CN110119637B - Hardware control method and hardware control system - Google Patents

Abstract

A hardware control method and a hardware control system are provided. The hardware control method is used for controlling at least one functional circuit by an operating system. The hardware control method includes the following steps. A first virtual address and a second virtual address from the operating system are respectively converted into a first intermediate address and a second intermediate address. The first intermediate address and the second intermediate address are respectively converted into a first extended physical address and a second extended physical address. The starting point of the first extended physical address is separated from the starting point of the second extended physical address by a distance. The first extended physical address and the second extended physical address are respectively converted into a first hardware physical address and a second hardware physical address. The first hardware physical address is adjacent to the second hardware physical address.

Description

Hardware control method and hardware control system

technical field

The present invention relates to a control method and a control system, and in particular to a hardware control method and a hardware control system of a switch controlled by a virtual machine.

Background technique

With the advancement of science and technology, various electronic products are constantly being introduced. Many electronic products are equipped with various functional circuits to realize various functions. Under the requirements of information security, it is necessary to control the authority of each functional circuit. Corresponding to different operating systems, only the required functional circuits are enabled, and the unusable functional circuits are disabled.

Conventionally, please refer to FIG. 1 , which shows a schematic diagram of the corresponding relationship between the operating systems OS11 , OS12 and the switches R10 , R11 , R12 , R13 , R15 , and R16 . Each switch R10, R11, R12, R13, R15, R16 corresponds to a part or all of the functions of a specific function circuit. The operating system OS11 is allowed to use the switches R11 , R12 , and R16 corresponding to its usable functional circuits; the operating system OS12 is allowed to use the switches R13 , R15 , and R10 corresponding to its usable functional circuits.

As shown in FIG. 1 , the conversion circuit 420 finds that the switch R10 is allowed to be used according to the control instruction of the operating system OS12 . Please refer to FIG. 2 , which shows a schematic diagram of the corresponding relationship between the switches R10-R17 and the hardware physical address PA'. The hardware physical address PA' corresponds to a page size. Since the operation of the conversion circuit 420 is based on a page size when the virtual machine control switch is used, this makes the hardware physical address PA' provided by the conversion circuit 420 for the switch R10 correspond to the switches R11 and R12 that should be disabled at the same time. Part or all of the functions of the specific functional circuit that should have been disabled are allowed to be used, thereby causing a loophole in information security.

Contents of the invention

The present invention relates to a hardware control method and a hardware control system, which utilizes the design of extended physical addresses, so that the control instructions provided by the operating system will only enable one switch, and will not enable other switches that should be disabled, and will not cause information security breach.

According to a first aspect of the present invention, a hardware control method is proposed. The hardware control method is used for an operating system to control at least one functional circuit. The hardware control method includes the following steps. A first virtual address and a second virtual address from the operating system are respectively translated into a first intermediate address and a second intermediate address. Converting the first intermediate address and the second intermediate address into a first extended physical address and a second extended physical address respectively. The starting point of the first extended physical address is separated from the starting point of the second extended physical address by a distance. Converting the first extended physical address and the second extended physical address into a first hardware physical address and a second hardware physical address respectively. The first hardware physical address is adjacent to the second hardware physical address. The states of a first switch and a second switch corresponding to the first hardware physical address and the second hardware physical address are respectively determined. The at least one functional circuit is controlled according to the states of the first switch and the second switch.

According to a second aspect of the present invention, a hardware control system is proposed. The hardware control system is used for an operating system to control at least one functional circuit. The hardware control system includes a first conversion circuit, a second conversion circuit and an analysis circuit. The first conversion circuit is used for respectively converting a first virtual address and a second virtual address from the operating system into a first intermediate address and a second intermediate address. The second conversion circuit is used to respectively convert the first intermediate address and the second intermediate address into a first extended physical address and a second extended physical address, the starting point of the first extended physical address and the second extended physical address The start of the address is separated by a gap. The analysis circuit is used for respectively converting the first extended physical address and the second extended physical address into a first hardware physical address and a second hardware physical address. The first hardware physical address is adjacent to the second hardware physical address. The analysis circuit further determines the states of a first switch and a second switch corresponding to the first hardware physical address and the second hardware physical address, and controls the at least one switch according to the states of the first switch and the second switch. functional circuit.

In order to have a better understanding of the above-mentioned and other aspects of the present invention, the following specific examples are given in detail with the accompanying drawings as follows:

Description of drawings

FIG. 1 is a schematic diagram illustrating the corresponding relationship between an operating system and a switch.

FIG. 2 is a schematic diagram illustrating the corresponding relationship between a plurality of switches and a plurality of hardware physical addresses.

FIG. 3 is a schematic diagram of a hardware control system of a switch.

FIG. 4 is a flowchart of a hardware control method of a switch according to an embodiment.

FIG. 5 shows the corresponding relationship between the operating system and the switches.

FIG. 6 is a comparison diagram of switches and extended physical addresses.

FIG. 7 is a comparison diagram of switches and hardware physical addresses.

FIG. 8 is a schematic diagram of a hardware control system of a switch of a virtual machine according to another embodiment.

FIG. 9 is a flowchart of a hardware control method for a switch of a virtual machine according to another embodiment.

Symbol Description

100, 200: hardware control system

110: The first conversion circuit

120: Second conversion circuit

130, 230: Analysis circuit

231: Judgment circuit

232: Mapping circuit

420: conversion circuit

600: switch

A0: start address

EPA1, EPA2: extended physical address

GP: Spacing

ID: identifier

IPA1, IPA2: Intermediate address

LUT: look-up table

OS, OS11, OS12, OS21, OS22: operating system

PA, PA': hardware physical address

R10, R11, R12, R13, R14, R15, R16, R17, R20, R21, R22, R23, R24, R25, R26, R27: switch

S110, S120, S130, S230, S231, S232, S233: steps

VA1, VA2: virtual address

Detailed ways

The following embodiments provide various implementations of hardware control methods and hardware control systems, which use the design of extended physical addresses, so that the control instructions provided by the operating system will only enable one switch, and will not enable other switches that should be disabled. Create information security loopholes.

Please refer to FIG. 3 , which is a schematic diagram of a hardware control system 100 for a switch controlled by a virtual machine. The hardware control system 100 includes a first conversion circuit 110 , a second conversion circuit 120 and an analysis circuit 130 . The first conversion circuit 110 , the second conversion circuit 120 and the analysis circuit 130 are, for example, a chip, a circuit board, a firmware circuit, or a circuit module in a chip. The operation mode of each element will be described in detail below with reference to the flow chart.

Please refer to FIG. 4 , which is a flow chart of a hardware control method for a switch according to an embodiment. First, in step S110, the first conversion circuit 110 respectively converts two virtual addresses VA1 and VA2 into two intermediate physical addresses IPA1 and IPA2. The virtual addresses VA1 and VA2 are generated by a virtual machine (not shown) according to an instruction of an operating system OS.

The first conversion circuit 110 then transmits the intermediate addresses IPA1 , IPA2 to the second conversion circuit 120 .

In step S120, the second conversion circuit 120 searches according to the intermediate addresses IPA1, IPA2 and an identifier ID of the operating system OS, to respectively convert the intermediate addresses IPA1, IPA2 into two extended physical addresses (extended physical address) EPA1, EPA2 . The starting point of the extended physical address EPA1 and the starting point of the extended physical address EPA2 are separated by a distance GP (shown in FIG. 6 ). Please refer to FIG. 5 , which shows a schematic diagram of the corresponding relationship between the operating systems OS21 , OS22 and the switches R20 , R21 , R22 , R23 , R25 , and R26 . Each switch R20, R21, R22, R23, R25, R26 corresponds to a part or all of the functions of a specific function circuit. The switches R20, R21, R22, R23, R25, R26 can be a memory or a register. The operating system OS21 is allowed to use the switches R21 , R22 , and R26 corresponding to its usable functional circuits; the operating system OS22 is allowed to use the switches R23 , R25 , and R20 corresponding to its usable functional circuits.

In this embodiment, the second converting circuit 120 finds that the switch R20 is allowed to be used according to the virtual address VA1 provided by the operating system OS22. Please refer to FIG. 6 , which shows a comparison diagram of the switches R20 , R21 and R22 and the extended physical address EPA1 . The extended physical address EPA1 corresponds to the switch R20 separated by a distance GP, and the distance GP is greater than a page size of the second conversion circuit 120, for example, 4KB. In this way, the extended physical address EPA1 only corresponds to one switch (such as the above-mentioned switch R20 ), but does not correspond to the switches R21 and R22 that should be disabled. In this step, the second conversion circuit 120 can convert the intermediate address IPA1 into the extended physical address EPA1 according to a lookup table LUT, and the lookup table LUT can be written by the virtual machine when it is powered on. Please note that in this embodiment, the hardware physical address (hardware physical address) PA corresponding to each switch R20, R21, R22, R23, R25, R26 has not changed, but each switch R20, R21, R22, R23 The length of the extended physical address EPA1 corresponding to , R25 and R26 is the distance GP.

Or, in another embodiment, the second conversion circuit 120 can convert the intermediate addresses IPA1 and IPA2 into the extended physical addresses EPA1 and EPA2 through a calculation formula.

Next, in step S130 , the analysis circuit 130 respectively converts the extended physical addresses EPA1 and EPA2 into two hardware physical addresses PA1 and PA2 . Please refer to FIG. 7 , which shows a comparison diagram of switches R20 - R27 and hardware physical addresses PA1 and PA2 . The analysis circuit 130 can convert the extended physical addresses EPA1, EPA2 into hardware physical addresses PA1, PA2 corresponding to only one switch. In this step, the analysis circuit 130 can convert the extended physical addresses EPA1 and EPA2 into hardware physical addresses PA1 and PA2 according to the look-up table LUT. Or, in another embodiment, the analysis circuit 130 can convert the extended physical addresses EPA1 and EPA2 into hardware physical addresses PA1 and PA2 through a calculation formula.

Then, in step S140 , the analysis circuit 130 determines the states of the switches R20 and R21 corresponding to the hardware physical addresses PA1 and PA2 respectively.

Moreover, in step S150 , the analysis circuit 130 controls at least one functional circuit according to the states of the switches R20 and R21 . The relationship between switches and functional circuits may be one-to-one, many-to-one, or many-to-many.

As shown in FIG. 3 , through the hardware physical address PA1 , the corresponding switch 600 can be enabled, and then the functional circuit (not shown) corresponding to the switch 600 can be run.

In this way, by extending the design of the physical address EPA1, the control command provided by the operating system OS will only enable a switch that should be allowed to be used, but will not enable other switches that should be disabled, and will not cause information security loopholes. problems with prior art.

Please refer to FIG. 8 , which shows a schematic diagram of a switch hardware control system 200 according to another embodiment. In this embodiment, the analyzing circuit 230 includes a judging circuit 231 and a mapping circuit 232 , and the rest of the similarities will not be described again.

Please refer to FIG. 9 , which is a flow chart of a hardware control method of a switch according to another embodiment. In this embodiment, the step S230 of converting the extended physical addresses EPA1 and EPA2 into hardware physical addresses PA1 and PA2 includes step S231 , step S232 and step S233 .

As shown in FIG. 6 , the first extended physical address EPA1 and the second extended physical address EPA2 have a common starting address A0 . In step S231 , the judging circuit 231 judges whether the extended physical addresses EPA1 , EPA2 are greater than the starting address A0 plus the address of the distance GP. If the extended physical address EPA1, EPA2 is greater than the initial address plus the address of the distance GP, then enter step S232; if the extended physical address EPA1, EPA2 is not greater than the initial address plus the address of the distance GP, then enter step S233. Since the extended physical addresses corresponding to the second and subsequent switches R21 - R27 (for example, the extended physical address EPA2 ) are separated by a distance GP, only the extended physical address EPA1 corresponding to the first switch R20 remains unchanged. The extended physical address EPA1 is not greater than the initial address plus the address of the gap GP, so the extended physical address EPA1 corresponds to the first switch R20.

In step S233 , the analysis circuit 230 directly uses the extended physical address EPA1 as the hardware physical address PA1 .

In step S232 , the judging circuit 231 transmits the extended physical address EPA2 to the mapping circuit 232 . The mapping circuit 232 maps the extended physical address EPA2 into a remapping physical address, and the analysis circuit 230 uses the remapping physical address as the hardware physical address PA2.

That is to say, when the extended physical address EPA1 is corresponding to the first switch R20, no conversion is required, which can speed up the processing speed.

The above-mentioned various embodiments provide the design of extending the physical address EPA1, EPA2, so that the control command provided by the operating system OS will only enable a switch that is allowed to be used, and will not enable other switches that should be disabled, and will not cause information security. loophole.

To sum up, although the present invention has been disclosed by the above embodiments, it is not intended to limit the present invention. Those skilled in the art may make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention should be defined by the appended application claims.

Claims (16)

1. A hardware control method for an operating system to control at least one functional circuit, the hardware control method comprising:

respectively converting a first virtual address and a second virtual address from the operating system into a first intermediate address and a second intermediate address;

converting the first intermediate address and the second intermediate address into a first extended physical address and a second extended physical address respectively, wherein a starting point of the first extended physical address and a starting point of the second extended physical address are separated by a distance, wherein the step of converting the first intermediate address into the first extended physical address is performed by a conversion circuit, and the distance is larger than or equal to a page size of the conversion circuit;

respectively converting the first extended physical address and the second extended physical address into a first hardware physical address and a second hardware physical address, wherein the first hardware physical address is adjacent to the second hardware physical address;

respectively determining the states of a first switch and a second switch corresponding to the first hardware physical address and the second hardware physical address; and

and controlling the at least one functional circuit according to the states of the first switch and the second switch.

2. The hardware control method of claim 1 wherein the first extended physical address corresponds to only one of the first switches and the second extended physical address corresponds to only one of the second switches.

3. The hardware control method of claim 1 wherein the first extended physical address and the second extended physical address are ordered from a common starting address, the hardware control method further comprising:

judging whether the first extended physical address is larger than the address of the initial address plus the distance; and

if the first extended physical address is not greater than the starting address plus the space, the step of converting the first extended physical address to the first hardware physical address uses the first extended physical address as the first hardware physical address.

4. The hardware control method of claim 1 wherein the pitch is greater than or equal to 4KB.

5. The hardware control method of claim 1 wherein the step of converting the first intermediate address to the first extended physical address is based on a lookup table.

6. The hardware control method of claim 5 wherein the virtual address is generated by the operating system via a virtual machine according to an instruction, and the lookup table is generated via the virtual machine.

7. The hardware control method of claim 1 wherein the step of converting the first intermediate address to the first extended physical address is based on an identifier corresponding to the operating system.

8. The hardware control method of claim 1 wherein the step of converting the first intermediate address to the first extended physical address is computationally based.

9. A hardware control system for an operating system to control at least one functional circuit, the hardware control system comprising:

a first conversion circuit for converting a first virtual address and a second virtual address from the operating system into a first intermediate address and a second intermediate address, respectively;

a second conversion circuit for converting the first intermediate address and the second intermediate address into a first extended physical address and a second extended physical address, respectively, wherein the start point of the first extended physical address and the start point of the second extended physical address are separated by a distance, and the distance is greater than or equal to a page size of the second conversion circuit; and

an analyzing circuit for converting the first extended physical address and the second extended physical address into a first hardware physical address and a second hardware physical address, respectively, wherein the first hardware physical address is adjacent to the second hardware physical address; the analysis circuit further determines states of a first switch and a second switch corresponding to the first hardware physical address and the second hardware physical address respectively, and controls the at least one functional circuit according to the states of the first switch and the second switch.

10. The hardware control system of claim 9 wherein the first extended physical address corresponds to only one of the first switches and the second extended physical address corresponds to only one of the second switches.

11. The hardware control system of claim 9 wherein the first extended physical address and the second extended physical address are ordered from a common starting address, the analyzing circuit comprising:

and the judging circuit is used for judging whether the first extended physical address is larger than the address of the initial address plus the interval or not, and if the first extended physical address is not larger than the address of the initial address plus the interval, the first extended physical address is used as the first hardware physical address.

12. The hardware control system of claim 9 wherein the pitch is 4KB.

13. The hardware control system of claim 9 wherein said second translation circuit translates said first intermediate address to said first extended physical address according to a lookup table.

14. The system of claim 13, wherein the virtual address is generated by the operating system via a virtual machine according to an instruction, and the lookup table is generated via the virtual machine.

15. The hardware control system of claim 9 wherein the second translation circuit translates according to an identifier corresponding to the operating system.

16. The hardware control system of claim 9 wherein said second translation circuit translates said first intermediate address to said first extended physical address in a computational formula.

Images