A memory access permission control method and device based on memory

Abstract

The present invention discloses a memory access permission control method and device based on a memory. The method comprises: calculating the regional address information of the management area according to the area in the memory that needs to be included in the memory access permission management, including the address index of the management area in the memory; determining the memory access control information, the memory access control information including the memory access control identifier of each storage unit in the management area; setting a memory access-specific identifier that matches the regional address information and the memory access control information, the memory access-specific identifier being used to indicate that the master with the memory access-specific identifier can access the memory regional address information and the memory access control information. It can be seen that the present invention can provide an open memory access permission control method based on a memory unit, dynamically configure the management regional address information and the memory access control information, realize the management of the independent memory access permission of each storage unit included in the management scope, improve the utilization efficiency of the memory, and save the use cost of the memory.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a memory access permission control method and device based on a memory. Background Art

[0002] With the rapid development of information technology, trusted computing has become a pressing need. To improve the security of computer equipment, computer system operations must be authorized and trusted. Because computing systems frequently access and store data in memory, controlling memory access permissions has become a crucial aspect of information security.

[0003] In practical applications, memory access permission control methods fall into two categories: 1) During the chip design phase, a fixed on-chip RAM area is used to mark memory access permissions, and memory access permissions are controlled through control tags in RAM; 2) A continuous area in physical memory is designated as a designated security area, and all security access operations are performed within this designated security area. As can be seen, existing memory access permission control methods all use a fixed storage area for permission control, which has poor flexibility and scalability, and reduces memory utilization efficiency. Summary of the Invention

[0004] The present invention provides a memory access permission control method and device based on a memory, which can provide an open memory access permission control method based on a storage unit, dynamically configure management area address information and memory access control information, realize the management of independent memory access permissions of each storage unit included in the management scope, and configure diversified memory access permission control strategies according to different needs, thereby improving the utilization efficiency of the memory, and can dynamically and flexibly set the management area and the storage area of ​​the area address information and memory access control information, thereby saving the use cost of the memory and improving the flexibility and scalability of the memory access control.

[0005] In order to solve the above technical problems, the first aspect of the present invention discloses a memory access permission control method based on a memory, the method comprising:

[0006] Calculating, based on the determined management area, area address information of the management area, the area address information including an address index of the management area in the memory, the management area being an area in the memory that needs to be included in memory access permission management;

[0007] Determining memory access control information associated with the management area, the memory access control information including a memory access control identifier of each storage unit in the management area;

[0008] A dedicated memory access identifier that matches the area address information and the memory access control information is set, where the dedicated memory access identifier is used to indicate that a Master with the dedicated memory access identifier can access the area address information and the memory access control information.

[0009] As an optional implementation manner, in the first aspect of the present invention, calculating the area address information of the management area according to the determined management area includes:

[0010] Calculating base address information and length information of the management area in the memory according to the determined management area;

[0011] The base address information and length information corresponding to the management area are determined as the area address information of the management area.

[0012] As an optional implementation manner, in the first aspect of the present invention, determining the memory access control information associated with the management area includes:

[0013] Determining a memory access control identifier for each storage unit in the management area according to a predetermined authority control model;

[0014] The memory access control identifiers corresponding to all the storage units are determined as the memory access control information of the management area.

[0015] As an optional embodiment, in the first aspect of the present invention, the method further comprises:

[0016] After determining the region address information and the memory access control information, cache the region address information and the memory access control information in a predetermined cache unit;

[0017] The step of caching the region address information and the memory access control information in a predetermined cache unit includes:

[0018] Determining whether the space of the cache unit is greater than or equal to the sum of the space required by the region address information and the memory access control information;

[0019] When the judgment result is yes, all the information of the area address information and the memory access control information is cached in the cache unit;

[0020] When the judgment result is no, the first cache weight value of the area address information and the second cache weight value of the memory access control information are calculated respectively, and according to the first cache weight value and the second cache weight value, the target area cache information is filtered out from the area address information and the target memory access control cache information is filtered out from the memory access control information respectively; the target area cache information and the target memory access control cache information are cached to the cache unit.

[0021] As an optional embodiment, in the first aspect of the present invention, the method further comprises:

[0022] After determining the area address information and the memory access control information, determining whether there is an overlapping area between the storage area of ​​the area address information, the storage area of ​​the memory access control information, and the management area;

[0023] When it is determined that the overlapping area exists, re-triggering the operation of calculating the area address information of the management area and the operation of determining the memory access control information associated with the management area; or

[0024] When it is determined that the overlapping area exists, the overlapping area is marked as a memory access prohibited area, and an error message is generated.

[0025] As an optional embodiment, in the first aspect of the present invention, the method further comprises:

[0026] monitoring whether a memory access control identifier of a certain storage unit needs to be changed, and when it is detected that the memory access control identifier of the storage unit needs to be changed, determining a target memory access control identifier of the storage unit that needs to be changed;

[0027] Changing the memory access control identifier corresponding to the storage unit in the memory access control information to the target memory access control identifier; or

[0028] The memory access dedicated Master changes the memory access control identifier corresponding to the storage unit in the memory access control information to the target memory access control identifier, wherein the memory access dedicated Master is the Master having the memory access dedicated identifier.

[0029] As an optional implementation manner, in the first aspect of the present invention, after setting the memory access dedicated identifier that matches the area address information and the memory access control information, the method further includes:

[0030] Determine whether a memory access command is received, where the memory access command is sent by any Master;

[0031] When it is determined that the memory access command is received, determining whether a target storage unit to be accessed by the memory access command exists in the management area;

[0032] When the judgment result is yes, it is judged whether there is content matching the memory access dedicated identifier in the memory access command;

[0033] When it is determined that the memory access command does not contain content matching the memory access dedicated identifier, the memory access command is refused to be executed.

[0034] As an optional embodiment, in the first aspect of the present invention, the method further comprises:

[0035] When it is determined that the memory access command contains content that matches the memory access dedicated identifier, determining whether the memory access control identifier corresponding to the memory access command matches the memory access control identifier corresponding to the target storage unit in the memory access control information;

[0036] When the judgment result is yes, executing the memory access command;

[0037] When the judgment result is no, the memory access command is refused to be executed.

[0038] A second aspect of the present invention discloses a memory access permission control device based on a memory, the device comprising:

[0039] a region management module, configured to calculate region address information of the management region according to the determined management region, wherein the region address information includes an address index of the management region in the memory, and the management region is a region in the memory that needs to be included in memory access permission management;

[0040] a control management module, configured to determine memory access control information associated with the management area, wherein the memory access control information includes a memory access control identifier of each storage unit in the management area;

[0041] The setting module is used to set a memory access dedicated identifier that matches the area address information and the memory access control information, and the memory access dedicated identifier is used to indicate that the Master with the memory access dedicated identifier can access the area address information and the memory access control information.

[0042] As an optional implementation manner, in the second aspect of the present invention, the area management module includes:

[0043] a calculation submodule, configured to calculate base address information and length information of the management area in the memory according to the determined management area;

[0044] The first determining submodule is configured to determine the base address information and length information corresponding to the management area as the area address information of the management area.

[0045] As an optional implementation manner, in the second aspect of the present invention, the control management module includes:

[0046] A second determining submodule is configured to determine a memory access control identifier of each storage unit in the management area according to a predetermined authority control model;

[0047] The third determining submodule is configured to determine the memory access control identifiers corresponding to all the storage units as the memory access control information of the management area.

[0048] As an optional embodiment, in the second aspect of the present invention, the device further includes:

[0049] a cache module configured to cache the region address information and the memory access control information in a predetermined cache unit after the region management module determines the region address information and the control management module determines the memory access control information;

[0050] The cache module is specifically used to:

[0051] Determining whether the space of the cache unit is greater than or equal to the sum of the space required by the region address information and the memory access control information;

[0052] When the judgment result is yes, all the information of the area address information and the memory access control information is cached in the cache unit;

[0053] When the judgment result is no, the first cache weight value of the area address information and the second cache weight value of the memory access control information are calculated respectively, and according to the first cache weight value and the second cache weight value, the target area cache information is filtered out from the area address information and the target memory access control cache information is filtered out from the memory access control information respectively; the target area cache information and the target memory access control cache information are cached to the cache unit.

[0054] As an optional embodiment, in the second aspect of the present invention, the device further includes:

[0055] a conflict detection module configured to determine, after the area management module determines the area address information and the control management module determines the memory access control information, whether there is an overlapping area between the storage area of ​​the area address information, the storage area of ​​the memory access control information, and the management area; and, when it is determined that there is an overlapping area, re-trigger the area management module to perform the operation of calculating the area address information of the management area and the control management module to perform the operation of determining the memory access control information associated with the management area; or,

[0056] The conflict detection module is further configured to mark the overlapping area as a prohibited memory access area and generate an error message when it is determined that the overlapping area exists.

[0057] As an optional embodiment, in the second aspect of the present invention, the device further includes:

[0058] A monitoring module is used to monitor whether the access control flag of a certain storage unit needs to be changed;

[0059] A memory access permission change module is used to determine the target memory access control identifier of the storage unit that needs to be changed when the monitoring module detects that the memory access control identifier of the storage unit needs to be changed; change the memory access control identifier corresponding to the storage unit in the memory access control information to the target memory access control identifier; or, to change the memory access control identifier corresponding to the storage unit in the memory access control information to the target memory access control identifier by a memory access-dedicated Master, wherein the memory access-dedicated Master is a Master having the memory access-dedicated identifier.

[0060] As an optional embodiment, in the second aspect of the present invention, the device further includes:

[0061] A judgment module, configured to judge whether a memory access command is received, wherein the memory access command is sent by any Master;

[0062] The judging module is further configured to, when it is determined that the memory access command is received, judge whether a target storage unit to be accessed by the memory access command exists in the management area;

[0063] The judgment module is further configured to, when it is determined that the target storage unit to be accessed by the memory access command exists in the management area, judge whether there is content matching the memory access dedicated identifier in the memory access command;

[0064] The execution module is configured to refuse to execute the memory access command when the judgment module determines that the memory access command does not contain any content matching the memory access dedicated identifier.

[0065] As an optional embodiment, in the second aspect of the present invention, the judgment module is further configured to, when it is determined that the memory access command contains content that matches the memory access dedicated identifier, determine whether the memory access control identifier corresponding to the memory access command matches the memory access control identifier corresponding to the target storage unit in the memory access control information;

[0066] The execution module is also used to execute the memory access command when the judgment module determines that the memory access control identifier corresponding to the memory access command matches the memory access control identifier corresponding to the target storage unit in the memory access control information; and is also used to refuse to execute the memory access command when the judgment module determines that the memory access control identifier corresponding to the memory access command does not match the memory access control identifier corresponding to the target storage unit in the memory access control information.

[0067] A third aspect of the present invention discloses another memory-based memory access permission control device, the device comprising:

[0068] a memory storing executable program code;

[0069] a processor coupled to the memory;

[0070] The processor calls the executable program code stored in the memory to execute part or all of the steps in any one of the memory-based memory access permission control methods disclosed in the first aspect of the present invention.

[0071] The fourth aspect of the present invention discloses a computer storage medium, which stores computer instructions. When the computer instructions are called, they are used to execute some or all of the steps in any memory-based memory access permission control method disclosed in the first aspect of the present invention.

[0072] Compared with the prior art, the present invention has the following beneficial effects:

[0073] The present invention calculates the regional address information of the management area, including the address index of the management area in the memory, based on the area in the memory that needs to be included in the memory access permission management; determines the memory access control information, which includes the memory access control identifier of each storage unit in the management area; and sets a dedicated memory access identifier that matches the regional address information and the memory access control information. The dedicated memory access identifier is used to indicate that the master with the dedicated memory access identifier can access the regional address information and the memory access control information. It can be seen that the present invention can provide an open memory access permission control method based on the storage unit, dynamically configure the management area address information and the memory access control information, realize the management of the independent memory access permission of each storage unit included in the management scope, and configure a variety of memory access permission control strategies according to different needs, thereby improving the utilization efficiency of the memory. The management area and the storage area of ​​the regional address information and the memory access control information can be dynamically and flexibly set, saving the use cost of the memory and improving the flexibility and scalability of the memory access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0075] Figure 1 This is a flow chart of a memory access permission control method based on a memory disclosed in an embodiment of the present invention;

[0076] Figure 2 This is a flow chart of another memory-based memory access permission control method disclosed in an embodiment of the present invention;

[0077] Figure 3 This is a schematic structural diagram of a memory access permission control device based on a memory disclosed in an embodiment of the present invention;

[0078] Figure 4 This is a schematic structural diagram of another memory-based memory access permission control device disclosed in an embodiment of the present invention;

[0079] Figure 5 This is a structural diagram of another memory-based memory access permission control device disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0080] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0081] The terms "first," "second," and so on, in the description and claims of the present invention and the accompanying drawings are used to distinguish between different items, not to describe a specific order. Furthermore, the terms "including," "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, apparatus, product, or end comprising a series of steps or elements is not limited to the listed steps or elements but may optionally include steps or elements not listed therein, or may optionally include other steps or elements inherent to such process, method, product, or end.

[0082] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present invention. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute a separate or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0083] The present invention discloses a memory access permission control method and device based on a memory, which can provide an open memory access permission control method based on a storage unit, dynamically configure management area address information and memory access control information, realize the management of independent memory access permissions of each storage unit included in the management scope, and configure diversified memory access permission control strategies according to different needs, thereby improving the utilization efficiency of the memory, and can dynamically and flexibly set the management area and the storage area of ​​the area address information and memory access control information, thereby saving the use cost of the memory and improving the flexibility and scalability of memory access control.

[0084] Example 1

[0085] See also Figure 1 , Figure 1 This is a flow chart of a memory access permission control method based on a memory disclosed in an embodiment of the present invention. Figure 1 The described method can be applied to a memory-based access permission control device, which can be an independent device (e.g., a memory access controller) or integrated into a computer processing device, which is not limited in the embodiment of the present invention. Figure 1As shown, the memory-based memory access permission control method may include the following operations:

[0086] 101. Calculate area address information of the management area according to the determined management area.

[0087] In the embodiment of the present invention, the management area is a storage area in the memory that needs to be included in the memory access permission control. It should be noted that the storage unit in the storage area is an area that can be indexed by address information, that is, the storage unit therein can be located by address addressing. In addition, the storage area can be a memory area, or a hard disk storage area, etc., which is not limited by the embodiment of the present invention. Based on the determined management area, the area address information of the management area can be calculated, and accordingly, the area address information includes the address index of the management area in the memory. The area address information is initialized and can be stored in the present memory or in the physical memory of the computer system, which is not limited by the embodiment of the present invention.

[0088] In this embodiment, the number of management areas can be one or more, and this is not limited in this embodiment of the present invention. For multiple management areas, it is necessary to determine the area address information corresponding to each management area. The multiple management areas can be continuous or non-contiguous in terms of storage addresses, and this is not limited in this embodiment of the present invention.

[0089] 102. Determine memory access control information associated with the management area.

[0090] In an embodiment of the present invention, based on a determined management area, to independently control each storage unit within the management area, a memory access control identifier is set for each storage unit within the management area, and the memory access control identifiers corresponding to all storage units are determined as memory access control information. The memory access control information is initialized and can be stored in the local memory or in the physical memory of the computer system, which is not limited in the embodiment of the present invention.

[0091] For example, the management area includes two page frame units, and the memory access control identifiers are set as {Page 1, secure} and {Page 2, non-secure} respectively. The Master of the non-secure world (for example, the CPU and other units that can request memory access) cannot access the page frame with security attributes. The memory access control information can be stored in 2 bits. The first low-order bit stores "0" to indicate that the memory access permission of the first page frame corresponding to the area address information is "secure"; the second low-order bit stores "1" to indicate that the memory access permission of the second page frame corresponding to the area address information is "non-secure".

[0092] It should be noted that the occupied space of each management area can be different, and the occupied space of each storage unit in each management area can also be different, to achieve more flexible memory access permission control. For example, the memory in the Linux operating system is stored in 4K / 16K / 64K page frames. To achieve page frame alignment with the operating system's memory, the space size of each storage unit in this management area can also be set to 4K / 16K / 64K.

[0093] 103. Set a memory access-specific identifier that matches the regional address information and memory access control information.

[0094] In an embodiment of the present invention, after the regional address information and memory access control information are initialized, one or more memory access-specific identifiers that match the regional address information and memory access control information are set. The memory access-specific identifier is used to indicate that the Master with the memory access-specific identifier can access the regional address information and memory access control information. For example, the third low-order bit of the Master ID converted into binary is 1 as the memory access-specific identifier. When it is detected that the ID of the Master that initiates the memory access request for the regional address information or memory access control information is 7, it is converted into binary "0x00000111", and its third low-order bit is 1, then the Master can access the regional address information or memory access control information.

[0095] Furthermore, the memory access dedicated identifier of the area address information and the memory access dedicated identifier of the memory access control information may be the same identifier or different identifiers, which is not limited in the embodiment of the present invention.

[0096] It can be seen that the method described in the embodiment of the present invention can provide an open memory access permission control method based on storage units, dynamically configure management area address information and memory access control information, realize the management of independent memory access permissions of each storage unit included in the management scope, and at the same time configure diversified memory access permission control strategies according to different needs, thereby improving the utilization efficiency of the memory, and can dynamically and flexibly set the management area and the storage area of ​​the area address information and memory access control information, thereby saving the use cost of the memory and improving the flexibility and scalability of memory access control.

[0097] In an optional embodiment, calculating the area address information of the management area according to the determined management area may include the following operations:

[0098] Calculate the base address information and length information of the management area in the memory according to the determined management area;

[0099] The base address information and length information corresponding to the management area are determined as the area address information of the management area.

[0100] In an embodiment of the present invention, after the management area is determined, the base address of the management area in the memory is calculated, and the length of the space occupied by the management area is calculated with the base address as the starting point. For example, if the space occupied by a certain management area is 0x00000000 to 0x00000111, the corresponding base address information is 0x00000000, and the length information is 7. Preferably, the base address and length here are recommended to be page frame aligned (4K / 16K / 64K) to facilitate embedding into the paged memory management system of the computer system. It should be noted that if there are multiple management areas, the base address information and length information corresponding to each management area need to be calculated accordingly to determine the area address information of each management area.

[0101] It can be seen that the method described in the embodiment of the present invention can store the regional address information in the structural form of the base address information and length information of the management area, saving the space occupied by the regional address information and the cost of the memory, while improving the addressing rate of the memory access process and enhancing flexibility and scalability.

[0102] In another optional embodiment, determining the memory access control information associated with the management area may include the following operations:

[0103] Determine the access control identifier of each storage unit in the management area according to a predetermined authority control model;

[0104] The memory access control identifiers corresponding to all storage units are determined as the memory access control information of the management area.

[0105] In an embodiment of the present invention, to achieve independent memory access control for each storage unit in a management area, the present invention sets and stores a separate memory access control identifier for each storage unit through a pre-set permission control model. The permission control model can be set according to actual circumstances and is not limited in the embodiment of the present invention.

[0106] For example, in the first permission control model, each bit can be set to represent the memory access permission of a page frame, and its two values ​​(0 and 1) respectively represent whether the corresponding page frame access permission is secure or non-secure; the non-secure world cannot access page frames with secure attributes; if the size of a page frame is 4K bytes, then the management area of ​​1G bytes requires (1G / 4K / 8) = 32K bytes of memory access control information. The second permission control model can be set to each 4 bits to represent the memory access permission of a page frame, marking the four access permissions: secure read (0001) / secure write (0010) / non-secure read (0100) / non-secure write (1000); if the size of a page frame is 4K bytes, then the management area of ​​1G bytes requires (1G / 4K / 2) = 128K bytes of memory access control information. The third permission control model can set every 8 bits to represent the memory access permission of a page frame, of which 6 bits mark the MasterID (up to 64 MasterIDs are supported) and 2 bits mark whether it is readable / writable; if the size of a page frame is 4K bytes, then the management area of ​​1G bytes requires (1G / 4K) = 256K bytes of memory access control information.

[0107] It can be seen that the method described in the embodiment of the present invention can adopt diversified memory access permission control strategies according to different memory access control requirements, realize independent memory access permission management for each storage unit included in the management scope, improve memory utilization efficiency, save memory usage costs, and improve the flexibility and scalability of access permission control.

[0108] In yet another optional embodiment, after determining the region address information and the memory access control information, the method may further include the following operations:

[0109] Cache the region address information and the memory access control information into a predetermined cache unit;

[0110] The step of caching the region address information and the memory access control information in a predetermined cache unit includes:

[0111] Determine whether the space of the cache unit is greater than or equal to the sum of the space required for the region address information and the memory access control information;

[0112] When the judgment result is yes, all the information of the region address information and the memory access control information is cached in the cache unit;

[0113] When the judgment result is no, the first cache weight value of the regional address information and the second cache weight value of the memory access control information are calculated respectively, and according to the first cache weight value and the second cache weight value, the target regional cache information is filtered out from the regional address information and the target memory access control cache information is filtered out from the memory access control information respectively; the target regional cache information and the target memory access control cache information are cached in the cache unit.

[0114] In an embodiment of the present invention, in order to avoid performance bottlenecks caused by frequent access to memory, the present invention caches the regional address information and memory access control information after determining the regional address information and the memory access control information. When it is determined that the space of the cache unit is greater than or equal to the sum of the space required for the regional address information and the memory access control information, all the information of the regional address information and the memory access control information can be cached from its storage area to the cache unit. When it is determined that the space size of the cache unit is insufficient, it is necessary to cache part of the information according to the cache strategy. First, according to the system load and / or application scenario, the first cache weight value corresponding to the regional address information and the second cache weight value corresponding to the memory access control information are determined, and the target regional cache information is filtered out from the regional address information and the target memory access control cache information is filtered out from the memory access control information according to the first cache weight value and the second cache weight value, and the target regional cache information and the target memory access control cache information are cached to the cache unit.

[0115] For example, if the size of the cache unit is 1M, the space occupied by the regional address information and the memory access control information is 2M. At this time, based on the application scenario of the system, it is determined that the main task of the system at this time is to access the memory access control information, and the first cache weight value of the regional address information is determined to be 0.3, and the second cache weight value of the memory access control information is determined to be 0.7, that is, the cache space reserved for the regional address information is approximately 300K, and the cache space reserved for the memory access control information is 700K. At this time, the storage units in the regional address information and the memory access control information can be prioritized according to the priority determination rule, and the target regional cache information with the highest priority in the regional address information (less than or equal to 300K) and the target memory access control cache information in the memory access control information (less than or equal to 700K) can be filtered out and cached in the cache unit.

[0116] It can be seen that the method described in the embodiment of the present invention can cache address information and memory access control information in a cache value cache unit, thereby improving the access efficiency of address information and memory access control information, while reducing the performance impact caused by frequent memory access, and further improving the memory utilization efficiency and memory access efficiency.

[0117] In yet another optional embodiment, after determining the region address information and the memory access control information, the method may further include the following operations:

[0118] Determine whether there is any overlapping area between the storage area of ​​regional address information, the storage area of ​​memory access control information, and the management area;

[0119] When it is determined that there is an overlapping area, re-triggering the operation of calculating the area address information of the management area and the operation of determining the memory access control information associated with the management area; or

[0120] When it is determined that there is an overlapping area, the overlapping area is marked as a prohibited memory access area and an error message is generated.

[0121] In an embodiment of the present invention, after determining the region address information and memory access control information based on the management region, overlapping regions are detected between each of the region address information storage region, the memory access control information storage region, and the management region. When an overlapping region is detected, the operations corresponding to steps 101 and 102 described above can be retriggered to re-determine the region address information and memory access control information storage region to avoid overlapping regions due to calculation errors. The overlapping region can also be marked as a prohibited memory access region, that is, marked as an invalid region and prohibited from use, and an error message containing the overlapping region information can be generated.

[0122] It can be seen that the method described in the embodiment of the present invention can detect overlapping areas of regional address information, memory access control information and storage space of the management area, reduce the probability of errors in subsequent memory access, and at the same time, through various measures to remedy the overlapping areas, improve the stability of the present invention, and further improve the memory utilization efficiency and memory access efficiency.

[0123] Example 2

[0124] See also Figure 2 , Figure 2 This is a flow chart of a memory access permission control method based on a memory disclosed in an embodiment of the present invention. Figure 2 The described method can be applied to a memory-based access permission control device, which can be an independent device (e.g., a memory access controller) or integrated into a computer processing device, which is not limited in the embodiment of the present invention. Figure 2 As shown, the memory-based memory access permission control method may include the following operations:

[0125] 201. Calculate area address information of the management area according to the determined management area.

[0126] 202. Determine memory access control information associated with the management area.

[0127] 203. Set a dedicated memory access identifier that matches the area address information and the memory access control information.

[0128] In the embodiment of the present invention, for other descriptions of step 201 to step 203, please refer to the detailed description of step 101 to step 103 in embodiment 1 respectively, and the embodiment of the present invention will not be repeated.

[0129] 204. When a memory access command is received, determine whether the target storage unit required by the memory access command to access exists in the management area; when the judgment result is yes, determine whether there is content in the memory access command that matches the memory access special identifier; when it is determined that there is no content in the memory access command that matches the memory access special identifier, trigger the execution of step 205.

[0130] In an embodiment of the present invention, upon receiving a memory access command from any master, the memory access command is parsed and a determination is made as to whether the target storage unit to be accessed by the memory access command exists in the management area of ​​the memory. If the determination result is negative, the memory access instruction is rejected. If the determination result is positive, the memory access instruction is further determined as to whether there is content in the memory access command that matches the memory access-specific identifier, for example, whether the parsed MasterID matches the memory access-specific identifier.

[0131] 205. Memory access command is refused.

[0132] 206. When it is determined that there is content in the memory access command that matches the memory access dedicated identifier, determine whether the memory access control identifier corresponding to the memory access command matches the memory access control identifier corresponding to the target storage unit in the memory access control information; when it is determined that the memory access control identifier corresponding to the memory access command matches the memory access control identifier corresponding to the target storage unit in the memory access control information, trigger the execution of step 207; when it is determined that the memory access control identifier corresponding to the memory access command does not match the memory access control identifier corresponding to the target storage unit in the memory access control information, trigger the execution of step 205.

[0133] In an embodiment of the present invention, when a memory access-specific identifier exists in the memory access command, it indicates that the Master that sends the memory access command has the authority to access the memory area address information and the memory access control information. At this time, it is necessary to continue to determine whether the memory access control identifier corresponding to the memory access command matches the memory access control identifier corresponding to the target storage unit in the memory access control information. For example, if the memory access command indicates that a write operation needs to be performed on the storage unit at the address position 0x00000001 in the management area, it is necessary to obtain the memory access control information in the memory access control information corresponding to the address position 0x00000001 and perform a comparison and match. If the memory access command indicates that a write operation needs to be performed on the storage unit at the address position 0x00000001 in the management area, the memory access control information in the memory access control information corresponding to the address position 0x00000001 is obtained as "writable", and they match, the memory access command can be executed.

[0134] Furthermore, when it is determined that the memory access control identifier corresponding to the memory access command does not match the memory access control identifier corresponding to the target storage unit in the memory access control information, the memory access command is refused to be executed.

[0135] 207. Execute the memory access command.

[0136] It can be seen that the method described in the embodiment of the present invention can provide an open memory access permission control method based on storage units, dynamically configure management area address information and memory access control information, and realize the management of independent memory access permissions of each storage unit included in the management scope. At the same time, by performing real-time inspection of memory access commands and rejecting unauthorized commands, it provides more scalability for the access permission control method, further improves the utilization efficiency of the memory, and saves the cost of memory use.

[0137] In an optional embodiment, the method may further include the following operations:

[0138] Monitoring whether a memory access control identifier of a certain storage unit needs to be changed, and when it is monitored that the memory access control identifier of a storage unit needs to be changed, determining a target memory access control identifier of the storage unit that needs to be changed;

[0139] The memory access control identifier corresponding to the storage unit in the memory access control information is changed to the target memory access control identifier; or

[0140] The dedicated memory access master changes the memory access control identifier corresponding to the storage unit in the memory access control information to the target memory access control identifier, wherein the dedicated memory access master is a master with the dedicated memory access identifier.

[0141] In an embodiment of the present invention, real-time detection is performed to determine whether a memory access control identifier of a particular storage unit requires a change. When a change is detected, the memory access control identifier corresponding to the storage unit in the memory access control information is changed to a target memory access control identifier. Furthermore, a dedicated memory access master (i.e., a master having the dedicated memory access identifier) ​​can also change the memory access control identifier corresponding to the storage unit in the memory access control information to the target memory access control identifier.

[0142] It can be seen that the method described in the embodiment of the present invention can dynamically set the memory access permission of a specified storage unit according to the allocation requirements of the memory management area through real-time monitoring, thereby improving the flexibility and scalability of memory access control.

[0143] Example 3

[0144] See also Figure 3 , Figure 3 This is a schematic diagram of the structure of a memory access permission control device based on a memory disclosed in an embodiment of the present invention. Figure 3 The device described can be an independent device (for example, a memory access controller) or integrated into a computer processing device, and the embodiments of the present invention do not limit this. It should be noted that the memory-based memory access permission control device refers to the steps in the memory-based memory access permission control method described in Embodiment 1 and Embodiment 2, and the detailed description is not repeated in this embodiment. Figure 3 As shown, the memory-based access permission control device may include:

[0145] The region management module 301 is configured to calculate region address information of the management region based on the determined management region, where the region address information includes an address index of the management region in the memory. The management region is a region in the memory that needs to be included in the memory access permission management.

[0146] A control management module 302 is configured to determine memory access control information associated with a management area, the memory access control information including a memory access control identifier for each storage unit in the management area;

[0147] A setting module 303 is configured to set a dedicated memory access identifier that matches the region address information and the memory access control information. The dedicated memory access identifier indicates that the master with the dedicated memory access identifier can access the region address information and the memory access control information.

[0148] It can be seen that the device described in the embodiment of the present invention can provide an open memory access permission control method based on storage units, dynamically configure management area address information and memory access control information, realize the management of independent memory access permissions of each storage unit included in the management scope, and configure diversified memory access permission control strategies according to different needs, thereby improving the utilization efficiency of memory, saving memory usage costs, and improving the flexibility and scalability of memory access control.

[0149] In an optional embodiment, if Figure 4 As shown, the area management module 301 may include:

[0150] The calculation submodule 3011 is used to calculate the base address information and length information of the management area in the memory according to the determined management area;

[0151] The first determining submodule 3012 is configured to determine the base address information and length information corresponding to the management area as the area address information of the management area.

[0152] It can be seen that the device described in the embodiment of the present invention can store the regional address information in the structural form of the base address information and length information of the management area, saving the space occupied by the regional address information and the cost of the memory, while improving the addressing rate of the memory access process and enhancing flexibility and scalability.

[0153] In another optional embodiment, Figure 4 As shown, the control management module 302 may include:

[0154] The second determining submodule 3021 is configured to determine a memory access control identifier for each storage unit in the management area according to a predetermined authority control model;

[0155] The third determining submodule 3022 is configured to determine the memory access control identifiers corresponding to all storage units as the memory access control information of the management area.

[0156] It can be seen that the device described in the embodiment of the present invention can adopt a variety of memory access permission control strategies according to different memory access control requirements, so as to realize the management of independent memory access permissions for each storage unit included in the management scope, thereby improving the utilization efficiency of the memory, saving the cost of memory use, and improving the flexibility and scalability of access permission control.

[0157] In another optional embodiment, Figure 4 As shown, the device may also include:

[0158] The cache module 304 is configured to cache the region address information and the memory access control information in a predetermined cache unit after the region management module 301 determines the region address information and the control management module 302 determines the memory access control information;

[0159] The cache module 304 is specifically configured to:

[0160] Determine whether the space of the cache unit is greater than or equal to the sum of the space required for the region address information and the memory access control information;

[0161] When the judgment result is yes, all the information of the region address information and the memory access control information is cached in the cache unit;

[0162] When the judgment result is no, the first cache weight value of the regional address information and the second cache weight value of the memory access control information are calculated respectively, and according to the first cache weight value and the second cache weight value, the target regional cache information is filtered out from the regional address information and the target memory access control cache information is filtered out from the memory access control information respectively; the target regional cache information and the target memory access control cache information are cached in the cache unit.

[0163] It can be seen that the device described in the embodiment of the present invention can cache address information and memory access control information in a cache value cache unit, thereby improving the access efficiency of address information and memory access control information, while reducing the performance impact caused by frequent memory access, and further improving the memory utilization efficiency and memory access efficiency.

[0164] In another optional embodiment, Figure 4 As shown, the device may also include:

[0165] The conflict detection module 305 is configured to determine whether there is any overlapping area between the storage area of ​​the regional address information, the storage area of ​​the memory access control information, and the management area after the regional management module 301 determines the regional address information and the control management module 302 determines the memory access control information;

[0166] When it is determined that there is an overlapping area, the area management module 301 is re-triggered to perform the operation of calculating the area address information of the management area and the control management module 302 is controlled to perform the operation of determining the memory access control information associated with the management area; or

[0167] When it is determined that there is an overlapping area, the overlapping area is marked as a prohibited memory access area and an error message is generated.

[0168] It can be seen that the device described in the embodiment of the present invention is able to detect overlapping areas of regional address information, memory access control information and storage space of the management area, reduce the probability of errors occurring in subsequent memory access, and at the same time, through various measures to remedy the overlapping areas, improve the stability of the present invention, and further improve the memory utilization efficiency and memory access efficiency.

[0169] In another optional embodiment, Figure 4 As shown, the device may also include:

[0170] A monitoring module 306 is used to monitor whether a memory access control flag of a certain storage unit needs to be changed;

[0171] The memory access permission change module 307 is used to determine the target memory access control identifier of the storage unit that needs to be changed when the monitoring module 306 detects that the memory access control identifier of the storage unit needs to be changed; change the memory access control identifier corresponding to the storage unit in the memory access control information to the target memory access control identifier; or, for the memory access-dedicated Master to change the memory access control identifier corresponding to the storage unit in the memory access control information to the target memory access control identifier, where the memory access-dedicated Master is a Master with a memory access-dedicated identifier.

[0172] It can be seen that the device described in the embodiment of the present invention can dynamically set the memory access permission of a specified storage unit according to the allocation requirements of the memory management area through real-time monitoring, thereby improving the flexibility and scalability of memory access control.

[0173] In another optional embodiment, Figure 4 As shown, the device may also include:

[0174] The judgment module 308 is used to judge whether a memory access command is received, and the memory access command is sent by any Master;

[0175] The judgment module 308 is further configured to, when it is determined that a memory access command has been received, determine whether a target storage unit to be accessed by the memory access command exists in the management area;

[0176] The judgment module 308 is further configured to, when it is determined that the target storage unit to be accessed by the memory access command exists in the management area, judge whether there is content in the memory access command that matches the memory access dedicated identifier;

[0177] The execution module 309 is configured to refuse to execute the memory access command when the judgment module 308 judges that the memory access command does not contain any content that matches the memory access dedicated identifier.

[0178] The judging module 308 is further configured to, when it is determined that the memory access command contains content that matches the memory access dedicated identifier, determine whether the memory access control identifier corresponding to the memory access command matches the memory access control identifier corresponding to the target storage unit in the memory access control information;

[0179] The execution module 309 is also used to execute the memory access command when the judgment module 308 determines that the memory access control identifier corresponding to the memory access command matches the memory access control identifier corresponding to the target storage unit in the memory access control information; and is also used to refuse to execute the memory access command when the judgment module 308 determines that the memory access control identifier corresponding to the memory access command does not match the memory access control identifier corresponding to the target storage unit in the memory access control information.

[0180] It can be seen that the device described in the embodiment of the present invention can provide an open memory access permission control method based on storage units, dynamically configure management area address information and memory access control information, and realize the management of independent memory access permissions of each storage unit included in the management scope. At the same time, by performing real-time inspection of memory access commands and rejecting unauthorized commands, it provides more scalability for the access permission control method, further improves the utilization efficiency of the memory, and saves the cost of memory use.

[0181] Example 4

[0182] See also Figure 5 , Figure 5 This is a schematic diagram of the structure of another memory access permission control device disclosed in an embodiment of the present invention. Figure 5 The device described may be an independent device (eg, a memory access controller) or may be integrated into a computer processing device, which is not limited in the embodiment of the present invention. Figure 5 As shown, the memory-based access permission control device may include:

[0183] A memory 401 storing executable program code;

[0184] a processor 402 coupled to the memory 401;

[0185] The processor 402 calls the executable program code stored in the memory 401 to execute part or all of the steps in the memory-based memory access permission control method disclosed in the first or second embodiment of the present invention.

[0186] Example 5

[0187] An embodiment of the present invention discloses a computer storage medium storing computer instructions. When the computer instructions are called, they are used to execute the steps of the memory-based memory access permission control method disclosed in the first or second embodiment of the present invention.

[0188] The device embodiments described above are merely illustrative, wherein the modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, i.e., they may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Those skilled in the art can understand and implement the present invention without inventive effort.

[0189] Through the detailed description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus the necessary general hardware platform, or of course, by means of hardware. Based on this understanding, the above technical solution, in essence, or the portion that contributes to the prior art, can be embodied in the form of a software product, which can be stored in a computer-readable storage medium, including a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium capable of carrying or storing data.

[0190] Finally, it should be noted that the memory-based memory access permission control method and device disclosed in the embodiments of the present invention are only preferred embodiments of the present invention, and are only used to illustrate the technical solutions of the present invention, rather than to limit them. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments can still be modified, or some of the technical features therein can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A memory access permission control method based on memory, characterized in that: The method comprises: Calculating, based on the determined management area, area address information of the management area, the area address information including an address index of the management area in the memory, the management area being an area in the memory that needs to be included in memory access permission management; Determining memory access control information associated with the management area, the memory access control information including a memory access control identifier of each storage unit in the management area; Setting a memory access dedicated identifier that matches the region address information and the memory access control information, wherein the memory access dedicated identifier is used to indicate that a master having the memory access dedicated identifier can access the region address information and the memory access control information; The determining of the memory access control information associated with the management area includes: According to a predetermined permission control model, a memory access control identifier of each storage unit in the management area is determined, wherein the permission control model includes one of a first permission control model, a second permission control model and a third permission control model. The first permission control model can set each bit to represent a first memory access permission for a page frame, and the two values ​​of each bit respectively represent whether the corresponding page frame access permission is secure or non-secure. The second permission control model can set each 4 bits to represent a second memory access permission for a page frame, and each 4 bits are used to respectively mark four access permissions: secure readable, secure writable, non-secure readable and non-secure writable. The third permission control model can set each 8 bits to represent a third memory access permission for a page frame, and 6 of the 8 bits are used to mark the Master ID and the remaining 2 bits are used to mark whether it is readable / writable. determining the memory access control identifiers corresponding to all the storage units as the memory access control information of the management area; And, the method further comprises: After determining the region address information and the memory access control information, determining whether a predetermined cache unit space is greater than or equal to a sum of spaces required by the region address information and the memory access control information; When the judgment result is yes, all the information of the area address information and the memory access control information is cached in the cache unit; When the judgment result is no, the first cache weight value of the area address information and the second cache weight value of the memory access control information are calculated respectively, and according to the first cache weight value and the second cache weight value, and according to the priority determination rule, the storage units in the area address information and the memory access control information are prioritized, and the target area cache information with the highest priority in the area address information and the target memory access control cache information in the memory access control information are filtered out and cached in the cache unit.

2. The memory access permission control method based on memory according to claim 1, characterized in that: The calculating, based on the determined management area, the area address information of the management area includes: Calculating base address information and length information of the management area in the memory according to the determined management area; The base address information and length information corresponding to the management area are determined as the area address information of the management area.

3. The memory access permission control method based on memory according to claim 1, characterized in that: The method further comprises: After determining the area address information and the memory access control information, determining whether there is an overlapping area between the storage area of ​​the area address information, the storage area of ​​the memory access control information, and the management area; When it is determined that the overlapping area exists, re-triggering the operation of calculating the area address information of the management area and the operation of determining the memory access control information associated with the management area; or When it is determined that the overlapping area exists, the overlapping area is marked as a memory access prohibited area, and an error message is generated.

4. The memory access permission control method based on memory according to claim 3, characterized in that: The method further comprises: monitoring whether a memory access control identifier of a certain storage unit needs to be changed, and when it is detected that the memory access control identifier of the storage unit needs to be changed, determining a target memory access control identifier of the storage unit that needs to be changed; Changing the memory access control identifier corresponding to the storage unit in the memory access control information to the target memory access control identifier; or The memory access dedicated Master changes the memory access control identifier corresponding to the storage unit in the memory access control information to the target memory access control identifier, wherein the memory access dedicated Master is the Master having the memory access dedicated identifier.

5. The memory access permission control method based on memory according to any one of claims 1 to 4, characterized in that: After setting the memory access dedicated identifier that matches the area address information and the memory access control information, the method further includes: Determine whether a memory access command is received, where the memory access command is sent by any Master; When it is determined that the memory access command is received, determining whether a target storage unit to be accessed by the memory access command exists in the management area; When the judgment result is yes, it is judged whether there is content matching the memory access dedicated identifier in the memory access command; When it is determined that the memory access command does not contain content matching the memory access dedicated identifier, the memory access command is refused to be executed.

6. The memory access permission control method based on memory according to claim 5, characterized in that: The method further comprises: When it is determined that the memory access command contains content that matches the memory access dedicated identifier, determining whether the memory access control identifier corresponding to the memory access command matches the memory access control identifier corresponding to the target storage unit in the memory access control information; When the judgment result is yes, executing the memory access command; When the judgment result is no, the memory access command is refused to be executed.

7. A memory access permission control device based on memory, characterized in that: The device comprises: a region management module, configured to calculate region address information of the management region according to the determined management region, wherein the region address information includes an address index of the management region in the memory, and the management region is a region in the memory that needs to be included in memory access permission management; a control management module, configured to determine memory access control information associated with the management area, wherein the memory access control information includes a memory access control identifier of each storage unit in the management area; A setting module, configured to set a dedicated memory access identifier that matches the region address information and the memory access control information, wherein the dedicated memory access identifier indicates that a master having the dedicated memory access identifier can access the region address information and the memory access control information; Wherein, the control management module includes: a second determination submodule, configured to determine a memory access control identifier of each storage unit in the management area according to a predetermined permission control model, wherein the permission control model includes one of a first permission control model, a second permission control model, and a third permission control model; the first permission control model can set each bit to represent a first memory access permission for a page frame, and the two values ​​of each bit respectively represent whether the corresponding page frame access permission is secure or non-secure; the second permission control model can set each 4 bits to represent a second memory access permission for a page frame, and each 4 bits are used to respectively mark four access permissions of secure readability, secure writeability, non-secure readability, and non-secure writeability; the third permission control model can set each 8 bits to represent a third memory access permission for a page frame, and 6 of the 8 bits are used to mark the Master ID and the remaining 2 bits are used to mark whether it is readable / writable; A third determining submodule is configured to determine the memory access control identifiers corresponding to all the storage units as the memory access control information of the management area; And, the device further comprises: a cache module, configured to determine, after the region management module determines the region address information and the memory access control information, whether a predetermined cache unit space is greater than or equal to a sum of spaces required by the region address information and the memory access control information; When the judgment result is yes, all the information of the area address information and the memory access control information is cached in the cache unit; When the judgment result is no, the first cache weight value of the area address information and the second cache weight value of the memory access control information are calculated respectively, and according to the first cache weight value and the second cache weight value, and according to the priority determination rule, the storage units in the area address information and the memory access control information are prioritized, and the target area cache information with the highest priority in the area address information and the target memory access control cache information in the memory access control information are filtered out and cached in the cache unit.

8. A memory access permission control device based on memory, characterized in that: The device comprises: a memory storing executable program code; a processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the memory-based memory access permission control method according to any one of claims 1 to 6.

Images