A method and apparatus for creating secure page tables and accessing memory

Abstract

The application discloses a method and device for creating a secure page table and accessing memory, and relates to the technical field of computers. The method can significantly reduce the memory access overhead of a processor when running a process. The method for creating a secure page table is applied to a processor running a first process. The method for creating a secure page table comprises the following steps: allocating a first physical page; when the first physical page is not allocated to any secure process as a secure space, creating an n-level page table in a first secure page table for the first process based on the first physical page; wherein the first secure page table is used for converting a virtual address of the first process into a physical address by the processor when the first process accesses memory, the first secure page table is an n-level page table, and n is a positive integer.

Description

TECHNICAL FIELD

[0001] The present application relates to the computer technical field, and in particular to a method and device for creating a secure page table and accessing memory. BACKGROUND

[0002] In the computer field, system isolation is an important supporting technology for improving the overall reliability and scalability of a system. When a third-party application runs on a computer that uses system isolation technology, even if the third-party application has defects, it will not affect other applications or the computer system. Among them, the enclave scheme belongs to a hardware or hardware-software combined system isolation scheme. The enclave provides a trusted execution environment, and privileged or unprivileged software cannot access the enclave. Therefore, when an application is located in the enclave, privileged or unprivileged software cannot affect the application.

[0003] In the enclave scheme, an important technical point is the isolation of memory. In the enclave-based memory isolation scheme, a global security bitmap (enclave bitmap) can usually be introduced in the memory to manage the physical pages in the memory. As shown in Figure 1 The security area 101 in the memory 10 stores a security bitmap, and each bit in the security bitmap represents a tag, such as tag 111. Each tag corresponds to a physical page in the memory, and the value of each tag is used to indicate the security level of the physical page corresponding to the tag. For example, when the value of the tag is 0, it indicates that the physical page corresponding to the tag is not allocated for use by the enclave process (or called secure process), i.e., the physical page is a non-enclave page. When the value of the tag is 1, it indicates that the physical page corresponding to the tag has been allocated for use by the enclave process, i.e., the physical page is an enclave page.

[0004] When a process running on the processor needs to access the memory, the processor converts the virtual address of the process into a physical address, and then needs to perform a security check on the physical page indicated by the physical address. Specifically, the processor determines whether the security level of the process matches the security level of the physical page by reading the value of the tag corresponding to the physical page in the security bitmap. When the match, for example, the process is a secure process, and the physical page is an enclave page, the process continues to access the physical page. If not match, for example, the process is a non-secure process, and the physical page is an enclave page, the memory rejects the process to access the physical page. However, the security bitmap is stored in the secure area of the memory, so that the process will generate a read operation from the memory each time the process accesses the memory, thereby causing additional access overhead. SUMMARY

[0005] The present application provides a method and device for creating a secure page table and accessing memory, which can significantly reduce the access overhead of the processor when running a process.

[0006] To achieve the above object, the present application provides the following technical solutions:

[0007] In a first aspect, the present application provides a method for creating a secure page table, which is applied to a processor running a first process, and the method comprises: allocating a first physical page; and when the first physical page is not allocated to any secure process as a secure space, creating an n-level page table in a first secure page table for the first process based on the first physical page. The first secure page table is used for converting a virtual address of the first process into a physical address when the first process accesses the memory, and the first secure page table is an n-level page table, and n is a positive integer.

[0008] By the method, the processor can perform a legality check on the last-level page table of the secure page table when creating the secure page table for the process, to determine that the first physical page mapped by the last-level page table has not been allocated to any secure process as a secure space, and then create the n-level page table based on the first physical page. In this way, the isolation of the memory is realized at the page granularity. Moreover, the processor has already performed a legality check on the first physical page mapped by the first secure page table of the first process when creating the page table, so that the processor does not need to perform a security check on the physical address mapped by the secure page table of the first process when running the first process, thereby significantly reducing the access overhead of the processor when running the process, and improving the system performance.

[0009] In a possible design, the "creating the nth-level page table in the first secure page table based on the first physical page when the first physical page is not allocated to any secure process as a secure space" includes: determining, by a preset module, that the first physical page is not allocated to any secure process as a secure space, where the preset module includes a running firmware or a preset microcode; and creating, by the preset module, the nth-level page table in the first secure page table for the first process based on the first physical page.

[0010] In another possible design, the method further includes: writing, by the preset module, the first secure page table into the first secure area in the memory.

[0011] With the two possible designs, the legitimacy of the first physical page is checked by running the firmware or the microcode to determine that the first physical page is not allocated to any secure process as a secure space. Since the security permission level of the running firmware and the microcode is higher than that of the kernel, and the created first secure page table is stored in the secure area in the memory, the memory isolation scheme based on the page granularity provided in the embodiments of the present application is more secure.

[0012] In another possible design, the method further includes: when the first physical page is not allocated to any secure process as a secure space and the first physical page is used as a non-secure space of the first process, setting a tag corresponding to the first physical page in a secure bitmap to a first value; or when the first physical page is not allocated to any secure process as a secure space, the first process is a secure process, and the first physical page is used as a secure space of the first process, setting the tag corresponding to the first physical page in the secure bitmap to a second value. For any tag in the secure bitmap, if the any tag takes the first value, it indicates that a physical page corresponding to the any tag is not allocated to a secure process as a secure space; and if the any tag takes the second value, it indicates that the physical page corresponding to the any tag is allocated to a secure process as a secure space.

[0013] With the possible design, after the nth-level page table is created, the tag corresponding to the first physical page is set to a corresponding value according to the security level of the first process and the security level of the current required memory space of the first process. In this way, the isolation of the memory in the page granularity is realized.

[0014] In another possible design, the secure bitmap is stored in a second secure area in the memory.

[0015] With the possible design, the secure bitmap is stored in the secure area in the memory, and therefore, the memory isolation scheme based on the page granularity provided in the embodiments of the present application is more secure.

[0016] In another possible design approach, the above method further includes: if the first physical page has been allocated to any security process as a security space, then it is determined that the creation of the nth level page table has failed.

[0017] This possible design achieves memory isolation at the page level.

[0018] In another possible design approach, before “allocating the first physical page” as described above, the method further includes: creating the first n-1 levels of page tables for the first security page table.

[0019] Secondly, this application provides a method for accessing memory. This method is applied to a processor running a first process, which corresponds to a first secure page table stored in a first secure region of memory. The first secure page table is an n-level page table, where n is a positive integer. The method includes: determining whether each level of the first secure page table is within the first secure region; if each level of the first secure page table is within the first secure region, determining the physical address corresponding to the virtual address of the first process based on the base address of the nth level page table in the first secure page table; and accessing memory based on the physical address.

[0020] The memory access method provided in this application is based on the secure page table created in the first aspect described above. Since the processor performs a validity check on the last-level page table of the secure page table during the creation of the secure page table for a process and stores the secure page table in a secure region of memory, when the processor needs to access memory during the execution of the first process, it only needs to determine that each level of the secure page table is within a secure region of memory to access the first physical page mapped by the first secure page table, without needing to perform further security checks. This significantly reduces the overhead of the processor accessing memory during process execution and improves system performance.

[0021] In one possible design, before determining whether each level of page table in the first secure page table is within the first secure region, the method further includes: obtaining a first base address, which is the base address of the first-level page table in the first secure page table. Based on the virtual address of the first process and the first base address, the base address of each level of page table in the subsequent n-1 levels of page tables in the first secure page table is determined.

[0022] In another possible design, the above-mentioned "obtaining the first base address" specifically includes: if the first process is a secure process, then obtaining the first base address from the register corresponding to the secure process; or, if the first process is an insecure process, then obtaining the first base address from the register corresponding to the insecure process.

[0023] This possible design improves system security by using different registers to store the page table base addresses of secure and insecure processes.

[0024] In another possible design approach, the above method also includes: if any level of page table in the first safe page table is not within the safe region, then the memory access is terminated.

[0025] With this possible design, since the processor performs a validity check on the last-level page table of the safe page table during the creation of the safe page table for the process and stores the safe page table in a safe region of memory, when the processor needs to access memory during the execution of the first process, it only needs to determine that any level of the safe page table is not in a safe region of memory to directly terminate the memory access. This eliminates the need to translate the virtual address of the first process into a physical address, perform a security check on that physical address, and then determine whether to terminate the access. The method provided in this application significantly reduces the overhead of the processor accessing memory when running processes and improves system performance.

[0026] Thirdly, this application provides an apparatus for creating a security page table. This apparatus is used to execute any of the methods provided in the first aspect. This application can divide the apparatus for creating a security page table into functional modules according to any of the methods provided in the first aspect. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. For example, this application can divide the apparatus for creating a security page table into allocation units and creation units, etc., according to function. The descriptions of possible technical solutions and beneficial effects of the various functional modules described above can be found in the technical solutions provided in the first aspect or its corresponding possible designs, and will not be repeated here.

[0027] Fourthly, this application provides an apparatus for accessing memory. This memory access apparatus is used to execute any of the methods provided in the second aspect above. This application can divide the memory access apparatus into functional modules according to any of the methods provided in the second aspect above. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. For example, this application can divide the memory access apparatus into a determining unit and an accessing unit, etc., according to function. The descriptions of possible technical solutions and beneficial effects executed by the aforementioned functional modules can refer to the technical solutions provided in the second aspect above or its corresponding possible designs, and will not be repeated here.

[0028] Fifthly, this application provides a processor for invoking computer instructions stored in memory to perform any method provided by any possible implementation of the first or second aspect described above.

[0029] Sixthly, this application provides a computer-readable storage medium, such as a non-transient computer-readable storage medium. A computer program (or instructions) is stored thereon, which, when executed on a processor, causes the processor to perform any method provided by any possible implementation of the first or second aspect described above.

[0030] In a seventh aspect, this application provides a computer program product that, when run on a processor, causes any method provided by any possible implementation of the first or second aspect to be executed.

[0031] Eighthly, this application provides a chip system comprising: a processor, the processor being configured to retrieve and execute a computer program stored in a memory, performing any method provided in the implementation of the first aspect or the second aspect.

[0032] It is understood that any of the devices, computer storage media, computer program products or chip systems provided above can be applied to the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0033] In this application, the names of the means for creating security page tables and the means for accessing memory do not limit the devices or functional modules themselves. In actual implementation, these devices or functional modules may appear under other names. As long as the functions of each device or functional module are similar to those in this application, they fall within the scope of the claims of this application and their equivalents.

[0034] These or other aspects of this application will become more readily apparent in the following description. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of a security bitmap stored in a secure region of memory in the prior art;

[0036] Figure 2 A schematic diagram illustrating the page table translation provided in this application embodiment;

[0037] Figure 3 A schematic diagram of the structure of a computer device provided in an embodiment of this application;

[0038] Figure 4 A schematic diagram of a processor provided in an embodiment of this application;

[0039] Figure 5 This is a schematic diagram of another processor structure provided in an embodiment of this application;

[0040] Figure 6 A schematic diagram showing the start and end addresses of the region used to store the security page table within the secure area of ​​memory provided in an embodiment of this application;

[0041] Figure 7 A schematic diagram of a secure page table area and a secure bitmap area in a secure region of a memory provided in an embodiment of this application;

[0042] Figure 8 This is a schematic flowchart illustrating the method for creating a security page table provided in an embodiment of this application.

[0043] Figure 9 This is a schematic flowchart of a method for accessing memory provided in an embodiment of this application;

[0044] Figure 10 This is a schematic diagram illustrating a method for accessing memory provided in an embodiment of this application;

[0045] Figure 11 A schematic diagram illustrating the beneficial effects of the method for creating a secure page table and accessing memory provided in the embodiments of this application;

[0046] Figure 12 A schematic diagram of the apparatus for creating a security page table provided in an embodiment of this application;

[0047] Figure 13 A schematic diagram of the structure of a memory access device provided in an embodiment of this application;

[0048] Figure 14 This is a schematic diagram of the structure of a chip system provided in an embodiment of this application;

[0049] Figure 15 This is a schematic diagram of the structure of a computer program product provided in an embodiment of this application. Detailed Implementation

[0050] To better understand the embodiments of this application, some terms or technologies involved in the embodiments of this application are explained below:

[0051] 1) Security Process

[0052] A process is an instance of a running program (such as an application, app).

[0053] A secure process is a process with high security privileges. When a secure process runs, its virtual memory and physical memory are exclusively isolated, thus ensuring the security of the process.

[0054] In contrast, processes with lower security privileges can be called insecure processes, or ordinary processes. Multiple insecure processes can share virtual and physical memory.

[0055] 2) Page Table

[0056] A page table is a special data structure, typically located in the page table area of ​​system memory, used to represent the mapping between a process's virtual address (VA) and its physical address (PA) in memory. This allows the processor to index the physical address using the page table corresponding to that process when translating the virtual address into a physical address. The virtual address can also be called the logical address.

[0057] It should be noted that each process has its own page table.

[0058] In the embodiments of this application, the page table corresponding to the process can be an n-level page table, where n is a positive integer.

[0059] For example, a page table can be a two-level page table, in which case the two-level page table includes the first-level page table and the second-level page table. As another example, a page table can be a four-level page table, including the first-level page table, the second-level page table, the third-level page table, and the fourth-level page table.

[0060] It should be understood that each level of a multi-level page table is essentially a physical page. Each level of the page table includes multiple entries.

[0061] As an example, taking a four-level page table as an example, in this four-level page table, the first-level page table (i.e., level 1) includes multiple entries, one of which can be used to indicate the base address of the second-level page table. The second-level page table (i.e., level 2) includes multiple entries, one of which can be used to indicate the base address of the third-level page table. The third-level page table (i.e., level 3) includes multiple entries, one of which can be used to indicate the base address of the fourth-level page table. The fourth-level page table (i.e., level 4) includes multiple entries, one of which can be used to indicate the base address of the physical page.

[0062] As an example, taking the x86 operating system, the first-level page table mentioned above can be a page maplevel 4 (PML4), the second-level page table mentioned above can be a page directory pointer table (PDPT), the third-level page table mentioned above can be a page directory (PD), and the fourth-level page table mentioned above can be a page table (PT).

[0063] 3) Page table translation

[0064] When a process needs to access memory while the processor's core is running a process, the core usually sends the process's virtual address to the memory management unit (MMU). The MMU then translates the process's virtual address into a physical memory address based on the page table corresponding to that process. This process is called page table translation.

[0065] The following is combined Figure 2 Taking the above page table as a 4-level page table and the physical page size as 4k as an example, the process of the MMU converting the virtual address of a process into the physical address of memory will be briefly explained.

[0066] refer to Figure 2 , Figure 2 An exemplary diagram illustrates the address translation performed by the MMU on the four-level page tables in the x86 operating system. For example... Figure 2 As shown, when the processing core in the processor starts running process 1, the processing core can write the base address of the PML4 corresponding to the process into the control register CR3.

[0067] When the processing core needs to access memory during the execution of process 1, and the physical page of memory it wants to access is not found in the cache (i.e., the physical page does not exist in the cache), the processing core sends the virtual address 20 of process 1 to the MMU.

[0068] In the x86 operating system, this virtual address 20 can include 64 bits. Typically, the high 12 bits (i.e., ...) of these 64 bits... Figure 2 The virtual address segment 201 shown has no actual meaning and can be called an invalid bit.

[0069] Thus, the effective address bits of virtual address 20 include the lower 48 bits, specifically including... Figure 2The virtual address segments 202, 203, 204, 205, and 206 are shown. Virtual address segment 202 represents the PML4 entry index (the first-level page table entry index), virtual address segment 203 represents the PDPT entry index (the second-level page table entry index), virtual address segment 204 represents the PD entry index (the third-level page table entry index), virtual address segment 205 represents the PT entry index (the fourth-level page table entry index), and virtual address segment 206 represents the page offset.

[0070] It should be understood that the MMU is typically located within the aforementioned processor. In a processor comprising multiple processing cores, the processor may include multiple MMUs, with each MMU corresponding one-to-one with a processing core. Alternatively, in a processor comprising multiple processing cores, the processor may include one MMU, meaning the multiple processing cores share this single MMU. This application does not specifically limit the scope of the embodiments described herein.

[0071] Next, as Figure 2 As shown, the MMU obtains the base address of PML4 from CR3 register 211 and reads the physical page 212 representing PML4 from memory based on this base address. Then, the MMU sets bits 39 to 47 of the aforementioned virtual address (as shown in the image) Figure 2 The virtual address segment 202 shown is added to the base address of the obtained PML4 to obtain the entry in the PML4 used to indicate the base address of the PDPT. The content of this entry is the base address of the PDPT.

[0072] Next, the MMU reads the physical page 213 representing the PDPT from memory based on the base address of the PDPT. Then, the MMU reads bits 30 to 38 of the aforementioned virtual address (e.g., ... Figure 2 The virtual address segment 203 shown is added to the base address of the PDPT to obtain the entry in the PDPT that indicates the base address of the PD. The content of this entry is the base address of the PD.

[0073] Next, the MMU reads the physical page 214 representing the PD from memory based on the PD's base address. Then, the MMU stores bits 21 to 29 of the aforementioned virtual address (e.g., ...). Figure 2 The virtual address segment 204 shown is added to the base address of the PD to obtain the entry in the PD that indicates the base address of the PT. The content of this entry is the base address of the PT.

[0074] Next, the MMU reads the physical page 215 representing the PT from memory based on the base address of the PT. Then, the MMU stores bits 12 to 20 of the aforementioned virtual address (e.g., ... Figure 2 The virtual address segment 205 shown is added to the base address of the PT to obtain the entry in the PT that indicates the base address of the page. Here, "page" refers to a physical page, and the content in this entry is the base address of the physical page.

[0075] Next, the MMU right-shifts the base address of the physical page by 12 bits to obtain the physical page number (PPN). Then, the MMU modifies bits 0 to 11 of the aforementioned virtual address (e.g., ...) Figure 2 The virtual address range 206 shown is added to the PPN to obtain the physical address corresponding to the virtual address. That is, the MMU completes the conversion of the virtual address to the physical address.

[0076] 4) Run firmware

[0077] Runtime firmware, also known as security firmware, is a set of software code that has the highest privilege level during the operation of the operating system.

[0078] 5) Microcode

[0079] Microcode, also known as microinstruction, is a collection of instructions. A set of instructions executed consecutively is called a microcode.

[0080] Microcode is typically written during the processor's design phase and stored in read-only memory (ROM) or a programmable logic array (PLA). Some machines may also store microcode in static random access memory (SRAM) or flash memory. Microcode is generally invisible and unmodifiable to ordinary programmers, and even assembly language programmers, who use the processor containing it.

[0081] 6) Safe Zone

[0082] A secure region is a region in memory where data stored in a secure region can only be written to by software (such as firmware) or microcode with the highest privilege level.

[0083] Typically, a secure region is a block of memory designated as a secure region by the operating system's boot firmware when the operating system starts up.

[0084] 7) Safety bitmap

[0085] A security bitmap is created when the firmware allocates a segment of memory from a secure region in memory and initializes its contents during operating system initialization. The security bitmap includes multiple tags, each corresponding to a physical page in memory. The tag's value indicates whether the physical page corresponding to that tag has been allocated to a secure process for use as secure space.

[0086] Specifically, when the tag value is the first value, it indicates that the physical page corresponding to that tag has not yet been allocated to any process, or that the physical page corresponding to that tag has not been allocated to any secure process as a secure space, or that the physical page corresponding to that tag has been allocated to at least one process as a non-secure space. It can be seen that multiple processes can share a single physical page used as a non-secure space. Of course, at any given time, a physical page can only be used by one process.

[0087] When the tag value is the second value, it means that the physical page corresponding to the tag has been allocated to a secure process (e.g., process 1) for use in the secure space. In this case, the physical page cannot be allocated to any process other than process 1.

[0088] As can be seen, by assigning different values ​​to the tags corresponding to physical pages, physical pages can be dynamically allocated to processes running on the processor, thus allowing them to be used as either secure or insecure spaces. It can also be seen that when a physical page is used as the secure space for a specific secure process, that physical page cannot be used as the insecure space for other processes. These other processes can be either secure or insecure.

[0089] As an example, the first and second values ​​mentioned above can be represented by one bit. For instance, the first value can be "0", in which case the second value is "1". Of course, the first value can be "1", in which case the second value is "0". Naturally, the first and second values ​​mentioned above can be represented by two or more bits, and this application embodiment does not limit this.

[0090] Understandably, when the firmware initializes the content of the memory used to store the security bitmap (the aforementioned "allocating a segment of memory from the security region in memory"), the values ​​of the tags in the security bitmap are all set to the first value.

[0091] During the operation of the operating system, the value of the tag in the security bitmap can be reset by running firmware or microcode.

[0092] In the following description of the embodiments of this application, the first value and the second value are represented by 1 bit as an example.

[0093] 8) Falling into

[0094] Traps typically refer to operations in computer operating systems that allow a process running in user mode to call the operating system kernel program, or for a kernel program to call a program with a higher privilege level.

[0095] 9) Other terms

[0096] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0097] In the embodiments of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0098] In this application, the term "at least one" means one or more, and the term "multiple" means two or more. For example, multiple second messages refer to two or more second messages. The terms "system" and "network" are often used interchangeably in this document.

[0099] It should be understood that the terminology used in the description of the various examples herein is for the purpose of describing particular examples only and is not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms “a” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0100] It should also be understood that, in the various embodiments of this application, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0101] It should be understood that determining B based on A does not mean determining B solely based on A; B can also be determined based on A and / or other information.

[0102] It should also be understood that the term “comprising” (also referred to as “includes”, “including”, “comprises” and / or “comprising”) as used in this specification specifies the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0103] It should also be understood that the term "if" can be interpreted as meaning "when" or "upon" or "in response to determination" or "in response to detection." Similarly, depending on the context, the phrases "if determination..." or "if detection [the stated condition or event]" can be interpreted as meaning "when determination..." or "in response to determination..." or "when detection [the stated condition or event]" or "in response to detection [the stated condition or event]."

[0104] It should be understood that the phrases "an embodiment," "an embodiment," and "a possible implementation" used throughout the specification mean that a specific feature, structure, or characteristic related to an embodiment or implementation is included in at least one embodiment of this application. Therefore, the phrases "in an embodiment," "an embodiment," or "a possible implementation" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments.

[0105] This application provides a method for creating a secure page table. This method can create a secure page table for a process. During the creation process, the processor performs a validity check on the physical page mapped by the last-level page table in the secure page table to determine whether the physical page can be used by the process. The created secure page table for the process is then written into a secure region.

[0106] Then, the memory access method provided in this application embodiment, when accessing memory during the processor's running process, determines that the base address of each level of the process's security page table is within the security region used to store the security page table. This means that the processor can translate the virtual address of the process into the physical address and access the physical address.

[0107] Therefore, the method provided in this application embodiment can achieve memory isolation at the page level. Furthermore, it eliminates the need to perform a security check on the physical page indicated by the physical address after indexing it through the process's page table, based on the security bitmap stored in the secure region of memory. Additionally, since the processor determines whether the base address of each level of the secure page table is within the secure region used to store the secure page table through hardware, the processor achieves zero runtime overhead. Therefore, compared to the prior art, the method provided in this application embodiment significantly reduces the overhead of the processor accessing memory when running processes.

[0108] This application also provides an apparatus for creating a security page table, which can be applied to a terminal. Specifically, the terminal can be a portable device such as a mobile phone, tablet computer, or wearable electronic device; it can also be a computing device such as a personal computer (PC), personal digital assistant (PDA), or netbook; or it can be any other terminal device capable of implementing the embodiments of this application, and this application does not limit it in this regard. Of course, the apparatus can also be applied to a server.

[0109] This application also provides a device for accessing memory, which can be applied to a terminal or a server. The terminal is described above and will not be repeated here.

[0110] refer to Figure 3 Taking the aforementioned terminal as a computer device as an example, Figure 3 A schematic diagram of the structure of a computer device 30 is shown. For example... Figure 3 As shown, the computer device 30 includes a processor 301, a memory 302, a communication interface 303, and a bus 304. The processor 301, memory 302, and communication interface 303 are connected via the bus 304. The aforementioned means for creating a security page table can be applied to the processor 301 in the computer device 30, and the aforementioned means for accessing memory can also be applied to the processor 301 in the computer device 30; there is no limitation on this.

[0111] The processor 301 is the control center of the computer device 30. It can be a general-purpose central processing unit (CPU) or other general-purpose processors. The general-purpose processor can be a microprocessor or any conventional processor.

[0112] As an example, processor 301 may include one or more CPUs, for example Figure 3 CPU 0 and CPU 1 are shown in the diagram.

[0113] refer to Figure 4 , Figure 4 A schematic diagram of a CPU structure provided in an embodiment of this application is shown. Figure 4 As shown, CPU 40 may include a processing core 41, a memory management unit 42, a page table base address register 43, a safe memory range base address register 44, a safe memory range final address register 45, and an address comparator 46.

[0114] The processing core 41 is used to run the application process. The memory management unit 42 is used to translate the virtual address of the process into a physical address when the processing core 41 needs to access memory during the execution of the process. Here, this embodiment of the application does not specifically limit the number of processing cores 41 and memory management units 42.

[0115] Page table base address register 43 is used to store the base address of the page table corresponding to the process currently running on processor core 41. More precisely, page table base address register 43 is used to store the base address of the first-level page table in the page table corresponding to the process currently running on processor core 41.

[0116] Normally, when the processing core 41 starts running a process, the processing core 41 writes the base address of the page table corresponding to that process into the page table base address register 43.

[0117] Optional, such as Figure 5 As shown, the page table base address register 43 may include a non-secure process page table base address register 531 and a secure process page table base address register 532.

[0118] The base address register 531 for the page table of the insecure process is used to store the base address of the page table corresponding to the insecure process currently running on the processing core 41.

[0119] The secure process page table base address register 532 is used to store the base address of the page table corresponding to the secure process currently running on the processing core 41.

[0120] In this case, such as Figure 5 As shown, CPU 40 may also include a base address selection register 57. The base address selection register 57 is used to indicate whether the process currently running on processing core 41 is a safe process or a non-safe process. In this way, memory management unit 42 can obtain the base address of the page table corresponding to the process from the corresponding register based on whether the process currently running on processing core 41 is a safe process or a non-safe process, and thus can translate the virtual address of the process into the corresponding physical address based on that base address.

[0121] As an example, when processing core 41 writes a "0" to the base address selection register 57, it indicates that the process currently running by processing core 41 is an insecure process. When processing core 41 writes a "1" to the base address selection register 57, it indicates that the process currently running by processing core 41 is a secure process. Alternatively, when processing core 41 writes a "1" to the base address selection register 57, it indicates that the process currently running by processing core 41 is an insecure process. When processing core 41 writes a "0" to the base address selection register 57, it indicates that the process currently running by processing core 41 is a secure process. This embodiment of the application does not limit this.

[0122] like Figure 4 As shown, the secure memory region base address register 44 is used to indicate the base address (or start address) of the region in the secure memory region used to store the secure page table. The secure memory region end address register 45 is used to indicate the end address (or end address) of the region in the secure memory region used to store the secure page table.

[0123] In this embodiment, the security page table is the page table created for the process running on the processor. This security page table can be an n-level page table, and it is typically stored in a secure region of memory. This ensures the security of the security page table.

[0124] As an example, see reference Figure 6 , Figure 6 This diagram illustrates the start and end addresses of the region within a secure memory area used to store secure page tables. Figure 6 As shown, memory 60 includes a secure region 61. Within secure region 61, the area storing secure page tables is called the secure page table area 611. Therefore, the address of the starting point A of the secure page table area 611 is the starting address of the secure page table area 611, and the address of the ending point B of the secure page table area 611 is the ending address of the secure page table area 611. Figure 6 As can be seen from (a) in the diagram, the security page table area 611 is located in the middle area of ​​the security region 61. (From...) Figure 6 As can be seen from (b) in the diagram, the security page table area 611 is located in the left region of the security area 61, and its starting address is the same as the starting address of the security area 61.

[0125] like Figure 4 As shown, the address comparator 46 is used to perform a security check on the base address of each level of the page table in the security page table during the process of the memory management unit 42 translating the virtual address of the process running on the processing core 41 into a physical address, so as to determine whether each level of the page table indicated by the base address of each level of the page table is within the security region.

[0126] Specifically, the address comparator 46 can determine whether each level of page table is within the safe region by comparing the base address of each level of page table (i.e., the base address of the physical page of each level of page table) with the base address stored in the safe memory region base address register 44, and by comparing the termination address of each level of page table (i.e., the termination address of the physical page of each level of page table) with the termination address stored in the safe memory region termination address register 45.

[0127] The memory 302 may be a read-only memory or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0128] In one possible implementation, the memory 302 can exist independently of the processor 301. The memory 302 can be connected to the processor 301 via a bus 304 and is used to store data, instructions, or program code. When the processor 301 calls and executes the instructions or program code stored in the memory 302, it can implement the method for creating a secure page table and accessing memory provided in the embodiments of this application.

[0129] In another possible implementation, the memory 302 can also be integrated with the processor 301.

[0130] It should be understood that if memory 302 is used as memory, the security page table and security bitmap provided in this application embodiment are both stored in the security area of ​​memory 302.

[0131] As an example, such as Figure 7 As shown, the memory 302 includes a secure region 71. The secure region 71 includes a secure page table area 711 for storing secure page tables and a secure bitmap area 712 for storing secure bitmaps.

[0132] The communication interface 303 is used for connecting the computer device 30 to other devices (such as servers) via a communication network, which may be Ethernet, radio access network (RAN), wireless local area network (WLAN), etc. The communication interface 303 may include a receiving unit for receiving data and a transmitting unit for sending data.

[0133] Bus 304 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 3 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0134] It should be pointed out that, Figure 3 The structure shown does not constitute a limitation on the computer device 30, except... Figure 3 In addition to the components shown, the computer device 30 may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0135] The methods for creating secure page tables and accessing memory provided in the embodiments of this application will be described below with reference to the accompanying drawings.

[0136] Example 1

[0137] refer to Figure 8 , Figure 8 This paper illustrates a flowchart of a method for creating a security page table according to an embodiment of this application. This method can be applied to... Figure 3 The method, using a processor in the computer device shown, may include the following steps:

[0138] S101. The processor creates a first n-1 level page table for the first process, where the first safe page table is an n-level page table.

[0139] The first process runs on the processor, and the first security page table is used to convert the virtual address of the first process into a physical address when the processor needs to access memory during the execution of the first process.

[0140] In the first possible scenario, the processor needs to create a security page table for the first process when it starts the first process.

[0141] Optionally, the processor can create the first n-1 levels of page tables for this first secure page table through the kernel.

[0142] The following example illustrates how the processor creates a 4-level page table as the first process, and provides a brief explanation of the first three levels of page tables created by the processor through the kernel.

[0143] The processor can first create the first-level page table by calling the first-level page table creation function. For example, the first-level page table creation function could be the `level1_alloc()` function. Specifically, the processor can allocate a free physical page 1 through the kernel and write the base address of physical page 1 into the page table address register. Then, the processor, through the kernel, adds the index of the first-level page table entry in the virtual address of the first process to the base address of physical page 1 to determine the entry 1 used to indicate the base address of the second-level page table. In this way, physical page 1 becomes the first-level page table of the four-level page table.

[0144] The processor then creates the second-level page table by calling the second-level page table creation function. For example, the second-level page table creation function could be the `level12_alloc()` function. Specifically, the processor can allocate a free physical page 2 through the kernel and write the base address of physical page 2 into entry 1 of the first-level page table. Then, the processor, through the kernel, adds the index of the second-level page table entry in the virtual address space of the first process to the base address of physical page 2 to determine entry 2 used to indicate the base address of the third-level page table. In this way, physical page 2 becomes the second-level page table of the four-level page table.

[0145] Then, the processor creates the third-level page table by calling the `pde_alloc()` function. For example, the third-level page table creation function could be `level3_alloc()`. Specifically, the processor can allocate a free physical page 3 through the kernel and write the base address of physical page 3 into entry 2 of the second-level page table. Then, the processor, through the kernel, adds the index of the third-level page table entry in the virtual address space of the first process to the base address of physical page 3 to determine the entry 3 used to indicate the base address of the fourth-level page table. In this way, physical page 3 becomes the third-level page table of the four-level page table.

[0146] In the second possible scenario, the processor encounters a page fault exception while running the first process. This indicates a page fault in the first safe page table corresponding to the first process, requiring the processor to recreate the page from the first safe page table via the kernel.

[0147] In this way, the processor can perform page fault handling through the kernel and create the missing first-level or multi-level page tables for the first process's first safe page table, where the missing first-level or multi-level page tables are the first n-1 levels of the first safe page table.

[0148] The description of how the processor creates the missing level one or more page tables for the first safe page table through the kernel can be found in the description of the processor creating any level of page table in the first n-1 level page tables of the first safe page table in the first possible case above, which will not be repeated here.

[0149] S102, the processor allocates a first physical page to the first process, and based on the first physical page, creates an nth-level page table of the first security page table, and writes the first security page table into the first security region.

[0150] The nth level page table is the last level page table in the first security page table.

[0151] Specifically, the processor can create an nth-level page table by calling a fourth-level page table creation function, such as creating a fourth-level page table within a 4-level security page table. In this case, the processor can allocate a first physical page through the kernel; this first physical page can be a free physical page. Then, the processor can check the validity of the first physical page through a preset module.

[0152] Specifically, if the validity check indicates that the first physical page has not been allocated to any secure process for use as a secure space, the processor creates an nth-level page table based on the first physical page using a preset module. If the validity check indicates that the first physical page has already been allocated to any secure process for use as a secure space, the processor determines that creating the nth-level page table has failed.

[0153] Specifically, the process of the processor checking the validity of the first physical page through a preset module and creating the nth-level page table based on the result of the validity check is explained below.

[0154] In the first possible implementation, when the fourth-level page table creation function instructs the running firmware to perform a validity check on the first physical page (e.g., the fourth-level page table creation function could be "level14_pt_page()"), the processor can enter the highest privilege level after allocating the first physical page through the kernel. That is, the processor can check the validity of the first physical page through the running firmware. In this case, the aforementioned preset module includes the running firmware.

[0155] refer to Figure 8 The processor, based on the first physical page, creates the nth-level page table by running firmware, and checks the validity of the first physical page through the following steps:

[0156] S1021, The processor reads the first tag corresponding to the first physical page in the security bitmap by running the firmware.

[0157] Specifically, the processor can determine the first tag corresponding to the first physical page in the security bitmap by running the firmware based on the base address of the first physical page.

[0158] Typically, in a secure bitmap, a tag is written to the second secure region of memory in bytes, that is, a tag is written to the second secure region of memory in 8-bit units.

[0159] For example, consider a 48-bit representation of the base address of a physical page in memory, where each physical page is 4KB in size. In this case, the lower 12 bits of these 48 bits can be used to represent a physical page. Therefore, the processor can right-shift the base address of the first physical page by 12 bits using firmware, thus obtaining the PPN of the first physical page. Next, the processor can right-shift the PPN of the first physical page by 3 bits using firmware to determine the position of the byte containing the first tag corresponding to the first physical page in the security bitmap. Then, based on the value of the lower three bits of the first physical page's PPN, the processor can determine the bit position of the first tag within that byte. For example, if the lower three bits are 100 (i.e., a value of 4), it indicates that the first tag is the fifth bit in that byte, and the value of this fifth bit is the value of the first tag.

[0160] S1022. The processor determines whether the value of the first tag is the first value by running the firmware.

[0161] When the processor determines through firmware execution that the value of the first tag is not the first value, i.e., the value of the first tag is the second value, the processor executes step S1023. When the processor determines through firmware execution that the value of the first tag is the first value, the processor executes steps S1024-S1028.

[0162] S1023, The processor determines that the creation of the nth level page table failed by running the firmware.

[0163] Since the first tag is not the first value (i.e., the first tag is the second value), it means that the first physical page has already been allocated to any secure process for use as a secure space. Therefore, the first physical page cannot be allocated to any other process. Thus, the processor can determine that the nth page table creation failed by running the firmware.

[0164] S1024. Based on the first physical page, the processor creates an nth-level page table by running firmware and writes a first secure page table including the nth-level page table into the first secure region.

[0165] When the value of the first tag is the first value, it indicates that the first physical page has not yet been allocated for use by a secure process, or that the first physical page has been allocated to any secure process for use as a non-secure space. In this case, the processor can create an nth-level page table based on the first physical page by running the firmware, and write a first secure page table including this nth-level page table into the first secure region.

[0166] Specifically, the explanation of how the processor creates the nth level page table by running the firmware can be found in the description of the processor creating any level page table in the first security page table through the kernel in S101 above, which will not be repeated here.

[0167] Specifically, the processor adds the base address of the nth-level page table to the index of the fourth-level page table entry in the virtual address of the first process by running firmware to determine entry 4, which indicates the base address of the first physical page. Then, the processor writes the base address of the first physical page into entry 4 of the nth-level page table by running firmware, thereby completing the mapping between the virtual address of the first process and the first physical page.

[0168] Once the processor has created the nth-level page table by running the firmware, it writes the first secure page table, which includes the nth-level page table, into the first secure region.

[0169] S1025. The processor determines whether the first process is a safe process by running the firmware.

[0170] In one possible implementation, the processor can run firmware, according to... Figure 5 The state of the base address selection register 57 shown determines whether the first process is a safe process or an unsafe process.

[0171] For example, when the state of the base address selection register 57 is "0", the processor determines that the first process is an unsafe process by running the firmware; when the state of the base address selection register 57 is "1", the processor determines that the first process is a safe process by running the firmware.

[0172] In another possible implementation, the processor can determine whether the first process is a secure process or a non-secure process by running firmware based on the first process's identity document (ID).

[0173] For example, if the ID of the first process is "0", the processor determines that the first process is an insecure process by running the firmware; if the ID of the first process is "1", the processor determines that the first process is a secure process by running the firmware.

[0174] When the first process is a secure process, the processor executes S1026 by running the firmware; when the first process is a non-secure process, the processor executes S1028 by running the firmware.

[0175] S1026. The processor determines whether the virtual space pointed to by the virtual address of the first process is a secure virtual space by running the firmware.

[0176] Typically, when a processor runs a secure process, the virtual address of that secure process points to either a secure virtual space or a non-secure virtual space.

[0177] Specifically, if the virtual address of the secure process points to a secure virtual space, then the first physical page mapped to that virtual address through the first secure page table is used as the secure space for the first process. In this case, the first physical page cannot be allocated to other processes.

[0178] If the virtual address of the secure process points to a non-secure virtual space, then the first physical page mapped to that virtual address through the first secure page table is used as the non-secure space of the first process. In this case, the first physical page can also be allocated to other processes.

[0179] Therefore, the processor can determine whether the virtual space corresponding to the virtual address of the first process is a secure virtual space by running firmware and according to a preset correspondence.

[0180] The preset correspondence is established by the designers when designing the program code, so the firmware can know it in advance.

[0181] If the virtual address of the first process points to a secure virtual space, the first physical page cannot be allocated to other processes. In this case, the processor executes S1027 by running the firmware. If the virtual address of the first process points to a non-secure virtual space, the first physical page can still be allocated to other processes. In this case, the processor executes S1028 by running the firmware.

[0182] S1027. The processor sets the first tag corresponding to the first physical page to the second value by running the firmware.

[0183] Specifically, by running firmware, the processor sets the bit representing the first tag corresponding to the first physical page in the security bitmap of the second security region stored in the security region of memory to a second value, such as "1".

[0184] S1028, The processor sets the first tag corresponding to the first physical page to the first value by running the firmware.

[0185] Specifically, by running firmware, the processor sets the bit representing the first tag corresponding to the first physical page in the security bitmap of the second security region stored in the security region of memory to a first value, such as "0".

[0186] In the second possible implementation, when the fourth-level page table creation function instructs the invocation of a preset microcode to perform a validity check on the first physical page (for example, the fourth-level page table creation function could be "pte_alloc()"), the processor can check the validity of the first physical page by invoking the preset microcode after allocating it through the kernel. In this case, the aforementioned preset module includes the preset microcode.

[0187] Thus, the processor can create the nth-level page table based on the first physical page, and check the validity of the first physical page, through instructions in the preset microcode.

[0188] For example, the preset microcode could be WR_SEC_PT. The preset microcode "WR_SEC_PT" could include the following instructions:

[0189] First command: GET TAG, PA;

[0190] The first instruction is used to instruct the processor to read the first tag corresponding to the first physical page. The process of reading the first tag can be referred to the description of S1021 above, and will not be repeated here.

[0191] Second instruction: CMP TAG, first value;

[0192] The second instruction is used by the processor to determine whether the first tag is the first value. If the first tag is not the first value, that is, if the first tag is the second value, the processor determines that the creation of the nth level page table has failed. If the first tag is the first value, the third instruction is executed.

[0193] Third instruction: CMP EID, 0;

[0194] The third instruction is used by the processor to determine whether the first process is a safe process. Here, the processor can determine whether the first process is a safe process by its ID.

[0195] If the processor determines that the first process is a safe process based on the third instruction, it executes the fourth instruction below; if the processor determines that the first process is an unsafe process based on the third instruction, it executes the sixth instruction group below.

[0196] Fourth instruction: CMP VA, SECVARANGE;

[0197] The fourth instruction is used by the processor to determine whether the virtual space pointed to by the virtual address of the first process is a safe virtual space. If it is, the processor executes the fifth instruction group below; if not, it executes the sixth instruction group below.

[0198] Fifth instruction group:

[0199] Instruction a1: MAP PTE, PA;

[0200] Instruction a1 instructs the processor to create a level n page table based on the first physical page. The explanation of how the processor creates the level n page table based on the first physical page can be found in the description of S1024 above, and will not be repeated here.

[0201] Instruction b1: SAVE LEVEL1E; SAVE LEVEL2E; SAVE LEVEL3E; ...; SAVE LEVELnE;

[0202] Instruction b1 is used to instruct the processor to write the first security page table (including the first-level page table to the nth-level page table) into the first security region.

[0203] Command c1: SAVE TAG, second value;

[0204] The instruction c1 instructs the processor to set the bit representing the first tag corresponding to the first physical page in the security bitmap stored in the second security region on the memory security region to the second value.

[0205] Sixth instruction group:

[0206] Instruction a2: MAP PTE, PA;

[0207] Instruction b2: SAVE LEVEL1E; SAVE LEVEL2E; SAVE LEVEL3E; ...; SAVE LEVELnE;

[0208] For an explanation of instructions a2 and b2, please refer to the descriptions of instructions a1 and b1 above; they will not be repeated here.

[0209] Execute c2: SAVE TAG, first value;

[0210] Instruction c2 is used to instruct the processor to set the bit representing the first tag corresponding to the first physical page in the security bitmap stored in the second security region on the memory security region to the first value.

[0211] As can be seen, in the second possible implementation, the processor executes the instructions of the preset microcode to implement the process described in S1021 to S1028 above.

[0212] Thus, the method for creating a secure page table provided in this application has completed the creation of the first secure page table for the first process. It can be seen that by performing a validity check on the first physical page mapped to the first secure page table during its creation process, the first physical page allocated to any secure process cannot be used by the first process, while allowing the first physical page not allocated to any secure process to be allocated to the first process. Furthermore, the tag value corresponding to the first physical page is updated and set according to the security level of the first process, thereby achieving isolation of memory used by processes with different security levels at the page granularity (physical page as the unit of granularity).

[0213] Furthermore, since the aforementioned legality checks are implemented by the processor through running firmware or microcode, and the security privilege levels of running firmware and microcode are higher than those of the kernel, and the aforementioned secure page tables are stored in a secure area of ​​memory, the page-granular memory isolation scheme provided in this application embodiment is more secure.

[0214] Example 2

[0215] refer to Figure 9 , Figure 9 A schematic flowchart of a memory access method provided in an embodiment of this application is shown. This method is implemented based on a security page table created in Embodiment 1 of this application. This method can be applied to... Figure 3 The processor in the computer device shown may include the following steps:

[0216] S201, The processor obtains the first base address.

[0217] In this system, a first process runs on the processor, and this first process corresponds to a first secure page table. Here, the first secure page table can be a secure page table created based on the method provided in Embodiment 1 above, and this first secure page table is stored in a first secure region within a memory secure region. The first base address is the base address of the first secure page table, which is also the base address of the first-level page table within the first secure page table.

[0218] For details regarding the first security page table, please refer to the description of the first security page table above; it will not be repeated here.

[0219] During the execution of the first process by the processing core in the processor, when memory access is needed, the processing core sends a memory access request to the MMU in the processor. This memory access request includes the virtual address of the first process (e.g., ...). Figure 10The virtual address 104 shown includes an invalid bit 1040, a first-level page table entry index 1041, a second-level page table entry index 1042, a third-level page table entry index 1043, a fourth-level page table entry index 1044, and a page offset ( Figure 10 (not shown in the image). Optionally, the memory access request may also include the ID of the first process.

[0220] It should be understood that when the processor starts the first process, or switches from running other processes to running the first process, the processor writes the base address of the first process's security page table, i.e., the base address of the first security page table, into the page table base address register. For example... Figure 4 The page table base address register 43 is shown in the figure.

[0221] In this way, the processor's MMU can obtain the first base address of the first secure page table from the page table base address register after receiving a memory access request.

[0222] Optionally, if the page table base address register includes a non-safe process page table base address register (e.g., Figure 5 The non-secure process page table base address register 531 shown is... Figure 10 The non-secure process page table base address register 101 and the secure process page table base address register (e.g., the secure process page table base address register) are shown. Figure 5 The security process page table base address register 532 shown is... Figure 10 If the processor writes the base address of the first secure page table to the corresponding page table base address register according to the security level of the first process (as shown in the secure process page table base address register 102), then the processor will write the base address of the first secure page table to the corresponding page table base address register.

[0223] As an example, see reference Figure 10 If the first process is an insecure process, the processor can write the base address of the first secure page table into the insecure process page table base address register 101. If the first process is a secure process, the processor can write the base address of the first secure page table into the secure process page table base address register 102.

[0224] Optionally, the processor also sets the base address selection register (e.g., based on the security level of the first process) Figure 5 The base address selection register 57 shown is... Figure 10 The state of the selection register 103 (as shown) allows it to indicate the security level of the first process.

[0225] In this way, the MMU in the processor can determine the security level of the first process by reading the state of the base address selection register, and obtain the base address of the first security page table from the corresponding base address register.

[0226] Of course, the MMU in the processor can also determine the security level of the first process by the ID of the first process included in the received memory access request, and obtain the base address of the first secure page table from the corresponding page table base address register.

[0227] As an example, see reference Figure 10 Upon receiving a memory access request from the processor core running the first process, the MMU in the processor reads the state of the selection register 103 to determine the security level of the first process. If the first process is an insecure process, the MMU obtains the base address of the first secure page table from the insecure process page table base address register 101. If the first process is a secure process, the MMU obtains the base address of the first secure page table from the secure process page table base address register 102.

[0228] S202, the MMU in the processor determines the base address of each page table in the next n-1 levels of the first secure page table based on the virtual address of the first process and the first base address, and determines whether each level of the page table in the first secure page table is in the first secure region.

[0229] Since the first base address is the base address of the first level page table of the first security page table, the MMU only needs to determine the base address of each level page table in the next n-1 levels of the first security page table.

[0230] The process by which the MMU determines the base address of each page table in the subsequent n-1 levels of the page table after the first security page table, based on the virtual address and the first base address of the first process, can be referred to the description in the page table translation above, and will not be repeated here.

[0231] In this embodiment, during the process of the MMU translating the virtual address of the first process into the corresponding physical address, the processor needs to further determine whether each level of the page table in the secure page table acquired or determined by the MMU is within the first secure region used to store the first secure page table. Here, each level of the page table is essentially a physical page. Taking the first-level page table as an example, the processor needs to determine whether the physical page representing the first-level page table (i.e., the first-level page table page) is within the first secure region used to store the first secure page table. If it is within the first secure region, the MMU can determine the base address of the second-level page table based on the base address of the first-level page table and the virtual address of the first process. If it is not within the first secure region, the MMU exits address translation, that is, the processor terminates the memory access requested by the first process.

[0232] The following is for reference. Figure 10 Taking a first-level security page table as an example, the address translation process provided in the embodiments of this application will be explained.

[0233] like Figure 10As shown, the processor has a base address register 106 and a terminal address register 107 pre-installed. For details regarding the base address register 106, please refer to [reference needed]. Figure 4 The description of the base address register 44 of the safe memory range and the final address register 107 can be found in [reference]. Figure 4 The explanation of the final address register 45 of the safe memory range in the memory is not repeated here.

[0234] It is understood that the address stored in the base address register 106 can be either the base address of the first secure region in memory used to store all secure page tables, or the base address of the secure region in memory used to store the first secure page table. Similarly, the address stored in the terminal address register 107 can be either the end address of the first secure region in memory used to store all secure page tables, or the end address of the secure region in memory used to store the first secure page table. This application embodiment does not specifically limit this.

[0235] In the embodiments of this application, the following description will be based on the example where the address stored in the base address register 106 is the base address of the first security region, and the address stored in the terminal address register 107 is the end address of the first security region.

[0236] like Figure 10 As shown, the processor also includes address comparators 1081, 1082, 1083, and 1084. Address comparator 1081 is used to determine whether the page pointed to by the base address of the first-level page table (i.e., the first base address obtained by the MMU from the page table base address register) is in the first secure region. For an explanation of how address comparator 1081 determines whether the page pointed to by the first base address is in the first secure region, please refer to the description of address comparator 46 above; it will not be repeated here.

[0237] The base address register 106 is connected to address comparators 1081, 1082, 1083 and 1084 respectively, so that address comparators 1081, 1082, 1083 and 1084 can obtain the base address of the first security region stored in the base address register 106 respectively.

[0238] The final address register 107 is connected to address comparators 1081, 1082, 1083, and 1084, respectively. In this way, address comparators 1081, 1082, 1083, and 1084 can respectively obtain the end address of the first security region stored in the final address register 107.

[0239] In this way, after the MMU in the processor obtains the first base address, it sends the first base address to the address comparator 1081. The address comparator 1081 can then determine whether the page table pointed to by the first base address is within the first secure region based on the first base address, the base address of the first secure region, and the end address of the first secure region.

[0240] If the page table pointed to by the first base address is within the first security region, the address comparator 1081 sends the first base address to the MMU. The MMU then reads the page table (i.e., the first-level page table 1051) indicated by the first base address from memory. Then, based on the first base address and the first-level page table entry index 1041, the MMU determines entry 1 in the first-level page table 1051, which indicates the second base address of the second-level page table.

[0241] If the page table pointed to by the first base address is not within the first secure region, the MMU ends the translation of the virtual address 104 of the first process, that is, the processor determines that the memory access is over.

[0242] Next, the MMU in the processor sends the second base address of the second-level page table indicated in entry 1 to the address comparator 1082. In this way, the address comparator 1082 can determine whether the page table page pointed to by the second base address is within the first security region based on the second base address, the base address of the first security region, and the end address of the first security region.

[0243] If the page table pointed to by the second base address is within the first security region, the address comparator 1082 sends the second base address to the MMU. The MMU then reads the page table indicated by the second base address (i.e., the second-level page table 1052) from memory. Then, based on the second base address and the second-level page table entry index 1042, the MMU determines entry 2 in the second-level page table 1052, which indicates the third base address of the third-level page table.

[0244] If the page table pointed to by the second base address is not within the first security region, the MMU ends the translation of the virtual address 104 of the first process, that is, the processor determines that the memory access is over.

[0245] Next, the MMU in the processor sends the third base address of the third-level page table indicated in entry 2 to the address comparator 1083. In this way, the address comparator 1083 can determine whether the page table page pointed to by the third base address is within the first security region based on the third base address, the base address of the first security region, and the end address of the first security region.

[0246] If the page table pointed to by the third base address is within the first security region, the address comparator 1082 sends the third base address to the MMU. The MMU then reads the page table indicated by the third base address (i.e., the third-level page table 1053) from memory. Then, based on the third base address and the third-level page table entry index 1043, the MMU determines entry 3 in the third-level page table 1053, which indicates the fourth base address of the fourth-level page table.

[0247] If the page table pointed to by the third base address is not within the first security region, the MMU ends the translation of the virtual address 104 of the first process, that is, the processor determines that the memory access is over.

[0248] Next, the MMU in the processor sends the fourth base address of the fourth-level page table indicated in entry 3 to the address comparator 1084. In this way, the address comparator 1084 can determine whether the page table page pointed to by the fourth base address is within the first security region based on the fourth base address, the base address of the first security region, and the end address of the first security region.

[0249] If the page table pointed to by the fourth base address is within the first security region, the address comparator 1082 sends the fourth base address to the MMU. The MMU then reads the page table indicated by the fourth base address (i.e., the fourth-level page table 1054) from memory. Then, based on the fourth base address and the fourth-level page table entry index 1044, the MMU determines entry 4 in the fourth-level page table 1054, which indicates the base address of the physical page.

[0250] If the page table pointed to by the fourth base address is not within the first security region, the MMU ends the translation of the virtual address 104 of the first process, that is, the processor determines that the memory access is over.

[0251] As can be seen, in the memory access method provided in the embodiments of this application, the processor does not need to access the security bitmap in the second security region of memory, but only needs to determine whether each level of the page table in the first security page table is located in the first security region through hardware, so it basically does not bring any additional runtime overhead.

[0252] S203. If each level of page table in the first security page table is within the first security region, then the MMU in the processor determines the physical address corresponding to the virtual address of the first process based on the base address of the nth level page table in the first security page table, and the processor accesses memory based on that physical address.

[0253] Specifically, if each level of page table in the first secure page table is within the first secure region, the MMU can determine the physical address corresponding to the virtual address of the first process based on the base address of the nth level page table in the first secure page table and the page offset in the virtual address of the first process. Then, the processor accesses memory based on this physical address.

[0254] As an example, combined Figure 10 The MMU can obtain the physical address mapped by the virtual address 104 of the first process based on the base address of the physical page indicated by entry 4 in the fourth-level page table 1054 and the page offset in the virtual address 104 of the first process. In this way, the processor can access memory based on the physical address.

[0255] Because the security page table of the first process has already undergone security checks during creation, and this security page table is stored in a secure region of memory, the processor, when performing virtual address translation (or translation) of the first process based on this security page table, does not need to additionally access the security bitmap in memory to perform the security checks as described in the background art after translating the virtual address into a physical address. Therefore, the processor reduces the overhead of additional access to the security bitmap in memory during process execution, improving system performance.

[0256] As an example, see reference Figure 11 , Figure 11 The beneficial effects of the method for creating a secure page table and accessing memory provided in the embodiments of this application are illustrated by way of example.

[0257] like Figure 11 As shown, in the prior art, if the total runtime required for a processor to access memory when running a process is t, then the time spent creating page tables (traditional page tables) for the process accounts for approximately 0.02% of the total runtime. The time the processor spends executing the process accounts for approximately 95% of the total runtime. Of this time, processor memory access (including access to main memory and cache) accounts for approximately 50%, and the cache miss rate (a cache miss, i.e., requiring memory access) accounts for approximately 10%. When accessing main memory, the additional time overhead of the processor accessing the security bitmap accounts for approximately 20%. Therefore, in the prior art, during the processor's process execution, the additional time overhead caused by accessing the security bitmap (such as...) Figure 11 The Δt1 shown is approximately 95% * 50% * 10% * 20% = 1%. In other words, during the processor's execution of a process, the additional time overhead due to accessing the security bitmap is approximately 1% * t.

[0258] When the method for creating a secure page table and accessing memory provided in this application is adopted, if the total running time required for the processor to access memory when running a certain process is t, then compared with the prior art, the time the processor spends creating a page table (the secure page table described in this application) for the process is approximately 10% longer than the time spent creating a page table for the process in the prior art. Figure 11 The example shows Δt2. However, the solution provided in this application does not incur additional time overhead for accessing the security bitmap during process execution. Therefore, the additional overhead incurred when creating the security page table (i.e., the overhead of performing a validity check on the last-level page table of the security page table) using the technical solution provided in this application is approximately 0.02% * 10% = 0.002%, or 0.002% * t. It is evident that the technical solution provided in this application significantly reduces the overhead of the processor accessing memory when running processes.

[0259] In summary, this application provides a method for creating secure page tables and accessing memory. This method achieves memory isolation at the page-level precision by using a secure bitmap. Furthermore, during the process of creating a secure page table for a process using the highest privilege level, the processor performs a validity check on the last-level page table before storing the created secure page table in a secure region of memory. Thus, when the processor needs to access memory during process execution, it only needs to determine through hardware whether each level of the secure page table is within the secure region of memory, without needing to additionally access the secure bitmap in the secure region of memory to perform a security check on the physical page indicated by the physical address translated by the MMU. This significantly reduces the overhead of the processor accessing memory during process execution and improves system performance.

[0260] The foregoing mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, it includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, based on the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0261] This application embodiment can divide the apparatus for creating a security page table and the apparatus for accessing memory into functional modules based on the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0262] like Figure 12 As shown, Figure 12 This illustration shows a schematic diagram of a device 120 for creating a security page table according to an embodiment of this application. The device 120 for creating a security page table can be applied to a processor running a first process. The device 120 can be used to execute the aforementioned method for creating a security page table, for example, to execute... Figure 8 The method is illustrated. The apparatus 120 for creating the security page table may include an allocation unit 121 and a creation unit 122.

[0263] Allocation unit 121 is used to allocate a first physical page. Creation unit 122 is used to create an nth-level page table in the first safe page table for the first process when the first physical page is not allocated to any safe process as a safe space. The first safe page table is used by the processor to translate the virtual address of the first process into a physical address when the first process accesses memory. The first safe page table is an n-level page table, where n is a positive integer.

[0264] As an example, combined Figure 8 The allocation unit 121 can be used to execute S102, and the creation unit 122 can be used to execute S1024.

[0265] Optionally, the apparatus 120 for creating a security page table further includes a determining unit 123. The determining unit 123 is configured to determine, via a preset module, that the aforementioned first physical page has not been allocated to any security process as a security space, wherein the preset module includes running firmware or preset microcode. The creating unit 122 is specifically configured to, based on the first physical page, create an nth-level page table in the first security page table for the first process via the preset module.

[0266] As an example, combined Figure 8 The determination unit 123 can be used to execute S1022, and the creation unit 122 can be used to execute S1024.

[0267] Optionally, the apparatus 120 for creating a secure page table further includes a writing unit 124. The writing unit 124 is used to write the first secure page table into a first secure region in memory via the aforementioned preset module.

[0268] As an example, combined Figure 8 The writing unit 124 can be used to execute S1024.

[0269] Optionally, the apparatus 120 for creating a security page table further includes a setting unit 125. The setting unit 125 is configured to: set the tag corresponding to the first physical page in the security bitmap to a first value when the first physical page is not allocated to any secure process as a secure space, and the first physical page is used as a non-secure space for the first process; or, when the first physical page is not allocated to any secure process as a secure space, the first process is a secure process, and the first physical page is used as a secure space for the first process, set the tag corresponding to the first physical page in the security bitmap to a second value. Wherein, for any tag in the security bitmap, if the tag takes the first value, it indicates that the physical page corresponding to that tag is not allocated to a secure process as a secure space. If the tag takes the second value, it indicates that the physical page corresponding to that tag has been allocated to a secure process as a secure space.

[0270] As an example, combined Figure 8 The setting unit 125 can be used to execute S1027 and S1028.

[0271] Optionally, the aforementioned security bitmap is stored in a second security region in memory.

[0272] Optionally, the determining unit 123 is also configured to determine that the creation of the nth level page table has failed if the first physical page described above has been allocated to any security process as a security space.

[0273] As an example, combined Figure 8 Unit 123 can be used to execute S1022 and S1023.

[0274] Optionally, the creation unit 122 is also used to create the first n-1 levels of the page table of the first security page table before the allocation unit 121 allocates the first physical page.

[0275] As an example, combined Figure 8 Unit 122 can be used to execute S101.

[0276] For a detailed description of the above-mentioned optional methods, please refer to the foregoing method embodiments, which will not be repeated here. Furthermore, the explanation of any of the above-provided apparatus 120 for creating a security page table and the description of its beneficial effects can be found in the corresponding method embodiments described above, and will not be repeated here.

[0277] As an example, combined Figure 3The allocation unit 121, creation unit 122, determination unit 123, writing unit 124, and setting unit 125 in the device 120 for creating security page tables can be... Figure 3 Processor 301 in the middle executes Figure 3 The program code is implemented in memory 302.

[0278] like Figure 13 As shown, Figure 13 A schematic diagram of a memory access device 130 provided in an embodiment of this application is shown. The memory access device 130 can be applied to a processor running a first process, the first process corresponding to a first secure page table, the first secure page table being stored in a first secure region of memory, and the first secure page table being an n-level page table (n is a positive integer). The memory access device 130 can be used to execute the above-described memory access method, for example, to execute... Figure 9 The method is shown. The memory access device 130 may include a determining unit 131 and an access unit 132.

[0279] Determining unit 131 is configured to determine whether each level of page table in the first secure page table is within the first secure region; and, if each level of page table in the first secure page table is within the first secure region, to determine the physical address corresponding to the virtual address of the first process based on the base address of the nth level page table in the first secure page table. Accessing unit 132 is configured to access memory based on the physical address determined by the determining unit.

[0280] As an example, combined Figure 9 The determining unit 131 can be used to execute S202, and the access unit 132 can be used to execute S203.

[0281] Optionally, the memory access device 130 further includes an acquisition unit 133. The acquisition unit 133 is configured to acquire a first base address before the determining unit 131 determines whether each level of page table in the first secure page table is within the first secure region. This first base address is the base address of the first level page table in the first secure page table. The determining unit 131 is further configured to determine the base address of each level of page table in the subsequent n-1 level page tables of the first secure page table based on the virtual address of the first process and the first base address acquired by the acquisition unit 133.

[0282] As an example, combined Figure 9 The acquisition unit 133 can be used to execute S201, and the determination unit 131 can be used to execute S202.

[0283] Optionally, the acquisition unit 133 is specifically used to: if the first process is a secure process, then acquire the first base address from the register corresponding to the secure process; or, if the first process is a non-secure process, then acquire the first base address from the register corresponding to the non-secure process.

[0284] As an example, combined Figure 9 The acquisition unit 133 can be used to execute S201.

[0285] Optionally, the access unit 132 is also configured to terminate memory access if any level of page table in the first secure page table is not within the secure region.

[0286] For a detailed description of the above-mentioned optional methods, please refer to the foregoing method embodiments, which will not be repeated here. Furthermore, the explanation of any of the memory access devices 130 provided above, as well as the description of their beneficial effects, can be found in the corresponding method embodiments described above, and will not be repeated here.

[0287] As an example, combined Figure 3 The determining unit 131, accessing unit 132, and obtaining unit 133 in the memory access device 130 can be used to... Figure 3 Processor 301 in the middle executes Figure 3 The program code is implemented in memory 302.

[0288] This application also provides a chip system 140, such as... Figure 14 As shown, the chip system 140 includes at least one processor and at least one interface circuit. As an example, when the chip system 140 includes a processor and an interface circuit, the processor can be... Figure 14 The processor 141 shown in the solid box (or the processor 141 shown in the dashed box) can be an interface circuit. Figure 14 The interface circuit 142 is shown in the solid box (or the dashed box). When the chip system 140 includes two processors and two interface circuits, the two processors include... Figure 14 The processor 141 shown in the solid box and the processor 141 shown in the dashed box, these two interface circuits include Figure 14 Interface circuit 142 shown in solid boxes and interface circuit 142 shown in dashed boxes. No limitations are imposed on this.

[0289] Processor 141 and interface circuit 142 can be interconnected via lines. For example, interface circuit 142 can be used to receive signals (e.g., instructions stored in memory). As another example, interface circuit 142 can be used to send signals to other devices (e.g., processor 141). Exemplarily, interface circuit 142 can read instructions stored in memory and send those instructions to processor 141. When the instruction is executed by processor 141, it can cause a device creating a security page table or a device accessing memory to perform the steps in the above embodiments. Of course, the chip system 140 may also include other discrete devices, which are not specifically limited in this application embodiment.

[0290] Another embodiment of this application also provides a computer-readable storage medium storing instructions that, when executed on a means for creating a secure page table or a means for accessing memory, perform the various steps executed by the means for creating a secure page table or the means for accessing memory in the method flow shown in the above method embodiments.

[0291] In some embodiments, the disclosed method may be implemented as computer program instructions encoded in a machine-readable format on a computer-readable storage medium or on other non-transitory media or articles of art.

[0292] Figure 15 A conceptual partial view of a computer program product provided in an embodiment of this application is shown schematically. The computer program product includes a computer program for executing computer processes on a computing device.

[0293] In one embodiment, a computer program product is provided using a signal bearer medium 150. The signal bearer medium 150 may include one or more program instructions that, when executed by one or more processors, can provide the above-mentioned... Figure 8 or Figure 9 The described function or part of the function. Therefore, for example, refer to... Figure 8 See S101 to S102, or refer to Figure 9 One or more features of S201 to S203 can be assumed by one or more instructions associated with the signal carrying medium 150. Furthermore, Figure 15 The program instructions in the document also describe example instructions.

[0294] In some examples, the signal carrying medium 150 may include a computer-readable medium 151, such as, but not limited to, a hard disk drive, a compact disc (CD), a digital video disc (DVD), a digital magnetic tape, a memory, a read-only memory (ROM), or a random access memory (RAM), etc.

[0295] In some implementations, the signal carrying medium 150 may include a computer recordable medium 152, such as, but not limited to, a memory, a read / write (R / W) CD, a R / W DVD, and so on.

[0296] In some implementations, the signal carrying medium 150 may include a communication medium 153, such as, but not limited to, digital and / or analog communication media (e.g., fiber optic cables, waveguides, wired communication links, wireless communication links, etc.).

[0297] The signal-bearing medium 150 may be transmitted by a wireless communication medium 153 (e.g., a wireless communication medium conforming to the IEEE 1502.11 standard or other transmission protocols). One or more program instructions may be, for example, computer-executable instructions or logical implementation instructions.

[0298] In some examples, such as targeting Figure 8 Devices for creating security page tables or Figure 9 The described memory access device can be configured to provide various operations, functions, or actions in response to one or more program instructions in a computer-readable medium 151, a computer-recordable medium 152, and / or a communication medium 153.

[0299] It should be understood that the arrangements described herein are for illustrative purposes only. Therefore, those skilled in the art will understand that other arrangements and other elements (e.g., machines, interfaces, functions, sequences, and functional groups, etc.) can be used instead, and some elements may be omitted depending on the desired outcome. Furthermore, many of the described elements are functional entities that can be implemented as discrete or distributed components, or in any suitable combination and location with other components.

[0300] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, it can be implemented, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer instructions. When executed on a computer and when the computer execution instructions are executed, all or part of the processes or functions according to the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.

[0301] Computer instructions can be stored in or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. A computer-readable storage medium can be any available medium that a computer can access, or it can contain one or more data storage devices such as servers or data centers that can be integrated with that medium. Available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

[0302] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for creating a security page table, characterized in that, Applied to a processor running a first process, the method includes: Allocate the first physical page; The preset module determines that the first physical page is not allocated to any security process as a security space. The preset module includes running firmware or preset microcode. Based on the first physical page, the preset module creates an nth-level page table in the first security page table for the first process; the first security page table is used by the processor to translate the virtual address of the first process into a physical address when the first process accesses memory; the first security page table is an nth-level page table, where n is a positive integer; The first security page table is written into the first security region in the memory through the preset module.

2. The method according to claim 1, characterized in that, The method further includes: If the first physical page is not allocated to any secure process as a secure space, and the first physical page is used as the non-secure space of the first process, then the tag corresponding to the first physical page in the security bitmap is set to the first value; or, When the first physical page is not allocated to any secure process as a secure space, the first process is a secure process, and the first physical page is used as the secure space of the first process, then the tag corresponding to the first physical page in the security bitmap is set to the second value. Specifically, for any tag in the security bitmap, if the value of any tag is the first value, it means that the physical page corresponding to the tag has not been allocated to the security process as a security space; if the value of any tag is the second value, it means that the physical page corresponding to the tag has been allocated to the security process as a security space.

3. The method according to claim 2, characterized in that, The security bitmap is stored in a second security region in the memory.

4. The method according to any one of claims 1-3, characterized in that, The method further includes: If the first physical page has been allocated to any secure process as a secure space, then the creation of the nth level page table is determined to have failed.

5. The method according to claim 1, characterized in that, Prior to allocating the first physical page, the method further includes: Create the first n-1 level page tables of the first security page table.

6. A method for accessing memory, characterized in that, Applied to a processor, the processor running a first process, the first process corresponding to a first security page table; The first secure page table is stored in a first secure region of the memory, and the first secure page table is an n-level page table, where n is a positive integer; the method includes: Determine whether each level of the page table in the first security page table is within the first security region; If each level of the page table in the first security page table is within the first security region, then the physical address corresponding to the virtual address of the first process is determined based on the base address of the nth level page table in the first security page table. Access the memory based on the physical address.

7. The method according to claim 6, characterized in that, Before determining whether each level of the page table in the first security page table is within the first security region, the method further includes: Obtain the first base address, which is the base address of the first-level page table in the first security page table; Based on the virtual address of the first process and the first base address, the base address of each page table in the subsequent n-1 level page tables of the first security page table is determined.

8. The method according to claim 7, characterized in that, Obtaining the first base address specifically includes: If the first process is a secure process, then the first base address is obtained from the register corresponding to the secure process; or, If the first process is an insecure process, then the first base address is obtained from the register corresponding to the insecure process.

9. The method according to any one of claims 6-8, characterized in that, The method further includes: If any level of page table in the first security page table is not within the security region, then the access to the memory is terminated.

10. An apparatus for creating a security page table, characterized in that, Applied to a processor running a first process, the device includes: The allocation unit is used to allocate the first physical page; A determining unit is configured to determine, through a preset module, that the first physical page has not been allocated to any security process as a security space, wherein the preset module includes running firmware or preset microcode; A creation unit is configured to create an nth-level page table in a first secure page table for the first process based on the first physical page, using the preset module; the first secure page table is used by the processor to translate the virtual address of the first process into a physical address when the first process accesses memory; the first secure page table is an nth-level page table, where n is a positive integer; The write unit is used to write the first secure page table into the first secure region in the memory through the preset module.

11. The apparatus according to claim 10, characterized in that, The device further includes a setting unit; the setting unit is used for: If the first physical page is not allocated to any secure process as a secure space, and the first physical page is used as the non-secure space of the first process, then the tag corresponding to the first physical page in the security bitmap is set to the first value; or, When the first physical page is not allocated to any secure process as a secure space, the first process is a secure process, and the first physical page is used as the secure space of the first process, then the tag corresponding to the first physical page in the security bitmap is set to the second value. Specifically, for any tag in the security bitmap, if the value of any tag is the first value, it means that the physical page corresponding to the tag has not been allocated to the security process as a security space; if the value of any tag is the second value, it means that the physical page corresponding to the tag has been allocated to the security process as a security space.

12. The apparatus according to claim 11, characterized in that, The security bitmap is stored in a second security region in the memory.

13. The apparatus according to any one of claims 10-12, characterized in that, The determining unit is further configured to determine that the creation of the nth level page table failed when the first physical page has been allocated to any security process as a security space.

14. The apparatus according to claim 10, characterized in that, The creation unit is further configured to create the first n-1 level page tables of the first security page table before the allocation unit allocates the first physical page.

15. A device for accessing memory, characterized in that, Applied to a processor, the processor running a first process, the first process corresponding to a first security page table; The first secure page table is stored in the first secure region of the memory, and the first secure page table is an n-level page table, where n is a positive integer; The device includes: The determining unit is configured to determine whether each level of the page table in the first security page table is within the first security region; and to determine the physical address corresponding to the virtual address of the first process based on the base address of the nth level page table in the first security page table if each level of the page table in the first security page table is within the first security region. An access unit is used to access the memory based on the physical address.

16. The apparatus according to claim 15, characterized in that, The device further includes an acquisition unit; The acquisition unit is used to acquire a first base address before the determining unit determines whether each level page table in the first security page table is in the first security region. The first base address is the base address of the first level page table in the first security page table. The determining unit is further configured to determine the base address of each level of page table in the last n-1 level page tables of the first security page table based on the virtual address of the first process and the first base address.

17. The apparatus according to claim 16, characterized in that, The acquisition unit is specifically used for: If the first process is a secure process, then the first base address is obtained from the register corresponding to the secure process; or, If the first process is an insecure process, then the first base address is obtained from the register corresponding to the insecure process.

18. The apparatus according to any one of claims 15-17, characterized in that, The access unit is further configured to terminate the access to the memory if any level of the first security page table is not within the security region.

19. A processor, characterized in that, The processor is used to invoke computer instructions stored in memory to perform the method as described in any one of claims 1 to 9.

20. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when run on a computer, causes the computer to perform the method of any one of claims 1 to 9.

Images