Memory configuration

Abstract

The invention relates to a memory configuration. A method of configuring a memory for use in executing an application. Configuring the memory includes defining a set of virtual memory resources associated with one or more contiguous memory regions of the memory. Consecutive virtual memory resources in the set of virtual memory resources are selectively merged based on respective security attributes of the virtual memory resources in the set of virtual memory resources, generating a merged set of virtual memory resources. The security attribute allocated to the virtual memory resource indicates that the virtual memory resource is a secure memory resource, a non-secure memory resource, or a non-secure callable memory resource. Configuration information indicating the merged set of virtual memory resources is stored for execution of the application.

Description

Technical Field

[0001] The present disclosure relates generally to the field of circuits and electronic devices, and to software applications that they may execute. The present disclosure relates more particularly to a configuration interface for an application executed by a processor. Background Art

[0002] A processor or "central processing unit" (CPU) is a complex electronic component that is used to execute a series of software instructions, thereby enabling it to execute application programs.

[0003] For its normal operation, a software application may request access to various functions of the device that implements it, such as memory or other specific electronic components, etc. Before being executed by the electronic device, the application generally uses a configuration interface that allows access to various functions of the device to be configured. Summary of the invention

[0004] One embodiment provides a method for configuring an application executed by a processor that facilitates optimizing a quantity of memory ranges associated with and used by the application based on a value representing a security level of the memory ranges associated with the application.

[0005] One embodiment provides a method for configuring an application executed by a processor, the method facilitating optimization of the number of memory ranges associated with an access controller, the data stored by the application being used. The application accesses the memory through the access controller. The optimization of the number of memory ranges is performed based on a value representing a security level of the memory range. In one embodiment, the access controller includes one or more registers that specify a memory range having a given security level.

[0006] One embodiment provides a method for configuring a memory to execute an application, the application being adapted to be implemented by a processor and using at least two first and second contiguous memory resources and a second contiguous memory resource associated with the application and disposed in at least one memory region of at least one memory,

[0007] wherein the method comprises the step of merging the at least two first and second contiguous memory resources into a third memory resource if the at least two first and second portions have the same security attribute value,

[0008] The method comprises the step of generating configuration data values ​​for a memory range of the memory.

[0009] Another embodiment provides a configuration interface adapted to perform a configuration method of a memory to execute an application, the application adapted to be implemented by a processor and to use at least two first and second contiguous memory resources associated with the application and deployed in at least one memory area of ​​at least one memory,

[0010] wherein the method comprises merging the at least two first portions and the second memory resource into a third memory resource if the at least two first and second portions have the same security attribute value,

[0011] Therein the method comprises the step of generating configuration data values ​​for a memory range of the memory.

[0012] According to an embodiment, the security attribute value is a security level of a portion of the memory.

[0013] According to an embodiment, the value of the attribute of the memory resource of the application may be equal to:

[0014] Safety;

[0015] unsafe; or

[0016] Unsafe callable.

[0017] According to one embodiment, if the value of an attribute of the first part is equal to non-secure, and if the value of an attribute of the second part is equal to non-secure callable, and if the second part is located in a memory area whose attribute value is equal to non-secure callable, then the at least two first parts and the second part are merged into a third part, and the value of the attribute of the third part is equal to non-secure, and the first part and the second part are effectively continuous.

[0018] An embodiment provides a device comprising the previously described interface.

[0019] According to an embodiment, the device comprises the processor adapted to execute an application program.

[0020] According to an embodiment, the device comprises the at least one memory.

[0021] Another embodiment provides a non-transitory device readable by a computer and adapted to perform the aforementioned method.

[0022] In one embodiment, a method for configuring a memory for use in executing an application is provided. Configuring the memory includes: defining a set of virtual memory resources associated with one or more contiguous memory regions of the memory; selectively merging contiguous virtual memory resources in the set of virtual memory resources based on corresponding security attributes of the virtual memory resources in the set of virtual memory resources to generate a merged set of virtual memory resources, wherein the security attributes assigned to the virtual memory resources indicate that the virtual memory resources are secure memory resources, non-secure memory resources, or non-secure callable memory resources; and storing configuration information indicating the merged set of virtual memory resources.

[0023] In one embodiment, a device includes a memory and a processing circuit coupled to the memory. The processing circuit configures the memory for use in executing an application program in operation, and configuring the memory includes: defining a set of virtual memory resources associated with one or more contiguous memory regions of the memory; selectively merging contiguous virtual memory resources in the set of virtual memory resources based on corresponding security attributes of the virtual memory resources in the set of virtual memory resources to generate a merged set of virtual memory resources, wherein the security attribute assigned to the virtual memory resource indicates that the virtual memory resource is a secure memory resource, a non-secure memory resource, or a non-secure callable memory resource; and storing configuration information indicating the merged set of virtual memory resources.

[0024] In one embodiment, a system includes a processing circuit and an interface, wherein the interface couples the processing circuit to a memory in operation. The processing circuit in operation: defines a set of virtual memory resources associated with one or more contiguous memory regions of the memory; selectively merges contiguous virtual memory resources in the set of virtual memory resources based on corresponding security attributes of the virtual memory resources in the set of virtual memory resources to generate a merged set of virtual memory resources, wherein the security attribute assigned to the virtual memory resource indicates that the virtual memory resource is a secure memory resource, a non-secure memory resource, or a non-secure callable memory resource; and stores configuration information indicating the merged set of virtual memory resources.

[0025] In one embodiment, a content configuration processing device of a non-temporary computer-readable medium is used to execute a method, the method comprising: configuring a memory for use in executing an application, configuring the memory comprising: defining a set of virtual memory resources associated with one or more contiguous storage areas of the memory; selectively merging contiguous virtual memory resources in the set of virtual memory resources based on corresponding security attributes of the virtual memory resources in the set of virtual memory resources to generate a merged set of virtual memory resources, wherein the security attributes assigned to the virtual memory resources indicate that the virtual memory resource is a secure memory resource, a non-secure memory resource, or a non-secure callable memory resource; and storing configuration information indicating the merged set of virtual memory resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The above features and advantages and other features and advantages will be described in detail in the following description of specific embodiments given by way of illustration and not limitation with reference to the accompanying drawings, in which:

[0027] Figure 1 The implementation is very schematically illustrated in the form of a block diagram Figures 2 to 12 Examples of electronic devices of embodiments of the present invention;

[0028] Figure 2 An embodiment of a configuration interface of an application is illustrated very schematically in the form of a block diagram;

[0029] Figure 3 An embodiment of a method for configuring an application is illustrated in the form of a block diagram.

[0030] Figure 4 The block diagram shows very schematically Figure 3 An example of an implementation method of the configuration method;

[0031] Figure 5 The block diagram shows very schematically Figure 3 An example of an implementation method of the configuration method;

[0032] Figure 6 The block diagram shows very schematically Figure 3 An example of an implementation method of the configuration method;

[0033] Figure 7 The block diagram shows very schematically Figure 3 An example of an implementation method of the configuration method;

[0034] Figure 8 The block diagram shows very schematically Figure 3 An example of an implementation method of the configuration method;

[0035] Fig. 9 The block diagram shows very schematically Figure 3 An example of an implementation method of the configuration method;

[0036] Fig.10 The block diagram shows very schematically Figure 3 An example of an implementation method of the configuration method;

[0037] Fig.11 The block diagram shows very schematically Figure 3 An example of an implementation of a configuration method; and

[0038] Fig.12 This is very schematically illustrated in the form of a block diagram Figure 3 An example of an implementation of a configuration method. DETAILED DESCRIPTION

[0039] In the various drawings, the same features have been indicated by the same reference numerals. In particular, common structural and / or functional features in various embodiments may have the same reference numerals, and the same structure, size and hardware characteristics may be deployed.

[0040] For the purpose of clarity, operations and elements that are useful for understanding the embodiments described herein have been illustrated and described in detail.

[0041] Unless otherwise specified, when two elements are referred to as being connected together, this means a direct connection without any intermediate elements except conductors, and when two elements are referred to as being coupled together, this means the two elements may be connected or they may be coupled via one or more other elements.

[0042] In the subsequent disclosure, unless otherwise specified, when referring to absolute position qualifiers (such as terms "front", "back", "top", "bottom", "left", "right", etc.), or relative position qualifiers (such as terms "above", "below", "high", "low", etc.), or direction qualifiers (such as terms "horizontal", "vertical", etc.), it refers to the orientation shown in the accompanying drawings.

[0043] Unless otherwise specified, the expressions "around", "approximately", "substantially" and "about" mean within 10%, and preferably within 5%.

[0044] The embodiments described below relate to a method for configuring an application that is executed by a processor and uses memory resources associated with the processor, and an associated configuration interface. Memory resources are here portions, sections, and areas in one or more real or virtual memories managed by the processor.

[0045] According to an embodiment, the configuration interface includes several functions. A first feature allows the security attributes associated with a physical memory region of memory to be modified, and then the memory region to be redefined if needed. A second feature allows a list of memory ranges associated with an application to be generated based in part on the physical partitioning of memory, and then the list of virtual memory ranges to be optimized to limit the number of memory ranges.

[0046] To implement these functions, the configuration interface relies on security attribute values ​​associated with each memory section, memory portion, or memory region and with each memory resource required by the application. More specifically, the security attribute defines whether the physical memory region is secure, and whether the application's memory resources are secure, non-secure, or non-secure callable. The security attribute will be combined with Fig.10 Describe in more detail.

[0047] Figure 1 The architecture of an example of an electronic device 100 designed for implementing a software application is illustrated very schematically in the form of a block diagram.

[0048] According to an embodiment, the electronic device 100 includes a processor 101 (CPU), which is designed to perform various processes on data stored in a memory and / or provided by other circuits of the device 100. According to an embodiment, the processor 101 is more specifically designed to execute one or several applications, such as in combination with Figure 2 As described.

[0049] According to one embodiment, the electronic device 100 includes one or more memories 102 (MEM), such as various types of memories, including, for example, non-volatile memory and / or volatile memory. According to an embodiment, these memories are designed to be used with the processor 101 and used by one or more applications executed by the processor. The processing of the memory by the processor will be combined with Figure 2 Describe in more detail.

[0050] According to an embodiment, the electronic device 100 comprises an input / output circuit 103 (IN / OUT) designed to carry out a communication of data and / or energy with a user and / or with one or several electronic devices.

[0051] As shown, the electronic device 100 includes various circuits 104 (FCT1), 105 (FCT2) and 106 (FCT3) designed to perform various functions. For example, the circuits 104, 105 and 106 may include measurement circuits, data conversion circuits, monitoring circuits for electronic or electromechanical devices, etc.

[0052] The electronic device 100 shown includes one or more data buses 107 designed to transmit data between various components of the electronic device.

[0053] Figure 2 A configuration interface 200 (MMT) or a memory configuration tool 200 for an application 210 (APP) designed to be implemented by a processor 220 (CPU) and using a memory 230 (MEM) is schematically illustrated in the form of a block diagram.

[0054] According to one embodiment, the application 210 is software designed to be executed by the processor 220, and its operation uses one or more hardware resources managed by the processor 220. More specifically, according to one embodiment, the application 210 is designed to use at least a memory resource managed by the processor 220, for example, to read and / or store data. A memory resource here refers to a portion of a memory used by the application 210 to read and / or write data.

[0055] According to one embodiment, the type of processor 220 is as follows Figure 1 The type of processor 101 described. The processor 220 is designed to operate the application 210 using hardware resources such as one or more memories or other components of the electronic device.

[0056] According to an example, the memory 230 is combined with Figure 1 The memory 230 is a memory of the type described above for memory 102. The memory 230 consists of a collection of memory cells, each memory cell being associated with an address. A collection of memory cells of a memory (hereinafter referred to as a memory portion or memory region) may be defined as a list of memory addresses. The memory 230 is designed to communicate with the processor 220.

[0057] According to an embodiment, in order to manage the memory 230 , in particular, in order to manage security issues related to the memory 230 , the processor 220 includes two memory attribute units 221 (IDAU) and 222 (SAU).

[0058] The memory attribute unit or circuit 221 is a hardware memory attribute unit (hereinafter referred to as hardware memory attribute unit 221), which is designed to divide the memory into multiple memory areas and associate the multiple memory areas with security attribute values. Unit 221 is called an implementation-defined attribute unit (IDAU). According to an example, unit 221 is an electronic component part of processor 220. The function of unit 221 is to divide the memory 230 into several storage areas, which means to divide into several sets of storage units. This division of memory is called hardware division of memory. According to an embodiment, each physical memory area is defined by the following:

[0059] Starting address;

[0060] size;

[0061] facultative end address; and

[0062] The value of the security attribute.

[0063] The starting address refers here to the address of the first memory cell of the memory area, which means, for example, the address of the memory cell of rank zero in the memory area. Similarly, the ending address refers here to the address of the last memory cell of the memory area, which means, for example, the address of the memory cell of rank N-1 in the memory area, where N is an integer value of the size of the memory area.

[0064] For the security attribute, each memory region has two possible values. A memory region can be secure or non-secure. A secure memory region is a portion of a memory whose data values ​​are considered secure. In other words, data stored in the secure portion is available to the processor only when the processor is in a secure state (S). According to another definition, data stored in the secure portion is accessible only by secure applications that can generate secure transactions. A non-secure memory region is a portion of a memory whose data values ​​are considered non-secure. In other words, when the processor is in a non-secure state (NS), data stored in the non-secure portion is available to the processor. According to another definition, data stored in the non-secure portion is accessible only by all applications that can issue non-secure transactions. According to an example, for security reasons, all memory regions of a memory are secure by default, some of which are later defined as non-secure.

[0065] According to one embodiment, for the security attribute, each memory region has two possible values. A memory region can be non-secure or non-secure callable. A non-secure callable region is a secure region, but access to which can be given to the processor when the processor is in non-secure mode. When the processor is operating in non-secure mode, the non-secure callable region can be accessed when executing specific secure instructions. According to another definition, a non-secure callable region is a secure region, but in which functions can be called by non-secure software due to a secure path that can transmit secure instructions (such as, for example, secure gateway (SG) instructions).

[0066] The memory attribute unit or circuit 222 is a security attribute unit designed to divide the memory into several memory ranges and associate the several memory ranges with security levels or security attribute values. The unit 222 is called a security attribute unit (SAU). According to an example, the unit 222 is an electronic component part of the processor 220. The data for configuring the memory ranges is stored in the registers of the memory attribute unit 222.

[0067] According to one embodiment, each memory range has three possible security levels. According to one embodiment, a memory range can be secure, non-secure, or non-secure callable. Therefore, the memory range defined by unit 222 includes an additional security level compared to the memory range defined by unit 221, which can only include two different security attribute values. The secure memory range has the same characteristics as the secure physical memory area. The non-secure memory range has the same characteristics as the non-secure physical memory area. The non-secure callable memory range has the same characteristics as the non-secure callable physical memory area.

[0068] According to one embodiment, unit 222 is designed to provide a limited number of memory ranges. According to one example, unit 222 is designed to provide eight memory ranges. In one embodiment, if the memory ranges provided by unit 222 do not cover all of memory 230, then the uncovered memory ranges are assigned a default security level, such as a security level of secure. Merging memory ranges as described herein facilitates using the available limited number of memory ranges to assign a specific security level to multiple or all ranges of memory (e.g., reducing the number of memory ranges in memory that are not covered by the provided limited number (which can be assigned a default security level)).

[0069] The configuration interface 200 is a software tool that allows configuring hardware resources (particularly memory resources) managed by the processor 220 for use by the application 210. To this end, the configuration interface 200 is designed to receive data from the application 210 and from the processor 220, in particular from the unit 221. The configuration interface 200 is designed to provide configuration data to the unit 222. In particular, the configuration interface 200 is designed to rely on the division of the memory 230 into memory areas by the unit 221 and then provide configuration data to define the memory ranges of the unit 222 according to the memory resources required by the functions of the application 210. The configuration interface 200 helps to optimize the number of memory ranges and set their security attribute values, etc. In an embodiment, the configuration interface 200 is particularly suitable for allowing the designer of the application to modify the memory resources used by the application 210 by modifying the values ​​of the security attributes of the memory resources used by the application 210. The functionality of the configuration interface 200 will be combined with Figures 3 to 12A more detailed description is given.

[0070] Figure 3 3 is a block diagram illustrating an implementation mode of a method 300 for configuring an application (more specifically, a method for configuring a memory area of ​​a memory and a memory area of ​​a memory resource used by an application), wherein the method 300 is, for example, composed of a configuration interface 200 (MMT), an application 210 (APP) and a processor 220 (CPU) (all in combination with Figure 2 Described) execution.

[0071] At step 301 (IDAU:MRegion), processor 220 uses hardware attribute unit 221, which is implemented to materially divide the memory into several memory regions. As described above, each memory region is defined by a starting address, a size, a value of a security attribute, and (according to an example) an end address.

[0072] The hardware attribute unit 221 provides a list of data value groups, each representing a memory region. The list represents the hardware partitioning of the memory 230. Based on the hardware partitioning, the configuration interface 200 constructs another list by replacing the non-secure callable memory region with the secure memory region to simplify the user (designer of the application) view. The list constructed by the configuration interface 200 is hereinafter referred to as the main partitioning of the memory. Step 301 combines Figure 4 A more detailed description is given.

[0073] At step 302 (App: AppReg in MRegion) after step 301, the designer of the application 210 prepares a list of memory resources required for the application 210 to run. Each memory resource is characterized by a value of a security attribute.

[0074] According to one embodiment, each memory resource has three possible security levels. According to one embodiment, a memory resource may be secure, non-secure, or non-secure callable. A secure memory resource has the same characteristics as a secure memory area or a secure physical memory area. A non-secure memory resource has the same characteristics as a non-secure memory area or a non-secure physical memory area. A non-secure callable memory resource has the same characteristics as a non-secure callable memory area or a non-secure callable physical memory area. The security level of a memory area is synchronized with the security level of a memory resource (by setting the security level of the memory area, or by moving the memory resource to a memory area with a corresponding security level).

[0075] The designer of application 210 then specifies the location of these memory resources in the memory area defined in step 301. In other words, the designer of application 210 selects, for each memory resource, a physical memory area in which to place the memory resource. According to one example, if the designer knows the value of the security attribute of the memory resource, they can select a memory area with that security attribute value. The implementation of step 302 will be combined with Figure 5 Provide explanation.

[0076] At step 303 (MMT: security check) after step 302, after the declaration of all locations of the memory resources of the application 210, according to one embodiment, the designer may decide to modify the values ​​of the security attributes of the memory resources in each memory area. To this end, the designer of the application uses the configuration interface 200.

[0077] At step 304 (MMT: Merge MRegion) after step 303, after all changes in step 303, the configuration interface 200 merges the continuous memory regions with the same attribute values ​​to obtain a new second partition of the memory. More specifically, if two memory regions share the same security attributes and if they are continuous, the configuration interface 200 merges the two memory regions. Similarly, if two memory regions / portions share the same security attributes and if they are continuous, the configuration interface 200 merges the two memory regions / portions. In addition, if one of the two memory regions / portions is non-secure and the other is non-secure callable and also located in the non-secure callable region in the hardware partition of the memory, and the boundary non-secure callable memory resource is effectively contiguous with the non-secure memory region or separated by a HW reserved memory zone, the configuration interface 200 merges the two memory regions / portions.

[0078] The partitioning obtained by step 304 is referred to as the sub-partitioning of the memory in the following text. Figures 6 to 8 Describe in more detail.

[0079] More specifically, two memory resources are considered contiguous by configuration interface 200 if:

[0080] - if they are effectively continuous;

[0081] - if they are separated by a hardware reserved memory area, the hardware reserved memory area is unavailable and any access to the hardware reserved memory area generates a bus error; or

[0082] - If they are in the same alias memory area.

[0083] The definition of "aliased memory area" is as follows: An aliased memory area is a memory area in which the physical memory is mapped to at least two different memory areas from the perspective of the processor.

[0084] Similarly, two memory regions or memory portions are considered contiguous by configuration interface 200 if:

[0085] - if their corresponding bounding memory resources are contiguous; or

[0086] - if one of them does not contain any memory resources.

[0087] In the alias memory region, the configuration interface 200 forces the memory resource to have the same security attributes as the memory region in which it is located in the hardware partitioning of the memory. In other words, if the designer of the application changes the security attributes of the memory resource in the alias memory region, the configuration interface 200 moves the memory resource to a memory region of the new security attributes that points to the same physical memory.

[0088] In one embodiment, the sub-division of the memory is used by the configuration interface 200 for the following steps of the configuration method and is not sent to the unit 221 .

[0089] After step 304, at step 305 (MMT: Def-SAU area), the subdivision of the memory into memory areas is ready. A set of data values ​​showing virtual memory associated with application 210 can then be created based on the subdivision of the memory and based on the location of the memory resources for application 210. The set of memory areas occupied by the memory resources of application 210 is referred to herein as "virtual memory associated with application 210." Therefore, at step 305, interface 200 generates a set of data values ​​showing virtual main memory based on the subdivision of the memory and the location of the memory resources claimed by application 210. This step will be combined with Fig. 9 and Fig.10 A more detailed description is given.

[0090] According to an example, the designer may decide to modify the values ​​of security attributes of memory resources in various memory areas at step 305. To do this, the designer of the application uses the configuration interface 200.

[0091] At step 306 (MMT: Merge SAU Reg) after step 305, once all data values ​​of the virtual main memory are ready, the configuration interface 200 merges the continuous memory areas with the same attribute values ​​to obtain a set of data values, which shows a new virtual memory including a virtual memory resource, which is referred to as a virtual secondary memory here. Here, if two memory resources are effectively continuous, or if they are separated only by memory resources that are not used by the application 210, then the two memory resources are said to be continuous. More specifically, two memory resources are said to be continuous in the following cases: if they are effectively continuous; or they are located in an alias memory area and they are separated only by memory resources that are not used by the application 210. A storage area pointing to the same physical memory device is called an alias storage area. For alias memory areas, the configuration interface 200 imposes the following rule: an alias non-secure memory area can only host non-secure memory resources. And the processor security hardware mechanism does not allow the non-secure callable memory area and the secure memory area to carry any non-secure memory resources. In other words, they can only carry non-secure callable memory resources or secure memory resources. According to one embodiment, the configuration interface only merges memory areas containing continuous resources with security attribute values ​​"non-secure" and / or "non-secure callable". This step will be combined with Fig.11 and Fig.12 A more detailed description is given.

[0092] At step 307 (SAU: Use SAU-Reg) after step 306, the data values ​​of the virtual secondary memory are ready, and the configuration interface 200 sends these data values ​​to the software attribute unit 222 so that it generates the virtual secondary memory, more specifically, the memory range of the virtual secondary memory. More specifically, the data values ​​of the virtual secondary memory are configured for storage in registers. For example, these data values ​​are memory addresses and security attribute values.

[0093] According to an embodiment, the method for configuring 300 is adapted to be performed by a computer-readable non-transitory device.

[0094] Figure 4 A more detailed illustration of the combination Figure 3 An example of implementation of step 301 is described.

[0095] The method starts at an initial stage (A) of step 301 with a memory 400 (MEM) which is not divided by hardware attribute units. The processor 220 sees this memory as just one large memory area.

[0096] To reach the final stage (B) of step 301, the attribute unit 221 divides the memory 400 into memory regions 401 (MR1), 402 (MR2), 403 (MR3), 404 (MR4), and 405 (MR5). The memory regions 401 to 405 may have the same or different sizes. To this end, memory cells with the same security attribute value are merged into a unique zone. Remember that the value of the security attribute value of a memory region can be secure, non-secure, or non-secure callable.

[0097] The attribute unit 221 formulates a list of groups including data values ​​defining the memory region and sends it to the processor 220. The processor 220 uses this list when accessing the memory. As described above, this list shows the main divisions of the memory region as shown.

[0098] According to the previously described embodiment, the attribute unit 221 can set the value of the security attribute of the storage area to only non-secure or non-secure callable. At the last stage of step 301, the application designer regards the non-secure callable memory area as a secure zone through the configuration interface 200. At the last stage of step 301, the configuration interface 200 regards the non-secure callable area of ​​the main partition as a secure zone.

[0099] Therefore, at stage (B) of step 301, areas 401, 403 and 405 are non-secure callable areas, and areas 402 and 404 are non-secure areas.

[0100] Figure 5 More details on the combination Figure 3 An example of implementation of step 302 is described.

[0101] At the initial stage (A) of step 302, corresponding to the combination Figure 4 In the stage (B) of step 301 described above, the designer of the application 210 uses the configuration interface 200 to configure the memory resources in the application 210. The property unit 221 provides a list of the main partitions of the memory 400 at the configuration interface 200. Figure 4 Likewise, the memory 400 has been divided into five memory areas 401 to 405 .

[0102] At the final stage (B) of step 302, the designer specifies the locations of the application's memory resources in memory areas 401 to 405. Figure 5 In FIG. 4 , it is considered that the memory resource 501 (App Reg) of the application 210 must be located in the memory region 404. Typically, the designer uses the configuration interface 200 to locate each memory resource in a memory region having the same security attribute value.

[0103] Figure 6 A more detailed illustration of the combination Figure 3 A first application example of the implementation of step 304 is described.

[0104] During step 303 , by using interface 200 , the designer of application 210 has the opportunity to modify the security attribute values ​​associated with each memory resource of application 210 .

[0105] At the initial stage (A) of step 304, the memory resource 501 is a non-secure memory resource, but it is always located in the non-secure memory area.

[0106] At the final stage (B) of step 304, the memory configuration interface 200 attempts to optimize the number of memory regions by merging consecutive memory regions with the same attribute values ​​to obtain a secondary partition of the memory 230. Here, all consecutive memory regions with the same security attribute value have been merged, and the secondary partition of the memory remains the same as the primary partition defined by the hardware attribute unit 221.

[0107] Figure 7 A more detailed diagram of the combination Figure 3 A second application example of the implementation of step 304 is described.

[0108] At the initial stage (A) of step 304 , the memory resource 501 has become a non-secure callable memory resource and has been located in the non-secure memory area.

[0109] At the last stage (B) of step 304, the memory configuration interface 200 defines the subdivision of the memory based on the memory attribute values ​​defined at stage (A). Thus, depending on the location of the memory resource 501 in the memory region 404, the region 404 is divided into two or three memory regions. Figure 7 In FIG. 4 , the memory region 404 is considered to be divided into three memory regions 701 , 702 and 703 , where regions 701 and 703 are non-secure regions and region 702 is a non-secure callable region. Memory resource 501 is located in memory region 702 .

[0110] In this case, the secondary partition of the memory 400 is different from the primary partition defined by the hardware attribute unit 221 .

[0111] Figure 8 A more detailed illustration of the combination Figure 3 A third application example of the implementation of step 304 is described.

[0112] At the initial stage (A) of step 304, as Figure 8As shown, the memory resource 501 has become a non-secure callable memory resource and has been located in the non-secure memory area.

[0113] At stage (B) of step 304, memory configuration interface 200 defines subdivision of memory based on the memory attribute values ​​defined at stage (A). Thus, region 404 is divided into two or three memory regions, depending on the location of memory resource 501 in memory region 404. Figure 8 In FIG. 4 , the memory region 404 is considered to be divided into two memory regions 801 and 802 , wherein the region 801 is non-secure callable and the region 802 is a non-secure region. The memory resource 501 is located or designated in the memory region 801 .

[0114] At the final stage (C) of step 304, the memory configuration interface 200 defines a subdivision of the memory by merging contiguous memory portions having the same security attribute value. Here, this is the case where both memory regions 403 and 801 are non-secure callable regions. They are then merged into memory region 803. Thus, memory resource 501 is located in memory region 803.

[0115] In this case, the secondary partition of the memory 400 is different from the primary partition defined by the hardware attribute unit 221 .

[0116] Fig. 9 Describes the combination in more detail Figure 3 An example of implementation of step 305 is described.

[0117] At the initial stage (A) of step 305, the interface 200 has available a set of data values ​​showing the subdivision of the memory and the distribution of the data values ​​showing the specified memory resources of the application 210 in the memory area of ​​the memory 230.

[0118] Therefore, in Fig. 9 In the example, the memory resources of the application 210 are as follows:

[0119] Secure memory resource 901 (App Reg 1), located in the non-secure callable memory area 401;

[0120] Non-secure callable memory resource 902 (App Reg 2), located in non-secure callable memory area 401;

[0121] Non-secure memory resource 903 (App Reg 3), located in non-secure memory region 402;

[0122] Non-secure memory resources 904 (App Reg 4), located in non-secure memory region 404;

[0123] Non-secure memory resources 905 (App Reg 5), located in non-secure memory region 404; and

[0124] Non-secure memory resource 906 (App Reg 6), located in the non-secure memory area 404.

[0125] According to one embodiment, the security attribute value of the memory resource can be modified according to the memory attribute value of the memory area where the memory resource is located. Fig.10 The rules for adjusting these values ​​are described.

[0126] At the last stage (B) of step 305, data of a virtual main memory 900 (App area) associated with the application 210 is generated. The virtual main memory 900 includes memory resources 901 to 906. For memory, the virtual memory associated with the application is a set of data values ​​based on the subdivision of the memory and based on the location of the memory resources for the application. The virtual memory is generated by the interface 200.

[0127] Fig.10 An embodiment of a rule for combining security attribute values ​​of memory resources of an application program according to the values ​​of security attributes of a memory region where the memory resource of the application program is located is illustrated very schematically in the form of a block diagram.

[0128] Fig.10 The physical memory 1000 is illustrated, which is divided into six memory areas 1001 (NS), 1002 (NS), 1003 (NS), 1004 (NSC-S), 1005 (NSC-S), 1006 (NSC-S). Memory areas 1001 to 1003 are non-secure memory areas, and according to one embodiment, memory areas 1004 to 1006 are non-secure callable memory areas.

[0129] exist Fig.10, a list 1010 of six memory resources 1011 (S), 1012 (NSC), 1013 (NS), 1014 (S), 1015 (NSC), and 1016 (NS) of the application is further illustrated, each memory resource being designed to be located in one of the memory regions 1001 to 1006. Each memory resource 1011 to 1016 includes attribute values ​​corresponding to the attribute values ​​intended by the designer of the application. More specifically, memory resources 1011 and 1014 are secure memory resources, memory resources 1012 and 1015 are non-secure callable memory resources, and memory resources 1013 and 1016 are non-secure memory resources.

[0130] exist Fig.10 In the example:

[0131] Memory resource 1011 is located in memory area 1001;

[0132] Memory resources 1012 are located in memory region 1002;

[0133] Memory resource 1013 is located in memory area 1003;

[0134] Memory resources 1014 are located in memory region 1004;

[0135] Memory resources 1015 are located in memory region 1005; and

[0136] Memory resources 1016 are located in memory area 1006 .

[0137] exist Fig.10 , further illustrated is a list 1020 that corresponds to the final list provided by interface 200 to unit 222 when the security attribute values ​​of the memory regions and the security attribute values ​​of the memory resources have been combined.

[0138] If a non-secure memory resource is located in a non-secure callable memory region, then the memory resource becomes non-securely callable. If a non-securely callable memory resource is located in a non-secure memory region, then the memory resource becomes non-securely callable.

[0139] According to an embodiment, the interface 200 may prohibit locating non-secure memory resources into a non-secure callable memory region.

[0140] Thus, a modified list 1020 of memory resources may be generated by the interface 200, and the modified list 1020 includes:

[0141] secure memory resource 1011;

[0142] Non-secure callable memory resources 1012;

[0143] Non-secure memory resources 1013;

[0144] secure memory resource 1014;

[0145] Non-secure callable memory resources 1015; and

[0146] Non-secure callable memory resources 1026 .

[0147] Fig.11 The combination is very schematically illustrated in the form of a block diagram Figure 3 The first implementation mode of steps 302 to 306 is described.

[0148] See the memory resource list 1100 (App Reg). The list 1100 includes eight memory parts 1101 (NS-App Reg 1), 1102 (NS-App Reg 2), 1103 (S-App Reg 3), 1104 (S-App Reg 4), 1105 (NS-App Reg 5), 1106 (NS-App Reg 6), 1107 (NSC-App Reg 7) and 1108 (S-App Reg 8), where:

[0149] Sections 1101, 1102, 1105, and 1106 are non-secure;

[0150] Portions 1103, 1104, and 1108 are safe; and

[0151] Section 1107 is a non-safe callable.

[0152] Stage (A) illustrates a list 1100 of data values ​​enabling provision of a virtual main memory associated with the application 210 .

[0153] Stage (B) illustrates a list 1110 of data values ​​that enables provision of a virtual secondary memory associated with the application 210. In other words, at stage (B), some memory resources have been merged. In particular, since memory portions 1101 and 1102 are contiguous and both are non-secure memory portions, they are merged into non-secure memory portion 1111. Similarly, since memory portions 1105 and 1106 are contiguous and both are non-secure memory portions, they are merged into non-secure memory portion 1112.

[0154] Thus, at the end of step 306, the virtual secondary memory associated with the application program includes a smaller portion of memory than the unoptimized virtual primary memory.

[0155] Fig.12 The combination is very schematically illustrated in the form of a block diagram Figure 3 A second implementation mode of steps 302 to 306 is described.

[0156] Please refer to the memory resource list 1200 (App Reg). The list 1200 includes eight memory parts 1201 (NS-App Reg 1), 1202 (NS-App Reg 2), 1203 (S-App Reg 3), 1204 (S-App Reg 4), 1205 (NS-App Reg 5), 1206 (NS-APP Reg 6), 1207 (NSC-App Reg 7) and 1208 (S-App Reg 8), where:

[0157] Sections 1201, 1202, 1205, and 1206 are non-secure;

[0158] Portions 1203, 1204, and 1208 are safe; and

[0159] Section 1207 is a non-safe callable.

[0160] Stage (A) illustrates a list 1200 of data values ​​enabling provision of a virtual main memory associated with the application 210 .

[0161] Stage (B) illustrates a list 1210 of data values ​​that enables provision of a virtual secondary memory associated with application 210. In other words, at stage (B), some memory resources have been merged. In particular, since memory portions 1201 and 1202 are contiguous and both are non-secure memory portions, they are merged into non-secure memory range 1211 (SAU Reg 1). The definition of the term "contiguous" is the same as given previously.

[0162] In addition, according to the above Fig.11 A variant of the described embodiment, it is contemplated here that if the non-secure callable memory resource is effectively contiguous with the non-secure memory portion or region, and if the non-secure callable memory resource is located in a memory region in the main partition that is considered to be a non-secure callable memory region, then the two memory portions can be merged into the non-secure memory portion. Therefore, memory portions 1205, 1206, and 1207 are merged into non-secure memory range 1212 (SAU Reg 2).

[0163] Thus, at the end of step 306, the virtual secondary memory associated with the application program includes fewer memory resources than the unoptimized virtual primary memory.

[0164] A number of embodiments and variations have been described. Those skilled in the art will appreciate that certain features of these embodiments may be combined, and those skilled in the art will readily conceive of other variations.

[0165] Finally, based on the functional description provided above, actual implementation of the embodiments and variants described herein is within the capabilities of those skilled in the art.

[0166] An embodiment of a method is disclosed for configuring (300) a memory (230) to execute an application (210), the reference program being adapted to be implemented by a processor (101; 220) and using at least two first and second contiguous memory resources (401 to 405; 901 to 906; 1101 to 1108; 1201 to 1208) associated with the application and arranged in at least one storage area (401 to 405) of at least one memory (102; 230; 400; 900; 1100; 1200). The method (300) comprises the following steps, if the at least two first and second contiguous memory resources (901 to 906; 1101 to 1108; 1201 to 1208) have the same security attribute value, then merging (306) the at least two first parts and second parts (901 to 906; 1101 to 1108; 1201 to 1208) into a third memory resource (803; 1111; 1112; 1211; 1212), wherein the method comprises the step of generating (307) a configuration data value of a memory range of the memory (102; 230; 400; 900; 1100; 1200).

[0167] An embodiment of a configuration interface (200) is disclosed, which is suitable for executing a configuration method (300) of a memory (230) to execute an application (210), the application being suitable for being implemented by a processor (101; 220) and using at least two first and second continuous memory resources (401 to 405; 901 to 906; 1101 to 1108; 1201 to 1208) associated with the application and arranged in at least one storage area (401 to 405) of at least one memory (102; 230; 400; 900; 1100; 1200). The method (300) comprises the following steps, if the at least two first and second continuous memory resources (901 to 906; 1101 to 1108; 1201 to 1208) have the same security attribute value, then merging (306) the at least two first and second parts (901 to 906; 1101 to 1108; 1201 to 1208) into a third memory resource (803; 1111; 1112; 1211; 1212), wherein the method may also comprise the step of generating (307) a configuration data value of a memory range of the memory (102; 230; 400; 900; 1100; 1200).

[0168] In one embodiment, the security attribute value is a security level of a portion (401 to 405; 901 to 906; 1101 to 1108; 1201 to 1208) of the memory (102; 230; 400; 900; 1100; 1200).

[0169] In one embodiment, the value of the attribute of the memory resource (901 to 906; 1101 to 1108; 1201 to 1208) of the application (210) may be equal to: secure; non-secure; and non-secure callable.

[0170] In one embodiment, if the value of the attribute of the first part (1206) is equal to non-secure, and if the value of the attribute of the second part (1207) is equal to non-secure callable, and if the second part (1207) is located in a memory area that is considered non-secure callable by the first memory partition and the second part (1207) is effectively continuous with the first part (1206), then the at least two first and second parts (1206, 1207) are merged into a third part (1212), and the value of the attribute of the third part (1212) is equal to non-secure.

[0171] In one embodiment, a method for configuring a memory for use in executing an application is provided. Configuring the memory includes: defining a set of virtual memory resources associated with one or more contiguous memory regions of the memory; selectively merging contiguous virtual memory resources in the set of virtual memory resources based on corresponding security attributes of the virtual memory resources in the set of virtual memory resources to generate a merged set of virtual memory resources, wherein the security attributes assigned to the virtual memory resources indicate that the virtual memory resource is a secure memory resource, a non-secure memory resource, or a non-secure callable memory resource; and storing configuration information indicating the merged set of virtual memory resources.

[0172] In one embodiment, the information indicative of the coalesced set of virtual memory resources comprises configuration data values ​​for one or more memory ranges of memory. In one embodiment, the configuration data values ​​comprise memory addresses and security attribute values.

[0173] In one embodiment, selective merging includes merging continuous virtual memory resources with the same security attribute in a set of virtual memory resources, wherein the same security attribute indicates that the continuous virtual memory resources are non-secure memory resources. In one embodiment, selective merging includes merging continuous virtual memory resources with the following security attributes in a set of virtual memory resources, wherein the security attribute indicates that the continuous virtual memory resources are non-secure memory resources or non-secure callable memory resources.

[0174] In one embodiment, the selective merging includes merging contiguous virtual memory resources in a set of virtual memory resources that have the following security attributes, wherein the security attributes indicate that the contiguous virtual memory resources are non-secure memory resources or non-secure callable memory resources. In one embodiment, the merged contiguous virtual memory resources have a security attribute value indicating that the merged contiguous virtual memory resources are non-secure virtual memory resources.

[0175] In an embodiment, the method includes executing the application using the memory and based on the stored configuration information indicating the coalesced set of virtual memory resources.

[0176] In one embodiment, a device includes a memory and a processing circuit coupled to the memory. The processing circuit configures the memory for use in executing an application program in operation, and configuring the memory includes: defining a set of virtual memory resources associated with one or more contiguous memory regions of the memory; selectively merging contiguous virtual memory resources in the set of virtual memory resources based on corresponding security attributes of the virtual memory resources in the set of virtual memory resources to generate a merged set of virtual memory resources, wherein the security attribute assigned to the virtual memory resource indicates that the virtual memory resource is a secure memory resource, a non-secure memory resource, or a non-secure callable memory resource; and storing configuration information indicating the merged set of virtual memory resources.

[0177] In one embodiment, the information indicative of the coalesced set of virtual memory resources comprises configuration data values ​​for one or more memory ranges of memory. In one embodiment, the configuration data values ​​comprise memory addresses and security attribute values.

[0178] In one embodiment, selective merging includes merging continuous virtual memory resources with the same security attribute in a set of virtual memory resources, wherein the same security attribute indicates that the continuous virtual memory resources are non-secure memory resources. In one embodiment, selective merging includes merging continuous virtual memory resources with the following security attributes in a set of virtual memory resources, wherein the security attribute indicates that the continuous virtual memory resources are non-secure memory resources or non-secure callable memory resources.

[0179] In one embodiment, the selective merging includes merging a continuous virtual memory resource in a set of virtual memory resources that has the following security attributes, wherein the security attributes indicate that the continuous virtual memory resources are non-secure memory resources or non-secure callable memory resources. In one embodiment, the merged continuous virtual memory resources have a security attribute value indicating that the merged continuous virtual memory resources are non-secure virtual memory resources.

[0180] In an embodiment, the processing circuit is operable to: execute the application using the memory and based on the stored configuration information indicating the coalesced set of virtual memory resources.

[0181] In one embodiment, a system includes a processing circuit and an interface, wherein the interface couples the processing circuit to a memory in operation. The processing circuit in operation: defines a set of virtual memory resources associated with one or more contiguous memory regions of the memory; selectively merges contiguous virtual memory resources in the set of virtual memory resources based on corresponding security attributes of the virtual memory resources in the set of virtual memory resources to generate a merged set of virtual memory resources, wherein the security attribute assigned to the virtual memory resource indicates that the virtual memory resource is a secure memory resource, a non-secure memory resource, or a non-secure callable memory resource; and stores configuration information indicating the merged set of virtual memory resources. In one embodiment, the processing circuit implements a configuration tool in operation to perform the selective merging and storage of the configuration information. In one embodiment, the system includes the memory. In one embodiment, the system includes an integrated circuit, which includes the processing circuit, the interface, and the memory.

[0182] In one embodiment, a content of a non-transitory computer-readable medium configures a processing device to execute a method, the method comprising: configuring a memory for use in executing an application, configuring the memory comprising: defining a set of virtual memory resources associated with one or more contiguous storage areas of the memory; selectively merging contiguous virtual memory resources in the set of virtual memory resources based on corresponding security attributes of the virtual memory resources in the set of virtual memory resources to generate a merged set of virtual memory resources, wherein the security attribute assigned to the virtual memory resource indicates that the virtual memory resource is a secure memory resource, a non-secure memory resource, or a non-secure callable memory resource; and storing configuration information indicating the merged set of virtual memory resources. In one embodiment, selectively merging comprises merging contiguous virtual memory resources in the set of virtual memory resources with the same security attribute, wherein the same security attribute indicates that the contiguous virtual memory resource is a non-secure memory resource. In one embodiment, selectively merging comprises merging contiguous virtual memory resources in the set of virtual memory resources with the following security attributes, wherein the security attribute indicates that the contiguous virtual memory resource is a non-secure memory resource or a non-secure callable memory resource. In one embodiment, the content comprises instructions executed by a processing device.

[0183] Some embodiments may take the form of, or include, a computer program product. For example, according to one embodiment, a computer readable medium is provided, comprising a computer program suitable for performing one or more of the above methods or functions. The medium may be a physical storage medium, such as, for example, a read-only memory (ROM) chip, or a disk, such as a digital versatile disk (DVD-ROM), a compact disk (CD-ROM), a hard disk, a memory, a network, or a portable medium article read by an appropriate drive or via an appropriate connection, including encoding with one or more barcodes or other related codes as stored on one or more such computer readable media and readable by an appropriate reader device.

[0184] In addition, in some embodiments, some or all of the methods and / or functionalities may be implemented or provided in other ways, such as at least partially implemented or provided in firmware and / or hardware, including but not limited to: one or more application-specific integrated circuits (ASICs), digital signal processors, discrete circuits, logic gates, standard integrated circuits, controllers (e.g., by executing appropriate instructions, and including microcontrollers and / or embedded controllers), field programmable gate arrays (FPGAs), complex programmable logic devices (CPLDs), etc., as well as devices using RFID technology, and various combinations thereof.

[0185] The various embodiments described above can be combined to provide further embodiments. Aspects of the embodiments can be modified, if necessary to employ concepts of the various patents, applications and publications to provide additional embodiments.

[0186] These and other changes to the embodiments can be made with the benefit of the above detailed description. In general, in the appended claims, the terms used should not be interpreted as limiting the claims to the specific embodiments disclosed in the specification and claims, but should be interpreted to include all possible embodiments and the full range of equivalents to which these claims are entitled. Therefore, the claims are not limited by the present disclosure.

Claims

1. A method comprising: A configuration memory is provided for use in executing an application program, the configuration memory comprising: defining a set of virtual memory resources associated with one or more contiguous memory regions of memory; selectively merging consecutive virtual memory resources in the set of virtual memory resources to generate a merged set of virtual memory resources based on corresponding security attributes of the virtual memory resources in the set of virtual memory resources, wherein the security attributes assigned to the virtual memory resources indicate that the virtual memory resources are secure memory resources, non-secure memory resources, or non-secure callable memory resources; and Configuration information indicating a merged set of virtual memory resources is stored. 2 . The method of claim 1 , wherein the information indicative of the coalesced set of virtual memory resources comprises configuration data values ​​for one or more memory ranges of memory. The method of claim 2 , wherein the configuration data value comprises a memory address and a security attribute value.

4. The method of claim 1, wherein selectively merging comprises: Consecutive virtual memory resources in the set of virtual memory resources having the same security attribute are merged, the same security attribute indicating that the contiguous virtual memory resources are non-secure memory resources.

5. The method of claim 4, wherein selectively merging comprises: The contiguous virtual memory resources in the set of virtual memory resources are merged and have a security attribute indicating that the contiguous virtual memory resources are non-secure memory resources or non-secure callable memory resources.

6. The method of claim 1, wherein selectively merging comprises: The contiguous virtual memory resources in the set of virtual memory resources are merged and have a security attribute indicating that the contiguous virtual memory resources are non-secure memory resources or non-secure callable memory resources.

7. The method of claim 6, wherein the merged contiguous virtual memory resource has a security attribute value indicating that the merged contiguous virtual memory resource is a non-secure virtual memory resource.

8. The method according to claim 1, comprising: An application is executed using the memory and based on the stored configuration information indicating the merged set of virtual memory resources.

9. A device comprising: Memory; A processing circuit coupled to the memory, wherein the processing circuit is operable to configure the memory for use in executing the application, configuring the memory comprising: defining a set of virtual memory resources associated with one or more contiguous memory regions of memory; selectively merging consecutive virtual memory resources in the set of virtual memory resources to generate a merged set of virtual memory resources based on corresponding security attributes of the virtual memory resources in the set of virtual memory resources, wherein the security attributes assigned to the virtual memory resources indicate that the virtual memory resources are secure memory resources, non-secure memory resources, or non-secure callable memory resources; and Configuration information indicating a merged set of virtual memory resources is stored.

10. The device according to claim 9, wherein: The information indicative of the coalesced set of virtual memory resources includes configuration data values ​​for one or more memory ranges of memory. The apparatus of claim 10 , wherein the configuration data values ​​include memory addresses and security attribute values.

12. The apparatus of claim 9, wherein selectively merging comprises: Consecutive virtual memory resources in the set of virtual memory resources having the same security attribute are merged, the same security attribute indicating that the contiguous virtual memory resources are non-secure memory resources.

13. The apparatus of claim 12, wherein selectively merging comprises: The contiguous virtual memory resources in the set of virtual memory resources are merged and have a security attribute indicating that the contiguous virtual memory resources are non-secure memory resources or non-secure callable memory resources.

14. The apparatus of claim 9, wherein selectively merging comprises: The contiguous virtual memory resources in the set of virtual memory resources are merged and have a security attribute indicating that the contiguous virtual memory resources are non-secure memory resources or non-secure callable memory resources.

15. The apparatus of claim 14, wherein the merged contiguous virtual memory resource has a security attribute value indicating that the merged contiguous virtual memory resource is a non-secure virtual memory resource.

16. The apparatus of claim 9, wherein the processing circuit is in operation: An application is executed using the memory and based on the stored configuration information indicating the merged set of virtual memory resources.

17. A system comprising: Processing circuit; and An interface that, in operation, couples the processing circuit to the memory, wherein the processing circuit, in operation: defining a set of virtual memory resources associated with one or more contiguous memory regions of memory; selectively merging consecutive virtual memory resources in the set of virtual memory resources to generate a merged set of virtual memory resources based on corresponding security attributes of the virtual memory resources in the set of virtual memory resources, wherein the security attribute assigned to the virtual memory resource indicates that the virtual memory resource is a secure memory resource, a non-secure memory resource, or a non-secure callable memory resource; and Configuration information indicating a merged set of virtual memory resources is stored.

18. The system of claim 17, wherein the processing circuitry is operable to implement a configuration tool to perform the selective merging and the storing of the configuration information.

19. The system according to claim 17, comprising: The memory.

20. The system according to claim 19, comprising: An integrated circuit comprises the processing circuit, the interface and the memory.

21. A non-transitory computer readable medium having contents configuring a processing device to perform a method, the method comprising: Configuration memory for use in executing the application, configuration memory includes: defining a set of virtual memory resources associated with one or more contiguous memory regions of memory; selectively merging consecutive virtual memory resources in the set of virtual memory resources to generate a merged set of virtual memory resources based on corresponding security attributes of the virtual memory resources in the set of virtual memory resources, wherein the security attributes assigned to the virtual memory resources indicate that the virtual memory resources are secure memory resources, non-secure memory resources, or non-secure callable memory resources; and Configuration information indicating a merged set of virtual memory resources is stored.

22. The non-transitory computer readable medium of claim 21 , wherein selectively merging comprises: Consecutive virtual memory resources in the set of virtual memory resources having the same security attribute are merged, the same security attribute indicating that the contiguous virtual memory resources are non-secure memory resources.

23. The non-transitory computer readable medium of claim 22, wherein selectively merging comprises: Consecutive virtual memory resources in the set of virtual memory resources are merged, the security attribute indicating that the contiguous virtual memory resources are non-secure memory resources or non-secure callable memory resources.

24. The non-transitory computer readable medium of claim 21 , wherein selectively merging comprises: Consecutive virtual memory resources in the set of virtual memory resources are merged, the security attribute indicating that the contiguous virtual memory resources are non-secure memory resources or non-secure callable memory resources.

25. The non-transitory computer-readable medium of claim 21, wherein the content comprises instructions executed by a processing device.

Images