机不具有对物理地址的访问权限，虚 拟化管理器可以不将物理地址发送至目标虚拟机，目标虚拟机也不进行物理地址的配置。
本公开的实施例中，可以通过目标虚拟机生成地址转换请求，通过内存管理单元将地址转换请求中的中间物理地址转换为物理地址，并在通过虚拟化管理器确定的访问权限信息表征目标虚拟机具有对物理地址的访问权限的情况下，通过目标虚拟机将物理地址配置于直接存储器访问控制器中。由于本公开的实施例中，配置至直接存储器访问控制器中的是物理地址，而不是中间物理地址，直接存储器访问控制器基于物理地址即可执行数据拷贝处理，并且，在将物理地址配置至直接存储器访问控制器中之前，已经进行了访问权限相关的判断(即确定目标虚拟机是否具有对物理地址的访问权限)，由此对目标虚拟机通过直接存储器访问控制器所能访问到的区域进行了限制，这样，本公开的实施例中，直接存储器访问控制器无需通过系统内存管理单元获取物理地址，也无需通过系统内存管理单元进行访问权限相关的判断，因此，芯片中无需配备系统内存管理单元(具体可参见图7中的芯片结构)，从而能够降低芯片的制造成本。
在一个可选示例中，物理地址存在对应的访问白名单，访问白名单中包括多个虚拟机标识信息，在图4所示实施例的基础上，步骤430包括图8-1所示的步骤4301或者图8-2所示的步骤4303。
步骤4301，响应于目标虚拟机的标识信息位于访问白名单中，通过虚拟化管理器确定访问权限信息表征目标虚拟机具有对物理地址的访问权限。
在一个可选示例中，步骤4301可以由处理器调用存储器存储的相应指令执行，也可以由被处理器运行的确定模块中的第一确定子模块执行。
步骤4303，响应于目标虚拟机的标识信息不位于访问白名单中，通过虚拟化管理器确定访问权限信息表征目标虚拟机不具有对物理地址的访问权限。
在一个可选示例中，步骤4303可以由处理器调用存储器存储的相应指令执行，也可以由被处理器运行的确定模块中的第二确定子模块执行。
需要说明的是，可以预先对物理地址与访问白名单之间的对应关系进行存储。在通过内存管理单元将地址转换请求包括的中间物理地址转换为物理地址之后，虚拟化管理器可以根据预先存储的对应关系，确定物理地址对应的访问白名单，并对物理地址对应的访问白名单进行遍历，以确定目标虚拟机的标识信息是否位于物理地址对应的访问白名单中。
如果目标虚拟机的标识信息位于物理地址对应的访问白名单中，虚拟化管理器确定的访问权限信息可以表示为“1”，以表征目标虚拟机具有对物理地址的访问权限。如果目标虚拟机的标识信息不位于物理地址对应的访问白名单中，虚拟化管理器确定的访问权限信息可以表示为“0”，以表征目标虚拟机不具有对物理地址的访问权限。
本公开的实施例中，由于访问白名单的设置，通过判断目标虚拟机的标识信息是否位于物理地址对应的访问白名单中，可以高效可靠地确定目标虚拟机是否具有对物理地址的访问权限。
需要指出的是，具体实现时，也可以为物理地址设置对应的访问黑名单，如果目标虚拟机的标识信息位于访问黑名单中，访问权限信息可以表征目标虚拟机不具有对物理地址的访问权限，而如果目标虚拟机的标识信息不位于访问黑名单中，访问权限信息可以表征 目标虚拟机具有对物理地址的访问权限。
在图8-1或图8-2所示实施例的基础，如图9-1或图9-2所示，步骤420包括步骤4201。
步骤4201，响应于已记录地址中不存在中间物理地址，通过内存管理单元将中间物理地址转换为物理地址。
在一个可选示例中，步骤4201可以由处理器调用存储器存储的相应指令执行，也可以由被处理器运行的转换模块中的转换子模块执行。
步骤430之后，该方法还包括步骤450。
步骤450，响应于访问权限信息表征目标虚拟机不具有对物理地址的访问权限，向已记录地址中添加中间物理地址。
在一个可选示例中，步骤450可以由处理器调用存储器存储的相应指令执行，也可以由被处理器运行的第一添加模块执行。
可选地，已记录地址可以通过一个地址表的形式表示。
在一个可选的例子中，目标虚拟机为Guest OS A，假设Guest OS A生成了包括的中间物理地址为IPA0的地址转换请求之后，Guest OS A将地址转换请求发送给了虚拟化管理器，虚拟化管理器可以对已记录地址进行遍历，以确定已记录地址中是否存在IPA0。
如果已记录地址中存在IPA0，虚拟化管理器可以拒绝Guest OS A的地址转换请求。
如果已记录地址中不存在IPA0，虚拟化管理器可以调用内存管理单元将IPA0转换为物理地址，转换得到的物理地址可以为PA0，虚拟化管理器还可以确定Guest OS A对PA0的访问权限信息。如果访问权限信息表征Guest OS A不具有对PA0的访问权限，虚拟化管理器可以向已记录地址中添加IPA0；如果访问权限信息表征Guest OS A具有对PA0的访问权限，虚拟化管理器可以不向已记录地址中添加IPA0，虚拟化管理器还可以将PA0发送至Guest OS A，以便Guest OS A将PA0配置于直接存储器访问控制器中。
对于上段中访问权限信息表征Guest OS A不具有对PA0的访问权限的情况，由于虚拟化管理器向已记录地址中添加了IPA0，当Guest OS A再次生成包括中间物理地址为IPA0的地址转换请求，并将地址转换请求发送给虚拟化管理器之后，虚拟化管理器通过对已记录地址进行遍历，可以确定已记录地址中存在IPA0，此时，虚拟化管理器可以拒绝Guest OS A的地址转换请求，而无需调用内存管理单元将IPA0转换为物理地址，也无需基于物理地址执行访问权限信息确定步骤以及物理地址配置步骤，这样有利于节约运算资源。
本公开的实施例中，通过已记录地址的更新和运用，无需通过内存管理单元对任一地址转换请求中的中间物理地址均进行转换，而仅需要对不存在于已记录地址中的中间物理地址进行转换，从而有利于节约运算资源。
在图8-1或图8-2所示实施例的基础，如图10-1或图10-2所示，该方法还包括步骤460和步骤470。
步骤460，响应于目标虚拟机在预设时长内生成大于预设数量的地址转换请求，且各地址转换请求对应的访问权限信息均表征目标虚拟机不具有对物理地址的访问权限，输出权限确认提示信息；其中，权限确认提示信息包括目标虚拟机的标识信息和物理地址。
在一个可选示例中，步骤460可以由处理器调用存储器存储的相应指令执行，也可以 由被处理器运行的输出模块执行。
可选地，预设时长可以为30秒、1分钟、2分钟等，预设数量可以为30个、40个、50个、60个、100个等，在此不再一一列举。
假设目标虚拟机在1分钟内生成了105个包括物理地址的地址转换请求，且基于物理地址对应的访问白名单，虚拟化管理器确定各地址转换请求对应的访问权限信息均表征目标虚拟机不具有对物理地址的访问权限，则可以通过语音方式、文字方式等输出包括目标虚拟机的标识信息和物理地址的权限确认提示信息，例如，可以通过语音说“请确认Guest OS A是否具有对PA0的访问权限”，再例如，可以通过屏幕上的弹窗显示“请确认Guest OS A是否具有对PA0的访问权限”，以提示人工确认Guest OS A是否具有对PA0的访问权限。
步骤470，响应于针对权限确认提示信息的触发操作，向访问白名单中添加目标虚拟机的标识信息。
在一个可选示例中，步骤470可以由处理器调用存储器存储的相应指令执行，也可以由被处理器运行的第二添加模块执行。
可选地，针对步骤460中输出的权限确认提示信息，在一种可选的实施方式中，可以采用语音的方式输出“是”或者“否”，如果获得语音输出的“是”指令，可以认为接收到针对权限确认提示信息的触发操作，那么，可以向访问白名单中添加Guest OS A的名称；或者，在另一种可选的实施方式中，屏幕上弹窗的下方可以显示“是”和“否”两个选择按钮，针对步骤460中输出的权限确认提示信息，可以选择“是”这个选择按钮或者“否”这个选择按钮，如果选择“是”这个选择按钮，可以认为接收到针对权限确认提示信息的触发操作，那么，可以向访问白名单中添加Guest OS A的名称。
本公开的实施例中，如果目标虚拟机在短时间内生成了包括相同中间物理地址的大量地址转换请求，且这些地址转换请求对应的访问权限信息均表征目标虚拟机不具有对物理地址的访问权限，则可以通过权限确认提示信息的输出，提示用户确认目标虚拟机是否具有对物理地址的访问权限，如果用户确认目标虚拟机具有对物理地址的访问权限，则可以向访问白名单中添加目标虚拟机的标识信息，从而保证访问白名单中记录的信息的准确性。
在一个可选示例中，中间物理地址包括中间物理源地址和中间物理目标地址，物理地址包括由中间物理源地址转换得到的物理源地址，以及由中间物理目标地址转换得到的物理目标地址。
在图4所示实施例的基础上，如图11所示，步骤440包括步骤4401。
步骤4401，响应于访问权限信息表征目标虚拟机同时具有对物理地址中的物理源地址和物理目标地址的访问权限，通过目标虚拟机将物理地址配置于直接存储器访问控制器中。
在一个可选示例中，步骤4401可以由处理器调用存储器存储的相应指令执行，也可以由被处理器运行的配置模块中的第一配置子模块执行。
假设中间物理地址中包括的中间物理源地址为IPA1，中间物理地址中包括的中间物理目标地址为IPA2，由IPA1转换得到的物理源地址为PA1，由IPA2转换得到的物理目标地址为PA2，则物理地址中可以包括PA1和PA2。
可选地，PA1和PA2可以分别具有对应的访问白名单，如果目标虚拟机的标识信息同 时位于PA1对应的访问白名单和PA2对应的访问白名单中，可以认为目标虚拟机同时具有对PA1和PA2的访问权限，那么，目标虚拟机可以将包括PA1和PA2的物理地址配置于直接存储器访问控制器中，直接存储器访问控制器后续可以将数据由PA1对应的地址空间复制至PA2对应的地址空间。如果目标虚拟机的标识信息不位于PA1对应的访问白名单，和/或，目标虚拟机的标识信息不位于PA2对应的访问白名单，可以认为目标虚拟机未同时具有对PA1和PA2的访问权限，那么，目标虚拟机可以不进行包括PA1和PA2的物理地址的配置。
本公开的实施例中，可以分别针对物理地址中的物理源地址和物理目标地址进行访问权限相关的判断，并结合判断结果，决定是否将物理地址配置于直接存储器访问控制器中，以有效地保证直接存储器访问控制器访问内存的安全性。
在图4所示实施例的基础上，如图12所示，在步骤440之前，该方法还包括步骤432和步骤434。
步骤432，获取目标虚拟机对直接存储器访问控制器的占用模式。
在一个可选示例中，步骤432可以由处理器调用存储器存储的相应指令执行，也可以由被处理器运行的第一获取模块执行。
需要说明的是，占用模式存在两种可能的情况，一种是独占模式，另一种是非独占模式；其中，独占模式下，目标虚拟机可以直接与直接存储器访问控制器通信；非独占模式下，目标虚拟机可以通过虚拟化管理器与直接存储器访问控制器通信。其中，独占模式的情况可以参见图5，非独占模式的情况可以参见图6。
步骤434，获取针对直接存储器访问控制器的控制信息。
在一个可选示例中，步骤434可以由处理器调用存储器存储的相应指令执行，也可以由被处理器运行的第二获取模块执行。
可选地，步骤434中获取的控制信息也可以称为DMA控制信息，DMA控制信息中可以包括以下至少一项：拷贝速度信息、拷贝模式信息、数据校验方式。
步骤440包括步骤4403和步骤4405。
步骤4403，确定与占用模式匹配的配置方式。
在一个可选示例中，步骤4403可以由处理器调用存储器存储的相应指令执行，也可以由被处理器运行的配置模块中的第四确定子模块执行。
如果占用模式为独占模式，与占用模式匹配的配置方式可以为：直接配置；如果占用模式为非独占模式，与占用模式匹配的配置方式可以为：通过虚拟化管理器进行配置。
步骤4405，通过目标虚拟机将物理地址和控制信息按照配置方式配置于直接存储器访问控制器中。
在一个可选示例中，步骤4405可以由处理器调用存储器存储的相应指令执行，也可以由被处理器运行的配置模块中的第二配置子模块执行。
如果占用模式为独占模式，目标虚拟机可以将物理地址和控制信息直接配置于直接存储器访问控制器；如果占用模式为非独占模式，目标虚拟机可以将物理地址和控制信息通过虚拟化管理器配置于直接存储器访问控制器。
本公开的实施例中，参考目标虚拟机对直接存储器访问控制器的占用模式，可以采用合适的配置方式，将物理地址和控制信息配置于直接存储器访问控制器，以便直接存储器访问控制器参考物理地址和控制信息，进行数据拷贝处理。
可选地，如图13所示，本公开的实施例提供的访问控制方法可以包括如下步骤：
步骤1201，Guest OS A使用MMU将虚拟源地址VA1和虚拟目标地址VA2转换成中间物理源地址IPA1和中间物理目标地址IPA2；
步骤1203，Guest OS A向虚拟化管理器请求使用MMU将中间物理源地址IPA1和中间物理目标地址IPA2转换成物理源地址PA1和物理目标地址PA2；
步骤1205，虚拟化管理器判断Guest OS A是否同时具有对物理源地址PA1和物理目标地址PA2的访问权限；如果是，执行步骤1207；如果否，结束；
步骤1207，虚拟化管理器将物理源地址PA1和物理目标地址PA2返回给Guest OS A；
步骤1209，Guest OS A将物理源地址PA1、物理目标地址PA2，以及控制信息配置到DMA控制器中(适于Guest OS A独占DMA控制器的情况)；或者，Guest OS A将物理源地址PA1、物理目标地址PA2，以及控制信息通过虚拟化管理器配置到DMA控制器中(适于Guest OS A与其他虚拟机共享DMA控制器的情况)。
可选地，物理源地址PA1既可以是内存中的地址，也可以是总线上外设的地址；物理目标地址PA2既可以是内存中的地址，也可以是总线上外设的地址。这样，DMA控制器处的数据拷贝处理可以有以下四种情况：内存中的地址→内存中的地址；内存中的地址→外设的地址；外设的地址→外设的地址；外设的地址→内存中的地址。
综上，本公开的实施例可以在没有SMMU的芯片上实现DMA控制器的虚拟化，使得芯片上运行的多个虚拟机使用DMA控制器时的权限都可以受到控制，有利于降低芯片成本，并且，虚拟机可以更快速地访问DMA控制器。
本公开实施例提供的任一种访问控制方法可以由任意适当的具有数据处理能力的设备执行，包括但不限于：终端设备和服务器等。或者，本公开实施例提供的任一种访问控制方法可以由处理器执行，如处理器通过调用存储器存储的相应指令来执行本公开实施例提及的任一种访问控制方法。下文不再赘述。
本领域普通技术人员可以理解：实现上述方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成，前述的程序可以存储于计算机可读存储介质中，该程序在执行时，执行包括上述方法实施例的步骤；而前述的存储介质包括：只读存储器(ROM)、随机存取存储器(RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
示例性装置
图14是本公开一示例性实施例提供的访问控制装置的结构示意图。图14所示的装置可以用于实现本公开上述任一方法实施例。图14所示的装置包括生成模块1410、转换模块1420、确定模块1430和配置模块1440。
生成模块1410，用于通过目标虚拟机生成地址转换请求，地址转换请求包括中间物理地址；
转换模块1420，用于通过内存管理单元将生成模块1410生成的地址转换请求包括的中间物理地址转换为物理地址；
确定模块1430，用于通过虚拟化管理器确定目标虚拟机对转换模块1420转换得到的物理地址的访问权限信息；
配置模块1440，用于响应于确定模块1430确定的访问权限信息表征目标虚拟机具有对物理地址的访问权限，通过目标虚拟机将物理地址配置于直接存储器访问控制器中。
在一个可选示例中，物理地址存在对应的访问白名单，访问白名单中包括多个虚拟机标识信息，确定模块1430包括图15-1所示的第一确定子模块14301或图15-2所示的第二确定子模块14303；
第一确定子模块14301，用于响应于目标虚拟机的标识信息位于访问白名单中，通过虚拟化管理器确定访问权限信息表征目标虚拟机具有对物理地址的访问权限；或者，
第二确定子模块14303，用于响应于目标虚拟机的标识信息不位于访问白名单中，通过虚拟化管理器确定访问权限信息表征目标虚拟机不具有对物理地址的访问权限。
在一个可选示例中，如图15-1、图15-2所示，转换模块1420，包括：
转换子模块14201，用于响应于已记录地址中不存在生成模块1410生成的地址转换请求包括的中间物理地址，通过内存管理单元将生成模块1410生成的地址转换请求包括的中间物理地址转换为物理地址；
该装置还包括：
第一添加模块1450，用于在确定模块1430通过虚拟化管理器确定目标虚拟机对转换模块1420转换得到的物理地址的访问权限信息之后，响应于确定模块1430确定的访问权限信息表征目标虚拟机不具有对转换子模块14201转换得到的物理地址的访问权限，向已记录地址中添加生成模块1410生成的地址转换请求包括的中间物理地址。
在一个可选示例中，如图15-1、图15-2所示，该装置还包括：
输出模块1460，用于响应于目标虚拟机在预设时长内生成大于预设数量的地址转换请求，且确定模块1430确定的各地址转换请求对应的访问权限信息均表征目标虚拟机不具有对转换模块1420转换得到的物理地址的访问权限，输出权限确认提示信息；其中，权限确认提示信息包括目标虚拟机的标识信息和物理地址；
第二添加模块1470，用于响应于针对输出模块1460输出的权限确认提示信息的触发操作，向访问白名单中添加目标虚拟机的标识信息。
在一个可选示例中，中间物理地址包括中间物理源地址和中间物理目标地址，物理地址包括由中间物理源地址转换得到的物理源地址，以及由中间物理目标地址转换得到的物理目标地址；
如图16所示，配置模块1440，包括：
第三确定子模块14401，用于确定由确定模块1430确定的访问权限信息是否表征目标虚拟机同时具有对物理地址中的物理源地址和物理目标地址的访问权限；
第一配置子模块14403，用于响应于第三确定子模块14401确定的访问权限信息表征目标虚拟机同时具有对物理地址中的物理源地址和物理目标地址的访问权限，通过目标虚 拟机将物理地址配置于直接存储器访问控制器中。
在一个可选示例中，如图17所示，该装置还包括：
第一获取模块1432，用于在通过虚拟机将物理地址配置于直接存储器访问控制器中之前，获取目标虚拟机对直接存储器访问控制器的占用模式；
第二获取模块1434，用于获取针对直接存储器访问控制器的控制信息；
配置模块1440，包括：
第四确定子模块14405，用于确定与第一获取模块1432获取的占用模式匹配的配置方式；
第二配置子模块14407，用于通过目标虚拟机将物理地址和第二获取模块1434获取的控制信息按照第四确定子模块14405确定的配置方式配置于直接存储器访问控制器中。
在本公开的装置中，上述公开的各种可选实施例、可选实施方式和可选示例，都可以根据需要进行灵活的选择和组合，从而实现相应的功能和效果，本公开不进行一一列举。
示例性电子设备
图18图示了根据本公开实施例的电子设备的框图。电子设备1800包括一个或多个处理器1810和存储器1820。
处理器1810可以是中央处理单元(CPU)或者具有数据处理能力和/或指令执行能力的其他形式的处理单元，并且可以控制电子设备1800中的其他组件以执行期望的功能。
存储器1820可以包括一个或多个计算机程序产品，所述计算机程序产品可以包括各种形式的计算机可读存储介质，例如易失性存储器和/或非易失性存储器。易失性存储器例如可以包括随机存取存储器(RAM)和/或高速缓冲存储器(cache)等。非易失性存储器例如可以包括只读存储器(ROM)、硬盘、闪存等。在计算机可读存储介质上可以存储一个或多个计算机程序指令，处理器1810可以运行一个或多个计算机程序指令，以实现上文所述的本公开的任一方法实施例的访问控制方法以及/或者其他期望的功能。
在一个可选示例中，电子设备1800还可以包括：输入装置1830和输出装置1840，这些组件通过总线系统和/或其他形式的连接机构(未示出)互连。
该输入装置1830还可以包括例如键盘、鼠标等等。
该输出装置1840可以向外部输出各种信息。该输出装置1840可以包括例如显示器、扬声器、打印机、以及通信网络及其所连接的远程输出设备等等。
当然，为了简化，图18中仅示出了该电子设备1800中与本公开有关的组件中的一些，省略了诸如总线、输入/输出接口等等的组件。除此之外，根据具体应用情况，电子设备1800还可以包括任何其他适当的组件。
示例性计算机程序产品和计算机可读存储介质
除了上述方法和设备以外，本公开的实施例还可以是计算机程序产品，其包括计算机程序指令，所述计算机程序指令在被处理器运行时使得所述处理器执行本说明书上述“示例性方法”部分中描述的根据本公开任一方法实施例的访问控制方法中的步骤。
所述计算机程序产品可以以一种或多种程序设计语言的任意组合来编写用于执行本公开实施例操作的程序代码，所述程序设计语言包括面向对象的程序设计语言，诸如Java、C++等，还包括常规的过程式程序设计语言，诸如“C”语言或类似的程序设计语言。程序代码可以完全地在用户计算设备上执行、部分地在用户设备上执行、作为一个独立的软件包执行、部分在用户计算设备上部分在远程计算设备上执行、或者完全在远程计算设备或服务器上执行。
此外，本公开的实施例还可以是计算机可读存储介质，其上存储有计算机程序指令，所述计算机程序指令在被处理器运行时使得所述处理器执行本说明书上述“示例性方法”部分中描述的根据本公开任一方法实施例的访问控制方法中的步骤。
所述计算机可读存储介质可以采用一个或多个可读介质的任意组合。可读介质可以是可读信号介质或者可读存储介质。可读存储介质例如可以包括但不限于电、磁、光、电磁、红外线、或半导体的系统、装置或器件，或者任意以上的组合。可读存储介质的更具体的例子(非穷举的列表)包括：具有一个或多个导线的电连接、便携式盘、硬盘、随机存取存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(EPROM或闪存)、光纤、便携式紧凑盘只读存储器(CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。
以上结合具体实施例描述了本公开的基本原理，但是，需要指出的是，在本公开中提及的优点、优势、效果等仅是示例而非限制，不能认为这些优点、优势、效果等是本公开的各个实施例必须具备的。另外，上述公开的具体细节仅是为了示例的作用和便于理解的作用，而非限制，上述细节并不限制本公开为必须采用上述具体的细节来实现。
本领域的技术人员可以对本公开进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本公开权利要求及其等同技术的范围之内，则本公开也意图包含这些改动和变型在内。

Claims (11)

  1. 一种访问控制方法，包括：
    通过目标虚拟机生成地址转换请求，所述地址转换请求包括中间物理地址；
    通过内存管理单元将所述中间物理地址转换为物理地址；
    通过虚拟化管理器确定所述目标虚拟机对所述物理地址的访问权限信息；
    响应于所述访问权限信息表征所述目标虚拟机具有对所述物理地址的访问权限，通过所述目标虚拟机将所述物理地址配置于直接存储器访问控制器中。
  2. 根据权利要求1所述的方法，其中，所述物理地址存在对应的访问白名单，所述访问白名单中包括多个虚拟机标识信息，所述通过虚拟化管理器确定所述目标虚拟机对所述物理地址的访问权限信息，包括；
    响应于所述目标虚拟机的标识信息位于所述访问白名单中，通过所述虚拟化管理器确定所述访问权限信息表征所述目标虚拟机具有对所述物理地址的访问权限；或者，
    响应于所述目标虚拟机的标识信息不位于所述访问白名单中，通过所述虚拟化管理器确定所述访问权限信息表征所述目标虚拟机不具有对所述物理地址的访问权限。
  3. 根据权利要求2所述的方法，其中，所述通过内存管理单元将所述中间物理地址转换为物理地址，包括：
    响应于已记录地址中不存在所述中间物理地址，通过内存管理单元将所述中间物理地址转换为物理地址；
    所述通过虚拟化管理器确定所述目标虚拟机对所述物理地址的访问权限信息之后，所述方法还包括：
    响应于所述访问权限信息表征所述目标虚拟机不具有对所述物理地址的访问权限，向所述已记录地址中添加所述中间物理地址。
  4. 根据权利要求2所述的方法，还包括：
    响应于所述目标虚拟机在预设时长内生成大于预设数量的所述地址转换请求，且各所述地址转换请求对应的所述访问权限信息均表征所述目标虚拟机不具有对所述物理地址的访问权限，输出权限确认提示信息；其中，所述权限确认提示信息包括所述目标虚拟机的标识信息和所述物理地址；
    响应于针对所述权限确认提示信息的触发操作，向所述访问白名单中添加所述目标虚拟机的标识信息。
  5. 根据权利要求1所述的方法，其中，所述中间物理地址包括中间物理源地址和中间物理目标地址，所述物理地址包括由所述中间物理源地址转换得到的物理源地址，以及由所述中间物理目标地址转换得到的物理目标地址；
    所述响应于所述访问权限信息表征所述目标虚拟机具有对所述物理地址的访问权限，通过所述目标虚拟机将所述物理地址配置于直接存储器访问控制器中，包括：
    响应于所述访问权限信息表征所述目标虚拟机同时具有对所述物理地址中的所述物理源地址和所述物理目标地址的访问权限，通过所述目标虚拟机将所述物理地址配置于所述直接存储器访问控制器中。
  6. 根据权利要求1所述的方法，其中，
    所述通过所述虚拟机将所述物理地址配置于直接存储器访问控制器中之前，所述方法还包括：
    获取所述目标虚拟机对所述直接存储器访问控制器的占用模式；
    获取针对所述直接存储器访问控制器的控制信息；
    所述通过所述目标虚拟机将所述物理地址配置于直接存储器访问控制器中，包括：
    确定与所述占用模式匹配的配置方式；
    通过所述目标虚拟机将所述物理地址和所述控制信息按照所述配置方式配置于所述直接存储器访问控制器中。
  7. 一种访问控制装置，包括：
    生成模块，用于通过目标虚拟机生成地址转换请求，所述地址转换请求包括中间物理地址；
    转换模块，用于通过内存管理单元将所述生成模块生成的所述地址转换请求包括的所述中间物理地址转换为物理地址；
    确定模块，用于通过虚拟化管理器确定所述目标虚拟机对所述转换模块转换得到的所述物理地址的访问权限信息；
    配置模块，用于响应于所述确定模块确定的所述访问权限信息表征所述目标虚拟机具有对所述物理地址的访问权限，通过所述目标虚拟机将所述物理地址配置于直接存储器访问控制器中。
  8. 根据权利要求7所述的装置，其中，所述物理地址存在对应的访问白名单，所述访问白名单中包括多个虚拟机标识信息，所述确定模块包括；
    第一确定子模块，用于响应于所述目标虚拟机的标识信息位于所述访问白名单中，通过所述虚拟化管理器确定所述访问权限信息表征所述目标虚拟机具有对所述物理地址的访问权限；或者，
    第二确定子模块，用于响应于所述目标虚拟机的标识信息不位于所述访问白名单中，通过所述虚拟化管理器确定所述访问权限信息表征所述目标虚拟机不具有对所述物理地址的访问权限。
  9. 一种计算机可读存储介质，所述存储介质存储有计算机程序，所述计算机程序用于执行上述权利要求1-6中任一所述的访问控制方法。
  10. 一种电子设备，包括：
    处理器；
    用于存储所述处理器可执行指令的存储器；
    所述处理器，用于从所述存储器中读取所述可执行指令，并执行所述指令以实现上述权利要求1-6中任一所述的访问控制方法。
  11. 一种计算机程序产品，当所述计算机程序产品中的指令被处理器执行时，实现上述权利要求1-6中任一所述的访问控制方法。
PCT/CN2023/108252 2022-07-22 2023-07-19 访问控制方法、装置、计算机可读存储介质及电子设备 WO2024017311A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210868546.3A CN115185643A (zh) 2022-07-22 2022-07-22 访问控制方法、装置、计算机可读存储介质及电子设备
CN202210868546.3 2022-07-22

Publications (1)

Publication Number Publication Date
WO2024017311A1 true WO2024017311A1 (zh) 2024-01-25

Family

ID=83520952

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/108252 WO2024017311A1 (zh) 2022-07-22 2023-07-19 访问控制方法、装置、计算机可读存储介质及电子设备

Country Status (2)

Country Link
CN (1) CN115185643A (zh)
WO (1) WO2024017311A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115185643A (zh) * 2022-07-22 2022-10-14 地平线征程(杭州)人工智能科技有限公司 访问控制方法、装置、计算机可读存储介质及电子设备
CN115145843A (zh) * 2022-07-22 2022-10-04 地平线征程(杭州)人工智能科技有限公司 数据拷贝方法、装置、计算机可读存储介质及电子设备
CN116594739B (zh) * 2023-07-10 2023-10-10 武汉吧哒科技股份有限公司 虚拟机的控制方法、计算机设备及存储介质
CN117591037B (zh) * 2024-01-18 2024-05-03 山东云海国创云计算装备产业创新中心有限公司 一种虚拟化数据访问系统、方法、装置及服务器

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140108701A1 (en) * 2010-07-16 2014-04-17 Memory Technologies Llc Memory protection unit in a virtual processing environment
CN109766164A (zh) * 2018-11-22 2019-05-17 海光信息技术有限公司 一种访问控制方法、内存管理方法及相关装置
CN111221758A (zh) * 2019-09-30 2020-06-02 华为技术有限公司 处理远程直接内存访问请求的方法和计算机设备
CN111290829A (zh) * 2020-01-15 2020-06-16 海光信息技术有限公司 访问控制模组、虚拟机监视器及访问控制方法
CN115185643A (zh) * 2022-07-22 2022-10-14 地平线征程(杭州)人工智能科技有限公司 访问控制方法、装置、计算机可读存储介质及电子设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140108701A1 (en) * 2010-07-16 2014-04-17 Memory Technologies Llc Memory protection unit in a virtual processing environment
CN109766164A (zh) * 2018-11-22 2019-05-17 海光信息技术有限公司 一种访问控制方法、内存管理方法及相关装置
CN111221758A (zh) * 2019-09-30 2020-06-02 华为技术有限公司 处理远程直接内存访问请求的方法和计算机设备
CN111290829A (zh) * 2020-01-15 2020-06-16 海光信息技术有限公司 访问控制模组、虚拟机监视器及访问控制方法
CN115185643A (zh) * 2022-07-22 2022-10-14 地平线征程(杭州)人工智能科技有限公司 访问控制方法、装置、计算机可读存储介质及电子设备

Also Published As

Publication number Publication date
CN115185643A (zh) 2022-10-14

Similar Documents

Publication Publication Date Title
WO2024017311A1 (zh) 访问控制方法、装置、计算机可读存储介质及电子设备
US10733112B2 (en) Method and apparatus for hardware virtualization
WO2024017146A1 (zh) 数据拷贝方法、装置、计算机可读存储介质及电子设备
US9495540B2 (en) Method and system for monitoring calls to an application program interface (API) function
JP6768710B2 (ja) ファームウェア関連イベント通知
WO2013095461A1 (en) Secure direct memory access
US20100192214A1 (en) Information processing apparatus, information processing method, and recording medium including computer program
US9886595B2 (en) Priority-based application execution method and apparatus of data processing device
US9183391B2 (en) Managing device driver cross ring accesses
JP2013041409A (ja) 情報処理装置、割込み制御方法および割込み制御プログラム
JP2008539484A (ja) ユニバーサル・シリアル・バス機能のデリゲーション
WO2023060957A1 (zh) 操作系统中权限控制方法及装置、电子设备、存储介质
WO2023103407A1 (zh) 多系统中近场通信单元访问方法及装置、电子设备、存储介质
WO2024060853A1 (zh) 一种动态配置安全内存的方法、设备、装置及存储介质
CN114047960A (zh) 操作系统运行方法及装置、电子设备和存储介质
US10216664B2 (en) Remote resource access method and switching device
JP2021117972A (ja) デバイス対話方法、権限管理方法、対話型デバイスおよびクライアント
US20150378944A1 (en) A method of and circuitry for controlling access by a master to a peripheral, a method of configuring such circuitry, and associated computer program products
US20130275791A1 (en) Method and System for Tracking and Selecting Optimal Power Conserving Modes of a PCD
CN112000491A (zh) 一种应用程序接口调用方法、装置、设备和存储介质
US8973145B2 (en) Antivirus computing system
CN108171062B (zh) 一种针对设备的定位方法、装置及存储介质
WO2018153113A1 (zh) 信息保护方法及装置
WO2024217281A1 (zh) 数据处理方法、装置及计算机可读存储介质
US20240143849A1 (en) Chip monitoring method and apparatus

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23842373

Country of ref document: EP

Kind code of ref document: A1