Memory access method and device, chip, electronic equipment and medium

Abstract

The invention relates to a memory access method and device, a chip, electronic equipment and a medium, and the method comprises the steps: obtaining a memory access request; the memory access request comprises a virtual machine identifier, a target intermediate physical address and a target access type; determining the target intermediate physical address as a target physical address; according to the target physical address and the virtual machine identifier, determining an access permission of a virtual machine corresponding to the virtual machine identifier to the target content on the target physical address; performing authentication processing according to the access permission and the target access type; under the condition that the authentication is passed, the target content on the target physical address is accessed according to the target access type, so that when the virtual machine identifier in the memory access request is changed, the virtual machine corresponding to the changed virtual machine identifier is prevented from accessing the target content on the target physical address through the authentication processing; therefore, the security of the target content is ensured, and the memory access security is ensured.

Description

Technical Field

[0001] The present disclosure relates to the technical field of data processing, and in particular, to a memory access method, apparatus, chip, electronic device, and medium. Background Art

[0002] Currently, virtualization technology is an important technology for constructing an independent and secure execution environment, and has important applications in fields such as cloud computing and privacy computing. The current memory access method is mainly that when a memory access request carrying a virtual address is received, the physical address is determined according to the virtual address, and then the content on the physical address is directly accessed and processed.

[0003] In the above solution, the memory access request is received at the operating system level and address conversion processing is performed. If the operating system level is attacked by a virus, the virtual machine identifier in the memory access request may be changed, and there may be a situation where the virtual machine corresponding to the changed virtual machine identifier accesses the content on the physical address, thus making it difficult to ensure the security of the content and the security of memory access. Summary of the Invention

[0004] The present disclosure provides a memory access method, apparatus, chip, electronic device, and medium.

[0005] According to a first aspect of an embodiment of the present disclosure, a memory access method is provided. The method includes: obtaining a memory access request; the memory access request includes: a virtual machine identifier, a target intermediate physical address, and a target access type; determining the target intermediate physical address as a target physical address; determining, according to the target physical address and the virtual machine identifier, an access right of a virtual machine corresponding to the virtual machine identifier to target content on the target physical address; performing an authentication process according to the access right and the target access type; and when the authentication passes, performing an access process on the target content on the target physical address according to the target access type.

[0006] In an embodiment of the present disclosure, the obtaining a memory access request includes: obtaining an original memory access request; the original memory access request includes: the virtual machine identifier, a target virtual address, and the target access type; querying a memory address translation page table according to the target virtual address, and obtaining a target intermediate physical address corresponding to the target virtual address in the memory address translation page table, so as to obtain the memory access request.

[0007] In one embodiment of the present disclosure, determining the access right of the virtual machine corresponding to the virtual machine identifier to the target content on the target physical address according to the target physical address and the virtual machine identifier includes: obtaining multiple address segments in the target physical address and the starting physical address of the permission page table; determining the first permission page table segment and the intermediate address corresponding to the first address segment in the first permission page table segment according to the starting physical address and the first address segment among the multiple address segments; sequentially for each non-first address segment among the multiple address segments, determining a non-first permission page table segment and the intermediate address corresponding to the non-first address segment in the non-first permission page table segment according to the determined intermediate address and the non-first address segment; and determining the access right of the virtual machine to the target content on the target physical address according to the content on the finally obtained intermediate address.

[0008] In one embodiment of the present disclosure, determining the access right of the virtual machine to the target content on the target physical address according to the content on the finally obtained intermediate address includes: using the content on the finally obtained intermediate address as the access right information of the target content on the target physical address; and querying the access right information according to the virtual machine identifier to obtain the access right of the virtual machine to the target content on the target physical address.

[0009] In one embodiment of the present disclosure, before using the target intermediate physical address as the target physical address, the method further includes: querying a permission cache according to the target intermediate physical address and the virtual machine identifier to determine whether there is an access right corresponding to the target intermediate physical address and the virtual machine identifier in the permission cache; and in the case where there is an access right corresponding to the target intermediate physical address and the virtual machine identifier in the permission cache, determining the access right as the access right of the virtual machine corresponding to the virtual machine identifier to the target content on the target physical address.

[0010] In one embodiment of the present disclosure, performing an authentication process according to the access right and the target access type includes: obtaining the allowed access types in the access right; and in the case where the target access type is included in the allowed access types, determining that the authentication passes.

[0011] In one embodiment of the present disclosure, performing an authentication process according to the access right and the target access type further includes: in the case where the target access type is not included in the allowed access types, determining that the authentication fails.

[0012] In one embodiment of the present disclosure, the method further includes: in the case where the authentication fails, stopping the access process to the target content on the target physical address.

[0013] In one embodiment of the present disclosure, the method further includes: when the authentication is passed, updating the virtual machine identifier, the target intermediate physical address, and the target access type to the permission cache.

[0014] According to a second aspect of the embodiments of the present disclosure, there is also provided a memory access device, including: an acquisition module, configured to acquire a memory access request; the memory access request includes: a virtual machine identifier, a target intermediate physical address, and a target access type; a first determination module, configured to determine the target intermediate physical address as a target physical address; a second determination module, configured to determine, according to the target physical address and the virtual machine identifier, the access permission of the virtual machine corresponding to the virtual machine identifier to the target content on the target physical address; an authentication processing module, configured to perform authentication processing according to the access permission and the target access type; and an access processing module, configured to, when the authentication is passed, perform access processing on the target content on the target physical address according to the target access type.

[0015] In one embodiment of the present disclosure, the acquisition module is specifically configured to acquire an original memory access request; the original memory access request includes: the virtual machine identifier, a target virtual address, and the target access type; query a memory address translation page table according to the target virtual address, and acquire a target intermediate physical address corresponding to the target virtual address in the memory address translation page table, so as to obtain the memory access request.

[0016] In one embodiment of the present disclosure, the second determination module includes: an acquisition unit, a first determination unit, a second determination unit, and a third determination unit; the acquisition unit is configured to acquire multiple address segments in the target physical address, and the starting physical address of a permission page table; the first determination unit is configured to determine a first permission page table segment, and an intermediate address corresponding to the first address segment in the first permission page table segment according to the starting physical address and the first address segment among the multiple address segments; the second determination unit is configured to sequentially, for each non-first address segment among the multiple address segments, determine a non-first permission page table segment, and an intermediate address corresponding to the non-first address segment in the non-first permission page table segment according to the determined intermediate address and the non-first address segment; and the third determination unit is configured to determine the access permission of the virtual machine to the target content on the target physical address according to the content on the finally acquired intermediate address.

[0017] In one embodiment of the present disclosure, the third determination unit is specifically configured to use the content on the last obtained intermediate address as the access permission information of the target content on the target physical address; query the access permission information according to the virtual machine identifier, and obtain the access permission of the virtual machine to the target content on the target physical address.

[0018] In one embodiment of the present disclosure, the device further includes: a third determination module and a fourth determination module; the third determination module is configured to query a permission cache according to the target intermediate physical address and the virtual machine identifier to determine whether there is an access permission corresponding to the target intermediate physical address and the virtual machine identifier in the permission cache; the fourth determination module is configured to, when there is an access permission corresponding to the target intermediate physical address and the virtual machine identifier in the permission cache, determine the access permission as the access permission of the virtual machine corresponding to the virtual machine identifier to the target content on the target physical address.

[0019] In one embodiment of the present disclosure, the authentication processing module is configured to obtain the allowed access type in the access permission; when the target access type is included in the allowed access types, determine that the authentication passes.

[0020] In one embodiment of the present disclosure, the authentication processing module is further configured to, when the target access type is not included in the allowed access types, determine that the authentication fails.

[0021] In one embodiment of the present disclosure, the authentication processing module is further configured to, when the authentication fails, stop the access processing of the target content on the target physical address.

[0022] In one embodiment of the present disclosure, the device further includes: an update module configured to update the virtual machine identifier, the target intermediate physical address, and the target access type to the permission cache when the authentication passes.

[0023] According to a third aspect of the embodiments of the present disclosure, there is also provided an electronic device, including: a processor; a memory for storing executable instructions of the processor; wherein, the processor is configured to: implement the steps of the memory access method as described above.

[0024] According to a fourth aspect of the embodiments of the present disclosure, there is also provided a non-transitory computer-readable storage medium, when the instructions in the storage medium are executed by the processor, enabling the processor to execute the memory access method as described above.

[0025] According to a fifth aspect of the embodiments of the present disclosure, a chip is further provided, including one or more interface circuits and one or more processors; the interface circuit is configured to receive a signal from a memory of an electronic device and send the signal to the processor, where the signal includes computer instructions stored in the memory, and when the processor executes the computer instructions, the electronic device is caused to execute the memory access method as described above.

[0026] The technical solutions provided by the embodiments of the present disclosure at least bring the following beneficial effects:

[0027] By obtaining a memory access request; the memory access request includes: a virtual machine identifier, a target intermediate physical address, and a target access type; determining the target intermediate physical address as the target physical address; determining, according to the target physical address and the virtual machine identifier, the access right of the virtual machine corresponding to the virtual machine identifier to the target content on the target physical address; performing an authentication process according to the access right and the target access type; and in the case where the authentication passes, performing an access process on the target content on the target physical address according to the target access type, so that when the virtual machine identifier in the memory access request is changed, the virtual machine corresponding to the changed virtual machine identifier can be prevented from accessing the target content on the target physical address through the authentication process, thereby ensuring the security of the target content and ensuring the security of memory access.

[0028] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present disclosure, and are used together with the specification to explain the principles of the present disclosure and do not constitute an improper limitation to the present disclosure.

[0030] Figure 1 It is a flowchart of a memory access method according to an embodiment of the present disclosure;

[0031] Figure 2 It is a flowchart of a memory access method according to another embodiment of the present disclosure;

[0032] Figure 3 It is a schematic diagram of an electronic device querying a memory address translation page table and a permission page table according to a target virtual address to determine the access right of a virtual machine to target content on a target physical address;

[0033] Figure 4 It is a schematic structural diagram of a memory access device according to an embodiment of the present disclosure;

[0034] Figure 5 It is a structural block diagram of an electronic device shown according to an exemplary embodiment of the present disclosure;

[0035] Figure 6 Schematic structural diagram of a chip according to an embodiment of the present disclosure. Detailed implementation manners

[0036] In order to enable those of ordinary skill in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings.

[0037] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily need to be used to describe a specific order or sequence. It should be understood that such used data can be interchanged under appropriate circumstances so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The implementation manners described in the following exemplary embodiments do not represent all implementation manners consistent with the present disclosure. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0038] Currently, virtualization technology is an important technology for constructing an independent and secure execution environment and has important applications in fields such as cloud computing and privacy computing. The current memory access method is mainly that when a memory access request carrying a virtual address is received, the physical address is determined according to the virtual address, and then the content on the physical address is directly accessed and processed.

[0039] In the above solution, the memory access request is received at the operating system level and address conversion processing is performed. If the operating system level is attacked by a virus, the virtual machine identifier in the memory access request may be changed, and there may be a situation where the virtual machine corresponding to the changed virtual machine identifier accesses the content on the physical address, thus making it difficult to ensure the security of the content and the security of memory access.

[0040] Figure 1 Flowchart of a memory access method according to an embodiment of the present disclosure. Among them, it should be noted that the memory access method of this embodiment can be applied to a memory access device, and this device can be configured in an electronic device or a chip so that the electronic device or the chip can perform the memory access function.

[0041] Among them, the electronic device can be any device with computing capabilities, such as a personal computer (PC for short), a mobile terminal, a server, a controller in a vehicle, etc. The mobile terminal can be, for example, a vehicle-mounted device, a mobile phone, a tablet computer, a personal digital assistant, a wearable device, etc., which are hardware devices with various operating systems, touch screens, and / or display screens.

[0042] In addition, the memory access device can also be a Memory Management Unit (MMU) in an electronic device. The MMU is a computer hardware that is responsible for processing memory access requests from the central processing unit (CPU). Its functions include virtual address to physical address translation (i.e., virtual memory management), memory protection, and control of the CPU cache.

[0043] In addition, the memory access device can also be software in an electronic device, etc. Among them, for example, the software is the management software in the memory management unit, etc. Among them, in the following embodiments, the execution entity is taken as an example of an electronic device for description.

[0044] Such as Figure 1 As shown, the method includes the following steps:

[0045] Step 101, obtain a memory access request; the memory access request includes: a virtual machine identifier, a target intermediate physical address, and a target access type.

[0046] In the embodiment of the present disclosure, the process of the electronic device executing step 101 can be, for example, obtaining an original memory access request; the original memory access request includes: a virtual machine identifier, a target virtual address, and a target access type; querying the memory address translation page table according to the target virtual address, and obtaining the target intermediate physical address corresponding to the target virtual address in the memory address translation page table, so as to obtain the memory access request.

[0047] Among them, the original memory access request can be sent by a virtual machine deployed in the electronic device to the electronic device. Correspondingly, the virtual machine identifier (virtual machine ID, VMID) carried in the memory access request is the identifier of the virtual machine that sends the memory access request. At least one virtual machine can be deployed in an electronic device.

[0048] In the embodiment of the present disclosure, the target access type can be any one of the following: read type, access type, and execution type. Among them, taking the execution type as an example, when the content in the target physical address corresponding to the target virtual address is code, etc., the code is processed according to the execution type, that is, the code is run to obtain the code running result.

[0049] In the embodiment of the present disclosure, the memory address translation page table usually adopts a multi-level page table structure to reduce the space occupied by the page table. In the multi-level page table structure, the page directory table and the page intermediate directory, etc., are all used to store page table entries, and each page table entry contains a pointer to the next page table or an intermediate physical address. By searching the page table level by level, the target intermediate physical address corresponding to the target virtual address can be finally found.

[0050] Among them, when the target intermediate physical address is the same as the target physical address, the process by which the electronic device queries the memory address translation page table according to the target virtual address to obtain the target intermediate physical address can be, for example: (1) Obtain multiple virtual address segments in the target virtual address, and the starting physical address of the memory address translation page table. (2) For the first virtual address segment among the multiple virtual address segments, determine the first translation page table segment according to the first virtual address segment and the starting physical address. Among them, the starting physical address of the first translation page table segment is the starting physical address of the memory address translation page table; the number of page table entries in the first translation page table segment is determined according to the number of bits in the first virtual address segment, that is, the number of page table entries is the number calculated with 2 as the base and the number of bits in the first virtual address segment as the exponent. (3) Query the first translation page table segment according to the offset value in the first virtual address segment to obtain the intermediate address in the corresponding page table entry; this intermediate address is an intermediate physical address; determine this intermediate address as an actual physical address, and further obtain the starting physical address of the next translation page table segment. (4) Determine the next translation page table segment according to this starting physical address and the next virtual address segment among the multiple virtual address segments; repeat the above process until all the multiple virtual address segments are processed; determine the target intermediate physical address according to the finally determined intermediate address.

[0051] Among them, it should be noted that the intermediate physical address refers to an intermediate state in the process of virtual address to physical address conversion during memory address conversion. In a multi-level page table structure, the virtual address needs to find the corresponding physical address by gradually searching the page table. In this process, the intermediate physical address refers to the intermediate state passed through by the virtual address during the process of gradually searching the page table, that is, the physical address corresponding to each level of the page table.

[0052] Among them, the acquisition of the original memory access request and the conversion process from the target virtual address to the target intermediate physical address enable the electronic device to quickly obtain the memory access request carrying the target intermediate physical address, and then perform subsequent processing, improving the processing efficiency.

[0053] Step 102: Determine the target intermediate physical address as the target physical address.

[0054] In an embodiment of the present disclosure, when the target intermediate physical address is inconsistent with the target physical address, when the electronic device stores content or performs other operations on the target physical address, it is necessary to combine the intermediate address in the process of determining the target intermediate physical address to determine the actual physical address of the next translation page table segment, and then perform a query process on the next translation page table segment. Among them, each time an intermediate address is determined, the page table needs to be accessed multiple times to determine the actual physical address of the next translation page table segment. Among them, the number of times the page table needs to be accessed is the same as the number of address segments in the intermediate address, which greatly increases the number of page table accesses and the processing volume. To reduce the number of page table accesses, the electronic device can set the target intermediate physical address and the target physical address to the same address. Correspondingly, after each intermediate address is determined, it is not necessary to access the page table multiple times to determine the actual physical address of the next translation page table segment, and the intermediate address can be directly used as the actual physical address of the next translation page table segment.

[0055] Step 103: Determine the access permission of the virtual machine corresponding to the virtual machine identifier for the target content on the target physical address according to the target physical address and the virtual machine identifier.

[0056] Among them, the access permission of the virtual machine corresponding to the virtual machine identifier for the target content on the target physical address, that is, the allowed access type of the virtual machine to the target content. Among them, the allowed access type may include at least one of the following: read type, write type, and execution type. In addition, the access permission of the virtual machine corresponding to the virtual machine identifier for the target content on the target physical address may also include the prohibited access type of the virtual machine to the target content. Among them, the prohibited access type is the access type other than the allowed access type among all access types. For example, when the allowed access types are read type and write type, the prohibited access type may be execution type.

[0057] Among them, for the content on each physical address, the access permissions of each virtual machine to the content on this physical address are stored in the permission page table. There is a one-to-one correspondence between the physical address and the address in the permission page table where the access permissions of each virtual machine to the content on this physical address are stored, and this correspondence can be determined in combination with the physical address and the starting physical address of the permission page table, etc. Therefore, in combination with the target physical address and the starting physical address of the permission page table, the access permissions of each virtual machine to the target content on the target physical address can be determined, and then the access permission of the virtual machine corresponding to the virtual machine identifier for the target content on the target physical address can be determined.

[0058] Step 104: Perform an authentication process according to the access permission and the target access type.

[0059] In an embodiment of the present disclosure, the process of the electronic device executing step 104 may be, for example, to obtain the allowed access types in the access permission; when the target access type is included in the allowed access types, determine that the authentication is passed; when the target access type is not included in the allowed access types, determine that the authentication fails.

[0060] Among them, the allowed access types refer to allowing the virtual machine to access and process the target content on the target physical address according to the allowed access types. For example, the allowed access types include the read type and the write type. When the execution type is not included, the virtual machine is allowed to perform read and write processing on the target content, and is not allowed to perform execution processing on the target content.

[0061] Among them, when the target access type is included in the allowed access types, it means that the virtual machine has the permission to access the target content, and the memory access request may be a real memory access request; when the target access type is not included in the allowed access types, it means that the operating system layer receiving the memory access request may be attacked by a virus, and the virtual machine identifier in the memory access request may have been changed and is not a real virtual machine identifier. It is necessary to block the memory access request to ensure the security of the target content and ensure the memory access security.

[0062] Step 105, when the authentication is passed, access and process the target content on the target physical address according to the target access type.

[0063] In an embodiment of the present disclosure, the electronic device may also execute the following process: when the authentication fails, stop accessing and processing the target content on the target physical address.

[0064] In the memory access method of the embodiment of the present disclosure, by obtaining a memory access request; the memory access request includes: a virtual machine identifier, a target intermediate physical address, and a target access type; determining the target intermediate physical address as the target physical address; according to the target physical address and the virtual machine identifier, determining the access permission of the virtual machine corresponding to the virtual machine identifier to the target content on the target physical address; performing authentication processing according to the access permission and the target access type; when the authentication is passed, accessing and processing the target content on the target physical address according to the target access type, so that when the virtual machine identifier in the memory access request is changed, the virtual machine corresponding to the changed virtual machine identifier can be prevented from accessing the target content on the target physical address through authentication processing, thereby ensuring the security of the target content and ensuring the memory access security.

[0065] Figure 2Flowchart of the memory access method according to another embodiment of the present disclosure. It should be noted that the memory access method of this embodiment can be applied to a memory access device, which can be configured in an electronic device or a chip, so that the electronic device or the chip can perform the memory access function.

[0066] Among them, the electronic device can be any device with computing capabilities, such as a personal computer (PC), a mobile terminal, a server, a controller in a vehicle, etc. The mobile terminal can be, for example, a hardware device such as a vehicle-mounted device, a mobile phone, a tablet computer, a personal digital assistant, a wearable device, etc. with various operating systems, touch screens, and / or display screens.

[0067] In addition, the memory access device can also be a memory management unit (MMU) in the electronic device. The MMU is a computer hardware responsible for processing memory access requests of the central processing unit (CPU). Its functions include virtual address to physical address conversion (i.e., virtual memory management), memory protection, and control of the central processing unit cache.

[0068] In addition, the memory access device can also be software in the electronic device, etc. Among them, the software is, for example, the management software in the memory management unit, etc. Among the following embodiments, the execution entity is taken as an example of an electronic device for illustration.

[0069] As Figure 2 shown, the method includes the following steps:

[0070] Step 201, obtain a memory access request; the memory access request includes: a virtual machine identifier, a target intermediate physical address, and a target access type.

[0071] Step 202, determine the target intermediate physical address as the target physical address.

[0072] In the embodiment of the present disclosure, a permission cache can be set in the electronic device, which includes historical access records, including the access permissions corresponding to each historical intermediate physical address and historical virtual machine identifier; among them, the access permissions include historical access types. Correspondingly, in order to speed up the memory access speed and reduce the number of memory accesses, before step 202, the electronic device can also perform the following process: query the permission cache according to the target intermediate physical address and the virtual machine identifier to determine whether there is an access permission corresponding to the target intermediate physical address and the virtual machine identifier in the permission cache; in the case where there is an access permission corresponding to the target intermediate physical address and the virtual machine identifier in the permission cache, determine the access permission as the access permission of the virtual machine corresponding to the virtual machine identifier to the target content on the target physical address.

[0073] Wherein, in the case that the access permission corresponding to the target intermediate physical address and the virtual machine identifier does not exist in the permission cache, steps 202 and subsequent steps are continued to obtain the access permission of the virtual machine corresponding to the virtual machine identifier to the target content on the target physical address.

[0074] Step 203, obtain multiple address segments in the target physical address, and the starting physical address of the permission page table.

[0075] In the embodiments of the present disclosure, the permission page table generally adopts a multi-level page table structure to reduce the space occupied by the page table. In the multi-level page table structure, the page directory table and the page middle directory, etc. are all used to store page table entries, and each page table entry contains a pointer to the next page table or an intermediate physical address. By searching the page table level by level, the storage address of the access permission can be finally found.

[0076] Step 204, determine the first permission page table segment and the intermediate address corresponding to the first address segment in the first permission page table segment according to the starting physical address and the first address segment among the multiple address segments.

[0077] Wherein, the starting physical address of the first permission page table segment is the starting physical address of the permission page table; the number of page table entries in the first permission page table segment is determined according to the number of bits in the first address segment, that is, the number of page table entries is the number calculated with 2 as the base and the number of bits in the first address segment as the exponent.

[0078] Wherein, the first permission page table segment includes multiple page table entries, and each page table entry includes an intermediate address. Among them, the offsets corresponding to different page table entries are different, that is, the numerical values of the address segments corresponding to different page table entries are different. For example, if the numerical value of the first address segment is the first numerical value, query the first permission page table segment with the first numerical value as the offset, and obtain the intermediate address in the page table entry with this offset; use this intermediate address as the intermediate address corresponding to the first address segment. If the numerical value of the first address segment is the second numerical value, query the first permission page table segment with the second numerical value as the offset, and obtain the intermediate address in the page table entry with this offset; use this intermediate address as the intermediate address corresponding to the first address segment.

[0079] Step 205, for each non-first address segment among the multiple address segments in turn, determine the non-first permission page table segment and the intermediate address corresponding to the non-first address segment in the non-first permission page table segment according to the determined intermediate address and the non-first address segment.

[0080] Among them, it is assumed that the target physical address includes four address segments. Among them, the first address segment is used to store other information rather than address information and does not participate in the process of determining access permissions. Then, the first address segment is ignored, and the remaining three address segments are respectively used as the first address segment, the second address segment, and the third address segment. Among them, after the electronic device obtains the intermediate address corresponding to the first address segment, for the second address segment, according to the intermediate address and the second address segment, a second permission page table segment is determined, and the intermediate address corresponding to the second address segment in the second permission page table segment; then, for the third address segment, according to the intermediate address and the third address segment, a third permission page table segment is determined, and the intermediate address corresponding to the third address segment in the third permission page table segment; the intermediate address is determined as the last obtained intermediate address.

[0081] Step 206: Determine the access permission of the virtual machine to the target content on the target physical address according to the content on the last obtained intermediate address.

[0082] In the embodiment of the present disclosure, the last obtained intermediate address is the address in the page table entry of the page table structure at the lowest level in the permission page table, and the access permissions of each virtual machine to the target content on the target physical address are stored in the page table entry of this address. Correspondingly, the process of the electronic device executing step 206 may be, for example, taking the content on the last obtained intermediate address as the access permission information of the target content on the target physical address; querying the access permission information according to the virtual machine identifier to obtain the access permission of the virtual machine to the target content on the target physical address.

[0083] Step 207: Perform authentication processing according to the access permission and the target access type.

[0084] Step 208: In the case of successful authentication, perform access processing on the target content on the target physical address according to the target access type.

[0085] In the embodiment of the present disclosure, a permission cache may be set in the electronic device, which includes historical access records, including the access permissions corresponding to each historical intermediate physical address and the historical virtual machine identifier; the access permissions include historical access types. Among them, in order to ensure the accuracy and real-time performance of the permission cache, after step 208, the electronic device may also execute the following process: in the case of successful authentication, update the virtual machine identifier, the target intermediate physical address, and the target access type to the permission cache.

[0086] Among them, it should be noted that the detailed descriptions of steps 201 to 202 and steps 207 to 208 can be referred to Figure 1Steps 101 to 102 and steps 104 to 105 in the illustrated embodiments will not be described in detail here.

[0087] In the memory access method of the embodiments of the present disclosure, by obtaining a memory access request; the memory access request includes: a virtual machine identifier, a target intermediate physical address, and a target access type; determining the target physical address as the target intermediate physical address; obtaining multiple address segments in the target physical address and the starting physical address of the permission page table; determining the first permission page table segment and the intermediate address corresponding to the first address segment in the first permission page table segment according to the starting physical address and the first address segment among the multiple address segments; sequentially for each non-first address segment among the multiple address segments, determining the non-first permission page table segment and the intermediate address corresponding to the non-first address segment in the non-first permission page table segment according to the determined intermediate address and the non-first address segment; determining the access permission of the virtual machine to the target content on the target physical address according to the content on the finally obtained intermediate address; performing an authentication process according to the access permission and the target access type; in the case of successful authentication, performing an access process on the target content on the target physical address according to the target access type, so that when the virtual machine identifier in the memory access request is changed, the virtual machine corresponding to the changed virtual machine identifier can be prevented from accessing the target content on the target physical address through the authentication process, thereby ensuring the security of the target content and ensuring the security of memory access.

[0088] The following is an example for illustration. As Figure 3 shown, it is a schematic diagram of an electronic device querying a memory address translation page table and a permission page table according to a target virtual address to determine the access permission of a virtual machine to target content on a target physical address. In Figure 3 taking the target virtual address including 5 virtual address segments, namely 63 - 48, 47 - 39, 38 - 30, 29 - 21, 20 - 12, 11 - 0 as an example, among which, the virtual address segment of 63 - 48 is used to store non-address information and is not considered.

[0089] In Figure 3 : (1) First, according to the virtual address segment of 47 - 39 and the starting physical address (TTBR_EL1) of the memory address translation page table, determine the first translation page table segment ( Figure 3 the first large box starting from the left in the first row in Figure 3Take 6 page table entries as an example. (2) Query the first translation page table segment according to the virtual address segment of 47-39, obtain an intermediate address, and use it as the starting physical address of the second translation page table segment, thereby determining the second translation page table segment. (3) Query the second translation page table segment according to the virtual address segment of 38-30, obtain an intermediate address, and use it as the starting physical address of the third translation page table segment, thereby determining the third translation page table segment. (4) Query the third translation page table segment according to the virtual address segment of 29-21, obtain an intermediate address, and use it as the starting physical address of the fourth translation page table segment, thereby determining the fourth translation page table segment. (5) Query the fourth translation page table segment according to the virtual address segment of 20-12 to obtain an intermediate address; according to this intermediate address and the virtual address segment of 11-0, determine the final intermediate address as the target intermediate physical address. (6) The target intermediate physical address includes 4 address segments, namely 63-37, 36-26, 25-15, 14-0. Among them, the address segment of 63-37 is used to store non-address information and is not considered. According to the address segment of 36-26 and the starting address of the permission page table (TTBR_EL2), determine the first permission page table segment ( Figure 3 The second large box starting from the left in the second row in, where there are a large number of page table entries, Figure 3 Take 6 page table entries as an example. (7) Query the first permission page table segment according to the address segment of 36-26, obtain an intermediate address, and use it as the starting physical address of the second permission page table segment, thereby determining the second permission page table segment. (8) Query the second permission page table segment according to the address segment of 25-15, obtain an intermediate address, and use it as the starting physical address of the third permission page table segment, thereby determining the third permission page table segment. (9) Query the third permission page table segment according to the address segment of 14-0, obtain an intermediate address; according to the content on this intermediate address, determine the access permission of the virtual machine to the target content on the target physical address.

[0090] Figure 4 It is a schematic structural diagram of a memory access device according to an embodiment of the present disclosure.

[0091] As Figure 4 shown, the memory access device may include: an acquisition module 401, a first determination module 402, a second determination module 403, an authentication processing module 404, and an access processing module 405.

[0092] Among them, an acquisition module 401 is configured to acquire a memory access request; the memory access request includes: a virtual machine identifier, a target intermediate physical address, and a target access type; a first determination module 402 is configured to determine the target intermediate physical address as a target physical address; a second determination module 403 is configured to determine, according to the target physical address and the virtual machine identifier, an access right of the virtual machine corresponding to the virtual machine identifier to target content on the target physical address; an authentication processing module 404 is configured to perform authentication processing according to the access right and the target access type; an access processing module 405 is configured to, when the authentication is passed, perform access processing on the target content on the target physical address according to the target access type.

[0093] In an embodiment of the present disclosure, the acquisition module 401 is specifically configured to acquire an original memory access request; the original memory access request includes: the virtual machine identifier, a target virtual address, and the target access type; query a memory address translation page table according to the target virtual address, and acquire a target intermediate physical address corresponding to the target virtual address in the memory address translation page table, so as to obtain the memory access request.

[0094] In an embodiment of the present disclosure, the second determination module includes: an acquisition unit, a first determination unit, a second determination unit, and a third determination unit; the acquisition unit is configured to acquire multiple address segments in the target physical address, and a starting physical address of a permission page table; the first determination unit is configured to determine a first permission page table segment and an intermediate address corresponding to the first address segment in the first permission page table segment according to the starting physical address and the first address segment among the multiple address segments; the second determination unit is configured to sequentially, for each non-first address segment among the multiple address segments, determine a non-first permission page table segment and an intermediate address corresponding to the non-first address segment in the non-first permission page table segment according to the determined intermediate address and the non-first address segment; the third determination unit is configured to determine an access right of the virtual machine to target content on the target physical address according to content on the finally acquired intermediate address.

[0095] In an embodiment of the present disclosure, the third determination unit is specifically configured to use content on the finally acquired intermediate address as access right information of target content on the target physical address; query the access right information according to the virtual machine identifier, and acquire an access right of the virtual machine to target content on the target physical address.

[0096] In an embodiment of the present disclosure, the apparatus further includes: a third determination module and a fourth determination module; the third determination module is configured to query a permission cache according to the target intermediate physical address and the virtual machine identifier, and determine whether there is an access permission corresponding to the target intermediate physical address and the virtual machine identifier in the permission cache; the fourth determination module is configured to, when there is an access permission corresponding to the target intermediate physical address and the virtual machine identifier in the permission cache, determine the access permission as the access permission of the virtual machine corresponding to the virtual machine identifier to the target content on the target physical address.

[0097] In an embodiment of the present disclosure, the authentication processing module 404 is configured to obtain the allowed access type in the access permission; when the target access type is included in the allowed access types, determine that the authentication is passed.

[0098] In an embodiment of the present disclosure, the authentication processing module 404 is further configured to, when the target access type is not included in the allowed access types, determine that the authentication fails.

[0099] In an embodiment of the present disclosure, the authentication processing module 404 is further configured to, when the authentication fails, stop the access processing of the target content on the target physical address.

[0100] In an embodiment of the present disclosure, the apparatus further includes: an update module, configured to update the virtual machine identifier, the target intermediate physical address, and the target access type to the permission cache when the authentication is passed.

[0101] In the memory access apparatus according to the embodiments of the present disclosure, by obtaining a memory access request; the memory access request includes: a virtual machine identifier, a target intermediate physical address, and a target access type; determining the target intermediate physical address as the target physical address; determining the access permission of the virtual machine corresponding to the virtual machine identifier to the target content on the target physical address according to the target physical address and the virtual machine identifier; performing authentication processing according to the access permission and the target access type; when the authentication is passed, performing access processing on the target content on the target physical address according to the target access type, so that when the virtual machine identifier in the memory access request is changed, the virtual machine corresponding to the changed virtual machine identifier can be prevented from accessing the target content on the target physical address through the authentication processing, thereby ensuring the security of the target content and ensuring the memory access security.

[0102] According to an embodiment of the present disclosure, there is also provided an electronic device, including: a processor; a memory for storing processor-executable instructions, wherein the processor is configured to: implement the memory access method as described above.

[0103] To implement the above embodiments, the present disclosure also proposes a non-transitory computer-readable storage medium.

[0104] Wherein, when the instructions in the storage medium are executed by the processor, the processor is enabled to execute the memory access method as described above.

[0105] To implement the above embodiments, the present disclosure also provides a computer program product.

[0106] Wherein, when the computer program product is executed by the processor of the electronic device, the electronic device is enabled to execute the method as above.

[0107] Figure 5 FIG. is a block diagram of an electronic device according to an exemplary embodiment. Figure 5 The illustrated electronic device is merely an example and should not impose any limitation on the functions and usage scope of the embodiments of the present disclosure.

[0108] As Figure 5 shown, the electronic device 1000 includes a processor 111, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM, Read Only Memory) 112 or the program loaded from the memory 116 into the random access memory (RAM, Random Access Memory) 113. In the RAM 113, various programs and data required for the operation of the electronic device 1000 are also stored. The processor 111, ROM 112, and RAM 113 are connected to each other via a bus 114. The input / output (I / O, Input / Output) interface 115 is also connected to the bus 114.

[0109] The following components are connected to the I / O interface 115: a memory 116 including a hard disk, etc.; and a communication part 117 including a network interface card such as a local area network (LAN) card, a modem, etc., and the communication part 117 performs communication processing via a network such as the Internet; a drive 118 is also connected to the I / O interface 115 as needed.

[0110] Specifically, according to the embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments of the present disclosure include a computer program carried on a computer-readable medium, and the computer program includes program codes for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 117. When the computer program is executed by the processor 111, the above functions defined in the method of the present disclosure are executed.

[0111] In an exemplary embodiment, a storage medium including instructions is also provided, such as a memory including instructions. The above instructions can be executed by the processor 111 of the electronic device 1000 to complete the above method. Optionally, the storage medium may be a non-transitory computer-readable storage medium. For example, the non-transitory computer-readable storage medium may be ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0112] In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program, which can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on a computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination of the above.

[0113] Figure 6 Schematic diagram of the structure of a chip according to an embodiment of the present disclosure. As Figure 6 shown, the chip includes a processor 601 and an interface circuit 602. Among them, the number of processors 601 may be one or more, and the number of interface circuits 602 may be one or more.

[0114] Optionally, the chip further includes a memory 603 for storing necessary computer programs and data; the interface circuit 602 is configured to receive signals from the memory 603 and send signals to the processor 601. The signals include computer instructions stored in the memory 603. When the processor 601 executes the computer instructions, the electronic device is caused to execute the memory access method described in the above embodiments of the present disclosure.

[0115] In addition, the word "exemplary" is used herein to mean serving as an example, instance, or illustration. Any aspect or design described herein as "exemplary" is not necessarily to be construed as advantageous over other aspects or designs. Rather, the word exemplary is intended to present concepts in a concrete fashion. As used herein, the term "or" is intended to mean an inclusive "or" rather than an exclusive "or". That is, unless specified otherwise, or clear from the context, "X applies A or B" is intended to mean any of the natural inclusive permutations. That is, if X applies A; X applies B; or X applies both A and B, then "X applies A or B" is satisfied under any one of the foregoing instances. Additionally, unless specified otherwise or clear from the context that it is referring to the singular form, the articles "a" and "an" as used in this application and the appended claims are generally understood to mean "one or more".

[0116] Likewise, although the present disclosure has been shown and described with respect to one or more implementations, equivalent variations and modifications will occur to those skilled in the art upon reading and understanding this specification and the drawings. The present disclosure includes all such modifications and variations and is limited only by the scope of the claims. Specifically with respect to the various functions performed by the components (e.g., elements, resources, etc.) described above, unless otherwise indicated, the terms used to describe such components are intended to correspond to any component (functionally equivalent) that performs the specific function of the described component, even if not structurally equivalent to the disclosed structure. Additionally, although a particular feature of the present disclosure may have been disclosed with respect to only one of several implementations, such a feature may, as may be desired and advantageous for any given or particular application, be combined with one or more other features of other implementations. Further, with respect to the use of "comprises", "comprising", "has", "having", "includes", or variants thereof in the detailed description or claims, such terms are intended to be inclusive in a manner similar to the term "including".

[0117] Other embodiments of the present disclosure will readily occur to those of ordinary skill in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include known or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are pointed out by the following claims.

[0118] It should be understood that the present disclosure is not limited to the exact structures described above and shown in the drawings, and various modifications and changes may be made without departing from its scope. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A memory access method, characterized in that, The method includes: Obtaining a memory access request; the memory access request includes: a virtual machine identifier, a target intermediate physical address, and a target access type; Determining the target intermediate physical address as the target physical address; Determining, according to the target physical address and the virtual machine identifier, the access right of the virtual machine corresponding to the virtual machine identifier to the target content on the target physical address; Performing an authentication process according to the access right and the target access type; In the case where the authentication is passed, performing an access process on the target content on the target physical address according to the target access type.

2. The method according to claim 1, wherein The obtaining of the memory access request includes: Obtaining an original memory access request; the original memory access request includes: the virtual machine identifier, a target virtual address, and the target access type; Querying a memory address translation page table according to the target virtual address, and obtaining a target intermediate physical address corresponding to the target virtual address in the memory address translation page table, so as to obtain the memory access request.

3. The method according to claim 1, characterized in that, The determining, according to the target physical address and the virtual machine identifier, the access right of the virtual machine corresponding to the virtual machine identifier to the target content on the target physical address includes: Obtaining a plurality of address segments in the target physical address, and the starting physical address of the permission page table; Determining a first permission page table segment and an intermediate address corresponding to the first address segment in the first permission page table segment according to the starting physical address and the first address segment among the plurality of address segments; Sequentially for each non-first address segment among the plurality of address segments, determining a non-first permission page table segment and an intermediate address corresponding to the non-first address segment in the non-first permission page table segment according to the determined intermediate address and the non-first address segment; Determining the access right of the virtual machine to the target content on the target physical address according to the content on the finally obtained intermediate address.

4. The method according to claim 3, characterized in that The determining the access right of the virtual machine to the target content on the target physical address according to the content on the finally obtained intermediate address includes: Taking the content on the finally obtained intermediate address as the access right information of the target content on the target physical address; Querying the access right information according to the virtual machine identifier, and obtaining the access right of the virtual machine to the target content on the target physical address.

5. The method according to claim 1, wherein Before taking the target intermediate physical address as the target physical address, the method further includes: Querying a permission cache according to the target intermediate physical address and the virtual machine identifier, and determining whether there is an access right corresponding to the target intermediate physical address and the virtual machine identifier in the permission cache; In the case where there is an access right corresponding to the target intermediate physical address and the virtual machine identifier in the permission cache, determining the access right as the access right of the virtual machine corresponding to the virtual machine identifier to the target content on the target physical address.

6. The method according to claim 1, characterized in that The performing an authentication process according to the access right and the target access type includes: Obtaining the allowed access types in the access right; When the target access type is included in the permitted access types, it is determined that the authentication is passed.

7. The method according to claim 6, characterized in that The performing authentication processing according to the access permission and the target access type further includes: When the target access type is not included in the permitted access types, it is determined that the authentication fails.

8. The method according to claim 1 or 7, characterized in that The method further includes: When the authentication fails, stop the access processing of the target content on the target physical address.

9. The method according to claim 1 or 5, characterized in that, The method further includes: When the authentication is passed, update the virtual machine identifier, the target intermediate physical address, and the target access type to the permission cache.

10. A memory access device, characterized in that, The apparatus includes: An acquisition module, configured to acquire a memory access request; the memory access request includes: a virtual machine identifier, a target intermediate physical address, and a target access type; A first determination module, configured to determine the target intermediate physical address as the target physical address; A second determination module, configured to determine the access permission of the virtual machine corresponding to the virtual machine identifier to the target content on the target physical address according to the target physical address and the virtual machine identifier; An authentication processing module, configured to perform authentication processing according to the access permission and the target access type; An access processing module, configured to, when the authentication is passed, perform access processing on the target content on the target physical address according to the target access type.

11. An electronic device, characterized in that, including: a processor; a memory for storing executable instructions of the processor; wherein, the processor is configured to: implement the steps of the memory access method according to any one of claims 1 to 9.

12. A non-transitory computer-readable storage medium, when the instructions in the storage medium are executed by a processor, enabling the processor to execute the memory access method according to any one of claims 1 to 9.

13. A chip, characterized in that, including one or more interface circuits and one or more processors; the interface circuit is configured to receive a signal from the memory of the electronic device and send the signal to the processor, the signal includes computer instructions stored in the memory, when the processor executes the computer instructions, enabling the electronic device to execute the memory access method according to any one of claims 1 to 9.

Images