Method, device and storage medium for protecting address space

Abstract

The present disclosure provides a method, an apparatus and a storage medium for protecting address space. The method for protecting address space comprises: receiving a first access request; determining whether the first access request conforms to an access right of a target address space, wherein the target address space comprises a target memory address space and a target register address space, and the access right defines whether an access request to the target address space is allowed; and in response to the first access request conforming to the access right, processing the first access request. The method for protecting address space ensures the security of data in the register and the security of data in the memory.

Description

Technical Field

[0001] Embodiments of this disclosure relate to methods, devices, apparatuses, and storage media for protecting address spaces. Background Technology

[0002] RISC-V is an open-source instruction set architecture (ISA) based on the Reduced Instruction Set Computing (RISC) principle. Unlike general-purpose commercial instruction set architectures (such as x86 and ARM), RISC-V, as an open-source architecture, can be used freely in any desired device, allowing anyone to design, manufacture, and sell RISC-V chips and software. Furthermore, RISC-V can be designed to select the appropriate instruction set for a specific scenario. Based on the RISC-V instruction set architecture, various CPUs can be designed for different applications, such as server CPUs, home appliance CPUs, industrial control CPUs, and CPUs for micro-sensors. Currently, a number of open-source RISC-V chip projects and commercial IoT device RISC-V chips and server RISC-V chips have emerged based on RISC-V.

[0003] To restrict access to untrusted code or applications, the RISC-V architecture provides Physical Memory Protection (PMP) technology, ensuring that untrusted code can only access the memory allocated to it, thus protecting the data in memory. However, current RISC-V-based processors do not simultaneously implement protection for both memory data and register data. Summary of the Invention

[0004] In view of the above description, at least one embodiment of this application discloses an address space protection method, protection device, apparatus, and storage medium to simultaneously protect the data in registers and the data in memory.

[0005] One aspect of this disclosure provides a method for protecting an address space, comprising: receiving a first access request; determining whether the first access request complies with access permissions for a target address space, wherein the target address space includes a target memory address space and a target register address space, and the access permissions limit whether an access request to the target address space is permitted; and in response to the first access request complying with the access permissions, approving the first access request.

[0006] For example, in at least one embodiment of the protection method provided in this disclosure, the method further includes: obtaining a first address to be accessed by the first access request; in response to the first address being located in the target memory address space, using a first protection control module to determine whether the first access request complies with the access permission; or in response to the first address being located in the target register address space, using a second protection control module to determine whether the first access request complies with the access permission.

[0007] For example, in the protection method provided in at least one embodiment of this disclosure, the first register of the first protection control module is used to set access permissions for the target memory address space; and the second register of the second protection control module is used to set access permissions for the target register address space.

[0008] For example, in the protection method provided in at least one embodiment of this disclosure, the first register and the second register are further configured to disable writing.

[0009] For example, in at least one embodiment of the protection method provided in this disclosure, the method further includes: blocking the first access request in response to the first access request not conforming to the access permission.

[0010] For example, in at least one embodiment of the protection method provided in this disclosure, the method further includes: in response to blocking a first access request, determining whether a second access request generated based on the first access request complies with the access permission.

[0011] For example, in the protection method provided in at least one embodiment of this disclosure, determining whether a second access request generated based on a first access request complies with access permissions includes: sending the first access request to a security processor, obtaining the second access request generated based on the first access request from the security processor; allowing the second access request to proceed if the second access request complies with access permissions; or blocking the second access request if the second access request does not comply with access permissions.

[0012] For example, in at least one embodiment of the protection method provided in this disclosure, the method further includes: obtaining a first address to be accessed by the first access request; accessing the first address in parallel with determining whether the first access request complies with the access permissions; and determining whether to continue the access operation to the first address based on whether the first access request complies with the access permissions.

[0013] For example, in the protection method provided in at least one embodiment of this disclosure, determining whether to continue the access operation to the first address based on whether the first access request complies with the access permission includes: canceling the access operation already performed on the first address in response to the first access request not complying with the access permission; or allowing the access operation already performed on the first address in response to the first access request complying with the access permission.

[0014] For example, in the protection method provided in at least one embodiment of this disclosure, the address space includes a non-secure address space and a target address space that is a secure address space. Determining whether a first access request complies with the access permission for the target address space includes: in response to the first access request accessing the target address space, determining whether the first access request comes from a secure processor or a non-secure processor; in response to the first access request coming from a secure processor, determining that the first access request complies with the access permission; and in response to the first access request coming from a non-secure processor, determining that the first access request does not comply with the access permission.

[0015] For example, in at least one embodiment of the protection method provided in this disclosure, the method further includes: accessing a non-secure address space in response to a first access request, by means of the first access request.

[0016] For example, in at least one embodiment of the protection method provided in this disclosure, the method further includes: in response to a first access request to access a non-secure address space, determining whether the first access request comes from a secure processor or a non-secure processor; and in response to the first access request coming from a secure processor, blocking the first access request.

[0017] Another aspect of this disclosure provides an address space protection device, comprising: a receiving unit configured to receive a first access request; and a management unit configured to: determine whether the first access request conforms to the access permission for a target address space, and, in response to the first access request conforming to the access permission, pass the first access request, wherein the target address space includes a target memory address space and a target register address space, and the access permission limits whether an access request to the address space is allowed.

[0018] For example, in the protection device provided in at least one embodiment of this disclosure, the receiving unit is further configured to: obtain the first address to be accessed by the first access request; the management unit includes a first protection control module and a second protection control module, wherein the first protection control module is configured to: determine whether the first access request complies with the access permission in response to the first address being located in the target memory address space; and the second protection control module is configured to: determine whether the first access request complies with the access permission in response to the first address being located in the target register address space.

[0019] For example, in the protection device provided in at least one embodiment of this disclosure, the first protection control module includes a first register and is configured to use the first register to set access permissions for a target memory address space; the second protection control module includes a second register and is configured to use the second register to set access permissions for a target register address space.

[0020] For example, in the protection device provided in at least one embodiment of this disclosure, the first register and the second register are further configured to disable writing.

[0021] For example, in a protection device provided in at least one embodiment of this disclosure, the management unit is further configured to block the first access request in response to the first access request not conforming to the access permission.

[0022] For example, in a protection device provided in at least one embodiment of this disclosure, the management unit is further configured to: in response to blocking a first access request, determine whether a second access request generated based on the first access request complies with the access permission.

[0023] For example, in a protection device provided in at least one embodiment of this disclosure, determining whether a second access request generated based on a first access request complies with access permissions includes: sending the first access request to a security processor, obtaining the second access request generated based on the first access request from the security processor; allowing the second access request to proceed if the second access request complies with access permissions; or blocking the second access request if the second access request does not comply with access permissions.

[0024] For example, in the protection device provided in at least one embodiment of this disclosure, the management unit is further configured to: obtain a first address to be accessed by a first access request; access the first address in parallel with determining whether the first access request complies with the access permission, and determine whether to continue the access operation to the first address based on whether the first access request complies with the access permission.

[0025] For example, in the protection device provided in at least one embodiment of this disclosure, determining whether to continue the access operation to the first address based on whether the first access request complies with the access permission includes: canceling the access operation already performed on the first address in response to the first access request not complying with the access permission; or allowing the access operation already performed on the first address in response to the first access request complying with the access permission.

[0026] For example, in the protection device provided in at least one embodiment of this disclosure, the address space includes a non-secure address space and a target address space that is a secure address space. Determining whether a first access request complies with the access permission for the target address space includes: in response to the first access request accessing the target address space, determining whether the first access request comes from a secure processor or a non-secure processor; and in response to the first access request coming from a secure processor, determining that the first access request complies with the access permission; and in response to the first access request coming from a non-secure processor, determining that the first access request does not comply with the access permission.

[0027] For example, in the protection device provided in at least one embodiment of this disclosure, the management unit is further configured to: access a non-secure address space in response to a first access request, via the first access request.

[0028] For example, in the protection device provided in at least one embodiment of this disclosure, the management unit is further configured to: in response to a first access request to access a non-secure address space, determine whether the first access request comes from a secure processor or a non-secure processor; and block the first access request in response to the first access request coming from a secure processor.

[0029] Another aspect of this disclosure provides an electronic device comprising: a processor; and a memory including one or more computer program modules; wherein the one or more computer program modules are stored in the memory and configured to be executed by the processor, and the one or more computer program modules include instructions for performing the protection method described in any one of this disclosure.

[0030] Another aspect of this disclosure provides a non-temporary computer-readable storage medium having executable instructions stored thereon, wherein, when executed by a processor, the executable instructions cause the processor to perform the protection method according to any one of this disclosure.

[0031] As described above, the address space protection device, apparatus, and storage medium according to at least one embodiment of this disclosure determine whether an access request conforms to access rights for a target address space including a target memory address space and a target register address space, and then approve access requests that conform to such access rights. Thus, only access requests that conform to the access rights can access the data in the target memory address space and the target register address space, while ensuring the security of the data in the registers and the data in the memory. Attached Figure Description

[0032] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings of the embodiments of this disclosure will be briefly described below. Clearly, the drawings described below only relate to some embodiments of this disclosure and are not intended to limit the scope of this disclosure. It should be noted that similar reference numerals and letters in the following drawings denote similar items; therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0033] Figure 1 A flowchart of a method for protecting a target address space according to at least one embodiment of the present disclosure is shown.

[0034] Figure 2 A schematic diagram illustrating the setting of access permissions for a target memory address space according to at least one embodiment of the present disclosure is shown.

[0035] Figure 3 A flowchart illustrating a method for determining whether a first access request complies with access permissions according to at least one embodiment of the present disclosure is shown.

[0036] Figure 4A A schematic diagram of a non-transparent transmission mode according to at least one embodiment of the present disclosure is shown.

[0037] Figure 4B A schematic diagram of a transparent transmission mode according to at least one embodiment of the present disclosure is shown.

[0038] Figure 5 A schematic diagram of the structure of an address space protection device according to at least one embodiment of the present disclosure is shown.

[0039] Figure 6 A more detailed structural schematic diagram of a protection device according to at least one embodiment of the present disclosure is shown.

[0040] Figure 7 A schematic diagram illustrating an example application scenario according to at least one embodiment of the present disclosure is shown.

[0041] Figure 8 A schematic diagram of a data access process according to at least one embodiment of the present disclosure is shown.

[0042] Figure 9 This is a schematic diagram of an electronic device provided in at least one embodiment of the present disclosure.

[0043] Figure 10 A schematic diagram of another electronic device provided for at least one embodiment of this disclosure.

[0044] Figure 11 This is a schematic diagram of a non-transiently readable storage medium according to at least one embodiment of the present disclosure. Detailed Implementation

[0045] Reference will now be made in detail to specific embodiments of the present disclosure, examples of which are illustrated in the accompanying drawings. Although the present disclosure will be described in conjunction with specific embodiments, it will be understood that it is not intended to limit the present disclosure to the described embodiments. Rather, it is intended to cover variations, modifications, and equivalents included within the spirit and scope of the present disclosure as defined by the appended claims. It should be noted that the method operations described herein can be implemented by any functional block or functional arrangement, and any functional block or functional arrangement can be implemented as a physical entity or a logical entity, or a combination of both.

[0046] To enable those skilled in the art to better understand this disclosure, the disclosure will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0047] Note that the examples described below are merely specific examples and are not intended to limit the embodiments of this disclosure to the specific shapes, hardware, connections, operations, values, conditions, data, sequences, etc., shown and described. Those skilled in the art can utilize the concepts of this disclosure to construct further embodiments not mentioned herein by reading this specification.

[0048] The terminology used in this disclosure is that which is currently widely used in the art in consideration of the functionality of this disclosure; however, these terms may vary depending on the intent, precedent, or new technology of those skilled in the art. Furthermore, specific terms may be chosen by the applicant, and in such cases, their detailed meanings will be described in the detailed description of this disclosure. Therefore, the terminology used in this specification should not be construed as simple names, but rather based on the meaning of the terms and the overall description of this disclosure.

[0049] This disclosure uses flowcharts to illustrate the operations performed by the system according to embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, various steps can be processed in reverse order or simultaneously, as needed. Furthermore, other operations can be added to these processes, or one or more steps can be removed from them.

[0050] First, let's explain the relevant terms used in this application:

[0051] Access request: An instruction initiated by the processor or host to access the address space, used to write data to or read data from the address space, or to perform other related operations.

[0052] Address space: A storage space used to store data. On one hand, for different storage devices, the address space can include a memory address space and a register address space. The memory address space represents the address space corresponding to memory, and the register address space represents the address space corresponding to peripheral registers. For example, the storage space can be addressed contiguously. On the other hand, for different security requirements, the address space can be divided into a secure address space and a non-secure address space. The secure address space is used to store secure data (protected data), and the non-secure address space is used to store insecure data (unprotected data). In at least one embodiment of this disclosure, the secure address space can include a secure memory address space within the memory address space and a secure register address space within the register address space.

[0053] In at least one embodiment of this disclosure, the “target address space” mentioned is, for example, a secure address space, but is not limited thereto. For example, it can be other address spaces that are set with certain permissions for protection.

[0054] In at least one embodiment of this disclosure, the “target memory address space” mentioned is, for example, a secure memory address space in which secure memory data (protected memory data) is stored, but is not limited thereto. For example, it can be other memory address spaces that are set with certain permissions for protection.

[0055] In at least one embodiment of this disclosure, the “target register address space” mentioned is, for example, a secure register address space that stores secure register data (protected register data), but is not limited thereto. For example, it can be other register address spaces that are set with certain permissions for protection.

[0056] In at least one embodiment of this disclosure, "access request device" refers to any access subject capable of initiating an access request to the address space, such as a central processing unit (CPU), processor core, or master, but is not limited thereto. Furthermore, regarding security requirements, "access request device" can include secure access request devices and insecure access request devices, such as secure processors and insecure processors, secure hosts and insecure hosts, etc. Secure access request devices can be used to construct secure or protected execution environments to securely process relevant data, while insecure access request devices can be used to construct insecure or unprotected execution environments to process relevant data in an insecure or low-security manner.

[0057] In at least one embodiment of this disclosure, the term "register" refers to, for example, a peripheral register, including peripheral registers such as USB and UART. However, the embodiments are not limited thereto, and "register" can be any suitable register through which the access-requesting device accesses or operates other devices.

[0058] For ease of description, in the following description of the address space protection method and address space protection device, the term "processor" will be used to refer to the "access request device" in at least one embodiment of this disclosure. However, it is understood that the description of "processor" also applies to other "access request devices" including a central processing unit (CPU), processor core, or master unit. Furthermore, the descriptions of "secure processor" and "insecure processor" also apply to the "secure access request device" and "insecure access request device" defined above, respectively.

[0059] As mentioned above, the RISC-V architecture provides Physical Memory Protection (PMP) technology to restrict untrusted code or applications, ensuring that untrusted code can only access the memory allocated to it, thereby protecting the security of memory data. However, RISC-V-based processors or hosts and other access-requesting devices require register access, necessitating the simultaneous support for ensuring the security of both register data and memory data.

[0060] At least one embodiment of this disclosure provides a method, device, apparatus, and storage medium for protecting the address space, so as to simultaneously support and ensure the security of data in registers and data in memory.

[0061] The following detailed description of the address space protection method, protection device, apparatus, and storage medium according to embodiments of the present disclosure is provided with reference to the accompanying drawings.

[0062] First, the following describes an address space protection method according to an embodiment of the present disclosure. This address space protection method can be applied to address space protection devices, electronic devices, other suitable software or hardware, or a combination of hardware and software, as further described below.

[0063] Figure 1 A flowchart of an address space protection method according to at least one embodiment of the present disclosure is shown, the protection method may include steps S102 to S106.

[0064] In step S102, a first access request is received.

[0065] In some embodiments, the first access request may be an access request to an address space issued by the processor. Based on this access request, the processor may perform access to the corresponding address space, such as reading data from the corresponding address space, writing data to the corresponding address space, or other suitable operations.

[0066] In step S104, it is determined whether the first access request complies with the access permission for the target address space, wherein the target address space includes the target memory address space and the target register address space, and the access permission limits whether the access request to the target address space is allowed.

[0067] In some embodiments, the first access request may access a target address space, such as a secure address space, but is not limited thereto; the target address space includes a target memory address space and a target register address space, and correspondingly, the secure address space includes a secure memory address space and a secure register address space. Secure data can generally be stored in the secure address space. For example, to ensure data security, when the processor issues an access request to access this secure data, it needs to check the access permissions of the access request to determine whether the access request complies with the access permissions for the target address space.

[0068] In some embodiments, access permissions may include permissions to operation attributes such as read / write operations on the target address space (also referred to herein as operation attribute access permissions). For example, part / all of the target address space may be read-only. As another example, part / all of the target address space may be write-only. Yet another example, a portion of the target address space may be read-only, while another portion of the target address space may be read-only.

[0069] In some embodiments, access permissions may include whether the processor initiating the first access request has access permissions to the address space (also referred to herein as processor access permissions). For example, the system includes multiple processors, such as secure processors and insecure processors. Secure processors can be used to process secure data, while insecure processors are only used to process insecure data. For example, a rich execution environment (REE) can be built based on an insecure processor, such as running a traditional operating system, ordinary programs, and storing ordinary information. For example, a trusted execution environment (TEE) can be built based on a secure processor, such as providing isolated execution, secure communication, secure storage, etc., ensuring the integrity, confidentiality, and availability of sensitive information within the TEE, and providing security services for the rich execution environment (REE). For example, secure processors can access both secure and insecure address spaces, while insecure processors can only access the insecure address space. Alternatively, secure processors can only access the secure address space, while insecure processors can only access the insecure address space.

[0070] In some embodiments, access permissions may be a combination of target address space operation attribute access permissions and processor access permissions or other suitable permissions.

[0071] In some embodiments, access permissions may be stored in a lookup table, text, or any other suitable form. Generally, access permissions may be stored locally, for example, in an apparatus capable of performing the address space protection methods of at least one embodiment of this disclosure (e.g., the memory (not shown) of the protection apparatus 500 described below) or an electronic device (e.g., the storage device 1080 of the electronic device 1000 described below), but this disclosure is not limited thereto; access permissions may also be stored remotely and may be accessed via wired or wireless means. Furthermore, to ensure the security of the acquired access permissions, they may be transmitted via encryption or decryption.

[0072] In step S106, in response to the first access request being in compliance with access permissions, the first access request is granted.

[0073] In some embodiments, when the first access request meets the access permission requirements—that is, when the first access request has permission to access the target address space—access operations can be performed on the target address space based on the access request. For example, when the first access request is a read operation, the read data can be returned to the processor. As another example, when the first access request is a write operation, the data to be written can be written to the first address.

[0074] As described above, the address space protection method according to at least one embodiment of this disclosure determines whether an access request conforms to access rights to a target address space including a target memory address space and a target register address space, and approves access requests that conform to such access rights. Thus, only access requests that conform to the access rights can access data in the target memory address space and / or the target register address space, providing protection for data at the target register address and / or data at the target memory address.

[0075] Other aspects of the address space protection method disclosed herein are described in detail below.

[0076] In some embodiments, a first address to be accessed by the first access request is obtained; in response to the first address being located in the target memory address space, a first protection control module is used to respond. For example, the first protection control module is used to determine whether the first access request complies with access permissions.

[0077] Alternatively, in response to the first address being located in the target register address space, a second protection control module is used. For example, the second protection control module is used to determine whether the first access request complies with access permissions.

[0078] In these embodiments, for example, protection control modules can be configured separately for memory and registers to provide separate responses to access requests to the target memory address space and the target register address space. For example, in an exemplary architecture, a first protection control module, referred to as MEM-PMP, responds to access requests to the memory address space, and a second protection control module, referred to as IO-PMP, responds to access requests to the register address space.

[0079] For example, the first protection control module can be placed at the memory entry point, and the second protection control module can be placed at the exit point of the Advanced Peripheral Bus (APB master). In this way, separate responses can be implemented for the memory address space and the register address space.

[0080] In some embodiments, registers of the first protection control module are used to set access permissions to the target memory address space, and registers of the second protection control module are simultaneously used to set access permissions to the target register address space, which will be discussed in conjunction with the following. Figure 2 Describe it.

[0081] Figure 2 A schematic diagram illustrating the setting of access permissions for a target memory address space according to at least one embodiment of the present disclosure is shown.

[0082] In some embodiments, the registers of the first protection control module itself are used to record configuration methods, for example, supporting 16 regions (e.g., region 0-region 15), that is, supporting 16 configuration methods for the memory address space. For example, Figure 2 Only four regions are shown (regions 0-3), however, it is understandable that... Figure 2 It can also include the remaining areas.

[0083] See Figure 2 Region 0 can cover the entire memory address space by default. Region priorities can be fixed, such as being arranged from highest to lowest region number. For example, region 3 has a higher priority than region 2, region 2 has a higher priority than region 1, and region 1 has a higher priority than region 0. If regions corresponding to a memory address space overlap, the configuration of the region with the highest priority takes precedence. For example, if regions corresponding to a memory address space include region 2 and region 0, the access permissions for that memory address space will be set based on region 2.

[0084] Continue to refer to Figure 2Each region can be divided into eight sub-regions, such as sub-regions 0 through 7 within each region. Each sub-region can be individually configured to be disabled. The memory address space corresponding to a disabled region has no access permissions and can therefore be considered insecure memory. Thus, region permissions corresponding to the memory address space can be set through the registers of the first protection control module, thereby setting the memory address space as a secure or insecure memory address space based on region permissions.

[0085] The method for setting access permissions for the target register address space is similar to the method for setting access permissions for the target memory address space described above.

[0086] In some embodiments, the registers of the second protection control module itself are used to record configuration methods, such as supporting 16 regions (e.g., regions 0-15), which means supporting 16 settings for the register address space. Region 0 can cover the entire register address space by default. The priority of the regions can be a fixed priority, such as being arranged from high to low according to the region number. For example, the priority of region 3 is higher than the priority of region 2, the priority of region 2 is higher than the priority of region 1, and the priority of region 1 is higher than the priority of region 0. If regions corresponding to a certain register address space overlap, the configuration of the region with the highest priority shall prevail. For example, if the regions corresponding to a certain register address space include region 2 and region 0, the access permissions corresponding to that register address space shall be set according to region 2. In this way, the region weight restrictions corresponding to the register address space can be set through the multiple regions supported by the registers of the first protection control module, thereby setting the register address space as a safe register address space and a non-safe register address space based on the region weight restrictions.

[0087] In some embodiments, for the registers of the second protection control module, the minimum address range of each region is 32 bits, and the sub-regions are 4 bits, so the entire register address space can cover at least 128 32-bit registers. This allows for the service of more peripherals, increasing the performance of peripheral services.

[0088] In this way, the registers of the first protection control module and the registers of the second protection control module can provide a variety of ways to set the security address space.

[0089] Figure 2The schematic diagrams showing the setting of access permissions for the target memory address space and the setting of access permissions for the target register address space are merely illustrative. There may be overlapping or non-overlapping regions, configuration methods for each sub-region, or other setting methods. This disclosure is not limited to these.

[0090] In some embodiments, the security processor may set access permissions to the target memory address space via a register of the first protection control module (e.g., referred to as the "first register"). In some embodiments, the security processor may set access permissions to the target register address space via a register of the second protection control module (e.g., referred to as the "second register"). Thus, setting the access permissions to the target memory address space or the target register address space by the security processor improves the security of access permission settings.

[0091] In some embodiments, the first protection control module and the second protection control module can be set to a secure mode via the first register of the first protection control module and the second register of the second protection control module, respectively. For example, in secure mode, a non-secure processor can only access the non-secure address space, but cannot access the secure address space. This prevents a non-secure processor from illegally accessing data in the secure address space, ensuring the security of the data in the secure address space.

[0092] In some embodiments, the security mode may further include a standard mode and an isolation mode. In standard mode, the security processor can access both the secure and non-secure address spaces. This allows the security processor to have access to the entire address space, facilitating secure access to memory or registers (and corresponding peripherals), thus providing a secure and rich execution environment. Conversely, in isolation mode, the security processor can only access the secure address space and not the non-secure address space. This prevents the security processor from accessing insecure data such as viruses, ensuring the security of the security processor.

[0093] In some embodiments, the address space can be set as a secure address space and a non-secure address space respectively based on operation attributes such as read / write, via the first register of the first protection control module and the second register of the second protection control module. For example, for a certain secure address space, its operation attribute access permission can be one of "read only", "write only", or "read and write". In this way, compared with uniformly setting the address space as a secure address space and a non-secure address space for read / write (i.e., operation attribute access permission is only "read and write"), a wider variety of storage attribute types can be set for the address space, increasing its practicality.

[0094] In some embodiments, the first register of the first protection control module and the second register of the second protection control module can also be set to disable write access. For example, the first register of the first protection control module and the second register of the second protection control module support secure_lock input to lock the first register of the first protection control module and the second register of the second protection control module to prevent accidental operation. This further reduces the risk of accidental modification or deletion of access permissions due to the security processor accidentally modifying the first register of the first protection control module and the second register of the second protection control module, thus improving the security of access permission settings.

[0095] In some embodiments, after the first register of the first protection control module and the second register of the second protection control module are locked, if it is necessary to modify the access permissions, the security processor can unlock the first register of the first protection control module and the second register of the second protection control module, and then modify the configuration of the first register of the first protection control module and the second register of the second protection control module to modify the access permissions.

[0096] Although the above embodiments describe how the first protection control module and the second protection control module respectively respond to requests for access to the memory address space and the register address space, and how the first protection control module and the second protection control module respectively set their respective access permissions through their respective registers, it is understood that this separation is not necessary, and that responses to requests for access to the memory address space and the register address space can be implemented without separating the first protection control module and the second protection control module, and that access permissions can also be set through one or more corresponding registers.

[0097] For example, through the above reference Figure 2 The described embodiments and their additional aspects allow address spaces to be configured as secure address spaces (target address spaces) and insecure address spaces. For example, memory address spaces can be configured as secure memory address spaces (target memory address spaces) and insecure memory address spaces. As another example, register address spaces can be configured as secure register address spaces (target register address spaces) and insecure register address spaces. In this case, when an access request is received, it is necessary to determine whether the access request complies with the set access permissions, such as whether the access request has access permissions to the target address space, or in other words, whether the access request to the target address space is legitimate.

[0098] Figure 3 A flowchart is shown of a method for determining whether a first access request complies with access permissions according to at least some embodiments of the present disclosure, the method including steps S302-S308.

[0099] See Figure 3 Upon receiving the first access request, in step S302, it is determined whether the first access request accesses the target address space. In some embodiments, the access request may include the address to be accessed by the first access request, and the access to the target address space can be determined by the address.

[0100] In response to the first access request to access the target address space (the "Yes" branch of step S302), in step S304, it is determined whether the first access request comes from a secure processor or a non-secure processor. In some embodiments, the access request may include an identifier that identifies the processor from which the access request originates, and this identifier can be used to determine whether the access request comes from a secure processor or a non-secure processor.

[0101] In response to the first access request originating from the security processor (the "Yes" branch of step S304), meaning it can be determined that the first access request complies with access permissions, in step S306, the first access request can be allowed or permitted, for example, the first access request can be continued to access the corresponding target address space. In other words, this is an access request to the target address space initiated by the security processor, and the access request complies with access permissions; therefore, the access request can be allowed or permitted. It is understood that, to ensure the security of the data in the target address space, the non-security processor can only access the non-security address space and cannot access the security address space (corresponding to the security mode described above) to access and modify data in the secure memory address space or the secure register address space.

[0102] When address spaces are set as secure and insecure address spaces based on operations such as operation attributes, access requests from the security processor can be checked for operation attribute access permissions. In some embodiments, in response to a first access request originating from the security processor, it is determined whether the operation attribute of the first access request is consistent with the operation attribute of the target address space. If the operation attribute of the first access request is consistent with the operation attribute of the target address space, it is determined that the first access request complies with access permissions; otherwise, if the operation attribute of the first access request is inconsistent with the operation attribute of the target address space, it is determined that the first access request does not comply with access permissions. The operation attribute access permission check described herein is optional and can be implemented instead of step S306, can be implemented in parallel with step S306, can be implemented before or after step S306, or can be implemented with steps S302 and S306 in any suitable order.

[0103] In response to the first access request originating from a non-secure processor (the "No" branch of step S304), in step S308, it is determined that the first access request does not comply with access permissions. That is, in this case, the non-secure processor accesses the target address space, and the access request does not comply with access permissions; therefore, the access request can be blocked, for example.

[0104] Returning to step S302, in response to the first access request to access the insecure address space (the "No" branch of step S302), the method proceeds to step S306 to allow access to the corresponding insecure address space by, for example, continuing the first access request. Typically, the insecure address space is used to store unprotected data; therefore, when an access request requests access to the insecure address space, the access request can be directly allowed.

[0105] In some cases, for example, there is a need to prevent the secure processor from accessing the insecure address space (corresponding to the isolation mode described above). Therefore, in some embodiments, as an alternative to the "No" branch of step S302, it is determined whether the first access request originates from the secure processor or the insecure processor; and in response to the first access request originating from the secure processor, the first access request is blocked. It is understood that, generally, the secure processor can access data in the insecure address space; however, in some cases, the data stored in the insecure address space may be insecure, and this data may be vulnerable to attacks on the secure processor. Therefore, blocking the secure processor's access requests to the insecure address space can reduce the probability of the secure processor being attacked.

[0106] According to steps S302-S308, it can be determined whether the access request complies with the access permission, and access requests that comply with the access permission can be allowed while requests that do not comply with the access permission are blocked. It should be noted that step S302 is not mandatory. For example, when the entire address space is set as the target address space, or when access requests always access the target address space due to other circumstances, the address space protection method according to at least one embodiment of this disclosure can directly start execution from step S304. The "No" branch of step S302 can also be used as an additional or optional aspect of determining whether the access request complies with the access permission, wherein when the access request accesses a non-secure address space, it can be determined whether to allow or block the access request in accordance with the standard mode or the isolation mode. Thus, based on the above reference... Figure 3 The described methods can determine whether an access request complies with access permissions.

[0107] Furthermore, the steps of each aspect of the method shown in the figure can be performed in any suitable order of execution, and the remaining operational steps can be modified appropriately without exceeding the scope of this disclosure.

[0108] In some cases, as described above, access requests may not comply with access permissions. Examples of access requests that do not comply with access permissions are described below.

[0109] In some embodiments, a first access request is blocked in response to a first access request not conforming to access permissions. For example, the first access request requires read access to a first address within the target address space, but the access permission for the first address is write-only (i.e., only write is allowed). Therefore, the first access request does not conform to access permissions and can be blocked. As another example, the access permissions may allow secure processors to access a target address space, while insecure processors are not allowed to access it. Therefore, an access request initiated by an insecure processor to the target address space will be considered to not conform to access permissions for that target address space, and the access request will be blocked. In this way, illegal access to the target address space can be blocked, ensuring the security of the data in the target address space.

[0110] In some cases, blocking and thus terminating an access request can be detrimental, for example, it might affect the execution of related threads. Therefore, it may be advantageous to resume or continue the execution of a blocked access request while ensuring the safety of the data in the target address space.

[0111] In some embodiments, in response to blocking a first access request, it is determined whether a second access request generated based on the first access request complies with access permissions. For example, access permissions may allow a secure processor to access a target address space, while a non-secure processor cannot. Therefore, an access request initiated by a non-secure processor to the target address space will be considered to be incompatible with access permissions for that target address space, and the access request will be blocked. In this case, it can be determined whether a second access request generated based on the first access request complies with access permissions. In this embodiment, the secure processor initiates the second access request instead of the non-secure processor, where the second access request is associated with the first access request. For example, the secure processor can access data corresponding to the data requested in the first request based on the second access request. For example, the only difference between the first and second access requests is that the identifier of the processor initiating the access request changes from a non-secure processor to a secure processor; the rest of the data can remain unchanged. Thus, by having the secure processor initiate the second access request instead of the non-secure processor, the probability of the access request passing can be increased, the impact on the execution of related threads can be reduced, and the security of the data within the target address space is guaranteed by the secure processor accessing the target address space instead of the non-secure processor.

[0112] In some embodiments, determining whether a second access request generated based on a first access request complies with access permissions may include: sending the first access request to a security processor, obtaining the second access request generated based on the first access request from the security processor; allowing the second access request if it complies with access permissions; and blocking the second access request if it does not comply with access permissions. In this way, the access permissions of the second access request can be checked similarly to those of the first access request, preventing the second access permission from directly accessing data such as in the target address space, thus ensuring the security of the data in the target address space.

[0113] In some embodiments, the first access request can be sent to the security processor via shared memory. For example, when the first access request is blocked, it can be stored in shared memory, and then the first access request stored in shared memory can be sent to the security processor. Of course, the embodiments of this disclosure are not limited to this, and the first access request can also be sent to the security processor via other data transmission methods so that the security processor can obtain a second access request generated based on the first access request.

[0114] In some cases, obtaining data related to the access request (e.g., data to be written in the case of a write operation, or data to be read in the case of a read operation) requires additional computational resource or time overhead for different access requests. Therefore, an efficient method is needed to simultaneously determine whether an access request complies with access permissions and obtain data related to the access request. At least one embodiment of this disclosure supports both non-transparent mode and transparent mode for the first access request to provide an efficient method for determining whether an access request complies with access permissions and obtaining data related to the access request.

[0115] Figure 4A A schematic diagram of a non-transparent transmission mode according to at least one embodiment of the present disclosure is shown.

[0116] See Figure 4AThe processor 402 can, for example, transmit a first access request to the physical memory management module (PMP) 404, where the PMP 404 can perform various aspects of the address space protection method described above. The PMP 404 can first perform a PMP check 405, in which it determines whether the first access request complies with access permissions, and then, in response to the first access request complying with access permissions, perform an access to the target address space 408 via the data bus 406. For example, when the access is to read data, the first address is accessed via the data bus, the data is retrieved from the first address, and the retrieved data is returned to the processor. As another example, when the access is to write data, the data to be written is retrieved via the data bus, and then the data to be written is written to the first address.

[0117] Thus, determining whether an access request complies with access permissions before retrieving data related to the access request, and deciding whether to retrieve data based on the result of determining whether the access request complies with access permissions, ensures that the retrieved data related to the access request can be utilized subsequently (e.g., returned to the processor or written to the target address space), guaranteeing high utilization of the computational resources overhead used to retrieve data related to the access request.

[0118] Figure 4B A schematic diagram of a transparent transmission mode according to at least one embodiment of the present disclosure is shown.

[0119] See Figure 4B The processor 402 can, for example, transmit a first access request to the physical memory management module (PMP) 404, and the PMP checks 405 and the data bus 406 in parallel, i.e., obtains the first address to be accessed by the first access request; and accesses the first address in parallel with determining, for example, whether the first access request meets the access permissions, and determines whether to continue the access operation for the first address based on whether the first access request meets the access permissions. For example, for a read operation, while determining whether the first access request meets the access permissions, the first address can be transmitted to the target address space via the data bus and the read data can be obtained. As another example, for a write operation, while determining whether the first access request meets the access permissions, the data to be written can be obtained.

[0120] In some embodiments, determining whether to continue access to the first address based on whether the first access request complies with access permissions includes: canceling the access operation already performed on the first address in response to the first access request not complying with access permissions; or allowing the access operation already performed on the first address in response to the first access request complying with access permissions. Thus, whether the data related to the acquired access request is utilized, such as whether it is returned to the processor or written to the corresponding target address space, needs to be controlled by the result of the access permission check or determination, ensuring the security of the data in the target address space.

[0121] In this way, determining whether an access request complies with access permissions before acquiring and executing data related to the access request can be done in parallel without waiting for the determination of whether the first access request complies with access permissions. This reduces the time required for the first access request to access the target address space and improves the execution efficiency of the access request.

[0122] In reference Figure 4A and Figure 4B In the described embodiments, the non-transparent transmission mode and the transparent transmission mode can be selected based on the actual application. For example, when the probability of the first access request meeting the access permission requirements is high or the data related to the access request is large, selecting the transparent transmission mode may be advantageous. Conversely, when the probability of the first access request meeting the access permission requirements is low or the data related to the access request is small, selecting the non-transparent transmission mode may be advantageous.

[0123] In some embodiments, determining whether to continue access to a first address based on whether the first access request complies with access permissions includes: canceling the access operation already performed on the first address in response to the first access request not complying with access permissions; or allowing the access operation already performed on the first address in response to the first access request complying with access permissions. For example, for a read operation, when the first access request does not comply with access permissions, this corresponds to an illegal read, and all zeros can be returned to the upstream processor, while discarding the data returned by the downstream slave device (e.g., memory or register). As another example, for a write operation, when the first access request does not comply with access permissions, this corresponds to an illegal write, and the data to be written issued by the upstream processor can be discarded, and a response indicating the write result, such as a write failure response, can be returned. Thus, by executing the operations of acquiring the data to be read and the data to be written in parallel, and determining whether the access request complies with access permissions, canceling or allowing the access operation based on whether the access request complies with access permissions not only improves the execution efficiency of the access request but also ensures the data security of the target address space.

[0124] It should be noted that the terms "first access request" and "second access request" in this document are used only to distinguish access requests within different loops. For example, the second access request may be a blocked access request and may undergo individual steps or a portion of those steps of the first access request described above. Therefore, although various aspects of the first access request have been described above, it is understood that the second access request can be processed in a similar manner to the first access request. Thus, in the context of this document, unless otherwise stated, operations performed on the first access request also apply to the second access request. Furthermore, unless otherwise stated, the access requests described in the context of this document include both the first and second access requests.

[0125] To enable those skilled in the art to better understand and implement the embodiments of this disclosure, the following description of an address space protection device capable of implementing the above-described address space protection method is provided with reference to the accompanying drawings.

[0126] Corresponding to the address space protection method provided in at least one embodiment of this disclosure, this disclosure also provides an address space protection device. Figure 5 A schematic diagram of an address space protection device according to at least one embodiment of the present disclosure is shown. This protection device can be compared with [see also...] Figure 4A and 4B The described PMP 304 is the same as or similar to the one mentioned above, and can be performed as described above. Figures 1 to 4A , Figure 4B The various aspects of the described address space protection methods.

[0127] Reference Figure 5 The protection device 500 may include a receiving unit 502 and a management unit 504.

[0128] The receiving unit 502 can be configured to receive a first access request.

[0129] Management unit 504 can be configured to determine whether a first access request complies with access permissions to a target address space, wherein the target address space includes a target memory address space and a target register address space, and the access permissions limit whether an access request to the target address space is allowed.

[0130] As described above, the address space protection method according to at least one embodiment of this disclosure determines whether an access request conforms to access rights for a target address space including a target memory address space and a target register address space, and approves access requests that conform to such access rights. Thus, only access requests that conform to the access rights can access the data in the target memory address space and the target register address space, while ensuring the security of the data in the registers and the data in the memory.

[0131] The following is a detailed description of additional aspects of the address space protection device disclosed herein.

[0132] Figure 6 A more detailed structural schematic diagram of a protection device 500 according to at least one embodiment of the present disclosure is shown.

[0133] See Figure 6 The management unit 504 included in the protection device 500 may include a first protection control module 610 and a second protection control module 620.

[0134] The receiving unit 502 can also be configured to obtain the first address to be accessed by the first access request.

[0135] The first protection control module 610 can be configured to: in response to the first address being located in the target memory address space, perform a determination of whether the first access request complies with the access permission.

[0136] The second protection control module 620 can be configured to: in response to the first address being located in the target register address space, perform a determination of whether the first access request complies with the access permission.

[0137] The first protection control module can be placed at the memory entry point, and the second protection control module can be placed at the APB master exit point. In this way, separate responses can be implemented for the memory address space and the register address space.

[0138] Figure 6 Only an example of the more detailed structure of the protection device 500 according to at least one embodiment of the present disclosure is shown, and it is possible to... Figure 6 The various units or modules shown can be appropriately combined or include other suitable units or modules, as long as the first protection control module and the second protection control module can respond to access requests to the memory address space and access requests to the register address space, respectively.

[0139] In some embodiments, the first protection control module may include registers for the first protection control module, and the first protection control module is configured to use the registers of the first protection control module to set access permissions for a target memory address space. Additionally, the second protection control module may include registers for the second protection control module, and the second protection control module is configured to use the registers of the second protection control module to set access permissions for a target register address space. Thus, a rich set of methods for setting secure address spaces can be provided through the registers of the first and second protection control modules.

[0140] In some embodiments, the security processor can set access permissions to the target memory address space via a register of the first protection control module (e.g., referred to as the "first register"). Alternatively, the security processor can set access permissions to the target register address space via a register of the second protection control module (e.g., referred to as the "second register"). Thus, setting the access permissions to the target memory address space or the target register address space by the security processor enhances the security of access permission settings.

[0141] In some embodiments, the registers of the first protection control module and the registers of the second protection control module can also be set to be write-prohibited. This further reduces the risk of accidental modification or deletion of access permissions due to the security processor accidentally modifying the registers of the first and second protection control modules, thus improving the security of access permission settings.

[0142] In some embodiments, the address space may include a non-secure address space and a target address space that serves as a secure address space. Determining whether a first access request complies with access permissions for the target address space may include: in response to the first access request accessing the target address space, determining whether the first access request originates from a secure processor or a non-secure processor; and in response to the first access request originating from a secure processor, determining that the first access request complies with access permissions; and in response to the first access request originating from a non-secure processor, determining that the first access request does not comply with access permissions. This allows for the checking of access permissions for access requests, ensuring that access requests with compliant permissions can access the corresponding target address space, thus guaranteeing the security of data within the target address space.

[0143] In some embodiments, the management unit may also be configured to access a non-secure address space in response to a first access request. This allows both secure and non-secure processors to directly access the non-secure address space.

[0144] In some embodiments, the management unit may also be configured to, in response to a first access request to access the insecure address space, determine whether the first access request originates from a secure processor or an insecure processor; and, in response to the first access request originating from a secure processor, block the first access request. It is understood that, typically, a secure processor can access data in the insecure address space; however, in some cases, the data stored in the insecure address space may be insecure, and this data could potentially be used to attack the secure processor. Therefore, blocking the secure processor's access requests to the insecure address space can reduce the probability of the secure processor being attacked.

[0145] In some embodiments, the management unit may also be configured to block a first access request in response to the first access request not conforming to access permissions. Therefore, an access request initiated by a non-secure processor to the target address space will be considered to be inconsistent with access permissions to the target address space, and the access request will be blocked. In this way, illegal access to the target address space can be blocked, ensuring the security of the data in the target address space.

[0146] In some embodiments, the management unit may also be configured to: in response to blocking the first access request, determine whether a second access request generated based on the first access request complies with the access permissions. Thus, by having a secure processor initiate the second access request instead of a non-secure processor, the probability of the access request being approved can be increased, the impact on the execution of related threads can be reduced, and the security of the data within the target address space is guaranteed by having a secure processor access the target address space instead of a non-secure processor.

[0147] In some embodiments, determining whether a second access request generated based on a first access request complies with access permissions may include: sending the first access request to a security processor, obtaining the second access request generated based on the first access request from the security processor; allowing the second access request if it complies with access permissions; or blocking the second access request if it does not comply with access permissions. In this way, the access permissions of the second access request can be checked similarly to those of the first access request, preventing the second access permission from directly accessing data such as in the target address space, thus ensuring the security of the data in the target address space.

[0148] In some embodiments, the management unit may also be configured to: obtain a first address to be accessed by the first access request; access the first address in parallel with determining whether the first access request complies with access permissions; and determine whether to continue the access operation to the first address based on whether the first access request complies with access permissions. Thus, determining whether the access request complies with access permissions while obtaining and executing data related to the access request eliminates the need to wait until the determination of whether the first access request complies with access permissions is completed before performing the operations of obtaining the read data and the data to be written. Instead, the operations of obtaining the read data and the data to be written can be performed in parallel with determining whether the first access request complies with access permissions, reducing the time required for the first access request to access the target address space and improving the execution efficiency of the access request.

[0149] In some embodiments, determining whether to continue access to the first address based on whether the first access request complies with access permissions may include: canceling the access operation already performed on the first address in response to the first access request not complying with access permissions; or allowing the access operation already performed on the first address in response to the first access request complying with access permissions. Thus, whether the data related to the acquired access request is utilized, such as whether it is returned to the processor or written to the corresponding target address space, needs to be controlled by the result of the access permission check or determination, ensuring the security of the data in the target address space.

[0150] The above is only based on Figure 5 and Figure 6 A portion of an address space protection device according to at least one embodiment of the present disclosure has been described, and the remaining portions of the address space protection device may correspond to various aspects of the space address protection method of the present disclosure. Furthermore, the effects of various aspects of the space address protection method according to at least one embodiment of the present disclosure may also be mapped to the address space protection device of the present disclosure, which will not be elaborated here.

[0151] The following is through Figure 7 and Figure 8 This describes example application scenarios and data access processes for the spatial address protection methods and devices according to this disclosure. It is understood that... Figure 7 and Figure 8 The scenarios and data access processes shown are merely illustrative and do not exhaustively illustrate all aspects of the above-mentioned methods and devices for protecting spatial addresses.

[0152] Figure 7 A schematic diagram illustrating an example application scenario according to at least one embodiment of the present disclosure is shown.

[0153] See Figure 7 Application scenario 700 includes, for example, a multi-core processor compliant with the RISC-V specification, which may include an E21 secure processor 706 and a U84 non-secure processor 708. In addition to multi-core processors, application scenario 700 may also include memory 710, registers 712 (shown in the figure as including UART, SPI, USB, etc.), as well as MEM-PMP 702 and IO-PMP 704.

[0154] MEM-PMP 702 corresponds to the first protection control module described above, and IO-PMP 704 corresponds to the second protection control module described above. MEM-PMP 702 and IO-PMP 704 can constitute a PMP, as detailed in this document. Figure 5 The described address space protection device 500.

[0155] MEM-PMP 702 and IO-PMP 704 can be coupled to individual processors (e.g., E21 secure processor 706, U84 non-secure processor 708) and memory / registers (e.g., memory 710, register 712) to respond to processor accesses to the address spaces of memory and registers. Specifically, the MEM-PMP couples the processor (E21 secure processor 706 and U84 non-secure processor 708) to memory 710 to respond to access requests to memory 710. The IO-PMP 704 couples the processor (E21 secure processor 706 and U84 non-secure processor 708) to register 712 to respond to access requests to register 712. The responses described herein may include receiving the access request and determining whether the access request complies with access permissions.

[0156] Figure 7 Although only a single component is shown (such as the E21 secure processor 706, the U84 non-secure processor 708, memory 710, registers 712, MEM-PMP 702, and IO-PMP 704), it is understood that other suitable numbers of components can be configured as needed. For example, one E21 secure processor 706 and multiple U84 non-secure processors 708 can be configured so that the E21 secure processor 706 performs access to the secure address space to suit the Trusted Execution Environment (TEE), and multiple U84 non-secure processors 708 perform access to the non-secure address space to suit the Rich Execution Environment (REE). This makes the architecture of application scenario 700 more consistent with actual industrial control applications.

[0157] Based on the above example application scenario, the following describes a specific example of a U84 non-secure processor 708 reading a secure memory address space.

[0158] By configuring the MEM-PMP register, the E21 sets the access permissions for the 0-100M memory space to "secure read / write" and the other spaces to "unsecure," thus dividing the memory address space into secure and unsecure memory address spaces. Setting MEM-PMP to standard mode allows the E21 to access data in all memory spaces.

[0159] Additionally, a segment of shared memory is allocated from the insecure space of memory to facilitate subsequent data transfer.

[0160] Subsequently, U84 initiated an access request to read data from memory space 0-100M:

[0161] a. The data bus first goes through MEM-PMP for inspection. If it finds that the access request has accessed data in the safe memory address space, it reports an error message and the access request is blocked.

[0162] b. U84 stores the data address information to be accessed in shared memory;

[0163] c. U84 sends an interrupt to E21 (inter-core interrupt);

[0164] d. When E21 receives an interrupt, it parses the data in the shared memory (generating a second access request based on the first access request).

[0165] e. E21 reads data from the secure memory address space based on the second access request and copies it to the shared memory;

[0166] f. E21 sends an interrupt to U84 (inter-core interrupt);

[0167] g and U84 receive an interrupt and read data from shared memory.

[0168] The following describes a specific example of writing to a secure memory address space by a U84 non-secure processor 708.

[0169] By configuring the MEM-PMP register, the E21 sets the access permissions for the 0-100M memory space to "secure read / write" and the other spaces to "unsecure," thus dividing the memory address space into secure and unsecure memory address spaces. Setting MEM-PMP to standard mode allows the E21 to access data in all memory spaces.

[0170] Additionally, a segment of shared memory is allocated from the insecure space of memory to facilitate subsequent data transfer.

[0171] Subsequently, U84 initiates an access request to write data to the 0-100M memory space:

[0172] a. The data bus first goes through MEM-PMP for inspection. If it finds that the access request has accessed data in the safe memory address space, it reports an error message and the access request is blocked.

[0173] b. U84 stores the data to be written and address information in shared memory;

[0174] a. U84 sends an interrupt to E21 (inter-core interrupt);

[0175] b. When E21 receives an interrupt, it parses the data in the shared memory (generating a second access request based on the first access request).

[0176] c. E21 writes data to the specified memory and updates the shared memory data write status (success or failure).

[0177] d. E21 sends an interrupt to U84 (inter-core interrupt)

[0178] e. U84 received an interrupt, and the data writing process ended.

[0179] The above description of E21 / U84 reading and writing to the memory address space via MEM-PMP is merely exemplary. Under the MEM-PMP architecture, other suitable methods can also be used to access the secure memory address space, and other suitable processors can be chosen to replace E21 and U84. Furthermore, the steps for IO-PMP-based read / write are the same or similar to those for MEM-PMP-based read / write, and will not be elaborated upon further in this article.

[0180] In this way, a secure processor can be used to access data in the secure address space, such as data in the secure memory address space and data in the secure register address space, instead of a non-secure processor. Non-secure processors cannot access data in the secure address space, thus ensuring the security of data in the secure address space.

[0181] Figure 8 A schematic diagram of a data access process according to at least one embodiment of the present disclosure is shown. Figure 8 The data access flow shown can be applied to an architecture built upon an address space protection device based on at least one embodiment of this disclosure, for example, applied to Figure 7 The example application scenario shown.

[0182] See Figure 8 The security processor 802 and the non-security processor 804 can initiate an access request 806 to the address space. The address space protection device 500 according to at least one embodiment of this disclosure can perform a permission check 808 on the access request, that is, determine whether the access request complies with the access permissions of the target address space. When it is determined that the access request complies with the access permissions of the target address space (the "yes" branch of 808), the access request can continue in 810, thereby completing the security processor's access to the target address space.

[0183] Returning to 808, when it is determined that the access request does not comply with the access permissions of the target address space (the "No" branch of 808), the access request can be blocked at 812, and it can be determined whether to terminate the access request. For example, it can be determined whether the number of times the same access request has been blocked exceeds a threshold. If the number of times the same access request has been blocked exceeds the threshold, the access request can be terminated. This disclosure is not limited to this, and other methods for determining whether to terminate the access request can be set according to actual usage needs.

[0184] In 812, in response to the need to terminate the access request (the "Yes" branch of 812), the access request can be terminated in 814. In response to not terminating the access request (the "No" branch of 814), a request can be made to the security processor in 816, which will then perform the access on behalf of the user based on the access request.

[0185] Understandably, determining whether to terminate the access request in 812 is optional. For example, in some cases, after determining that the access request does not comply with the access permissions of the target address space (the "No" branch of 808), the access can be blocked and proceed directly to 814 to terminate the access request. As another example, in some cases, after determining that the access request does not comply with the access permissions of the target address space (the "No" branch of 808), the access can be blocked and proceed directly to 816 to request the security processor to perform the access based on the request.

[0186] in addition, Figure 8 The permission check shown may only be a check of the access permissions for access requests to the secure address space. When the access request is, for example, an access request to the insecure address space initiated by an insecure processor, the insecure processor can directly access the insecure address space (e.g., the "No" branch of step S302 described above), therefore, although not shown, there may be a data stream continuing to access request 810 to the insecure processor 804.

[0187] Understandably, based on actual needs, in addition to including Figure 8 In addition to the permission check 808 shown, the address space protection device disclosed herein may also include Figure 8 This disclosure is not limited to any part of the various units or modules shown.

[0188] Figure 9 This is a schematic diagram of an electronic device provided in at least one embodiment of this disclosure. Figure 9 As shown, the electronic device 900 includes a processor 910 and a memory 920. The memory 920 includes one or more computer program modules 921. The one or more computer program modules 921 are stored in the memory 920 and configured to be executed by the processor 910. These computer program modules 921 include instructions for performing an address space protection method provided in at least one embodiment of the present disclosure. When executed by the processor 910, they can perform one or more steps of the address space protection method and its additional aspects provided in at least one embodiment of the present disclosure. The memory 920 and the processor 910 can be interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0189] For example, processor 910 may be a central processing unit (CPU), a digital signal processor (DSP), or other processing unit with data processing and / or program execution capabilities, such as a field-programmable gate array (FPGA); for example, the central processing unit (CPU) may be an x86 or ARM architecture, a RISC-V architecture, etc. Processor 910 may be a general-purpose processor or a special-purpose processor, capable of controlling other components in electronic device 900 to perform desired functions.

[0190] For example, memory 920 may include any combination of one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, erasable programmable read-only memory (EPROM), portable compact disc read-only memory (CD-ROM), USB memory, flash memory, etc. One or more computer program modules 921 may be stored on the computer-readable storage medium, and processor 910 may run one or more computer program modules 921 to implement various functions of electronic device 9. Various application programs and various data, as well as various data used and / or generated by the application programs, may also be stored in the computer-readable storage medium. Electronic device 9 may be, for example, a system-on-a-chip (SOC) or a computer, television, monitor, etc., including the SOC. The specific functions and technical effects of electronic device 9 can be referred to the description of address space protection methods and their additional aspects above, and will not be repeated here.

[0191] Figure 10 This is a schematic diagram of another electronic device 400 provided for at least one embodiment of the present disclosure. The electronic device 400 is, for example, suitable for implementing the address space protection method and its additional aspects provided for at least one embodiment of the present disclosure. It should be noted that... Figure 10 The illustrated electronic device 1000 is merely an example and does not impose any limitation on the functionality and scope of use of at least one embodiment of this disclosure.

[0192] like Figure 10As shown, the electronic device 1000 may include a processing device (e.g., a central processing unit, a graphics processor, etc.) 1010, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1020 or a program loaded from a storage device 1080 into a random access memory (RAM) 1030. The RAM 1030 also stores various programs and data required for the operation of the electronic device 1000. The processing device 1010, ROM 1020, and RAM 1030 are interconnected via a bus 1040. An input / output (I / O) interface 1050 is also connected to the bus 1040.

[0193] Typically, the following devices can be connected to the I / O interface 1050: input devices 460 including, for example, a touchscreen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; output devices 1070 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1080 including, for example, magnetic tape, hard disk, etc.; and communication devices 1090. Communication device 1090 allows electronic device 1000 to communicate wirelessly or wiredly with other electronic devices to exchange data. Although Figure 10 An electronic device 1000 with various devices is shown, but it should be understood that it is not required to implement or have all of the devices shown, and the electronic device 1000 may alternatively implement or have more or fewer devices.

[0194] For example, the address space protection method and its additional aspects provided in at least one embodiment of this disclosure can be implemented as a computer software program. For instance, an embodiment of this disclosure includes a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program including program code for executing the aforementioned address space protection method and its additional aspects. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device 1090, or installed from a storage device 1080, or installed from a ROM 1020. When the computer program is executed by the processing device 410, the address space protection method and its additional aspects provided in at least one embodiment of this disclosure can be executed.

[0195] At least one embodiment of this disclosure also provides a non-transiently readable storage medium. Figure 11 This is a schematic diagram of a non-transitory readable storage medium according to at least one embodiment of the present disclosure. Figure 11 As shown, a non-transiently readable storage medium 1100 stores computer instructions 1110, which, when executed by a processor, perform one or more steps of the address space protection method and its additional aspects as described above.

[0196] For example, the non-transitory readable storage medium 1100 can be any combination of one or more computer-readable storage media. For instance, one computer-readable storage medium may contain computer-readable program code for receiving a first access request, another computer-readable storage medium may contain computer-readable program code for determining whether the first access request complies with access permissions to the target address space, and yet another computer-readable storage medium may contain computer-readable program code for granting access to the first access request in response to the first access request being deemed to comply with access permissions. Of course, the aforementioned program code may also be stored in the same computer-readable medium, and the embodiments of this disclosure do not impose limitations on this.

[0197] For example, when the program code is read by a computer, the computer can execute the program code stored in the computer storage medium, and perform, for example, the address space protection method and its additional aspects provided in any embodiment of this disclosure.

[0198] For example, the storage medium may include a memory card for a smartphone, a storage component for a tablet computer, a hard disk for a personal computer, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), portable compact disc read-only memory (CD-ROM), flash memory, or any combination of the above storage media, or other suitable storage media.

[0199] In the detailed description above, specific details have been set forth for purposes of explanation and not limitation, in order to provide a thorough understanding of the various aspects and embodiments described in this disclosure. In some instances, detailed descriptions of well-known devices, components, circuits, and methods have been omitted so as not to obscure the description of the embodiments disclosed herein with unnecessary detail. All statements of principles, aspects, and embodiments disclosed herein, along with specific examples thereof, are listed herein to cover both structural and functional equivalents. Furthermore, such equivalents are intended to include both currently known equivalents and those developed in the future, i.e., any element developed to perform the same function, regardless of its structure. Thus, for example, it can be understood that the block diagrams herein may represent conceptual diagrams of illustrative circuit systems or other functional units embodying the principles of the described embodiments. Similarly, it can be understood that any flowchart, etc., represents various processes that may be substantially represented in a computer-readable storage medium and executed by a computer or processor, whether or not such a computer or processor is explicitly shown. The functionality of the various elements comprising functional blocks may be provided by the use of hardware, such as circuit hardware and / or hardware capable of executing software in the form of coded instructions stored on the aforementioned computer-readable storage medium. Therefore, such functions and illustrated function blocks will be understood as hardware-implemented and / or computer-implemented, and thus machine-implemented. In hardware implementations, function blocks may include or encompass, but are not limited to, digital signal processor (DSP) hardware, reduced instruction set processors, hardware (e.g., digital or analog) circuit systems, including but not limited to application-specific integrated circuits (ASICs) and / or field-programmable gate arrays (FPGAs), and (where appropriate) state machines capable of performing these functions. In computer implementations, a computer is generally understood to include one or more processors or one or more controllers. When provided by a computer, processor, or controller, functionality may be provided by a single dedicated computer, processor, or controller, a single shared computer, processor, or controller, or multiple separate computers, processors, or controllers, some of which may be shared or distributed.

[0200] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0201] In the several embodiments provided in this application, it should be understood that each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks / operations may occur in a different order than those indicated in the figures. For example, two consecutive blocks / operations may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block / operation in the block diagrams and / or flowcharts, and combinations of blocks / operations in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0202] If the at least one function described in at least one embodiment of this disclosure is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the methods of the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0203] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0204] The above description is merely a preferred embodiment of this disclosure and is not intended to limit this disclosure. Various modifications and variations can be made to this disclosure by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

Claims

1. A method for protecting an address space, comprising: Receive the first access request; Determine whether the first access request complies with the access permission for the target address space, wherein the target address space includes a target memory address space and a target register address space, and the access permission limits whether an access request to the target address space is allowed; In response to the first access request conforming to the access permissions, the first access request is granted; In response to the first access request not conforming to the access permission, the first access request is blocked; In response to blocking the first access request, determine whether to terminate the first access request; In response to not terminating the first access request, the first access request is sent to a security processor, and a second access request generated based on the first access request is obtained from the security processor; and In response to the second access request conforming to the access permissions, the second access request is granted.

2. The protection method according to claim 1 further includes: Obtain the first address that the first access request wants to access; In response to the fact that the first address is located in the target memory address space, the first protection control module is used to determine whether the first access request complies with the access permission. or In response to the first address being located in the target register address space, the second protection control module is used to determine whether the first access request complies with the access permission.

3. The protection method according to claim 2, wherein, Use the first register of the first protection control module to set access permissions for the target memory address space; Use the second register of the second protection control module to set access permissions for the target register address space.

4. The protection method according to claim 3, wherein, The first register and the second register are also set to disable writing.

5. The protection method according to claim 1 further includes: In response to the second access request not conforming to the access permissions, the second access request is blocked.

6. The protection method according to claim 1 further includes: Obtain the first address that the first access request wants to access; The first address is accessed in parallel with determining whether the first access request complies with the access permissions, and whether to continue the access operation to the first address is determined based on whether the first access request complies with the access permissions.

7. The protection method according to claim 6, wherein, Determining whether to continue access to the first address based on whether the first access request complies with the access permissions includes: In response to the first access request not conforming to the access permission, cancel the access operation already performed on the first address; or In response to the first access request conforming to the access permissions, the access operation already performed on the first address is permitted.

8. The protection method according to claim 1, wherein, The address space includes a non-secure address space and the target address space, which is a secure address space. Determining whether the first access request complies with access permissions for the target address space includes: In response to the first access request to access the target address space, determine whether the first access request comes from a secure processor or a non-secure processor; In response to the first access request originating from the security processor, it is determined that the first access request complies with the access permissions; and In response to the first access request originating from the insecure processor, it is determined that the first access request does not comply with the access permissions.

9. The protection method according to claim 8 further includes: In response to the first access request, access to the insecure address space is granted via the first access request; or In response to the first access request to access the insecure address space, determine whether the first access request comes from the secure processor or the insecure processor; And in response to the first access request originating from the security processor, the first access request is blocked.

10. An address space protection device, comprising: The receiving unit is configured to receive the first access request; The management unit is configured as follows: Determine whether the first access request complies with the access permissions for the target address space; in response to the first access request complying with the access permissions, pass the first access request, wherein the target address space includes a target memory address space and a target register address space, and the access permissions limit whether an access request to the address space is allowed; In response to the first access request not conforming to the access permission, the first access request is blocked; In response to blocking the first access request, determine whether to terminate the first access request; In response to not terminating the first access request, the first access request is sent to a security processor, and a second access request generated based on the first access request is obtained from the security processor; and In response to the second access request conforming to the access permissions, the second access request is granted.

11. The protection device according to claim 10, wherein, The receiving unit is further configured to: obtain the first address to be accessed by the first access request; The management unit includes a first protection control module and a second protection control module, wherein, The first protection control module is configured to: determine whether the first access request complies with access permissions in response to the first address being located in the target memory address space; and The second protection control module is configured to: determine whether the first access request complies with access permissions in response to the first address being located in the target register address space.

12. The protection device according to claim 11, wherein, The first protection control module includes a first register, and the first protection control module is configured to use the first register to set access permissions for the target memory address space; The second protection control module includes a second register, and the second protection control module is configured to use the second register to set access permissions to the target register address space.

13. The protection device according to claim 12, wherein, The first register and the second register are also set to disable writing.

14. The protective device according to claim 10, further comprising: In response to the second access request not conforming to the access permissions, the second access request is blocked.

15. The protection device according to claim 10, wherein, The management unit is also configured to: Obtain the first address that the first access request wants to access; The first address is accessed in parallel with determining whether the first access request complies with the access permissions, and whether to continue the access operation to the first address is determined based on whether the first access request complies with the access permissions.

16. The protective device according to claim 15, wherein, Determining whether to continue access to the first address based on whether the first access request complies with the access permissions includes: In response to the first access request not conforming to the access permission, cancel the access operation already performed on the first address; or In response to the first access request conforming to the access permissions, the access operation already performed on the first address is permitted.

17. The protection device according to claim 10, wherein, The address space includes a non-secure address space and the target address space, which is a secure address space. Determining whether the first access request complies with access permissions for the target address space includes: In response to the first access request to access the target address space, it is determined whether the first access request originates from a secure processor or a non-secure processor; and In response to the first access request originating from the security processor, it is determined that the first access request complies with the access permissions; and In response to the first access request originating from the insecure processor, it is determined that the first access request does not comply with the access permissions.

18. The protective device according to claim 17, wherein, The management unit is also configured to: In response to the first access request, access to the insecure address space is granted via the first access request; or In response to the first access request to access the insecure address space, determine whether the first access request comes from the secure processor or the insecure processor; And in response to the first access request originating from the security processor, the first access request is blocked.

19. An electronic device comprising: processor; Memory, including one or more computer program modules; The one or more computer program modules are stored in the memory and configured to be executed by the processor, and the one or more computer program modules include instructions for performing the protection method as described in any one of claims 1-9.

20. A non-temporary computer-readable storage medium having executable instructions stored thereon. in, When the executable instructions are executed by the processor, the processor performs the protection method according to any one of claims 1-9.

Images