Memory system and method for a memory system

Abstract

A memory system includes a processor configured to: associate a program instruction address range with a memory address range and an access permission for the memory address range with respect to a processor counter address range, wherein the access permission indicates the access permission of an owner software module; receive a memory access request for a memory address, wherein the memory access request is received from a requesting software module executing at the program instruction address; in response, determine that the requesting software module is the owner software module of the requested memory address by determining that the program instruction address belongs to the program instruction address range associated with the memory address range to which the memory address belongs; then determine whether the memory access request is permitted under the access permission of the owner software module associated with the program instruction address and the memory address, and if permitted, execute the memory request, and if not permitted, trigger a memory trap.

Description

Technical Field

[0001] This invention generally relates to the field of memory management, and more specifically, to a memory system and a method for providing an enforced memory protection unit (EMPU) for the memory system, wherein the EMPU achieves hardware-based spatial isolation while sharing a common virtual and physical address space. Background Technology

[0002] Mixed-critical systems (MCS) comprise tasks with two or more distinct Safety Integrity Levels (SILs). When these systems are implemented (merged) on the same embedded platform, they can share computational and communication resources. A key aspect of security analysis for MCS certification against different standards is ensuring Freedom from Interference (FFI) between components. In MCS systems, traditional techniques are used to provide spatial isolation, such as a Memory Management Unit (MMU) that translates virtual addresses to physical addresses and performs access permission checks, and a Memory Protection Unit (MPU) that performs access permission checks.

[0003] However, in certain critical scenarios, such traditional techniques cannot adequately guarantee protection against spatial interference. For example, if any one of the multiple modules used to store data fails, the data structures of other modules may exhibit unwanted behavior and potentially crash. Therefore, a technical challenge exists: how to provide spatial isolation and prevent unwanted data corruption between software modules running at the same privilege level and sharing the same address space, while maintaining system performance and minimizing code modifications.

[0004] Therefore, based on the above discussion, it is necessary to overcome the aforementioned deficiencies associated with traditional memory protection systems in hybrid critical systems, particularly in ensuring spatial isolation between software modules running at the same privilege level and sharing the same address space. Summary of the Invention

[0005] This invention provides a memory system and a method for using said memory system. The invention provides a solution to the following existing problem: how to provide spatial isolation and prevent unnecessary data corruption between software modules running at the same privilege level and sharing the same address space, while maintaining system performance and minimizing code modification. The object of this invention is to provide a solution that at least partially overcomes the problems encountered in the prior art, and to provide a memory system and a method for providing an enforced memory protection unit (EMPU) in the memory system, which achieves hardware-based spatial isolation while sharing a common virtual and physical address space.

[0006] One or more objects of the present invention are achieved by the solutions provided in the appended independent claims. Advantageous embodiments of the invention are further defined in the dependent claims.

[0007] In one aspect, the present invention provides a memory system including a processor configured to associate a program instruction address range with a memory address range and access permissions for the memory address range with respect to a processor counter address range, wherein the access permissions indicate the access permissions of an owner software module. Furthermore, the processor receives a memory access request for a memory address, wherein the memory access request is received from a requesting software module executing at the program instruction address. Additionally, the memory system is configured to: in response to this, determine that the requesting software module is the owner software module of the requested memory address by determining that the program instruction address belongs to the program instruction address range associated with the memory address range to which the memory address belongs. Furthermore, the memory system is configured to: determine whether the memory access request is permitted under the access permissions of the owner software module associated with the program instruction address and the memory address; if permitted, execute the memory request; if not permitted, trigger a memory trap.

[0008] Advantageously, the memory system provides enforced memory access control by establishing a direct relationship between program instruction addresses and memory access permissions. By distinguishing between owner and non-owner software modules based on program instruction addresses, the memory system achieves fine-grained control over memory access permissions, thereby preventing unauthorized memory access while maintaining memory system performance. Determining ownership status and verifying access permissions before executing memory requests ensures strong spatial isolation between software modules, effectively preventing unauthorized data access. Furthermore, the implementation of memory traps provides immediate detection and handling of unauthorized access attempts, thereby enhancing the overall reliability and security of the memory system.

[0009] In another aspect, the present invention provides a method for a memory system that associates a program instruction address range with a memory address range and access permissions for the memory address range relating to a processor counter address range, wherein the access permissions indicate the access permissions of an owner software module. Furthermore, a memory access request for a memory address is received, wherein the memory access request is received from a requesting software module executing at the program instruction address. In response, the requesting software module is determined to be the owner software module of the requested memory address by determining that the program instruction address belongs to the program instruction address range associated with the memory address range to which the memory address belongs; then it is determined whether the memory access request is permitted under the access permissions of the owner software module associated with the program instruction address and the memory address; if permitted, the memory request is executed; if not permitted, a memory trap is triggered.

[0010] The method described herein achieves all the advantages and technical effects of the memory system of the present invention.

[0011] It should be understood that all of the aforementioned implementation methods can be combined together.

[0012] It should be noted that all devices, elements, circuits, units, and apparatuses described in this application can be implemented in software or hardware elements or any combination thereof. All steps performed by the various entities described in this application and the functions described for performance by the various entities are intended to indicate that each entity is suitable for or used to perform the corresponding steps and functions. Even in the description of the following specific embodiments, if a particular function or step to be performed by an external entity is not reflected in the description of the specific detailed elements of the entity performing that particular step or function, it will be apparent to those skilled in the art that these methods and functions can be implemented in the corresponding software or hardware elements, or in any combination of such elements. It should be understood that the features of the invention are readily combined in various combinations without departing from the scope of the invention as defined by the appended claims.

[0013] Additional aspects, advantages, features, and objects of the invention will become apparent from the accompanying drawings and the detailed description of illustrative implementations as explained in conjunction with the following appended claims. Attached Figure Description

[0014] A better understanding of the above-described invention and the following detailed description of illustrative embodiments can be obtained by reading the accompanying drawings. Exemplary structures of the invention are shown in the drawings to illustrate the invention. However, the invention is not limited to the specific methods and tools disclosed herein. Furthermore, those skilled in the art will understand that the drawings are not drawn to scale. Where possible, similar elements are represented by the same numbers.

[0015] Embodiments of the present invention are described below by way of example only with reference to the following accompanying drawings, in which: Figure 1 This is a block diagram of a memory system for providing hardware-based spatial isolation, provided in an embodiment of the present invention. Figure 2 This is a flowchart of a method for providing a hardware-based spatially isolated memory system according to an embodiment of the present invention; Figure 3 A schematic diagram of a Safety Access (SAC) module for memory protection in a memory system provided by an embodiment of the present invention is shown. Figure 4 A schematic diagram of an exemplary program memory layout provided in an embodiment of the present invention is shown, illustrating memory access control in a memory system.

[0016] Figure 5 This diagram illustrates an exemplary access permission check in the Safety Access (SAC) module provided in an embodiment of the present invention. Figure 6 A schematic diagram of an enforced memory protection unit (EMPU) that combines a memory protection unit (MPU) and SAC functions in a memory system provided by an embodiment of the present invention is shown. Figure 7 A schematic diagram of an EMPU that combines a Memory Management Unit (MMU) and SAC functions in a memory system provided by an embodiment of the present invention is shown.

[0017] In the accompanying diagrams, underlined numbers indicate the item in which the underlined number appears or the item adjacent to the underlined number. Ununderlined numbers relate to the item identified by the line that associates the ununderlined number with the item. When a number is ununderlined and has an associated arrow, the ununderlined number is used to identify the general item that the arrow points to. Detailed Implementation

[0018] The following detailed description illustrates embodiments of the present invention and ways in which these embodiments can be implemented. While some modes of implementing the invention have been disclosed, those skilled in the art will recognize that other embodiments for implementing or practicing the invention may also exist.

[0019] Figure 1 This is a block diagram of a memory system providing hardware-based spatial isolation, as provided in an embodiment of the present invention. (Reference) Figure 1The figure shows a block diagram 100 of a memory system 102 including a processor 104, a memory protection unit 106, and a memory management unit (MMU) 108.

[0020] Processor 104 is used to associate a range of program instruction addresses with a range of memory addresses. Examples of processor 104 include microprocessors, microcontrollers, application-specific integrated circuits (ASICs), or other computing units capable of handling complex data processing tasks and optimizing algorithms. In one implementation, one or more processors may be used to associate a range of program instruction addresses with a range of memory addresses.

[0021] At runtime, processor 104 associates program instruction address ranges with memory address ranges and access permissions for memory address ranges relative to processor counter address ranges, where the access permissions indicate the access permissions of the owner software module. This association enables processor 104 to establish a specific ownership relationship between program instructions and memory regions, where the access permissions determine which operations, such as read or write, the owner software module can perform on the specified memory range. Processor 104 includes a mapping mechanism that uses predefined permission registers to link instruction addresses to memory regions. When an access request is made, processor 104 cross-references the mapping to ensure that only software modules with appropriate ownership permissions can perform the permitted operations. Processor 104 uses the association to verify whether a software module attempting to access memory has appropriate owner-level permissions, thereby providing hardware-level control over memory access based on both the source and target memory location of the access request.

[0022] Furthermore, processor 104 is used to receive memory access requests for memory addresses. These memory access requests are received from the requesting software module executing at the specified program instruction address. In response, by determining that the program instruction address belongs to a program instruction address range associated with the memory address range to which the memory address belongs, it is determined that the requesting software module is the owner software module of the requested memory address. Then, it is determined whether the memory access request is permitted under the access rights of the owner software module associated with the program instruction address and the memory address. If permitted, the memory request is executed; if not permitted, a memory trap is triggered. When processor 104 receives a memory access request, it identifies the requested memory address and the program instruction address of the requesting software module at the time of execution. Processor 104 receives requests during the operation of memory system 102 when any software module attempts to access a memory location. The received request includes information about the target memory address to be accessed and the program instruction address of the requesting software module for subsequent access rights verification. Processor 104 performs the determination process by checking whether the program instruction address of the requesting software module belongs to a predefined program instruction address range. This determination verifies ownership by confirming that the program instruction address of the requesting software module is within the range associated with the requested memory address range. When a program instruction address falls within a defined range, processor 104 determines that the requesting software module has ownership of the requested memory address. Processor 104 performs access permission verification by checking whether the received memory access request conforms to the access permissions assigned to the owner software module. Based on this determination, if the access permissions permit the requested operation, processor 104 executes the memory request; otherwise, if the access is unauthorized, processor 104 triggers a memory trap. Memory traps, as a hardware-level protection mechanism, help to immediately stop unauthorized memory access attempts and ensure the strict implementation of memory protection policies.

[0023] According to one embodiment, processor 104 is further configured to: determine that the requesting software module is not the owner software module of the requested memory address by determining that the program instruction address does not belong to the program instruction address range associated with the memory address range to which the memory address belongs; then determine whether the memory access request is permitted under the access rights of the non-owner software module associated with the program instruction address and the memory address; if permitted, execute the memory request; if not permitted, trigger a memory trap. In one implementation, if processor 104 determines that the program instruction address of the requesting software module does not belong to a defined range, processor 104 identifies the module as non-owner. In this case, processor 104 is configured to verify whether the memory access request conforms to the access rights specifically allocated for the non-owner software module. Therefore, based on this verification, processor 104 checks whether the non-owner access rights permit the requested operation. If permitted, processor 104 executes the memory request; otherwise, processor 104 triggers a memory trap to prevent unauthorized access.

[0024] According to one embodiment, memory system 102 includes access permissions associated with program instruction address ranges, which also indicate non-owner access permissions. In one implementation, each memory range maintains two different sets of access permissions. First, one set is for owner software modules. Second, there is a set specifically for non-owner software modules. Non-owner access permissions are stored along with the owner access permissions for each memory range, enabling memory system 102 to implement different levels of access control based on whether a software module is identified as owner or non-owner. For example, owner software modules may have full read-write permissions, while non-owner modules may be restricted to read-only access or not access the same memory range at all. Therefore, two-layer access control enhances security and efficient memory management by imposing different permissions on owners and non-owners. Two-layer access control prevents unauthorized modifications while allowing controlled access when needed. Additionally, two-layer access control reduces security risks, minimizes unintended memory changes, and optimizes resource utilization within memory system 102.

[0025] According to one embodiment, memory system 102 includes a default access permission for non-owner modules. In one implementation, memory system 102 automatically assigns a predetermined default access permission to any software module identified as a non-owner. The default access permission provides a baseline protection mechanism for providing minimal or no access permissions to non-owner modules. For example, the default configuration might be set to "inaccessible" or "read-only," ensuring that non-owner software modules have restricted access to memory regions without requiring explicit permission settings for each non-owner module. Therefore, the automatic assignment of default access permissions enhances security and operational efficiency by ensuring restricted access for non-owner modules without manual configuration. This approach prevents unauthorized access, minimizes security risks, and simplifies access control management, thereby maintaining the integrity of memory regions within memory system 102.

[0026] According to one embodiment, the processor 104 is further configured to store multiple associations of program instruction address ranges, memory address ranges, and access permissions for memory address ranges with respect to processor 104 counter address ranges in multiple address registers within a Safety Access (SAC) module. The processor 104 stores multiple associations in dedicated address registers within the SAC module, where each register maintains a relationship between a specific program instruction address range, memory address range, and corresponding access permissions. The SAC module includes a configuration register for providing efficient storage and lookup of multiple memory protection configurations. Therefore, storing multiple associations in the SAC module enables efficient access control, fast lookup of access permissions, and secure memory management, thereby enhancing the reliability and security of the memory system 102.

[0027] According to one embodiment, the SAC module is associated with a lock_bit, wherein the processor 104 is used to receive requests for the address of the SAC module, determine that the lock_bit of the SAC module is set, and trigger a memory trap in response. In one implementation, each register in the SAC module may include a lock_bit to prevent unauthorized modifications when the lock_bit is set in the SAC module, and the processor 104 monitors all access requests for any register within the SAC module. Upon receiving such a request, the processor 104 checks the state of the lock_bit. If it finds that the lock_bit is set, the processor 104 immediately triggers a memory trap to prevent modifications to the SAC module configuration. This protection mechanism protects all registers in the SAC module, thereby preventing unauthorized modifications after the lock_bit is set. Additionally, the control registers in the SAC module include a process-level bit (PBIT), which controls the evaluation of non-privileged registers, providing additional access control when the CPU runs at different privilege levels. Therefore, the lock_bit ensures access control by preventing unauthorized modifications to the SAC module. By triggering a memory trap when lock_bit is set, processor 104 protects all registers, maintains configuration integrity, and enhances the security of memory system 102.

[0028] According to one embodiment, each address register is associated with a control register, and each control register includes a lock_bit. The processor 104 receives a request for an address register, determines that the lock_bit of the address register is set, and triggers a memory trap in response. In one implementation, the processor 104 provides protection at a separate register level, where each address register in the SAC module has its own associated control register including a lock_bit. When the processor 104 receives a request to access a specific address register, the processor 104 checks the lock_bit status in the corresponding control register. If the lock_bit of that specific address register is set, the processor 104 triggers a memory trap. This prevents modification of the register while allowing access to other registers whose lock_bits are not set. Therefore, the processor 104 provides fine-grained register-level protection to prevent unauthorized modifications to critical registers while allowing access to other registers, enhancing security and stability.

[0029] According to one embodiment, the processor 104 is also configured to receive a memory address as a physical memory address. In one implementation, the processor 104 directly receives and processes memory access requests using a physical memory address, which represents the actual hardware location in the memory system 102. When a memory access request is received, the processor 104 processes the physical address without any address translation, thereby enabling direct verification of access permissions against the actual memory location in the hardware. Therefore, directly processing the physical memory address simplifies the memory access process, improves performance by eliminating the need for address translation, and ensures faster access permission verification.

[0030] According to one embodiment, the memory system 102 also includes a memory protection unit 106. Furthermore, the processor 104 is configured to receive physical memory addresses in parallel with the memory protection unit 106. In one implementation, the processor 104 directly receives and processes memory access requests using physical memory addresses, which represent the actual hardware locations in memory. Upon receiving a memory access request, the processor 104 operates directly on the physical address without address translation, thus enabling on-the-fly verification of access permissions for hardware memory locations. The memory system 102 includes a high Security Integrity Level (SIL) chip to ensure security and reliability. Therefore, the memory protection unit 106 verifies access permissions, providing an additional layer of security while maintaining high performance by eliminating translation latency. Parallel processing ensures memory access with protective mechanisms.

[0031] According to one embodiment, the memory system 102 further includes a memory management unit 108, which receives virtual memory addresses and translates them into corresponding physical memory addresses. The processor also receives physical memory addresses from the MMU 108. In one implementation, when a memory access request is initiated using a virtual memory address, the MMU 108 first receives the virtual address. The MMU 108 translates the virtual memory address into its corresponding physical address. After the translation, the processor 104 receives the physical memory address from the MMU 108 to verify access rights and ownership. The memory system 102 can implement access control at different granularities, from function-level to file-level protection, thereby enabling flexible deployment while maintaining security. Therefore, the memory system 102 achieves efficient memory management by translating virtual addresses into physical addresses, ensuring appropriate access control and ownership verification, while maintaining the security of the memory system 102 and optimizing memory utilization.

[0032] According to one embodiment, access permissions are stored as bitmasks. In one implementation, access permissions to memory regions are represented and stored using a bitmask format, where specific bits in the mask indicate different types of access rights. Processor 104 utilizes the bitmask representation to efficiently store and verify access permissions, where each bit in the mask corresponds to a specific type of access right, such as read or write access to owner and non-owner software modules. Therefore, the bitmask format can efficiently store and quickly verify access permissions, thereby enabling the management of memory permissions while reducing the complexity of access control checks.

[0033] Advantageously, memory system 102 provides enforced memory access control by determining a direct relationship between program instruction addresses and memory access permissions. Memory system 102 achieves fine-grained control over memory access permissions by distinguishing between owner and non-owner software modules based on program instruction addresses, thereby preventing unauthorized memory access while maintaining memory system performance. Memory system 102 automatically determines ownership status and verifies access permissions before executing memory requests, ensuring strong spatial isolation between software modules and effectively preventing accidental and intentional data corruption. Furthermore, the implementation of memory traps in memory system 102 provides immediate detection and handling of unauthorized access attempts, thereby enhancing the reliability and security of memory system 102 without requiring extensive modifications to existing software modules. In addition, memory system 102 provides spatial isolation and prevents unnecessary data corruption between software modules running at the same privilege level and sharing the same address space, while maintaining system performance and minimizing code modifications. Additionally, memory system 102 is used to provide low runtime overhead, for example, by providing comprehensive protection at the inter-process, inter-thread, and intra-thread levels simultaneously.

[0034] Figure 2 This is a flowchart illustrating a method for providing a hardware-based spatially isolated memory system according to an embodiment of the present invention. (See reference) Figure 2 A flowchart of a memory system method 200, including steps 202 to 212, is shown. The memory system (i.e. Figure 1 The memory system 102) is used to execute the memory system method 200.

[0035] In step 202, the method 200 for memory system 102 includes associating the following 202, which initiates the process of determining a protected memory region. As the association expands, processor 104 proceeds to the following sub-step: program instruction address range 202A, in which the method 200 for memory system 102 specifies specific boundaries that define the residence and execution locations of program instructions. These boundaries naturally extend to the end of the following sub-step: memory address range 202B, in which the method 200 for memory system 102 maps the corresponding memory region that will cooperate with the instruction address. The association ends with the following sub-step: access permissions for the memory address range of the processor counter address range, wherein the access permissions indicate the access permissions of the owner software module 202C, and the method 200 for memory system 102 performs protection by precisely defining which operations the owner software module can perform within the defined boundaries. Through this sequence, the method 200 for memory system 102 forms a complete chain from instruction location to memory access control.

[0036] In step 202, the method 200 for memory system 102 includes associating a program instruction range with a memory address range and access permissions, wherein substeps 202A, 202B, and 202C define the boundaries of the program instruction address, the memory address, and the corresponding access permissions of the owner software module. In step 204, the method 200 for memory system 102 includes receiving a memory access request for a memory address. In step 206, the method 200 for memory system 102 includes determining that the requesting software module is the owner software module of the requested memory address. In step 208, the method 200 for memory system 102 includes verifying whether the memory access request is permitted under the access permissions of the owner software module associated with the program instruction address and the memory address. The method 200 for memory system 102 includes a two-phase verification process. In step 206, ownership is determined by checking whether the program instruction address falls within a predefined range. In step 208, the requested memory operation is evaluated against the access permissions configured for the owner software module. After double verification, proceed to step 210, where a memory request is executed, or in step 212, a memory trap is triggered.

[0037] According to one embodiment, method 200 includes: determining that the requesting software module is not the owner software module of the requested memory address by determining that the program instruction address does not belong to a program instruction address range associated with the memory address range to which the memory address belongs; then determining whether the memory access request is permitted under the access rights of the non-owner software module associated with the program instruction address and the memory address; if permitted, executing the memory request; if not permitted, triggering a memory trap. In one implementation, method 200 for memory system 102 includes: determining that the requesting software module is not the owner software module of the requested memory address by determining that the program instruction address does not belong to a program instruction address range associated with the memory address range to which the memory address belongs; and determining whether the memory access request is permitted under the access rights of the owner software module associated with the program instruction address and the memory address. Furthermore, upon receiving a memory access request, method 200 for memory system 102 first determines ownership by checking whether the program instruction address belongs to a determined range. If the program instruction does not belong to the memory address range, ownership is verified. Once ownership is verified, method 200 for memory system 102 evaluates whether the requested memory operation conforms to the access rights configured for the owner software module. Dual authentication prepares the memory system 102 for the final decision point where it will either execute a memory request or trigger a memory trap.

[0038] Advantageously, method 200 provides mandatory memory access control by determining a direct relationship between program instruction addresses and memory access permissions. Method 200 enables fine-grained control of memory access permissions by distinguishing between owner and non-owner software modules based on program instruction addresses, thereby preventing unauthorized memory access while maintaining memory system performance. Determining ownership status and verifying access permissions before executing memory requests ensures strong spatial isolation between software modules, effectively preventing unauthorized data access. Furthermore, the implementation of memory traps provides immediate detection and handling of unauthorized access attempts, thereby enhancing the overall reliability and security of the memory system.

[0039] A computer program product is also provided, including program instructions, wherein the program instructions are configured to perform method 200 for memory system 102 when executed by a processor in the memory system. The computer program product is implemented as an algorithm and embedded in software stored in a non-transitory computer-readable storage medium. The non-transitory computer-readable storage device may include, but is not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. Examples of computer-readable storage media include, but are not limited to, electrically erasable programmable read-only memory (EEPROM), random access memory (RAM), read-only memory (ROM), hard disk drive (HDD), flash memory, secure digital (SD) cards, solid-state drives (SSDs), computer-readable storage media, and / or CPU cache memory.

[0040] Figure 3 A schematic diagram of a Safety Access (SAC) module for memory protection in a memory system provided by an embodiment of the present invention is shown. (Reference) Figure 3 This diagram 300 shows a security access (SAC) module for memory protection in memory system 102.

[0041] In one implementation, the SAC module configuration initiates memory protection through a hierarchical register structure at operation 300. This structure includes N privileged-level registers at operation 302, which cooperate with M non-privileged-level registers at operation 314 to determine a comprehensive protection boundary. Each register configuration is performed sequentially. The program counter field at operation 304 defines the pc address range, directly linked to the memory region field at operation 306 specifying the corresponding data range. The permission field at operation 308 manages the range by implementing read / write access control bits. Operation 310 establishes owner permissions (RD_BIT, WR_BIT), forming a complete access control framework together with the other permissions in operation 312. Operation 314 provides a connector field that can link multiple register sets to extend the protection domain. Furthermore, the control mechanism at operation 326 manages the configuration through a sequential series of control registers: operation 328 (control register -1), operation 330 (control register -5), extending all the way to control register -N. The control register includes a process-level bit (PBIT) for controlling the evaluation of non-privileged registers and implements a lock bit function. When the lock bit function is set, further modifications to the SAC configuration are prevented until a reset. Therefore, memory system 102 provides fine-grained access control through privileged and non-privileged level integration and prevents any unauthorized modifications, thereby enhancing overall data security, data integrity, and scalability while maintaining a consistent access policy for memory system 102.

[0042] Figure 4 A schematic diagram of an exemplary program memory layout provided by an embodiment of the present invention is shown, illustrating memory access control in a memory system. (Reference) Figure 4 A schematic diagram 400 of an exemplary program memory layout is shown, illustrating memory access control in memory system 102.

[0043] In one implementation, the program memory layout demonstrates how the SAC mechanism implements spatial isolation through memory organization at operation 402. The memory structure includes the data portion at operation 404, where operations 404A and 404B represent separate data regions for different software modules. The code portion at operation 406 includes operations 406A and 406B, which contain the executable code for the respective modules. The access control interface at operation 408 manages the interaction between the parts, where operation 408A establishes specific access paths between code and data regions. The access control flow continues through operation 410, which is connected to the acknowledgment mechanism at operation 412. Operation 412A implements the permission control logic that enforces the defined access policies between software modules.

[0044] Figure 5 This diagram illustrates an exemplary access permission check in the Safety Access (SAC) module provided in an embodiment of the present invention. (See reference...) Figure 5 The diagram 500 illustrates an exemplary access control check in the SAC module.

[0045] In one implementation, the SAC module at operation 502 implements a hierarchical structure for verifying access permissions. This module includes several key components organized in a parallel structure. Operation 504 establishes the main configuration framework, which includes a series of register entries at operations 506, 508, 510, and 512. Operation 514 serves as a single control register, maintaining specific configuration parameters for implementing access control. The register structure extends to operations 520A, 520B, and 520C, which represent the evolution of the program counter value during execution. Arrows pointing from the program counter value to operations 510 and 512 indicate the type of privileged access to be verified. Operation 516 is also a single control register, linking entries to their respective implementation mechanisms. Operation 518 provides interface logic for coordinating between different register sets, ensuring uniform access control throughout the protection scheme.

[0046] Figure 6 This diagram illustrates a forced memory protection unit (EMPU) that combines a memory protection unit (MPU) and SAC (Safety Assurance) functions in a memory system provided by an embodiment of the present invention. (See reference) Figure 6 The diagram 600 shows the EMPU architecture.

[0047] In one implementation, the EMPU receives the physical address, program counter value, and CPU privilege level information at operation 602 for verifying memory access. These inputs flow through operation 604 to a parallel processing architecture, which includes the MPU at operation 612 and the SAC module at operation 616. The parallel operations implemented via connection paths 610A, 610B, and 610C enable simultaneous verification of standard memory protection and access permissions. At operation 612, the memory system 102 processes the CPU privilege level, program counter (PC) value, and requested memory address read / write signals. If the MPU or SAC detects an unauthorized access attempt, operation 618 initiates a trap signal to protect the physical memory space. The MPU and SAC can operate in parallel to perform memory access or generate trap signals, ensuring efficient protection without incurring additional latency.

[0048] Figure 7 This diagram illustrates an EMPU (Memory Management Unit) that combines the functions of a Memory Management Unit (MMU) and a Memory Controller (SAC) in a memory system provided by an embodiment of the present invention. (See reference...) Figure 7 A schematic diagram 700 of an EMPU in memory system 102, which combines the functions of MMU and SAC, is shown.

[0049] In one implementation, at operation 702, the EMPU receives the virtual address that needs to be translated and verified. The virtual address flows through operation 704 to operation 712, where the MMU performs the translation from virtual address to physical address. The translated physical address then traverses a structured path. Operation 708 manages intermediate routing, while operation 710 completes the path to operation 714, where the SAC module is located. The sequence of processes continues through operations 716, 718, and 720, which constitute a step-by-step verification process. Upon detection of any unauthorized access attempt, operation 722 generates a trap signal to protect the physical memory space 724. This sequential process ensures that each memory access request undergoes address translation and thorough permission verification before being authorized or denied access to physical memory. Therefore, the EMPU, which combines MMU and SAC functional verification, enables secure address translation and verification in a sequential process, ensuring that all memory accesses undergo address translation and permission checks, and maintains the integrity of the memory system 102 through trap response capabilities at operation 726.

[0050] Modifications to the embodiments of the invention described above may be made without departing from the scope of the invention as defined in the appended claims. Expressions such as “comprising,” “including,” “incorporated,” “having,” “is / are,” etc., used to describe and claim the invention are intended to be interpreted in a non-exclusive manner, allowing for the presence of items, components, or elements not explicitly described. Singular references should also be interpreted as relating to the plural. The word “exemplary” as used herein means “as an example, instance, or illustration.” Any embodiment described as “exemplary” is not necessarily to be construed as being more preferred or advantageous than other embodiments, or excluding combinations of features from other embodiments. The word “optionally” as used herein means “provided in some embodiments and not in others.” It should be understood that certain features of the invention described in the context of a single embodiment for clarity may also be provided in combination in a single embodiment. Conversely, various features of the invention described in the context of a single embodiment for brevity may also be provided individually or in any suitable combination or as embodiments of any other described aspect of the invention.

Claims

1. A memory system (102), characterized in that, Includes a processor (104), said processor (104) being used for: Will Program instruction address range and Memory address range and The access permissions associated with the memory address range of the processor counter address range are defined, wherein the access permissions indicate the access permissions of the owner software module; Receive a memory access request for a memory address, wherein the memory access request is received from a requesting software module executed at the program instruction address; In response, by determining that the program instruction address belongs to the program instruction address range associated with the memory address range to which the memory address belongs, it is determined that the requesting software module is the software module that owns the requested memory address. Then it is determined whether the memory access request is permitted under the access permissions of the owner software module associated with the program instruction address and the memory address. If permitted, the memory request is executed. If not allowed, a memory trap will be triggered.

2. The memory system (102) according to claim 1, characterized in that, The processor (104) is also used for: By determining that the program instruction address does not belong to the program instruction address range associated with the memory address range to which the memory address belongs, it is determined that the requesting software module is not the owner software module of the requested memory address. Then it is determined whether the memory access request is allowed under the access permissions of the non-owner software module associated with the program instruction address and the memory address. If permitted, the memory request is executed. If not allowed, a memory trap will be triggered.

3. The memory system (102) according to claim 1, characterized in that, The access permissions associated with the program instruction address range, the memory address range also indicating non-owner access permissions.

4. The memory system (102) according to claim 1 or 2, characterized in that, The non-owner access permissions are the default access permissions.

5. The memory system (102) according to any one of the preceding claims, characterized in that, The processor (104) is also configured to store multiple associations of the program instruction address range, the memory address range, and the access permissions of the memory address range with respect to the processor counter address range in multiple address registers in the Safety Access (SAC) module.

6. The memory system (102) according to claim 5, characterized in that, The SAC module is associated with lock_bit, and the processor (104) is used for: Receive a request for the address of the SAC module. It is determined that the lock_bit of the SAC module is set, and a memory trap is triggered in response.

7. The memory system (102) according to claim 5 or 6, characterized in that, Each address register is associated with a control register, and each control register includes a lock_bit, which the processor (104) uses to: Receive a request for the address register. It is determined that the lock_bit of the address register is set, and a memory trap is triggered in response.

8. The memory system (102) according to any one of the preceding claims, characterized in that, The processor (104) is also used to receive the memory address as a physical memory address.

9. The memory system (102) according to any one of the preceding claims, characterized in that, It also includes a memory protection unit (106), and the processor (104) is also used to receive the physical memory address in parallel with the memory protection unit (106).

10. The memory system (102) according to any one of claims 1 to 8, characterized in that, It also includes a memory management unit (108), wherein the memory management unit (108) is used to receive a virtual memory address and convert the virtual memory address into a corresponding physical memory address, and the processor (104) is also used to receive the physical memory address from the memory management unit (108).

11. The memory system (102) according to any one of the preceding claims, characterized in that, The access permissions are stored as a bitmask.

12. A method (200) for a memory system (102), characterized in that, The method (200) includes: Will Program instruction address range and Memory address range and The access permissions associated with the memory address range of the processor counter address range are defined, wherein the access permissions indicate the access permissions of the owner software module; Receive a memory access request for a memory address, wherein the memory access request is received from a requesting software module executed at the program instruction address; In response, by determining that the program instruction address belongs to the program instruction address range associated with the memory address range to which the memory address belongs, it is determined that the requesting software module is the software module that owns the requested memory address. Then it is determined whether the memory access request is permitted under the access permissions of the owner software module associated with the program instruction address and the memory address. If permitted, the memory request is executed. If not allowed, a memory trap will be triggered.

13. The method (200) according to claim 12, characterized in that, The method (200) further includes: By determining that the program instruction address does not belong to the program instruction address range associated with the memory address range to which the memory address belongs, it is determined that the requesting software module is not the owner software module of the requested memory address. Then it is determined whether the memory access request is allowed under the access permissions of the non-owner software module associated with the program instruction address and the memory address. If permitted, the memory request is executed. If not allowed, a memory trap will be triggered.

14. A computer program product, characterized in that, Includes program instructions, wherein the program instructions are configured to perform the method (200) according to claim 12 or 13 when executed by one or more processors in the memory system (102).

Images