Memory protection method and related device

Abstract

A memory protection method is applied to realizing physical memory isolation. In the method, the segment register is adopted to record the operation authority of the memory area where the page table is located, and the authority table is adopted to record the operation authority of the memory area where the to-be-accessed data is located, so that the page table access operation in the memory access process can realize authority check based on the segment register with relatively high reading speed; the permission check is avoided by querying the permission table in the memory, and the efficiency of the permission check of the page table access operation is improved, so that the overall efficiency of physical memory protection is improved. Moreover, as the resources of the segment register are limited, the operation authority of the memory area where the data to be accessed are located is recorded through the authority table, it is ensured that a large amount of data of different types can achieve recording of corresponding authorities based on the authority table, and the expandability of physical memory protection is ensured.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to a memory protection method and related devices. Background Art

[0002] In the field of computer security technology, Trusted Execution Environment (TEE) can provide an isolation domain for upper-level applications through hardware and firmware, thereby ensuring that the calculations and data of applications in the isolation domain can be protected by hardware and firmware. The key technology of TEE is the isolation of physical memory, that is, the physical memory corresponding to different isolation domains is isolated. The physical memory corresponding to an isolation domain is not allowed to be accessed by applications in other isolation domains.

[0003] In order to implement the physical memory isolation mechanism of TEE, an isolation solution based on a permission table is currently generally used. Specifically, for different memory areas, a permission table is used to record the corresponding operation permissions of each memory area. In this way, when any application accesses a specific memory area, it can be checked by checking the permission table to check whether the application has the permission to access the memory area.

[0004] Since the permission table is usually stored in the memory in the permission table-based isolation scheme, the permission table-based isolation scheme will introduce a large number of additional memory access operations (i.e., access permission table operations), which will bring a large performance overhead and result in low efficiency in implementing physical memory protection. Summary of the invention

[0005] The present application provides a memory protection method, which can improve the efficiency of implementing physical memory protection.

[0006] The first aspect of the present application provides a memory protection method, which is used to implement an isolation mechanism for physical memory. In this method, a first memory access request is first obtained. The first memory access request can be initiated by an application or a running function, and is used to request access to data in the memory. In addition, the first memory access request includes a first virtual address and a first operation performed on the data corresponding to the first virtual address. The first operation includes, for example, reading, writing, or executing. That is, the first operation can be, for example, reading data in the memory; or, the first operation can be writing new data to the memory; or, the first operation can be executing data in the memory (such as executing program code in the memory).

[0007] Then, in the process of determining the first physical address corresponding to the first virtual address, a permission check of the first page table access operation is performed by querying the first segment register. The first segment register is used to record the operation permission of the memory area where the page table is located, the page table is used to record the mapping relationship between the first virtual address and the first physical address, and the first page table access operation is used to determine the first physical address corresponding to the first virtual address by accessing the page table. If the page table access operation passes the permission check, the operation content indicated by the page table access operation continues to be executed, that is, the page table in the memory is read, so as to query and obtain the first physical address corresponding to the first virtual address.

[0008] Secondly, in the process of executing the first operation based on the first physical address, since the process of executing the first operation based on the first physical address is actually also a memory access behavior, it is also necessary to perform a permission check on the first operation. At this time, the permission check of the first operation is performed by querying the permission table in the memory, and the permission table is used to record the operation permission of the memory area where the first physical address is located.

[0009] In this solution, by using the segment register in the central processing unit (CPU) to record the operation permissions of the memory area where the page table is located, and using the permission table to record the operation permissions of the memory area where the data to be accessed is located, the page table access operation in the memory access process can be based on the segment register to implement permission checks, avoiding the permission check by querying the permission table in the memory, improving the efficiency of the permission check of the page table access operation, and thus improving the overall efficiency of physical memory protection. Specifically, for the process of converting the virtual address to the physical address by accessing the page table in the memory during the memory access process, the segment register is introduced to uniformly record the operation permissions of the page table, and the permission table in the memory can be accessed instead of accessing the segment register in the process of performing the permission check of the page table access operation. Since the reading speed of the segment register is much higher than the reading speed of the memory, this solution can effectively improve the efficiency of the permission check.

[0010] In addition, since segment register resources are limited, the operating permissions for the memory area where the data to be accessed is located are recorded through a permission table, ensuring that a large number of different types of data can record corresponding permissions based on the permission table, thereby ensuring the scalability of physical memory protection.

[0011] In one possible implementation, the first segment register is used to record the operation permissions of a continuous memory area, and the continuous memory area is used to store one or more page tables, and the one or more page tables correspond to the same operation permissions. In other words, for multiple page tables corresponding to the same operation permissions in the system, the multiple page tables can be placed in a continuous memory area, and the permissions of this continuous memory area can be recorded through the first segment register. In this way, for multiple different page tables, a small number of segment registers can be used to record the operation permissions of a large number of different page tables, saving segment register resources.

[0012] In a possible implementation, the above-mentioned memory protection method is applied to a virtual machine scenario. In the virtual machine scenario, the page table that uses the first segment register to record the operation permission includes a client page table and a nested page table, the client page table is used to indicate the mapping relationship between the first virtual machine address and the client physical address, the nested page table is used to indicate the mapping relationship between the client physical address and the host physical address, and the first physical address belongs to the host physical address.

[0013] That is to say, in the virtual machine scenario, for all types of page tables needed during address translation, segment registers can be used to record the operation permissions of these page tables, thereby adjusting the permission check behavior for page table access operations to access high-speed segment registers, avoiding a large number of additional memory access behaviors introduced by access permission tables, and effectively improving the performance of physical memory protection.

[0014] In one possible implementation, the above-mentioned memory protection method also includes: obtaining a second memory access request, the second memory access request includes a second virtual address and a second operation performed on the data corresponding to the second virtual address; in the process of determining the second physical address corresponding to the second virtual address, performing a permission check for the second page table access operation by querying the first segment register, the page table is also used to record the mapping relationship between the second virtual address and the second physical address, and the second page table access operation is used to determine the second physical address corresponding to the second virtual address by accessing the page table; in the process of executing the second operation based on the second physical address, performing a permission check for the second operation by querying the second segment register, and the second segment register is used to record the operation permission of the memory area where the second physical address is located.

[0015] That is, for the memory area where the second physical address is located, the second segment register may be used to record the operation permission corresponding to the memory area. In this way, when the second operation indicated in the second memory access request is executed based on the second physical address, the permission check of the second operation may be performed by querying the second segment register, thereby further avoiding the memory access behavior caused by querying the permission table.

[0016] In this solution, when there are sufficient segment registers, in addition to using some segment registers to record the operation permissions of the memory area where the page table is located, other segment registers are also used to record the operation permissions of the memory area where some data accessed by the application is located, thereby ensuring that when executing memory access operations for this part of data, all permission checks can be converted into querying the segment registers, further reducing the memory access behavior caused by the access permission table and effectively improving the performance of physical memory protection.

[0017] In a possible implementation, the second segment register is used to record the operation permission of the memory area where the target data is located, the target data is data with an access frequency greater than a preset threshold, and the target data includes data located at the second physical address.

[0018] In other words, the second segment register is actually used to record the operating permissions of the memory area where the data with high access frequency is located. For example, in a database scenario, the database system can pre-allocate a continuous memory area to store data with high access frequency, and use the second segment register to record the operating permissions of this continuous memory area. In this way, when any application triggers access to the frequently accessed data stored in this continuous memory area, it can query the second segment register to implement the permission check of the data access behavior, without having to query the permission table in the memory to implement the permission check, thereby improving the efficiency of the permission check.

[0019] In a possible implementation, the second segment register is used to record the operation authority of the memory area allocated to the target application, and the data generated by the target application includes data located at the second physical address.

[0020] In this solution, since the data generated by the target application are all stored in the memory area allocated for the target application, when accessing the data generated by the target application, the permission of the data access behavior can be checked by accessing the second segment register, thereby reducing the additional memory access behavior generated by the application accessing this part of the data and maximizing the access efficiency of data with higher access frequency.

[0021] In a possible implementation, the above-mentioned memory protection method is applied to a trusted execution environment, and the trusted execution environment includes a security monitor, and the security monitor is used to configure the first-segment register and the data recorded in the permission table.

[0022] A second aspect of the present application provides a memory protection device, including: an acquisition module, used to acquire a first memory access request, the first memory access request including a first virtual address and a first operation performed on data corresponding to the first virtual address; a processing module, used to perform a permission check of a first page table access operation by querying a first segment register in a process of determining a first physical address corresponding to the first virtual address, the first segment register being used to record the operation permissions of a memory area where a page table is located, the page table being used to record a mapping relationship between the first virtual address and the first physical address, the first page table access operation being used to determine the first physical address corresponding to the first virtual address by accessing the page table; the processing module is also used to perform a permission check of the first operation by querying a permission table in a process of performing the first operation based on the first physical address, the permission table being used to record the operation permissions of the memory area where the first physical address is located.

[0023] In a possible implementation, the first segment register is used to record the operation permission of a continuous memory area, the continuous memory area is used to store one or more page tables, and the one or more page tables correspond to the same operation permission.

[0024] In one possible implementation, the above-mentioned memory protection device is applied to a virtual machine scenario; in the virtual machine scenario, the page table includes a client page table and a nested page table, the client page table is used to indicate the mapping relationship between the first virtual machine address and the client physical address, and the nested page table is used to indicate the mapping relationship between the client physical address and the host physical address, and the first physical address belongs to the host physical address.

[0025] In one possible implementation, the acquisition module is also used to acquire a second memory access request, the second memory access request includes a second virtual address and a second operation performed on the data corresponding to the second virtual address; the processing module is also used to perform a permission check on the second page table access operation by querying the first segment register in the process of determining the second physical address corresponding to the second virtual address, the page table is also used to record the mapping relationship between the second virtual address and the second physical address, the second page table access operation is used to determine the second physical address corresponding to the second virtual address by accessing the page table; the processing module is also used to perform a permission check on the second operation by querying the second segment register in the process of performing the second operation based on the second physical address, the second segment register is used to record the operation permission of the memory area where the second physical address is located.

[0026] In a possible implementation, the second segment register is used to record the operation permission of the memory area where the target data is located, the target data is data with an access frequency greater than a preset threshold, and the target data includes data located at the second physical address.

[0027] In a possible implementation, the second segment register is used to record the operation authority of the memory area allocated to the target application, and the data generated by the target application includes data located at the second physical address.

[0028] In a possible implementation, the above-mentioned memory protection device is applied to a trusted execution environment, and the trusted execution environment includes a security monitor, and the security monitor is used to configure the first segment register and the data recorded in the permission table.

[0029] In a possible implementation manner, the first operation includes reading, writing or executing.

[0030] The third aspect of the present application provides a memory protection device, which may include a processor, the processor and a memory are coupled, the memory stores program instructions, and when the program instructions stored in the memory are executed by the processor, the method of the first aspect or any implementation of the first aspect is implemented. For the steps in each possible implementation of the first aspect executed by the processor, the details can be referred to the first aspect, and will not be repeated here.

[0031] The fourth aspect of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer executes the method of any implementation manner of the first aspect.

[0032] A fifth aspect of the present application provides a circuit system, the circuit system includes a processing circuit, and the processing circuit is configured to execute a method in any implementation manner of the above-mentioned first aspect.

[0033] The sixth aspect of the present application provides a computer program product, which, when executed on a computer, enables the computer to execute a method implemented in any one of the first aspects.

[0034] The seventh aspect of the present application provides a chip system, which includes a processor for supporting a server or a feature screening device to implement the functions involved in any implementation of the first aspect, for example, processing the data and / or information involved in the above method. In one possible design, the chip system also includes a memory, which is used to store program instructions and data necessary for the server or feature screening device. The chip system can be composed of chips, or it can include chips and other discrete devices.

[0035] The beneficial effects of the second to seventh aspects mentioned above can be referred to the introduction of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A schematic diagram of an implementation process of physical memory protection in the related art;

[0037] Figure 2 A schematic diagram of the structure of an electronic device 101 provided in an embodiment of the present application;

[0038] Figure 3 A schematic diagram of a system architecture provided for an embodiment of the present application;

[0039] Figure 4 A flowchart of a memory protection method provided in an embodiment of the present application;

[0040] Figure 5 A schematic diagram of optimizing permission checking through segment registers provided in an embodiment of the present application;

[0041] Figure 6 A flowchart of another memory protection method provided in an embodiment of the present application;

[0042] Figure 7 A schematic diagram of another method of optimizing permission checking through segment registers provided in an embodiment of the present application;

[0043] Figure 8 A schematic diagram of a flow chart for configuring a segment register and a permission table provided in an embodiment of the present application;

[0044] Fig. 9 A schematic diagram of a configuration segment register provided in an embodiment of the present application;

[0045] Fig.10 A schematic diagram of a configuration permission table provided in an embodiment of the present application;

[0046] Fig.11 A schematic diagram of the structure of a memory protection device provided in an embodiment of the present application;

[0047] Fig.12 A schematic diagram of the structure of an execution device provided in an embodiment of the present application;

[0048] Fig.13 A schematic diagram of the structure of a computer-readable storage medium provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments.

[0050] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein.

[0051] In addition, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus that includes a series of steps or elements is not necessarily limited to those steps or elements explicitly listed, but may include other steps or elements not explicitly listed or inherent to such process, method, product, or apparatus.

[0052] To facilitate understanding, some technical terms involved in the embodiments of the present application are first introduced below.

[0053] (1) Trusted Execution Environment

[0054] A trusted execution environment is a secure program execution environment that is not subject to external interference or attack. A trusted execution environment is essentially a secure execution environment isolated from the operating system and provided by hardware.

[0055] Considering the Linux operating system, which is popular in the current server field, the design of its macro kernel (all kernel codes run in a high-privilege mode and can arbitrarily access the code and memory of user-mode programs) and the huge amount of code mean that any vulnerability in the kernel may cause an attacker to control the entire kernel and use the kernel's high privileges to attack low-privilege user-mode programs, change the normal execution flow or steal user data. Considering the cloud service scenario, the user's program runs on the server provided by the cloud service provider, and the operating system or the lower-level virtual machine manager itself is under the control of the server vendor. The user cannot guarantee whether his program can run correctly. How to ensure the correct operation of the program and the security of the data when other user programs running on the same machine or even high-privilege programs such as the operating system kernel are not trustworthy has become a new problem. Therefore, the concept of trusted execution environment came into being. Generally, TEE technology requires a lightweight (minimizing the number of vulnerabilities) and verifiable (proving its security through formal verification and other methods) trusted base, such as a security monitor, and uses the software and hardware in the trusted base to provide a safe and reliable operating environment for upper-level applications.

[0056] (2) Security Monitor

[0057] The security monitor is system software with the highest security privileges in a trusted execution environment that is used to manage confidential virtual machines and security applications.

[0058] (3) Register

[0059] Registers are high-speed storage components with limited storage capacity in the CPU. Simply put, registers are small storage areas inside the CPU used to store data, and are used to temporarily store data involved in calculations and calculation results. Compared to the memory in the computer, registers have very high read and write speeds, so data transfer between registers is very fast.

[0060] (4) Segment registers

[0061] Segment register is a register in CPU. Segment register is set for memory segmentation management. Specifically, the computer needs to segment memory to allocate it to different programs. When describing memory segmentation, the following segment information is required: 1. Segment size; 2. Segment start address; 3. Segment management attributes (write-forbidden / execution-forbidden / system-only, etc.). Therefore, segment register is specially used to store information of memory segmentation.

[0062] (5) Virtual address (VA)

[0063] A virtual address refers to the address of a storage unit seen from the application's perspective in a computer architecture. A virtual address is often different from a physical address of a storage unit and needs to be converted into a physical address (PA) by an address translator.

[0064] Simply put, a virtual address is usually an address generated by the CPU in a computer when an application is running; a physical address is a real address in physical memory.

[0065] (6) Page Table

[0066] The page table is a special data structure used to record the mapping relationship between virtual addresses and physical addresses. Generally, in a computer, the memory management unit (MMU) can achieve the conversion between virtual addresses and physical addresses by querying the page table.

[0067] After the applicant's research, it was found that the current isolation scheme based on the permission table is aimed at different memory areas, and the permission table is used to record the corresponding operation permissions of each memory area. Generally speaking, for the memory access request initiated by the application, it is often necessary to convert the virtual address indicated in the memory access request into a physical address before the corresponding physical address in the memory can be accessed. Since the page table that records the mapping relationship between the virtual address and the physical address is actually stored in the memory, the behavior of converting the virtual address to the physical address needs to be implemented by accessing the page table in the memory. In addition, under the physical memory isolation mechanism, in order to avoid the tampering behavior of the application program against the page table, the page table located in the memory usually needs to be protected by the permission table. That is, the operation permissions of the memory area where the page table is located will be recorded in the permission table. In this way, when the conversion from the virtual address to the physical address is realized by accessing the page table, the access behavior of the page table can be performed. Permission check to determine whether the access behavior of the page table is legal.

[0068] Generally, in order to improve the query efficiency of the permission table, two levels of permission tables are set up. Specifically, a root permission table is responsible for recording the permissions of the coarse-grained memory range, and another leaf permission table is responsible for recording the permissions of the fine-grained memory range. When querying the operation permissions of a memory area, you need to query the roottable first, and then query the specific operation permissions corresponding to the memory area in the corresponding leaf table based on the instructions of the root table.

[0069] Similarly, the page table is stored in the physical memory in the form of a three-level tree. For example, the root of the tree is a 4096-byte page table page, which contains 512 page tables, which contain the physical addresses of the next-level page table pages. Each page table in the intermediate-level page table page contains the physical address of the last-level page table page. In this way, by querying the page table pages level by level, it is possible to query the target page table that records the mapping relationship between a specific virtual address and a physical address.

[0070] Therefore, when the permission table is divided into two levels and the page table is divided into three levels, a large number of memory access operations will be introduced in the process of querying the physical address corresponding to the virtual address, resulting in a non-negligible performance overhead.

[0071] For example, see Figure 1 , Figure 1 FIG. 1 is a schematic diagram of an implementation process of physical memory protection in the related art. Figure 1As shown in the figure, when executing a memory access request initiated by an application, it is necessary to first query the corresponding physical address based on the virtual address in the memory access request (i.e., query the three page tables at the L2-L0 level based on the virtual address), and then access the corresponding data based on the queried physical address. That is, there are four memory access behaviors in the process of executing a memory access request. The first three memory access behaviors are used to query the page table in the memory to determine the physical address corresponding to the virtual address, and the last memory access is used to access the corresponding data.

[0072] Since the page table is located in the memory, before accessing the page table in the memory, it is necessary to query the permission table to determine whether the current access to the page table is legal. In this way, for the three memory access behaviors targeting the page table, it is necessary to query the permission table before each query of the page table. In addition, the permission table is divided into two levels, so it is necessary to access the memory twice to query the two-level permission table in the memory.

[0073] In this way, for the memory access request initiated by the application, there are actually 12 memory access behaviors. Among them, the first memory access behavior and the second memory access behavior are to query the L1-level permission table and the L0-level permission table respectively to determine whether the behavior of accessing the L2-level page table is legal (that is, to perform a permission check on the L2-level page table access behavior); after the permission check is passed, the third memory access behavior is executed, that is, to query the L2-level page table. The fourth memory access behavior and the fifth memory access behavior are to query the L1-level permission table and the L0-level permission table respectively to determine whether the behavior of accessing the L1-level page table is legal; after the permission check is passed, the sixth memory access behavior is executed, that is, to query the L1-level page table. By analogy, in the process of querying the three-level page table, two memory access behaviors need to be executed before querying each level of the page table to query the L1-level permission table and the L0-level permission table to determine whether the page table access behavior is legal. Therefore, in the process of querying the page table, there are a total of 6 additional memory access behaviors.

[0074] After obtaining the physical address by querying the third-level page table, it is necessary to query the permission table twice (i.e., the 10th memory access behavior and the 11th memory access behavior) to check whether the access to the physical address is legal. Finally, after the permission check passes, the 12th memory access behavior is executed, that is, the data at the physical address is accessed, completing the application's memory access.

[0075] From the above analysis, it can be seen that the current isolation scheme based on permission tables will introduce a large number of additional memory access operations (i.e., access operations on the permission table before accessing the page table), which will bring about a large performance overhead and result in low efficiency in implementing physical memory protection.

[0076] In view of this, the present application provides a memory protection method, which uses the segment register in the CPU to record the operation permissions of the memory area where the page table is located, and uses the permission table to record the operation permissions of the memory area where the data to be accessed is located, so that the page table access operation in the memory access process can be based on the segment register to implement permission checks, avoiding the permission check by querying the permission table in the memory, improving the efficiency of the permission check of the page table access operation, and thus improving the overall efficiency of physical memory protection. In addition, since the segment register resources are limited, the operation permissions of the memory area where the data to be accessed is located are recorded through the permission table, ensuring that a large number of different types of data can implement the recording of corresponding permissions based on the permission table, and ensuring the scalability of physical memory protection.

[0077] For ease of understanding, the device and system architecture to which the memory protection method provided in the embodiments of the present application is applied will be introduced below.

[0078] See also Figure 2 , Figure 2 Schematic diagram of the structure of an electronic device 101 provided in an embodiment of the present application. Figure 2 As shown, the electronic device 101 to which the memory protection method provided in the embodiment of the present application is applied includes a processor 103, and the processor 103 is coupled to a system bus 105. The processor 103 can be one or more processors, each of which can include one or more processor cores. A display adapter (video adapter) 107, which can drive a display 109, and the display 109 is coupled to the system bus 105. The system bus 105 is coupled to an input-output (I / O) bus through a bus bridge 111. An I / O interface 115 is coupled to the I / O bus. The I / O interface 115 communicates with a variety of I / O devices, such as an input device 117 (such as a touch screen, etc.), an external memory 121 (for example, a hard disk, a floppy disk, an optical disk or a USB flash drive), a multimedia interface, etc.). A transceiver 123 (which can send and / or receive radio communication signals), a camera 155 (which can capture static and dynamic digital video images) and an external USB port 125. Optionally, the interface connected to the I / O interface 115 can be a USB interface.

[0079] The processor 103 may be any conventional processor, including a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, or a combination thereof. Alternatively, the processor may be a dedicated device such as an ASIC.

[0080] The electronic device 101 can communicate with the software deployment server 149 through the network interface 129. Exemplarily, the network interface 129 is a hardware network interface, such as a network card. The network 127 can be an external network, such as the Internet, or an internal network, such as Ethernet or a virtual private network (VPN). Optionally, the network 127 can also be a wireless network, such as a WiFi network, a cellular network, etc.

[0081] The hard disk drive interface 131 is coupled to the system bus 105. The hard disk drive interface is connected to the hard disk drive 133. The internal memory 135 is coupled to the system bus 105. The data running in the internal memory 135 may include an operating system (OS) 137 of the electronic device 101, an application 143, and a scheduler.

[0082] The operating system includes a shell 139 and a kernel 141. Shell 139 is an interface between the user and the kernel of the operating system. The shell is the outermost layer of the operating system. The shell manages the interaction between the user and the operating system: waiting for user input, interpreting user input to the operating system, and processing various operating system output results.

[0083] The kernel 141 consists of those parts of the operating system that manage memory, files, peripherals, and system resources. The kernel 141 interacts directly with the hardware. The operating system kernel usually runs processes and provides communication between processes, provides CPU time slice management, interrupts, memory management, IO management, etc.

[0084] See also Figure 3 , Figure 3 A schematic diagram of a system architecture provided in an embodiment of the present application. Figure 3 As shown, the system architecture used by the memory protection method provided in the embodiment of the present application includes a software module and a hardware module. Among them, the software module includes multiple applications running in user mode, and the multiple applications usually exist in the form of enclaves. Among them, enclave refers to program code running in a trusted execution environment.

[0085] The software module also includes a software driver and a page table manager running in the operating system mode, wherein the software driver is used to provide an interface in the kernel state, and the page table manager is a module in the kernel responsible for configuring the page table.

[0086] The software module also includes a software management module, a software communication module and a security monitor running in the highest privilege mode. In the embodiment of the present application, the security monitor is used to implement the segment-table hybrid isolation mechanism, that is, responsible for the configuration of the segment register and the permission table.

[0087] The hardware module includes a memory management unit and a segment-table hybrid isolation module. The memory management unit is responsible for translating virtual addresses to physical addresses, and the segment-table hybrid isolation module is responsible for isolating physical memory.

[0088] See also Figure 4 , Figure 4 A flowchart of a memory protection method provided in an embodiment of the present application is shown below. Figure 4 As shown, the memory protection method includes the following steps 401-403.

[0089] Step 401: Obtain a first memory access request, where the first memory access request includes a first virtual address and a first operation performed on data corresponding to the first virtual address.

[0090] In this embodiment, the first memory access request may be initiated by an application or a running function, and is used to request access to data in the memory. The first memory access request may be obtained from inside the device, such as from an application running inside the device. The first memory access request may also be obtained from outside the device, such as in a database system scenario, obtaining a memory access request of an application of an external device for a database. In general, this embodiment does not limit the source of the first memory access request.

[0091] Specifically, the first memory access request includes a first virtual address, and the first virtual address is used to indicate the virtual address corresponding to the data requested to be accessed. The first memory access request also includes a first operation performed on the data corresponding to the first virtual address, and the first operation includes, for example, reading, writing, or executing. That is, the first operation may be, for example, reading data in the memory; or, the first operation may be writing new data to the memory; or, the first operation may be executing data in the memory (such as executing program code in the memory).

[0092] Step 402, in the process of determining the first physical address corresponding to the first virtual address, a permission check for the first page table access operation is performed by querying the first segment register, the first segment register is used to record the operation permission of the memory area where the page table is located, the page table is used to record the mapping relationship between the first virtual address and the first physical address, and the first page table access operation is used to determine the first physical address corresponding to the first virtual address by accessing the page table.

[0093] In the process of determining the first physical address corresponding to the first virtual address, it is often necessary to determine the first physical address corresponding to the first virtual address by querying the page table, that is, to perform a page table access operation based on the first virtual address to determine the first physical address corresponding to the first virtual address. Since the page table is stored in the memory, the page table access operation for accessing the memory also needs to perform a permission check.

[0094] In this embodiment, the operation permission of the memory area where the page table is located is recorded by configuring the first segment register. For example, the operation permission of the memory area where the page table is located is recorded by the first segment register as only readable. In this way, when performing a permission check on the page table access operation, it can be determined whether the current page table access operation is legal by accessing the permission information recorded by the first segment register. For example, when the page table access operation is a request to read the page table in the memory, and the permission information recorded by the first segment register is readable, it means that the page table access operation is legal and can pass the permission check. For another example, when the page table access operation is a request to write to the page table in the memory, and the permission information recorded by the first segment register is readable, it means that the page table access operation is illegal and cannot pass the permission check.

[0095] When the page table access operation passes the permission check, the operation content indicated by the page table access operation continues to be executed, that is, the page table in the memory is read, so as to query and obtain the first physical address corresponding to the first virtual address.

[0096] The first segment register is, for example, one or more segment registers, which is not specifically limited in this embodiment. For example, in some systems with limited segment register capacity, two segment registers can be used to cooperate to complete the recording of the operation permissions of the page table. In some systems with sufficient segment register capacity, one segment register can be used to complete the recording of the operation permissions of the page table.

[0097] Optionally, the first segment register is used to record the operating permissions of a continuous memory area. This continuous memory area is used to store one or more page tables, and one or more page tables correspond to the same operating permissions. In other words, for multiple page tables corresponding to the same operating permissions in the system, the multiple page tables can be placed in a continuous memory area, and the first segment register is used to record the permissions of this continuous memory area. In this way, for multiple different page tables, a small number of segment registers can be used to record the operating permissions of a large number of different page tables, saving segment register resources.

[0098] It should be noted that for page tables with different operation permissions, the permissions of the page tables can be recorded through different segment registers. That is, the page table corresponding to a certain same operation permission can be placed in a continuous memory area, and the page table corresponding to another same operation permission can be placed in another continuous memory area, and different continuous memory areas use different segment registers to record the same operation permission, thereby realizing the permission of recording page tables with different operation permissions.

[0099] Step 403: In the process of executing the first operation based on the first physical address, a permission check of the first operation is performed by querying a permission table, where the permission table is used to record the operation permission of the memory area where the first physical address is located.

[0100] After obtaining the first physical address corresponding to the first virtual address, the first operation indicated in the first memory access operation is performed according to the first physical address, that is, the first operation is performed on the data located at the first physical address in the memory. Since the process of performing the first operation based on the first physical address is actually also a memory access behavior, it is also necessary to perform a permission check on the first operation.

[0101] In this embodiment, the memory area where the first physical address is located has a permission table that records the corresponding operation permissions, so the permission check for the first operation can be performed by querying the permission table. The permission table can be located in the memory, and the permission check is implemented by accessing the permission table in the memory. Optionally, the permission table can be a two-level permission table, that is, for example, including a root table and a leaf table. When querying the operation permissions of the memory area where the first physical address is located, the root table can be queried first, and then the specific operation permissions corresponding to the memory area can be queried in the corresponding leaf table based on the indication of the root table.

[0102] In general, in this embodiment, in view of the process of converting virtual addresses to physical addresses by accessing the page table in the memory during memory access, a segment register is introduced to uniformly record the operation permissions of the page table, and in the process of performing permission checks on page table access operations, the permission table in the memory can be replaced by accessing the segment register. Since the reading speed of the segment register is much higher than the reading speed of the memory, this solution can effectively improve the efficiency of permission checks.

[0103] In addition, compared to a large amount of application data with different permissions in the memory, the permissions corresponding to different page tables are usually consistent, so a small number of segment registers can be used to record the permission information corresponding to a large number of page tables to ensure the feasibility of this solution. For example, different applications will generate different data, and different data correspond to different permissions; and the same application may also generate a large number of different types of data, and different types of data may correspond to different permissions. In this way, application data distributed in different memory areas may correspond to different permissions, and it is difficult to record the permissions of each part of the memory area through a limited number of segment registers. The page tables corresponding to different applications and the page tables of different levels under the same application often have the same permission information, so a limited number of segment registers can be used to record the permission information corresponding to a large number of page tables.

[0104] For example, see Figure 5 , Figure 5 A schematic diagram of optimizing permission checking through segment registers provided in an embodiment of the present application. Figure 5 As shown, before optimizing the permission check, in the process of determining the physical address corresponding to the virtual address by querying the page table, it is necessary to access the permission table in the memory 6 times in total to perform the permission check of the page table. After optimizing the permission check based on the memory protection method provided in this embodiment, in the process of determining the physical address corresponding to the virtual address by querying the page table, it is no longer necessary to access the permission table in the memory, but the permission operation of the page table access operation is directly performed by accessing the segment register, that is, 6 additional memory access behaviors are omitted.

[0105] Depend on Figure 5 It can be seen that before optimizing the permission check, a total of 8 memory accesses are required to implement the permission check; after optimizing the permission check, only 2 memory accesses are required to implement the permission check. Obviously, after optimizing the permission check, 75% of the additional memory accesses can be optimized, effectively improving the performance of physical memory protection.

[0106] Optionally, the memory protection method provided in this embodiment can be applied to a virtual machine scenario. In a virtual machine scenario, a virtual machine runs in a host machine, which generally refers to a computer with a virtual machine environment. The opposite of the host machine is a client machine, which refers to the environment in which the virtual machine runs, so the client machine is often also called a virtual machine instance. In a virtual machine scenario, each client machine runs an independent operating system and application program.

[0107] In the virtual machine scenario, the virtual address in the memory access request initiated by the application running in the client belongs to the client virtual address and cannot be directly converted into the physical address of the physical memory, but needs to go through two layers of address translation. Specifically, the client virtual address generated by the application needs to go through two layers of translation, the client page table and the nested page table. That is, the client virtual address is first translated into the client physical address through the client page table, and then the client physical address is translated into the host physical address (i.e., the physical address of the physical memory) through the nested page table. Obviously, in the virtual machine scenario, the process of determining the physical address corresponding to the virtual address in the memory access request is more complicated, and the number of page tables that need to be accessed increases exponentially, resulting in an exponential increase in the number of permission checks for page table access operations, which ultimately leads to a significant increase in additional memory access behaviors.

[0108] Based on this, in the virtual machine scenario, the page table that uses the first segment register to record operation permissions includes a client page table and a nested page table. The client page table is used to indicate the mapping relationship between the first virtual machine address and the client physical address, and the nested page table is used to indicate the mapping relationship between the client physical address and the host physical address. The first physical address belongs to the host physical address.

[0109] That is to say, in the virtual machine scenario, for all types of page tables needed during address translation, segment registers can be used to record the operation permissions of these page tables, thereby adjusting the permission check behavior for page table access operations to access high-speed segment registers, avoiding a large number of additional memory access behaviors introduced by access permission tables, and effectively improving the performance of physical memory protection.

[0110] The above describes the process of using segment registers to record the operation permissions of the page table in this embodiment. In some embodiments, when the number of segment registers is sufficient, some segment registers can also be used to record the operation permissions of the memory area where some data is located, thereby speeding up the permission check of the application in the process of accessing this part of data.

[0111] For example, see Figure 6 , Figure 6 A flowchart of another memory protection method provided in an embodiment of the present application. Figure 6 As shown, the memory protection method includes the following steps 601-603.

[0112] Step 601: Obtain a second memory access request, where the second memory access request includes a second virtual address and a second operation performed on data corresponding to the second virtual address.

[0113] In this embodiment, step 601 is similar to the above-mentioned step 401. Please refer to the above-mentioned step 401 for details, which will not be repeated here.

[0114] Step 602, in the process of determining the second physical address corresponding to the second virtual address, a permission check for the second page table access operation is performed by querying the first segment register. The page table is also used to record the mapping relationship between the second virtual address and the second physical address. The second page table access operation is used to determine the second physical address corresponding to the second virtual address by accessing the page table.

[0115] In this embodiment, similar to step 402, the operation permission of the page table used to record the mapping relationship between the second virtual address and the second physical address is also recorded through the first segment register, so the permission check of the second page table access operation can be implemented by querying the first segment register.

[0116] Step 603, in the process of executing the second operation based on the second physical address, the permission check of the second operation is performed by querying the second segment register, and the second segment register is used to record the operation permission of the memory area where the second physical address is located.

[0117] In this embodiment, for the memory area where the second physical address is located, the second segment register may be used to record the operation permission corresponding to the memory area. In this way, when the second operation indicated in the second memory access request is executed based on the second physical address, the permission check of the second operation may be performed by querying the second segment register, thereby further avoiding the memory access behavior caused by querying the permission table.

[0118] See also Figure 7 , Figure 7 Another schematic diagram of optimizing permission checking through segment registers provided in an embodiment of the present application. Figure 7 As shown, for the second memory access request including the second virtual address, after optimizing the permission check based on the memory protection method provided in this embodiment, in the process of determining the second physical address corresponding to the second virtual address by querying the page table, it is no longer necessary to access the permission table in the memory, but directly perform the permission check of the page table access operation by accessing the segment register, that is, 6 additional memory access behaviors are saved. In addition, after determining that the second physical address is obtained, in the process of accessing data based on the second physical address, it is no longer necessary to access the permission table in the memory, but directly perform the permission check of the data access operation by accessing the segment register, saving 2 additional memory access behaviors. In this way, in the process of executing the second memory access request including the second virtual address, it is actually only necessary to perform four unavoidable memory access behaviors, namely, three behaviors of accessing the page table in the memory and one behavior of accessing the actual data in the memory, completely avoiding the additional memory access behavior introduced by the permission check.

[0119] In this solution, when there are sufficient segment registers, in addition to using some segment registers to record the operation permissions of the memory area where the page table is located, other segment registers are also used to record the operation permissions of the memory area where some data accessed by the application is located, thereby ensuring that when executing memory access operations for this part of data, all permission checks can be converted into querying the segment registers, further reducing the memory access behavior caused by the access permission table and effectively improving the performance of physical memory protection.

[0120] In a possible implementation, the second segment register is used to record the operation permission of the memory area where the target data is located, the target data is data with an access frequency greater than a preset threshold, and the target data includes data located at the second physical address.

[0121] In other words, the second segment register is actually used to record the operating permissions of the memory area where the data with high access frequency is located. For example, in a database scenario, the database system can pre-allocate a continuous memory area to store data with high access frequency, and use the second segment register to record the operating permissions of this continuous memory area. In this way, when any application triggers access to the frequently accessed data stored in this continuous memory area, it can query the second segment register to implement the permission check of the data access behavior, without having to query the permission table in the memory to implement the permission check, thereby improving the efficiency of the permission check.

[0122] The access frequency may refer to the number of times data is accessed within a preset time period, such as the number of times data is accessed within an hour or a day. The preset threshold may be a value based on the definition of access frequency and an actual application scenario, such as 100 or 500, etc., which is not specifically limited in this embodiment.

[0123] Since the segment register resources in the device are limited (usually 32 or 64 segment registers), and the segment registers are often needed to implement other functions originally defined, the number of segment registers that can be used to record the operation permissions of the memory area is limited. Based on this, in this solution, when some segment registers are used to record the operation permissions of the memory area where the page table is located, the remaining free segment registers can be used to record the operation permissions of the memory area where the data with high access frequency is located, thereby reducing the additional memory access behavior generated by the application accessing this part of the data and maximizing the access efficiency of the data with high access frequency.

[0124] In another possible implementation, the second segment register is used to record the operation authority of the memory area allocated to the target application, and the data generated by the target application includes data located at the second physical address.

[0125] Among them, the target application is, for example, a performance-sensitive application, that is, it requires high operating performance and data access performance. Therefore, for the memory area allocated for the target application, the second segment register can be used to record the operation permissions of this part of the memory area. In this way, since the data generated by the target application is stored in the memory area allocated for the target application, when accessing the data generated by the target application, the permission of the data access behavior can be checked by accessing the second segment register, thereby reducing the additional memory access behavior generated by the application accessing this part of the data, and maximizing the access efficiency of the data with higher access frequency.

[0126] The above describes the process of improving the efficiency of permission checking through segment registers during the execution of memory access requests. For ease of understanding, the following describes the process of configuring segment registers and the operation permissions recorded in the permission table.

[0127] Exemplarily, the memory protection method provided in this embodiment is applied to a trusted execution environment, which includes a security monitor, and the security monitor is used to configure the data recorded in the first segment register and the permission table.

[0128] See also Figure 8 , Figure 8 A flow chart of configuring a segment register and a permission table provided in an embodiment of the present application. Figure 8 As shown, the process of configuring the segment register and the permission table includes the following steps 801-803.

[0129] Step 801: The operating system allocates N fast general memory segments (General Memory Segment, GMS) and M slow GMS.

[0130] Specifically, GMS refers to a continuous section of page-aligned physical memory, that is, a continuous section of physical memory. In addition, each GMS can be used to store data of the same type and with the same operating permissions, such as page tables. Fast GMS refers to a memory segment that needs to perform a fast permission check, and slow GMS refers to a memory segment that does not need to perform a fast permission check. For example, a fast GMS can be used to store page tables, and a slow GMS can be used to store data generated by a certain application, that is, different applications can correspond to different slow GMS. In short, the operating system can be divided into N fast GMS and M slow GMS according to the actual operating conditions. In addition, during the continuous operation of the operating system, more slow GMS can be continuously allocated, which is not specifically limited here.

[0131] Wherein, N is determined based on the segment register resources in the device. For example, when there are 30 free segment registers in the device, N can be 30, that is, each segment register can be used to record the operation permission of a fast GMS. M can be determined according to the actual needs of the application running in the operating system, and is not specifically limited here.

[0132] In step 802, the operating system transmits the allocated fast GMS information and slow GMS information to the security monitor.

[0133] After the allocation of the fast GMS and the slow GMS is realized, the operating system transmits the allocated fast GMS information and the slow GMS information to the security monitor. For example, the operating system can transmit the address segments of N fast GMS to the security monitor, and mark the N address segments as belonging to the fast GMS and the operation permissions corresponding to each of the N address segments; and the operating system can transmit the address segments of M slow GMS to the security monitor, and mark the M address segments as belonging to the slow GMS and the operation permissions corresponding to each of the M address segments.

[0134] Step 803: The security monitor configures the operation permissions of the fast GMS in the segment register and configures the operation permissions of the slow GMS in the permission table.

[0135] After obtaining the fast GMS information and the slow GMS information transmitted by the operating system, the security monitor can configure the address segment and the operation permission corresponding to each address segment in the segment register based on the fast GMS information. In addition, the security monitor can configure the address segment and the operation permission corresponding to each address segment in the permission table based on the slow GMS information.

[0136] For example, see Fig. 9 and Fig.10 , Fig. 9 A schematic diagram of a configuration segment register provided in an embodiment of the present application, Fig.10 A schematic diagram of a configuration permission table provided in an embodiment of the present application. Fig. 9 As shown, the security monitor obtains N address segments corresponding to the fast GMS (i.e. Fig. 9 In the case of address segments 1 to address segments N) and the corresponding operation permissions of the N address segments, a corresponding segment register can be allocated to each address segment, and the specific address segment and operation permissions are recorded in the segment register. Fig. 9In the hardware system, there are s+N segment registers, of which s segment registers (i.e., segment register 1-segment register s) are used to implement conventional functions, and N segment registers (i.e., segment register s+1-segment register s+N) are used to record the permissions of the address segment. Among them, the bits in each segment register can be divided into two parts, one part is used to record the address segment (for example, the base address of the address segment and the size of the address segment), and the other part is the configuration bit, which is used to indicate the function implemented by the current segment register. The configuration bit of the segment register also includes two parts, one part is the T bit, and the T bit is used to indicate whether the function implemented by the current segment register is a conventional function or a permission recording function (for example, when the T bit is 0, it means that the segment register implements the conventional function, and when the T bit is 1, it means that the segment register implements the permission recording function), and the other part indicates the specific content recorded by the current segment register. Specifically, for the segment register used to implement the permission recording function, two bits in the configuration bit can be used to indicate the operation permission corresponding to the address segment recorded by the segment register. For example, when the values ​​of the two bits in the configuration bit are 00, it means that the operation permission of the address segment recorded in the segment register is readable; when the values ​​of the two bits in the configuration bit are 01, it means that the operation permission of the address segment recorded in the segment register is readable and writable; when the values ​​of the two bits in the configuration bit are 10, it means that the operation permission of the address segment recorded in the segment register is executable; when the values ​​of the two bits in the configuration bit are 11, it means that the operation permission of the address segment recorded in the segment register is readable, writable and executable.

[0137] like Fig.10 As shown, the security monitor obtains the M address segments corresponding to the slow GMS (i.e. Fig.10 In the case of address segment 1-address segment M) and the operation permissions corresponding to the M address segments, the operation permissions corresponding to each address segment can be recorded in the root permission table and the leaf permission table, so that the permission check can be implemented by querying the root permission table and the leaf permission table later. Among them, the root permission table and the leaf permission table are both stored in the memory, so in the process of executing the permission check, it is necessary to access the root permission table and the leaf permission table in the memory to implement the permission check.

[0138] The method provided in the embodiment of the present application is described in detail above. Next, the device provided in the embodiment of the present application for executing the above method will be introduced.

[0139] See also Fig.11 , Fig.11 A schematic diagram of the structure of a memory protection device provided in an embodiment of the present application. Fig.11As shown, the memory protection device includes: an acquisition module 1101, which is used to acquire a first memory access request, the first memory access request includes a first virtual address and a first operation performed on data corresponding to the first virtual address; a processing module 1102, which is used to perform a permission check of a first page table access operation by querying a first segment register in a process of determining a first physical address corresponding to the first virtual address, the first segment register is used to record the operation permission of the memory area where the page table is located, the page table is used to record the mapping relationship between the first virtual address and the first physical address, and the first page table access operation is used to determine the first physical address corresponding to the first virtual address by accessing the page table; the processing module 1102 is also used to perform a permission check of the first operation by querying a permission table in a process of performing a first operation based on the first physical address, the permission table is used to record the operation permission of the memory area where the first physical address is located.

[0140] In a possible implementation, the first segment register is used to record the operation permission of a continuous memory area, the continuous memory area is used to store one or more page tables, and the one or more page tables correspond to the same operation permission.

[0141] In one possible implementation, the above-mentioned memory protection device is applied to a virtual machine scenario; in the virtual machine scenario, the page table includes a client page table and a nested page table, the client page table is used to indicate the mapping relationship between the first virtual machine address and the client physical address, and the nested page table is used to indicate the mapping relationship between the client physical address and the host physical address, and the first physical address belongs to the host physical address.

[0142] In one possible implementation, the acquisition module 1101 is also used to obtain a second memory access request, which includes a second virtual address and a second operation performed on the data corresponding to the second virtual address; the processing module 1102 is also used to perform a permission check on the second page table access operation by querying the first segment register in the process of determining the second physical address corresponding to the second virtual address, the page table is also used to record the mapping relationship between the second virtual address and the second physical address, and the second page table access operation is used to determine the second physical address corresponding to the second virtual address by accessing the page table; the processing module 1102 is also used to perform a permission check on the second operation by querying the second segment register in the process of performing the second operation based on the second physical address, and the second segment register is used to record the operation permission of the memory area where the second physical address is located.

[0143] In a possible implementation, the second segment register is used to record the operation permission of the memory area where the target data is located, the target data is data with an access frequency greater than a preset threshold, and the target data includes data located at the second physical address.

[0144] In a possible implementation, the second segment register is used to record the operation authority of the memory area allocated to the target application, and the data generated by the target application includes data located at the second physical address.

[0145] In a possible implementation, the above-mentioned memory protection device is applied to a trusted execution environment, and the trusted execution environment includes a security monitor, and the security monitor is used to configure the first segment register and the data recorded in the permission table.

[0146] In a possible implementation manner, the first operation includes reading, writing or executing.

[0147] See also Fig.12 , Fig.12 This is a schematic diagram of a structure of an execution device provided in an embodiment of the present application. The execution device 1200 can be specifically a mobile phone, a tablet, a laptop, a smart wearable device, a server, etc., which is not limited here. Specifically, the execution device 1200 includes: a receiver 1201, a transmitter 1202, a processor 1203 and a memory 1204 (wherein the number of processors 1203 in the execution device 1200 can be one or more, Fig.12 In the example of FIG. 1 , the processor 1203 may include an application processor 12031 and a communication processor 12032. In some embodiments of the present application, the receiver 1201, the transmitter 1202, the processor 1203 and the memory 1204 may be connected via a bus or other means.

[0148] The memory 1204 may include a read-only memory and a random access memory, and provides instructions and data to the processor 1203. A portion of the memory 1204 may also include a non-volatile random access memory (NVRAM). The memory 1204 stores processor and operation instructions, executable modules or data structures, or subsets thereof, or extended sets thereof, wherein the operation instructions may include various operation instructions for implementing various operations.

[0149] The processor 1203 controls the operation of the execution device. In a specific application, the various components of the execution device are coupled together through a bus system, wherein the bus system includes not only a data bus but also a power bus, a control bus, and a status signal bus, etc. However, for the sake of clarity, various buses are referred to as bus systems in the figure.

[0150] The method disclosed in the above embodiment of the present application can be applied to the processor 1203, or implemented by the processor 1203. The processor 1203 can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 1203 or an instruction in the form of software. The above processor 1203 can be a general-purpose processor, a digital signal processor (digital signal processing, DSP), a microprocessor or a microcontroller, and can further include an application specific integrated circuit (ASIC), a field-programmable gate array (field-programmable gate array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0151] The processor 1203 can implement or execute the methods, steps and logic diagrams disclosed in the embodiments of the present application. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 1204, and the processor 1203 reads the information in the memory 1204 and completes the steps of the above method in combination with its hardware.

[0152] The receiver 1201 can be used to receive input digital or character information, and generate signal input related to the relevant settings and function control of the execution device. The transmitter 1202 can be used to output digital or character information through the first interface; the transmitter 1202 can also be used to send instructions to the disk group through the first interface to modify the data in the disk group; the transmitter 1202 can also include a display device such as a display screen.

[0153] The electronic device provided in the embodiment of the present application may specifically be a chip, and the chip includes: a processing unit and a communication unit, the processing unit may be, for example, a processor, and the communication unit may be, for example, an input / output interface, a pin or a circuit, etc. The processing unit may execute the computer execution instructions stored in the storage unit so that the chip in the execution device executes the method described in the above embodiment. Optionally, the storage unit is a storage unit in the chip, such as a register, a cache, etc. The storage unit may also be a storage unit located outside the chip in the wireless access device, such as a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM), etc.

[0154] See also Fig.13 , Fig.13 This is a schematic diagram of the structure of a computer-readable storage medium provided in an embodiment of the present application. The present application also provides a computer-readable storage medium. In some embodiments, the above Figure 4 The disclosed methods may be implemented as computer program instructions encoded in a machine-readable format on a computer-readable storage medium or on other non-transitory media or articles of manufacture.

[0155] Fig.13 Schematically illustrates a conceptual partial view of an example computer-readable storage medium including a computer program for executing a computer process on a computing device, arranged in accordance with at least some embodiments presented herein.

[0156] In one embodiment, the computer readable storage medium 1300 is provided using a signal bearing medium 1301. The signal bearing medium 1301 may include one or more program instructions 1302, which when executed by one or more processors may provide the above-mentioned Figure 4 Describes the functionality or part of the functionality.

[0157] In some examples, the signal bearing medium 1301 may include a computer readable medium 1303 such as, but not limited to, a hard drive, a compact disk (CD), a digital video disk (DVD), a digital tape, a memory, a ROM or RAM, and the like.

[0158] In some embodiments, the signal bearing medium 1301 may include a computer recordable medium 1304, such as, but not limited to, a memory, a read / write (R / W) CD, a R / W DVD, etc. In some embodiments, the signal bearing medium 1301 may include a communication medium 1305, such as, but not limited to, a digital and / or analog communication medium (e.g., a fiber optic cable, a waveguide, a wired communication link, a wireless communication link, etc.). Thus, for example, the signal bearing medium 1301 may be communicated by a wireless form of the communication medium 1305 (e.g., a wireless communication medium that complies with the IEEE 802.X standard or other transmission protocol).

[0159] The one or more program instructions 1302 may be, for example, computer executable instructions or logic implementation instructions. In some examples, the computing device of the computing device may be configured to provide various operations, functions, or actions in response to the program instructions 1302 communicated to the computing device via one or more of the computer readable medium 1303, the computer recordable medium 1304, and / or the communication medium 1305.

[0160] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0161] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the method of each embodiment of the present application.

[0162] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0163] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, a computer, a training device or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device or data center. The computer-readable storage medium can be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that contains one or more available media integration. Available media can be magnetic media, (e.g., floppy disk, hard disk, tape), optical media (e.g., DVD), or semiconductor media (e.g., solid-state hard disk (SSD)), etc.

Claims

1. A memory protection method, characterized in that: include: Obtaining a first memory access request, where the first memory access request includes a first virtual address and a first operation performed on data corresponding to the first virtual address; In the process of determining the first physical address corresponding to the first virtual address, a permission check of a first page table access operation is performed by querying a first segment register, the first segment register is used to record the operation permission of the memory area where the page table is located, the page table is used to record the mapping relationship between the first virtual address and the first physical address, and the first page table access operation is used to determine the first physical address corresponding to the first virtual address by accessing the page table; In the process of performing the first operation based on the first physical address, a permission check of the first operation is performed by querying a permission table, where the permission table is used to record the operation permission of the memory area where the first physical address is located.

2. The method according to claim 1, characterized in that The first segment register is used to record the operation permission of a continuous memory area, the continuous memory area is used to store one or more page tables, and the one or more page tables correspond to the same operation permission.

3. The method according to claim 1 or 2, characterized in that: The method is applied to a virtual machine scenario; In the virtual machine scenario, the page table includes a client page table and a nested page table. The client page table is used to indicate the mapping relationship between the first virtual machine address and the client physical address, and the nested page table is used to indicate the mapping relationship between the client physical address and the host physical address. The first physical address belongs to the host physical address.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: Obtaining a second memory access request, where the second memory access request includes a second virtual address and a second operation performed on data corresponding to the second virtual address; In the process of determining the second physical address corresponding to the second virtual address, a permission check of a second page table access operation is performed by querying the first segment register, the page table is further used to record a mapping relationship between the second virtual address and the second physical address, and the second page table access operation is used to determine the second physical address corresponding to the second virtual address by accessing the page table; In the process of executing the second operation based on the second physical address, the permission check of the second operation is performed by querying the second segment register, and the second segment register is used to record the operation permission of the memory area where the second physical address is located.

5. The method according to claim 4, characterized in that The second segment register is used to record the operation authority of the memory area where the target data is located, the target data is data with an access frequency greater than a preset threshold, and the target data includes data located at the second physical address.

6. The method according to claim 4, characterized in that The second segment register is used to record the operation authority of the memory area allocated to the target application, and the data generated by the target application includes the data located at the second physical address.

7. The method according to any one of claims 1 to 6, characterized in that: The method is applied to a trusted execution environment, wherein the trusted execution environment includes a security monitor, and the security monitor is used to configure the first segment register and the data recorded in the permission table.

8. The method according to any one of claims 1 to 7, characterized in that: The first operation includes reading, writing or executing.

9. A memory protection device, characterized in that: include: An acquisition module, configured to acquire a first memory access request, wherein the first memory access request includes a first virtual address and a first operation performed on data corresponding to the first virtual address; a processing module, configured to perform a permission check of a first page table access operation by querying a first segment register in a process of determining a first physical address corresponding to the first virtual address, the first segment register being used to record the operation permission of a memory area where a page table is located, the page table being used to record a mapping relationship between the first virtual address and the first physical address, and the first page table access operation being used to determine the first physical address corresponding to the first virtual address by accessing the page table; The processing module is further used to perform a permission check of the first operation by querying a permission table during the process of performing the first operation based on the first physical address, and the permission table is used to record the operation permission of the memory area where the first physical address is located.

10. The device according to claim 9, characterized in that The first segment register is used to record the operation permission of a continuous memory area, the continuous memory area is used to store one or more page tables, and the one or more page tables correspond to the same operation permission.

11. The device according to claim 9 or 10, characterized in that The device is applied to a virtual machine scenario; In the virtual machine scenario, the page table includes a client page table and a nested page table. The client page table is used to indicate the mapping relationship between the first virtual machine address and the client physical address, and the nested page table is used to indicate the mapping relationship between the client physical address and the host physical address. The first physical address belongs to the host physical address.

12. The device according to any one of claims 9 to 11, characterized in that: The acquisition module is further used to acquire a second memory access request, where the second memory access request includes a second virtual address and a second operation performed on data corresponding to the second virtual address; The processing module is further configured to perform a permission check of a second page table access operation by querying the first segment register in a process of determining the second physical address corresponding to the second virtual address, the page table is further configured to record a mapping relationship between the second virtual address and the second physical address, and the second page table access operation is configured to determine the second physical address corresponding to the second virtual address by accessing the page table; The processing module is also used to perform a permission check for the second operation by querying a second segment register during the process of executing the second operation based on the second physical address, and the second segment register is used to record the operation permission of the memory area where the second physical address is located.

13. The device according to claim 12, characterized in that The second segment register is used to record the operation authority of the memory area where the target data is located, the target data is data with an access frequency greater than a preset threshold, and the target data includes data located at the second physical address.

14. The device according to claim 12, characterized in that The second segment register is used to record the operation authority of the memory area allocated to the target application, and the data generated by the target application includes the data located at the second physical address.

15. The device according to any one of claims 9 to 14, characterized in that: The device is applied to a trusted execution environment, wherein the trusted execution environment comprises a security monitor, and the security monitor is used to configure the first segment register and the data recorded in the permission table.

16. The device according to any one of claims 9 to 15, characterized in that: The first operation includes reading, writing or executing.

17. A memory protection device, characterized in that: The device comprises a memory and a processor; the memory stores codes, the processor is configured to execute the codes, and when the codes are executed, the device executes the method according to any one of claims 1 to 8.

18. A computer storage medium, characterized in that The computer storage medium stores instructions, which, when executed by a computer, cause the computer to implement the method of any one of claims 1 to 8.

Images