Memory management system and method thereof

Abstract

The present invention provides a memory management system and a method thereof. The memory management system includes a client device, a memory, and a system memory management unit. The system memory management unit performs multiple security checks on a virtual address-physical address conversion transaction issued by a client device, such as a memory security check, a virtual user security check, and a register configuration security check. When a target context is not owned by a virtual user, the result of the virtual user security check is illegal. When a target register is owned by a virtual user other than a second virtual user who initiates a configuration request, the result of the register configuration security check is illegal. The system memory management unit determines whether to execute a virtual address-physical address conversion transaction based on the results of the multiple security checks in order to access a target page in the memory. The memory management system and the memory management method thereof of the present invention can effectively enhance information security.

Description

Technical Field

[0001] The present invention relates to the technical field of integrated circuits, and in particular to a memory management system and a method thereof. Background Art

[0002] In a conventional System On Chip (SoC), the System Memory Management Unit (SMMU) is configured between the cache and the main memory. With the help of the page table configured by software, the SMMU maps the virtual address (VA) of the cache accessing the main memory to the actual physical address (PA) of the main memory. How to improve the information security of the SMMU is one of the many technical issues in the field of integrated circuit technology. Summary of the invention

[0003] The present invention is directed to a memory management system and method thereof to enhance information security.

[0004] In an embodiment of the present invention, a memory management system includes a client device, a memory, and a system memory management unit (SMMU). The system memory management unit is coupled between the client device and the memory. The system memory management unit includes a plurality of registers. The system memory management unit performs a plurality of security checks on a virtual address-physical address translation transaction issued by the client device. The system memory management unit determines whether to execute a virtual address-physical address translation transaction to access a target page in the memory based on the check results of the plurality of security checks. The plurality of security checks include a memory security check, a virtual user security check, and a register configuration security check. The memory security check is used to check the attributes of the virtual address-physical address translation transaction and the attributes of the target page to obtain a memory security check result. The virtual user security check is used to check the first virtual user (virtual function, VF) that initiates the virtual address-physical address translation transaction and the target context (context) of the virtual address-physical address translation transaction to obtain a virtual user security check result. When the target context is not owned by the first virtual user, the virtual user security check result is illegal. The register configuration security check is used to check the configuration request of the management device for the plurality of registers to obtain a register configuration security check result. When the target register of the configuration request is owned by another virtual user different from the second virtual user initiating the configuration request, the register configuration security check result is illegal.

[0005] In an embodiment of the present invention, a memory management method includes: a system memory management unit performs multiple security checks on a virtual address-physical address translation transaction issued by a client device, wherein the system memory management unit is coupled between the client device and the memory, and the system memory management unit includes multiple registers; and the system memory management unit determines whether to execute the virtual address-physical address translation transaction based on the inspection results of the multiple security checks to access the target page in the memory. The multiple security checks include: a memory security check, which is used to check the attributes of the virtual address-physical address translation transaction and the attributes of the target page to obtain a memory security check result; a virtual user security check, which is used to check the first virtual user who initiates the virtual address-physical address translation transaction and the target context of the virtual address-physical address translation transaction to obtain a virtual user security check result, wherein when the target context is not owned by the first virtual user, the virtual user security check result is illegal; and a register configuration security check, which is used to check the configuration request of the management device for the multiple registers to obtain a register configuration security check result, wherein when the target register of the configuration request is owned by a virtual user other than the second virtual user who initiates the configuration request, the register configuration security check result is illegal.

[0006] Based on the above, in the process of the system memory management unit processing the virtual address-physical address conversion transaction issued by the client device, the system memory management unit performs multiple security checks (such as memory security check, virtual user security check and register configuration security check) to enhance information security. Virtual users can only access their own contexts, registers and other corresponding resources. Based on the check results, the system memory management unit decides whether to execute the virtual address-physical address conversion transaction. Once an error is found, the system memory management unit immediately stops processing and returns "fault" to the client device to improve address conversion efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 FIG. 1 is a schematic diagram of a circuit block of a memory management system according to an embodiment.

[0008] Figure 2 It is a flowchart of a memory management method according to an embodiment of the present invention.

[0009] Figure 3 It is a flowchart of a memory management method according to another embodiment of the present invention.

[0010] Description of Reference Numerals

[0011] 100: Memory Management System

[0012] 110: System on Chip

[0013] 111: Customer equipment

[0014] 112: Manage Devices

[0015] 113: System memory management unit

[0016] 120: Memory

[0017] 121: Page table

[0018] REG1: Register

[0019] S210~S220, S310~S350: Steps DETAILED DESCRIPTION

[0020] Reference will now be made in detail to exemplary embodiments of the present invention, examples of which are illustrated in the accompanying drawings. Whenever possible, the same reference numerals are used in the drawings and the description to refer to the same or like parts.

[0021] The term "coupled (or connected)" used in the entire specification of this case (including the claims) may refer to any direct or indirect means of connection. For example, if the text describes a first device coupled (or connected) to a second device, it should be interpreted that the first device can be directly connected to the second device, or the first device can be indirectly connected to the second device through other devices or some means of connection. The terms "first", "second", etc. mentioned in the entire specification of this case (including the claims) are used to name the components (element) or to distinguish different embodiments or ranges, and are not used to limit the upper or lower limit of the number of components, nor to limit the order of components. In addition, wherever possible, components / components / steps with the same number in the drawings and embodiments represent the same or similar parts. Components / components / steps with the same number or the same terminology in different embodiments can refer to the relevant descriptions of each other.

[0022] Figure 1 FIG. 1 is a schematic diagram of a circuit block of a memory management system 100 according to an embodiment. Figure 1 The memory management system 100 shown includes a system on chip (SoC) 110 and a memory 120. For example (but not limited to), the system on chip 110 may include an artificial intelligence (AI) chip, a graphics processing unit (GPU), a general-purpose computing on GPU (GPGPU), or other processing circuits. Figure 1 In the illustrated embodiment, the system on chip 110 includes a client device 111, a manager device 112, and a system memory management unit (SMMU) 113. The system memory management unit 113 includes a plurality of registers REG1. The manager device 112 issues a configuration request for the register REG1 to trigger the system memory management unit 113 to perform register configuration. Register REG1 is used to mark the information passed by the software to the system memory management unit 113, such as the security of the stream identifier (SID) and the permissions it possesses. For example, register REG1 records the correspondence between the identifier (VFID) of the virtual function (VF) and the context, as well as the security of the context. The context is similar to the process in the central processing unit (CPU).

[0023] The system memory management unit 113 is coupled between the client device 111 and the memory 120. Based on actual design and application, the client device 111 includes a compute unit (CU, or compute core), an execution unit (EU, or execution core), a stream processor cluster (SPC), a command processor (CP), a system direct memory access (SDMA) or other memory access devices in the system on chip. The client device 111 issues a virtual address-physical address translation transaction to the system memory management unit 113. The translation transaction sent by the client device 111 carries data stream identifier (SID) information and a security flag. Through the SID, the system memory management unit 113 searches the register REG1, performs a security state determination (SSD), and determines the SSD security attribute of the translation transaction. Through the security flag, the system memory management unit 113 identifies the security attribute of the translation transaction. Based on the contents of register REG1 and page table 121 , system memory management unit 113 processes virtual address-physical address translation transactions to translate virtual addresses into physical addresses of memory 120 so that client device 111 accesses a target page (a block of space in memory 120 ) in memory 120 .

[0024] The system memory management unit 113 has high security. In different application scenarios, the system memory management unit 113 can provide specific security permission ranges for different client devices, or provide specific permission ranges for different virtual users (virtual functions, VFs) of the same client device. For higher security requirements, the system memory management unit 113 can achieve necessary isolation between different client devices or between different virtual users. According to different designs, in some embodiments, the above-mentioned client device 111, management device 112 and (or) system memory management unit 113 can be implemented in hardware (hardware) circuits, firmware (firmware), software (software, i.e., program) or a combination of the above.

[0025] In terms of hardware, the client device 111, the management device 112 and / or the system memory management unit 113 may be implemented as a logic circuit on an integrated circuit. For example, the functions of the client device 111, the management device 112 and / or the system memory management unit 113 may be implemented in various logic blocks, modules and circuits in one or more hardware controllers, microcontrollers, hardware processors, microprocessors, application-specific integrated circuits (ASICs), digital signal processors (DSPs), field programmable gate arrays (FPGAs), central processing units (CPUs) and / or other processing units. The functions of the client device 111, the management device 112 and / or the system memory management unit 113 may be implemented as hardware circuits, such as various logic blocks, modules and circuits in an integrated circuit, using hardware description languages ​​(such as Verilog HDL or VHDL) or other suitable programming languages.

[0026] In terms of software and / or firmware, the relevant functions of the above-mentioned client device 111, management device 112 and / or system memory management unit 113 can be implemented as programming codes. For example, the client device 111, management device 112 and / or system memory management unit 113 are implemented using general programming languages ​​(such as C, C++ or assembly language) or other suitable programming languages. The programming codes can be recorded / stored in a "non-transitory machine-readable storage medium". In some embodiments, the non-transitory machine-readable storage medium includes, for example, a semiconductor memory and / or a storage device. An electronic device (such as a computer, a CPU, a hardware controller, a microcontroller, a hardware processor or a microprocessor) can read and execute the programming codes from the non-transitory machine-readable storage medium to implement the relevant functions of the client device 111, management device 112 and / or system memory management unit 113.

[0027] Figure 2 1 is a flowchart of a memory management method according to an embodiment of the present invention. Each step in the flowchart or a combination of steps in the flowchart can be implemented by various means, such as hardware, one or more computer-readable media storing a computer program, or a computer program product. In some embodiments, Figure 2 The operation method shown can be implemented in firmware or software. Figure 2 The related operations of the operation method shown can be implemented as non-transitory machine-readable instructions (code or program), and the non-transitory machine-readable instructions can be stored in a "non-transitory machine-readable storage medium". When the non-transitory machine-readable instructions are executed by a computer, the following operations can be implemented: Figure 2 In some other embodiments, Figure 2 The operation method shown can be implemented in hardware, for example, Figure 1 The client device 111, the management device 112 and the system memory management unit 113 are shown. In some other embodiments, one or more steps in the flowchart can be embodied by a computer program of a computer program product. The computer program product can be stored by one or more memory devices in a computing device and executed by a processor in the computing device. The computer program product can be implemented on a computer or other programmable device to generate a machine so that the computer program product generates a function for implementing the functions specified in the steps of the flowchart. The computer program product can include one or more computer-readable memories (the memory can store computer program instructions), or one or more computer program instructions of the computer program product can also be loaded onto a computer or other programmable device.

[0028] Please refer to Figure 1 and Figure 2 In the process of the system memory management unit 113 processing the virtual address-physical address translation transaction issued by the client device 111, the system memory management unit 113 performs multiple security checks (step S210, such as memory security check, virtual user security check and register configuration security check) on the virtual address-physical address translation transaction to enhance information security. Based on the security check, the virtual user can only access the corresponding resources such as the context and registers owned by the virtual user. In step S220, the system memory management unit 113 decides whether to execute the virtual address-physical address translation transaction based on the inspection results of the multiple security checks in order to access the target page in the memory 120. Once an error is found, the system memory management unit 113 immediately stops processing and returns a "fault" to the client device 111 to improve the address translation efficiency.

[0029] The above-mentioned "memory security check" is used to check the attributes of the virtual address-physical address translation transaction and the attributes of the target page to obtain a memory security check result. The security rules of the memory security check include: "Secure transactions cannot write to the non-secure region of memory 120", "Non-secure transactions cannot access the secure region of memory 120" and "Write transactions cannot access the read-only region of memory 120". For example, the memory security check includes the following operations. When the security attribute of the virtual address-physical address translation transaction and the security attribute of the target page are both secure and the access attribute of the virtual address-physical address translation transaction is read, the memory security check result is legal. When the security attribute of the virtual address-physical address translation transaction and the security attribute of the target page are both secure and the access attribute of the virtual address-physical address translation transaction is write and the access attribute of the target page is non-read-only, the memory security check result is legal. When the security attribute of the virtual address-physical address translation transaction and the security attribute of the target page are both non-secure and the access attribute of the virtual address-physical address translation transaction is read, the memory security check result is legal. When the security attribute of the virtual address-physical address translation transaction and the security attribute of the target page are both non-secure and the access attribute of the virtual address-physical address translation transaction is write and the access attribute of the target page is not read-only, the memory security check result is legal. When the security attribute of the virtual address-physical address translation transaction is secure and the security attribute of the target page is non-secure and the access attribute of the virtual address-physical address translation transaction is write, the memory security check result is illegal. When the security attribute of the virtual address-physical address translation transaction is secure and the security attribute of the target page is non-secure and the access attribute of the virtual address-physical address translation transaction is read, the memory security check result is legal. When the security attribute of the virtual address-physical address translation transaction is non-secure and the security attribute of the target page is secure, the memory security check result is illegal. When the access attribute of the virtual address-physical address translation transaction is write and the access attribute of the target page is read-only, the memory security check result is illegal.

[0030] For example, a virtual address-physical address translation transaction carries an access flag (read / write flag) and a security flag, and the page table 121 includes the security attributes, access attributes, etc. of a page (a block of space in the memory 120). When the access flag of the virtual address-physical address translation transaction indicates that the access attribute is write and the content of the page table 121 indicates that the access attribute of the target page is read-only, the system memory management unit 113 determines that the memory security check result is illegal. When the access flag of the virtual address-physical address translation transaction indicates that the access attribute is write and the content of the page table 121 indicates that the access attribute of the target page is not read-only, the system memory management unit 113 determines that the memory security check result is legal. When the security flag of the virtual address-physical address translation transaction indicates that the security attribute is secure and the content of the page table 121 indicates that the security attribute of the target page is secure, the system memory management unit 113 determines that the memory security check result is legal. When the security flag of the virtual address-physical address translation transaction indicates that the security attribute is secure and the access flag indicates that the access attribute is write, and the content of the page table 121 indicates that the security attribute of the target page is non-secure, the system memory management unit 113 determines that the memory security check result is illegal (because a secure transaction writes a non-secure page, which may cause the leakage of security information, so this embodiment sets the security check rule that a secure transaction cannot write a non-secure page). When the security flag of the virtual address-physical address translation transaction indicates that the security attribute is secure and the access flag indicates that the access attribute is read, and the content of the page table 121 indicates that the security attribute of the target page is non-secure, the system memory management unit 113 determines that the memory security check result is legal. When the security flag of the virtual address-physical address translation transaction indicates that the security attribute is non-secure, and the content of the page table 121 indicates that the security attribute of the target page is non-secure, the system memory management unit 113 determines that the memory security check result is legal. When the security flag of the virtual address-physical address translation transaction indicates that the security attribute is non-secure and the access flag indicates that the access attribute is write (or read), and the content of the page table 121 indicates that the security attribute of the target page is secure, the system memory management unit 113 determines that the memory security check result is illegal (because non-secure transactions read and write secure pages, which may lead to the leakage of security information, so this embodiment sets the security check rule that non-secure transactions cannot access secure pages regardless of reading or writing). Once the memory security check result is illegal, the system memory management unit 113 immediately stops processing the virtual address-physical address translation transaction and returns a "fault" to the client device 111 to improve the address translation efficiency.

[0031] The above-mentioned "virtual user security check" is used to check the virtual user (virtual function, VF) that initiates the virtual address-physical address translation transaction and the target context (context) of the virtual address-physical address translation transaction to obtain the virtual user security check result. The security rules of the virtual user security check include: "the validity of the virtual user's identifier (VFID)", "the validity of the target context resources accessed by the virtual user" and "the virtual user can only access the corresponding resources such as the context owned by each (isolated from each other and cannot access each other to avoid information leakage to other virtual users)". For example, the virtual user security check includes the following operations. When the target context is not owned by the virtual user that initiates the virtual address-physical address translation transaction, the system memory management unit 113 determines that the virtual user security check result is illegal. The system memory management unit 113 checks the validity of the virtual user's identifier (VFID) and the validity of the target context accessed by the virtual user. When the validity of the virtual user's identifier (VFID) is invalid or the validity of the target context is invalid, the system memory management unit 113 determines that the virtual user security check result is illegal. When the target context is owned by the virtual user and the validity of the virtual user identifier (VFID) and the validity of the target context are both valid, the system memory management unit 113 determines that the virtual user security check result is legal.

[0032] For example, the system memory management unit 113 checks whether the target context resources accessed by the virtual user exceed the total amount of resources, and whether it exceeds the total amount of context resources configured for the virtual user. Assume that the system stipulates that the virtual user's identifier (VFID) can only be VF0, VF1 and VF2, and assume that the system has a total of 6 contexts 0, 1, 2, 3, 4 and 5. Assume that the virtual user VF0 has context 0 and context 1, and assume that the virtual user VF1 has context 2 and context 3, and assume that the virtual user VF2 has context 4 and context 5. The virtual address-physical address translation transaction carries information such as the address space identifier (ASID) (including VFID information) and the context index used. In the system memory management unit 113, as long as the virtual user's identifier is not VF0, VF1 and VF2, the system memory management unit 113 determines that the virtual user security check results are all illegal. In the system memory management unit 113, as long as the target context accessed by the virtual user is a context other than context 0, 1, 2, 3, 4 and 5, the system memory management unit 113 determines that the virtual user security check result is illegal. When the virtual address-physical address conversion transaction is marked as virtual user VF0 and the context index used is 3, the system memory management unit 113 determines that the virtual user security check result is illegal (because it exceeds the maximum number of contexts owned by virtual user VF0). When the virtual address-physical address conversion transaction is marked as virtual user VF3 and the context index used is 3, the system memory management unit 113 determines that the virtual user security check result is illegal (because the system stipulates that the virtual user's identifier can only be VF0, VF1 and VF2). When the virtual address-physical address conversion transaction is marked as virtual user VF1 and the context indexes used are 2 and 3, the system memory management unit 113 determines that the virtual user security check result is legal. Once the virtual user security check result is illegal, the system memory management unit 113 immediately stops processing the virtual address-physical address translation transaction and returns a “fault” to the client device 111 to improve the address translation efficiency.

[0033] The above-mentioned "register configuration security check" is used to check the configuration request (configuration transaction) of the management device 112 to the register REG1 to obtain the register configuration security check result. The security rules of the register configuration security check include: "Register REG1 is divided into read-only, read-write and other permissions according to the access attribute", "Register REG1 is divided into secure, non-secure and other permissions according to the security attribute" and "Virtual users can only access the corresponding resources such as registers owned by each of them (isolated from each other and cannot access each other to avoid information leakage to other virtual users)". For example, the register configuration security check includes the following operations. When the target register of the configuration request is owned by other virtual users different from the "virtual user who initiated the configuration request", the system memory management unit 113 determines that the register configuration security check result is illegal. When the access attribute of the configuration request is write and the access attribute of the target register is read-only, the system memory management unit 113 determines that the register configuration security check result is illegal. When the security attribute of the configuration request is non-secure and the security attribute of the target register is secure, the system memory management unit 113 determines that the register configuration security check result is illegal. When the target register of the configuration request is owned by the virtual user who initiated the configuration request, the system memory management unit 113 determines that the register configuration security check result is legal. The system memory management unit 113 checks the validity of the identifier (VFID) of the virtual user who initiated the configuration request and the validity of the target register accessed by the virtual user. When the validity of the identifier of the virtual user who initiated the configuration request is invalid or the validity of the target register is invalid, the system memory management unit 113 determines that the register configuration security check result is illegal.

[0034] For example, assume that the register REG1 in the system memory management unit 113 has Reg0, Reg1, Reg2, Reg3, Reg4, Reg5 and Reg6, assume that the system stipulates that the identifier (VFID) of the virtual user can only be VF0, VF1 and VF2, assume that the system stipulates that the security attributes of registers Reg0 and Reg1 are secure, assume that the security attribute of Reg2 is non-secure, assume that the access attribute of register Reg3 is read-only, assume that virtual user VF0 owns register Reg4, assume that virtual user VF1 owns register Reg5, and assume that virtual user VF2 owns register Reg6. When the management device 112 configures the register REG1 in the system memory management unit 113, the configuration request sent by the management device 112 to the system memory management unit 113 carries information such as an access flag (read / write flag), a security flag (security flag), and an address space identifier (ASID) for checking the security of the register configuration. When the access flag of the configuration request indicates that the access attribute is write and the access target is register Reg3, the system memory management unit 113 determines that the result of the register configuration security check is illegal (because the access attribute of register Reg3 is read-only). When the security flag of the configuration request indicates that the security attribute is secure and the access target is registers Reg0, Reg1, and Reg2, the system memory management unit 113 determines that the result of the register configuration security check is legal. When the security flag of the configuration request indicates that the security attribute is non-secure and the access target is register Reg2, the system memory management unit 113 determines that the result of the register configuration security check is legal. When the security flag of the configuration request indicates that the security attribute is non-secure and the access target is registers Reg0 and Reg1, the system memory management unit 113 determines that the result of the register configuration security check is illegal (because non-secure configuration requests access secure registers, which may cause key information to be maliciously tampered with, so the security check rule in this embodiment is set to that non-secure configuration requests can only access non-secure registers). When the virtual user identifier (VFID) marked in the address space identifier (ASID) of the configuration request is VF0 and the access target is register Reg4, the system memory management unit 113 determines that the result of the register configuration security check is legal.When the identifier (VFID) marking the virtual user in the address space identifier (ASID) of the configuration request is VF0 and the access target is registers Reg5 and Reg6, the system memory management unit 113 determines that the register configuration security check result is illegal (because virtual users are isolated from each other, it can be prevented that a virtual user intentionally or unintentionally tampered with the information of other virtual users, so the security check rule is set in this embodiment that virtual users can only access corresponding resources such as registers owned by each virtual user, and different virtual users are isolated from each other and cannot access each other). When the identifier (VFID) marking the virtual user in the address space identifier (ASID) of the configuration request is VF3 and the access flag indicates that the access attribute is write and the security flag indicates that the security attribute is secure and the access target is register Reg3, the system memory management unit 113 determines that the register configuration security check result is illegal (because the VFID is illegal, the system stipulates that the VFID can only be VF0, VF1 and VF2). When the identifier (VFID) of the virtual user marked in the address space identifier (ASID) of the configuration request is VF0 and the access flag indicates that the access attribute is write and the security flag indicates that the security attribute is secure and the access target is register Reg3, the system memory management unit 113 determines that the result of the register configuration security check is illegal (because the access attribute of register Reg3 is read-only). When the identifier (VFID) of the virtual user marked in the address space identifier (ASID) of the configuration request is VF0 and the access flag indicates that the access attribute is read and the security flag indicates that the security attribute is secure and the access target is register Reg3, the system memory management unit 113 determines that the result of the register configuration security check is legal. Once the result of the register configuration security check is illegal, the system memory management unit 113 immediately stops processing the virtual address-physical address conversion transaction and returns "fault" to the client device 111 to improve the address conversion efficiency.

[0035] Based on the above, in the process of the system memory management unit 113 processing the virtual address-physical address conversion transaction issued by the client device 111, the system memory management unit 113 performs multiple security checks (such as memory security check, virtual user security check and register configuration security check) to enhance information security. Virtual users can only access corresponding resources such as contexts and registers that they own. Based on the check results, the system memory management unit 113 decides whether to execute the virtual address-physical address conversion transaction. Once an error is found, the system memory management unit 113 immediately stops processing the virtual address-physical address conversion transaction and returns "fault" to the client device 111 to improve address conversion efficiency.

[0036] Although the above embodiments use "memory security check", "virtual user security check" and "register configuration security check" as examples of the multiple security checks, they are not limited to this. For example, the following embodiments will use "context security check", "page table security check", "memory security check", "virtual user security check" and "register configuration security check" as examples of the multiple security checks. During the entire life cycle of the conversion transaction in contact with the system memory management unit 113, the system memory management unit 113 performs a security permission check on the conversion transaction throughout the entire process. Once an error occurs in the security permission check (any security check result is illegal), the system memory management unit 113 will immediately stop address conversion for the conversion transaction and return "fault" to the client device 111 to improve address conversion efficiency. The "memory security check", "virtual user security check" and "register configuration security check" in the following embodiments can refer to the relevant description of the above embodiments, so they will not be repeated.

[0037] Figure 3 is a flowchart of a memory management method according to another embodiment of the present invention. Each step in the flowchart or a combination of steps in the flowchart can be implemented by various means, such as hardware, one or more computer-readable media storing a computer program, or a computer program product. In some embodiments, Figure 3 The operation method shown can be implemented in firmware or software. For example, Figure 3 The related operations of the operation method shown can be implemented as non-transitory machine-readable instructions (code or program), and the non-transitory machine-readable instructions can be stored in a "non-transitory machine-readable storage medium". When the non-transitory machine-readable instructions are executed by a computer, the following operations can be implemented: Figure 3 In some other embodiments, Figure 3 The operation method shown can be implemented in hardware, for example, Figure 1 The client device 111, the management device 112 and the system memory management unit 113 are shown. In some other embodiments, one or more steps in the flowchart may be embodied by a computer program of a computer program product. The computer program product may be stored in one or more memory devices in a computing device and executed by a processor in the computing device.

[0038] Please refer to Figure 1 and Figure 3In step S310, the management device 112 sends a configuration request for register REG1 to the system memory management unit 113. When the management device 112 configures the register REG1 in the system memory management unit 113, the system memory management unit 113 performs a "register configuration security check" to check the security of the register configuration according to the access flag (read / write flag), security flag (security flag), address space identifier (ASID) and other information carried in the configuration request (step S310). Once the result of the register configuration security check is illegal, the system memory management unit 113 immediately stops processing the configuration request and returns a "fault" to the management device 112 to improve the efficiency of the system memory management unit 113.

[0039] In step S320, the virtual address-physical address conversion transaction sent by the client device 111 is sent to the system memory management unit 113. The conversion transaction sent by the client device 111 carries information such as an access flag (read / write flag), a security flag (security flag), and an address space identifier (ASID). The system memory management unit 113 identifies the read / write type (access attribute) of the conversion transaction through the access flag, identifies the security attribute (secure transaction or non-secure transaction) of the conversion transaction through the security flag, identifies the identifier (VFID) of the virtual user to which the conversion transaction belongs through the address space identifier (ASID), and identifies the context and corresponding resources to be used by the virtual address-physical address conversion transaction. The system memory management unit 113 performs multiple security checks on the security attributes, virtual users, and contexts of the virtual address-physical address conversion transaction to enhance information security. For example, the system memory management unit 113 performs a "context security check" and a "virtual user security check" in step S320. Based on the security check, the virtual user can only access the corresponding resources such as the context and registers owned by the virtual user. In step S320, the system memory management unit 113 decides whether to perform the virtual address-physical address conversion transaction based on the check results of the "context security check" and the "virtual user security check". Once an error is found in step S320 (the context security check result or the virtual user security check result is illegal), the system memory management unit 113 immediately stops processing and returns a "fault" to the client device 111 to improve the address conversion efficiency.

[0040] The above-mentioned "context security check" is used to check the attributes of the virtual address-physical address translation transaction and the attributes of the corresponding context used by the virtual address-physical address translation transaction to obtain the context security check result. The security rules of the context security check include: "Secure transactions can only access and use secure contexts and their corresponding resources", "Non-secure transactions can only access and use non-secure contexts and their corresponding resources" and "Different contexts are isolated from each other (can only access and use their own corresponding resources, cannot access each other)". Isolation from each other restricts at the hardware level that any context in the system memory management unit 113 can only use the resources it owns in the system memory management unit 113 to avoid information leakage to other contexts. The resources of the context in the system memory management unit 113 include registers, address translation bypass cache (Translation lookaside buffer, TLB) units (entries), etc. For example, the context security check includes the following operations. When the security attribute of the virtual address-physical address translation transaction is secure and the security attribute of the corresponding context resources is secure, the system memory management unit 113 determines that the context security check result is legal. When the security attribute of the virtual address-to-physical address translation transaction is non-secure and the security attribute of the resource of the corresponding context is non-secure, the system memory management unit 113 determines that the context security check result is legal. When the security attribute of the virtual address-to-physical address translation transaction is non-secure and the security attribute of the resource of the corresponding context is secure, the system memory management unit 113 determines that the context security check result is illegal. When the security attribute of the virtual address-to-physical address translation transaction is secure and the security attribute of the resource of the corresponding context is non-secure, the system memory management unit 113 determines that the context security check result is illegal.

[0041] For example, assume that the system has a total of 2 contexts (context 0, context 1), where context 0 is configured as a secure context and context 1 is configured as a non-secure context. The two contexts each have independent resources and store the information necessary to complete the virtual address-physical address conversion, and different contexts are isolated from each other (cannot access each other). The virtual address-physical address conversion transaction carries a security flag and a context index to be used to facilitate context security checks. When the security flag of the virtual address-physical address conversion transaction indicates that the security attribute is secure and the context to be used is context 0, the system memory management unit 113 determines that the context security check result is legal. When the security flag of the virtual address-physical address conversion transaction indicates that the security attribute is non-secure and the context to be used is context 0, the system memory management unit 113 determines that the context security check result is illegal (because context 0 is configured as a secure context). When the security flag of the virtual address-physical address conversion transaction indicates that the security attribute is secure and the context to be used is context 1, the system memory management unit 113 determines that the context security check result is illegal (because context 1 is configured as a non-secure context). When the security flag of the virtual address-physical address translation transaction indicates that the security attribute is non-secure and the context to be used is context 1, the system memory management unit 113 determines that the context security check result is legal. Once the context security check result is illegal, the system memory management unit 113 immediately stops processing the virtual address-physical address translation transaction and returns a "fault" to the client device 111 to improve the address translation efficiency.

[0042] In step S330, the system memory management unit 113 processes the virtual address-physical address conversion transaction. The system memory management unit 113 isolates resources such as registers and address translation bypass buffer units (TLB entries) based on virtual users and contexts. At the same time, the system memory management unit 113 uses indirect indexes for registers of each context to reduce the occupation of the register address space by the system memory management unit 113. The system memory management unit 113 supports software to configure the security of each context and the number of context resources owned by each virtual user to enhance the flexibility of software when using the system memory management unit 113. When the system memory management unit 113 performs the virtual address-physical address conversion transaction, according to the security attributes, virtual users and contexts identified in step S320, the system memory management unit 113 performs "context security check" and "virtual user security check" to enhance information security. Virtual users can only access the corresponding resources they own (virtual users are isolated from each other and cannot access each other). In the process of the system memory management unit 113 processing the conversion transaction, the system memory management unit 113 performs multiple security checks on the security attributes, virtual users and contexts of the virtual address-physical address conversion transaction to enhance information security. For example, the system memory management unit 113 performs a "context security check" and a "virtual user security check". In step S330, the system memory management unit 113 decides whether to execute the virtual address-physical address conversion transaction based on the check results of the "context security check" and the "virtual user security check". Once an error is found in step S330 (the context security check result or the virtual user security check result is illegal), the system memory management unit 113 immediately stops processing and returns a "fault" to the client device 111 to improve the efficiency of address conversion.

[0043] In step S340, the system memory management unit 113 performs a page table query and a page table security check. When the system memory management unit 113 finds that the "mapping relationship between the virtual address and the physical address" required to complete the conversion transaction is missing (miss) in the address translation bypass buffer (TLB), the system memory management unit 113 needs to perform a page table query (Page Table Walk, PTW) on the page table 121 in the memory 120, that is, the system memory management unit 113 generates a page table query request based on the target context of the virtual address-physical address conversion transaction to obtain the corresponding page table of the virtual address-physical address conversion transaction from the memory 120. When performing a page table query (Page Table Walk, PTW) request, the system memory management unit 113 performs a "page table security check" to enhance information security. In step S340, the system memory management unit 113 decides whether to execute the virtual address-physical address conversion transaction based on the check result of the "page table security check". Once an error is found in step S340 (the page table security check result is illegal), the system memory management unit 113 immediately stops processing and returns a “fault” to the client device 111 to improve address translation efficiency.

[0044] The above-mentioned "page table security check" is used to check the attributes of the target context and the attributes of the target area in the memory 120 where the corresponding page table is located, and obtain the page table security check result. The security rules of the page table security check include: "page table 121 sets a valid flag", "the page table of the security context is stored in the secure area of ​​the memory 120", "the page table of the non-security context is stored in the non-security area of ​​the memory 120" and "the system memory management unit 113 generates a secure or non-secure page table query (PTW) request based on the security of the context". For example, the context security check includes the following operations. When the security attribute of the target context of the virtual address-physical address conversion transaction is secure and the security attribute of the target area (the area in the memory 120 where the corresponding page table required to complete the virtual address-physical address conversion transaction is located) is secure, the system memory management unit 113 determines that the page table security check result is legal. When the security attribute of the target context is non-secure and the security attribute of the target area is non-secure, the system memory management unit 113 determines that the page table security check result is legal. When the security attribute of the target context is secure and the security attribute of the target area is non-secure, the system memory management unit 113 determines that the result of the page table security check is illegal. When the security attribute of the target context is non-secure and the security attribute of the target area is secure, the system memory management unit 113 determines that the result of the page table security check is illegal. After the system memory management unit 113 obtains the corresponding page table required to complete the virtual address-physical address conversion transaction from the memory 120, the system memory management unit 113 also checks the valid flag of the corresponding page table from the memory 120. When the valid flag is not valid, the system memory management unit 113 determines that the result of the page table security check is illegal. When the valid flag is valid, the system memory management unit 113 determines that the result of the page table security check is legal.

[0045] For example, it is assumed that any page table in the page table 121 contains information such as a valid flag, a physical address of a page, a security attribute of a page, and a read-write attribute of a page. Assuming that the security attribute of the target context used by the virtual address-physical address translation transaction is secure and a page table query (PTW) is required, the system memory management unit 113 issues a PTW request with a security attribute of secure to the memory 120 to retrieve the corresponding page table required to complete the virtual address-physical address translation transaction. When the security attribute of the target context of the virtual address-physical address translation transaction is secure and the security attribute of the target area (the area in the memory 120 where the corresponding page table required to complete the virtual address-physical address translation transaction is located) is secure, the system memory management unit 113 determines that the result of the page table security check is legal (the target page table of the virtual address-physical address translation transaction can be retrieved normally). When the security attribute of the target context is secure and the security attribute of the target area is non-secure, the system memory management unit 113 determines that the result of the page table security check is illegal (the target page table of the virtual address-physical address translation transaction cannot be retrieved).

[0046] Assuming that the security attribute of the target context used by the virtual address-physical address translation transaction is non-secure and a page table query (PTW) is required, the system memory management unit 113 issues a PTW request with a non-secure security attribute to the memory 120 to retrieve the corresponding page table required to complete the virtual address-physical address translation transaction. When the security attribute of the target context of the virtual address-physical address translation transaction is non-secure and the security attribute of the target area (the area in the memory 120 where the target page table of the virtual address-physical address translation transaction is located) is secure, the system memory management unit 113 determines that the result of the page table security check is illegal (the target page table of the virtual address-physical address translation transaction cannot be retrieved). When the security attribute of the target context is non-secure and the security attribute of the target area is non-secure, the system memory management unit 113 determines that the result of the page table security check is legal (the target page table of the virtual address-physical address translation transaction can be retrieved normally).

[0047] After the page table lookup (PTW) obtains the corresponding page table from the memory 120, when the valid flag bit of the corresponding page table is invalid, the system memory management unit 113 determines that the page table security check result is illegal. When the valid flag bit of the corresponding page table is valid, the system memory management unit 113 determines that the page table security check result is legal. Once the page table security check result is illegal, the system memory management unit 113 immediately stops processing the virtual address-physical address translation transaction and returns a "fault" to the client device 111 to improve the address translation efficiency.

[0048] In step S350, the system memory management unit 113 performs a memory security check based on the page table that is legal for the security check. According to the read / write type (access attribute) and security attribute of the conversion transaction identified in step S320, the system memory management unit 113 performs a "memory security check" to enhance information security. In step S350, the system memory management unit 113 decides whether to execute the virtual address-physical address conversion transaction based on the check result of the "memory security check". Once an error is found in step S350 (the memory security check result is illegal), the system memory management unit 113 immediately stops processing and returns a "fault" to the client device 111 to improve the address conversion efficiency. Only when all the checks in the above steps S310 to S350 are legal, the system memory management unit 113 completes the virtual address-physical address conversion transaction (step S360).

[0049] Based on the above, the features of this embodiment include:

[0050] 1) There are many types of security permission checks. The security permission check is performed on the entire virtual address-physical address conversion transaction. For different application scenarios of the system memory management unit 113, more security protection performance can be provided. At the same time, once an error is found, the processing can be stopped immediately and a "fault" can be returned to improve the address conversion efficiency.

[0051] 2) The hardware provides a certain security permission checking capability to reduce the pressure on the software to perform security permission checking when using the system memory management unit 113.

[0052] 3) Registers are isolated based on contexts to avoid information leakage between contexts at the hardware level, and indirect indexing is used for registers of each context, thereby reducing the register address space occupied by the system memory management unit 113.

[0053] 4) Based on virtual users, resources such as context, registers, and address translation bypass buffer units (TLB entries) are isolated to avoid information leakage between virtual users at the hardware level.

[0054] 5) Supporting software to configure the security of each context and the number of context resources owned by each virtual user, thereby improving the flexibility of software in using the system memory management unit 113.

[0055] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A memory management system, characterized in that: The memory management system comprises: Customer equipment; Memory; and A system memory management unit is coupled between the client device and the memory, in, The system memory management unit includes a plurality of registers. The system memory management unit performs a plurality of security checks on the virtual address-physical address translation transaction issued by the client device, and the system memory management unit determines whether to execute the virtual address-physical address translation transaction based on the inspection results of the plurality of security checks so as to access the target page in the memory, and the plurality of security checks include: A memory security check is used to check the attributes of the virtual address-to-physical address translation transaction and the attributes of the target page to obtain a memory security check result, wherein the attributes of the virtual address-to-physical address translation transaction include: security attributes and access attributes of the virtual address-to-physical address translation transaction, and the attributes of the target page include: security attributes and access attributes of the target page; A virtual user security check, for checking the validity of a first virtual user initiating the virtual address-to-physical address translation transaction and the validity of a target context of the virtual address-to-physical address translation transaction to obtain a virtual user security check result, wherein when the target context is not owned by the first virtual user, the virtual user security check result is illegal; and The register configuration security check is used to check the configuration request of the management device for the multiple registers to obtain a register configuration security check result, wherein when the target register of the configuration request is owned by a virtual user other than the second virtual user who initiated the configuration request, the register configuration security check result is illegal.

2. The memory management system according to claim 1, characterized in that: The memory safety check includes: When the security attribute of the virtual address-physical address translation transaction and the security attribute of the target page are both secure and the access attribute of the virtual address-physical address translation transaction is read, the memory security check result is legal; When the security attribute of the virtual address-to-physical address translation transaction and the security attribute of the target page are both secure and the access attribute of the virtual address-to-physical address translation transaction is write and the access attribute of the target page is non-read-only, the memory security check result is legal; When the security attribute of the virtual address-to-physical address translation transaction and the security attribute of the target page are both non-secure and the access attribute of the virtual address-to-physical address translation transaction is read, the memory security check result is legal; and When the security attribute of the virtual address-to-physical address translation transaction and the security attribute of the target page are both non-secure and the access attribute of the virtual address-to-physical address translation transaction is write and the access attribute of the target page is non-read-only, the memory security check result is legal.

3. The memory management system according to claim 1, characterized in that: The memory safety check includes: When the security attribute of the virtual address-physical address translation transaction is secure and the security attribute of the target page is non-secure and the access attribute of the virtual address-physical address translation transaction is write, the memory security check result is illegal; and When the security attribute of the virtual address-physical address translation transaction is secure, the security attribute of the target page is non-secure, and the access attribute of the virtual address-physical address translation transaction is read, the memory security check result is legal.

4. The memory management system according to claim 1, characterized in that: The memory safety check includes: When the security attribute of the virtual address-physical address translation transaction is non-secure and the security attribute of the target page is secure, the memory security check result is illegal.

5. The memory management system according to claim 1, characterized in that: The memory safety check includes: When the access attribute of the virtual address-physical address translation transaction is write and the access attribute of the target page is read-only, the memory security check result is illegal.

6. The memory management system according to claim 1, characterized in that: The virtual user security check includes: checking the validity of the identifier of the first virtual user and the validity of the target context accessed by the first virtual user; When the validity of the identifier of the first virtual user is invalid or the validity of the target context is invalid, the virtual user security check result is illegal; and When the target context is owned by the first virtual user and the validity of the identifier of the first virtual user and the validity of the target context are both valid, the virtual user security check result is legal.

7. The memory management system according to claim 1, characterized in that: The register configuration security check includes: When the access attribute of the configuration request is write and the access attribute of the target register is read-only, the register configuration security check result is illegal; When the security attribute of the configuration request is non-secure and the security attribute of the target register is secure, the register configuration security check result is illegal; and When the target register of the configuration request initiated by the second virtual user is owned by the second virtual user, the result of the register configuration security check is legal.

8. The memory management system according to claim 1, characterized in that: The register configuration security check includes: checking the validity of the identifier of the second virtual user and the validity of the target register accessed by the second virtual user; and When the validity of the identifier of the second virtual user is invalid or the validity of the target register is invalid, the register configuration security check result is illegal.

9. The memory management system according to claim 1, characterized in that: The multiple security checks also include: The context security check is used to check the attributes of the virtual address-physical address translation transaction and the attributes of the corresponding context used by the virtual address-physical address translation transaction to obtain a context security check result.

10. The memory management system according to claim 9, characterized in that: The context security check includes: When the security attribute of the virtual address-physical address translation transaction is secure and the security attribute of the resource of the corresponding context is secure, the context security check result is legal; When the security attribute of the virtual address-physical address translation transaction is non-secure and the security attribute of the resource of the corresponding context is non-secure, the context security check result is legal; When the security attribute of the virtual address-physical address translation transaction is non-secure and the security attribute of the resource of the corresponding context is secure, the context security check result is illegal; and When the security attribute of the virtual address-physical address translation transaction is secure and the security attribute of the resource of the corresponding context is non-secure, the context security check result is illegal.

11. The memory management system according to claim 1, characterized in that: The system memory management unit generates a page table query request based on the target context to obtain a corresponding page table of the virtual address-physical address translation transaction from the memory, and the plurality of security checks further include: The page table security check is used to check the attributes of the target context and the attributes of the target area in the memory where the corresponding page table is located to obtain a page table security check result.

12. The memory management system according to claim 11, characterized in that: The page table security check includes: When the security attribute of the target context is secure and the security attribute of the target area is secure, the page table security check result is legal; When the security attribute of the target context is non-secure and the security attribute of the target area is non-secure, the page table security check result is legal; When the security attribute of the target context is secure and the security attribute of the target region is non-secure, the page table security check result is illegal; and When the security attribute of the target context is non-secure and the security attribute of the target region is secure, the page table security check result is illegal.

13. The memory management system according to claim 11, characterized in that: The page table security check includes: Checking the valid flag bit of the corresponding page table from the memory; When the valid flag bit is an error, the page table security check result is illegal; and When the valid flag is correct, the page table security check result is legal.

14. A memory management method, characterized in that: The memory management method comprises: A system memory management unit performs a plurality of security checks on a virtual address-to-physical address translation transaction issued by a client device, wherein the system memory management unit is coupled between the client device and a memory, and the system memory management unit includes a plurality of registers; and The system memory management unit determines whether to perform the virtual address-physical address translation transaction to access a target page in the memory based on the results of the multiple security checks, wherein the multiple security checks include: A memory security check is used to check the attributes of the virtual address-to-physical address translation transaction and the attributes of the target page to obtain a memory security check result, wherein the attributes of the virtual address-to-physical address translation transaction include: security attributes and access attributes of the virtual address-to-physical address translation transaction, and the attributes of the target page include: security attributes and access attributes of the target page; A virtual user security check, for checking the validity of the first virtual user initiating the virtual address-to-physical address translation transaction and the validity of the target context of the virtual address-to-physical address translation transaction to obtain a virtual user security check result, wherein when the target context is not owned by the first virtual user, the virtual user security check result is illegal; and The register configuration security check is used to check the configuration request of the management device for the multiple registers to obtain a register configuration security check result, wherein when the target register of the configuration request is owned by a virtual user other than the second virtual user who initiated the configuration request, the register configuration security check result is illegal.

15. The memory management method according to claim 14, characterized in that: The multiple security checks also include: The context security check is used to check the attributes of the virtual address-physical address translation transaction and the attributes of the corresponding context used by the virtual address-physical address translation transaction to obtain a context security check result.

16. The memory management method according to claim 15, characterized in that: The context security check includes: When the security attribute of the virtual address-physical address translation transaction is secure and the security attribute of the resource of the corresponding context is secure, the context security check result is legal; When the security attribute of the virtual address-physical address translation transaction is non-secure and the security attribute of the resource of the corresponding context is non-secure, the context security check result is legal; When the security attribute of the virtual address-physical address translation transaction is non-secure and the security attribute of the resource of the corresponding context is secure, the context security check result is illegal; and When the security attribute of the virtual address-physical address translation transaction is secure and the security attribute of the resource of the corresponding context is non-secure, the context security check result is illegal.

17. The memory management method according to claim 14, characterized in that: The system memory management unit generates a page table query request based on the target context to obtain a corresponding page table of the virtual address-physical address translation transaction from the memory, and the plurality of security checks further include: The page table security check is used to check the attributes of the target context and the attributes of the target area in the memory where the corresponding page table is located to obtain a page table security check result.

18. The memory management method according to claim 17, characterized in that: The page table security check includes: When the security attribute of the target context is secure and the security attribute of the target area is secure, the page table security check result is legal; When the security attribute of the target context is non-secure and the security attribute of the target area is non-secure, the page table security check result is legal; When the security attribute of the target context is secure and the security attribute of the target region is non-secure, the page table security check result is illegal; and When the security attribute of the target context is non-secure and the security attribute of the target region is secure, the page table security check result is illegal.

Images