142 results about "Memory protection" patented technology

The invention discloses a solid state disk management system and a data processing method, and relates to the technical field of solid state disk management. Flexible task scheduling and resource management are provided through a lightweight operating system module, and a computing task program defined by a user is supported to be dynamically loaded; edge computing or machine learning operators are efficiently executed in combination with a programmable hardware processing unit and a DMA channel of the computing acceleration engine module, the data preloading module is utilized to predict and preload data to DDR based on LBA access history, access delay is reduced, an NVMe protocol is expanded by means of the task unloading interface module, host task issuing and result returning are achieved, and the data processing efficiency is improved. And hardware-level memory protection is ensured through the security isolation module, so that the data calculation processing capacity of the solid state disk is remarkably improved, localized calculation tasks such as edge calculation and machine learning are supported, mass data transmission is effectively reduced, and bus and network loads are relieved.

The invention relates to an automatic memory protection method and device, computer equipment and a storage medium, and the automatic memory protection method comprises the steps: responding to a real-time memory read-write instruction, and determining a target memory address corresponding to the memory read-write instruction; determining a pre-stored tag value corresponding to the target memory address and an actual tag value currently embedded in a memory block pointed by the target memory address; and when it is detected that the pre-stored tag value is not matched with the actual tag value, stopping a memory operation associated with the memory read-write instruction. Through the method and the device, the problem that the data-oriented attack cannot be effectively prevented is solved, the data-oriented attack is effectively prevented, and the memory security and the system operation efficiency are improved.

According to embodiments of the present disclosure, a system includes: a microkernel having a low-level application programming interface (API) and providing memory protection domains to user-level processes; and an abstraction layer running on top of the microkernel and comprising a plurality of service extensions to the microkernel and configured to provide a high-level operating system (OS) API for use by one or more application processes running in user space, wherein different ones of the service extensions are configured to run within different ones of the memory protection domains provided by the microkernel.

The invention discloses a memory management method, device and equipment and a computer readable storage medium. The method comprises the following steps: when a mapping request exists, determining a target I / O virtual address corresponding to the mapping request and triggering an application identity identifier of the mapping request; detecting whether the target I / O virtual address is associated with the application identity label or not; and if yes, establishing mapping between the target I / O virtual address and the corresponding memory physical address. According to the method and the device, the memory protection capability of the equipment can be enhanced on a system without IOMMU (Input / Output Management Unit); and the complexity of hardware design can be reduced on a system with an IOMMU, and the hardware cost is reduced.

The invention relates to a heterogeneous trusted execution environment architecture construction method and device, and the method comprises the following steps: constructing a tensor analyzer which is located in a memory control unit of a central processing unit of a heterogeneous trusted execution environment architecture; and providing memory protection with uniform tensor granularity for data interaction between the neural network processor of the heterogeneous trusted execution environment architecture and the central processing unit through the tensor analyzer.

Systems and methods are disclosed for memory protection for memory protection for gather-scatter operations. For example, an integrated circuit may include a processor core; a memory protection circuit configured to check for memory protection violations with a protection granule; and an index range circuit configured to: memoize a maximum value and a minimum value of a tuple of indices stored in a vector register of the processor core as the tuple of indices is written to the vector register; determine a range of addresses for a gather-scatter memory instruction that takes the vector register as a set of indices based on a base address of a vector in memory, the memoized minimum value, and the memoized maximum value; and check, using the memory protection circuit during a single clock cycle, whether accessing elements of the vector within the range of addresses will cause a memory protection violation.

Computer-implemented methods and associated hardware for static trusted execution environment for inter-architecture processor program compatibility are disclosed herein. A device (e.g., a Reduced Instruction Set Computing-Five (RISC-V) device), may emulate a static trusted execution environment (e.g., ARM TrustZone) using physical memory protection (PMP). A regular world may have access to only a portion of an address space of the device, while a secure world may have access to the full address space. A secure world identifier (SWID) may be stored in a configuration status register (CSR) only accessible by a mode (e.g., machine mode). When an entry is added to a translation lookaside buffer (TLB), the SWID may be added as part of a tag to differentiate secure world entries from regular world entries.

The invention provides a task stack protection method and device, electronic equipment, a chip and a medium, and relates to the technical field of computer security. The task stack protection method comprises the following steps: in response to starting of an operating system, initializing a memory protection unit; based on the memory protection unit, the first task is removed from a stack protection memory area, the stack protection memory area is a stack top space of a task stack memory area of an operating system memory, and the first task is a process or a thread operated by an operating system in the stack protection memory area; setting attributes of a stack protection memory area of a second task, the second task being a task executed after the first task and being an active task; and moving the second task into the stack protection memory area. Through the technical scheme provided by the invention, the problem that the task stack protection of the memory area by the memory protection unit is unsafe and unreliable is solved, and the safety and reliability of the task stack protection of the memory area by the memory protection unit are improved.

There is provided an apparatus that includes processing circuitry for performing processing in one of a fixed number of at least two domains. One of those domains is subdivided into a variable number of execution environments and memory protection circuitry uses a key input to perform encryption or decryption on the data of a memory access request issued to a memory address from within a current one of the domains. The key input is different for each of the domains and for each of the execution environments, the key input for each of the domains is fixed at boot time of the apparatus, and the key input for each of the execution environments is dynamic.

An apparatus is provided in which processing circuitry performs processing in one of a fixed number of at least two domains. One of the domains is subdivided into a variable number of execution environments one of which is a management execution environment configured to manage the execution environments. Memory protection circuitry defines a point of encryption after at least one unencrypted storage circuit of a memory hierarchy and before at least one encrypted storage circuit of the memory hierarchy. The at least one encrypted storage circuitry uses a key input to perform encryption or decryption on the data of a memory access request issued from within a current one of the domains. The key input is different for each of the domains and for each of the execution environments and the management execution environment is configured to inhibit issuing a maintenance operation to the at least one encrypted storage circuit of the memory hierarchy.

The invention discloses a user interrupt event callback mechanism implementation method, which adopts an implementation method of combining user interrupt event callback caused by hardware interrupt and conventional task scheduling, after system hardware interrupt occurs, kernel interrupt processing codes construct a user mode code running environment, and a user mode is switched to run a user event callback function, so that the user interrupt event callback is realized. After the execution of the user event callback function is finished, the system environment before the execution of the user event callback function is recovered through an undefined instruction falling into a kernel; and when all the user callback event functions are executed, falling into the kernel through the undefined instruction again, and recovering an instruction execution stream before the interruption event occurs by utilizing the stack frame information reserved when the interruption is entered. According to the method, an emergency processing mechanism with determined delay is realized, the constructed interrupt event callback function runs in a user space, and the method has the functions of shielding low-priority interrupt and protecting a memory, is low in overhead, simple to implement and easy to adapt to various processors, and has a good application prospect.

A system controls access to a physical address (PA) space. The system includes multiple system resources addressable within the PA space, and multiple processing circuits executing multiple virtual machines (VMs). A given region of the PA space is dedicated to addressing the VMs. The system also includes multiple memory management units (MMUs) coupled to corresponding processing circuits. A given MMU is operative to translate a virtual address indicated in an access request from a processing circuit into a requested PA that is accessible by the processing circuit according to a configurable setting of the given MMU. The system further includes multiple memory protection units (MPUs). A given MPU, which is coupled to a target system resource allocated with the requested PA, is operative to grant or deny the request based on information indicating whether the requested PA is accessible to a requesting VM executed on the processing circuit.

The invention belongs to the technical field of program updating, and particularly relates to a method for flashing Bootloader software, which comprises the following steps of: judging the validity of an application program by an operation starting manager, judging the validity of a programming mark if the application program is valid, and skipping to the operation of the application program if the programming mark is invalid; flashing the software of the second version of the boot loader and the effective copy mark into the flash area, and resetting the micro-control unit; the application program judges whether the copy effective mark is effective or not, if yes, the software of the second-version boot loader is copied to the position where the software of the first-version boot loader is located, after copying is completed, the copy effective mark is removed, and the software of the second-version boot loader is copied. And starting a memory protection unit preset by the micro-control unit to perform write access protection of all memories except for using the EEPROM, and enabling the application program to wait for other tasks. According to the method, the problem that the brick is damaged due to power failure when the power failure occurs in the process of flashing the Bootloader by running the APP is solved.

The embodiment of the invention relates to the technical field of memory management, and provides a container memory protection method and device, electronic equipment and a medium. A pointer authentication code is embedded into a pointer to be accessed to obtain an authentication pointer with authentication information, and the pointer authentication code is generated according to the pointer and context information of the first access request; extracting a pointer authentication code from the authentication pointer, and verifying the authentication pointer based on the pointer authentication code; and when the verification is passed, temporarily inserting a mapping item which allows access to the memory of the target container in an expansion page table allocated for the target container, and performing access control on the memory of the target container through the mapping item. Consequently, container memory protection with light weight and low performance influence is achieved.

The invention discloses a memory protection method and device, equipment and a storage medium, and relates to the technical field of computers. The method comprises the following steps: receiving a memory access request initiated by a first kernel of an operating system, wherein the memory access request is used for requesting to access a first region of a memory; according to the memory access request, kernel-level barrier check is executed on the first kernel to obtain a first check result, and the kernel-level barrier check is used for determining whether the first kernel has the access permission of the first area or not; under the condition that the first check result is that the first kernel has the access permission of the first area, executing token permission check on the first kernel to obtain a second check result; and under the condition that the second check result is that the first kernel has the effective authorization token corresponding to the first area, executing an access operation on the first area according to the memory access request. According to the method, memory protection is realized, and the security of memory access is improved.

The invention discloses a memory cross-border positioning method and device and a storage medium, and the method comprises the steps: recognizing a protection memory section which may have a pollution possibility, and distributing continuous memory blocks in front of and behind the protection memory section to obtain a memory protection region, setting the attribute of the memory protection area as a system mode or a non-executable mode; then calling the memory management unit to respond to a CPU access request; and when the response of the memory management unit is abnormal, capturing and positioning a position where memory crossing occurs. By utilizing the characteristic that when a memory is set to be in a read-only mode or a non-executable mode, writing cannot be carried out, when positioning cross-border occurs, a pollution source tries to access a memory protection area, and at the moment, a read-only attribute or a non-executable attribute set in the memory protection area causes insufficient access authority, so that response abnormity occurs; the position where memory crossing occurs can be accurately judged by tracking the error position, memory crossing positioning is achieved, the efficiency of memory crossing positioning is improved, and resource consumption is reduced.

The invention relates to a firmware trusted platform module realized by utilizing a PMP memory protection mechanism in a framework, which is used for solving the problems of realization complexity of a current firmware TPM (Trusted Platform Module) scheme under an RISC-V (Reduced Infrastructure Standard-Virtualization) framework and support requirements on extra hardware. The method comprises the following modules: (1) an NVRAM security memory module using a PMP mechanism: based on an RISC-V instruction set, realizing memory isolation by using a privilege architecture and a physical memory protection (PMP) technology, dividing a plurality of memory areas and configuring different access permissions; through the mode, the security of the memory is ensured from the aspect of hardware, and meanwhile, a reducible key is generated by adopting a DRAM (Dynamic Random Access Memory) latch PUF (Physical Unclonable Function), so that the security risk of key storage is avoided. The PMP technology is further used for controlling access to Flash equipment, so that the NVRAM data can be safely encrypted and stored and effectively protected. And (2) an RISC-V architecture rollback attack defense module: modifying part of TPM command semantics and utilizing an NVRAM to maintain a scheme of error attempt times so as to cope with the problems of rollback attacks possibly faced by the TPM, lack of a security clock and the like.

An embodiment of the present application provides a method and apparatus for kernel and task isolation. By adding a separate trusted base to a computer system, the trusted base is independent of the kernel and tasks, and the trusted base, tasks, and kernel each have independent memory. The tasks and the kernel cannot access each other's memory. When task scheduling is required, the trusted base configures the memory protection device according to the memory switching configuration information stored in the memory of the trusted base. By configuring the memory protection device, the memory access boundary can be switched from the kernel's memory to the task's memory, or from the task's memory to the kernel's memory. The access to the memory of the task and the kernel is achieved through the switching of the memory boundary, thereby ensuring the security of the task and the kernel.

A method for ensuring heap memory space security of an embedded system, according to some embodiments of the present invention, may comprise the steps of: receiving a source code; generating an instrumentation code for the source code; compiling the instrumentation code and executing a program; setting a plurality of memory protection units for a heap area; and performing memory boundary checking before performing a read / write command included in the program, wherein the step of performing the memory boundary checking can include the steps of: using a base pointer and a pointer for the read / write command, and specifying one of the plurality of memory protection units by using the base pointer; and using the base pointer and the pointer so as to determine whether to exceed the heap size for the specified memory protection unit.

The invention relates to a software and hardware combined fine-grained memory protection mechanism, which realizes high-speed mapping from a physical address to a fine-grained permission label by integrating a metadata search unit and a metadata conversion lookup buffer on a critical path of a processor loading / storage unit. An operating system maintains a multi-level fine-grained permission metadata table in a main memory, and the minimum memory protection granularity is refined to a 64-byte sub-page level. When a processor executes a memory access instruction, address conversion and permission verification are completed in parallel, an access type and a permission label are compared in real time within 1-2 clock periods, and when permission conflicts are detected, high-priority abnormity is triggered immediately, and illegal addresses and fault types are reported accurately. The method supports instruction set extension, buffer overflow protection, multi-level metadata management and user mode and kernel mode differentiated authority control, reduces the influence on the performance of the processor while improving the security of the memory, and is suitable for a computing system with high security and high performance.

Computer-implemented methods and associated hardware for static trusted execution environment for inter-architecture processor program compatibility are disclosed herein. A device (e.g., RISC-V), may emulate a static trusted execution environment (e.g., ARM TrustZone) using physical memory protection (PMP). A regular world may have access to only a portion of an address space of the device, while a secure world may have access to the full address space. A secure world identifier (SWID) may be a configuration status register (CSR) only accessible by a mode (e.g., machine mode). When an entry is added to a translation lookaside buffer (TLB), the SWID may be added as part of a tag to differentiate secure world entries from regular world entries.

The invention discloses an implementation method for an RISC-V physical memory protection mechanism, and the method comprises the following steps: analyzing a physical memory protection mechanism module structure and the input and output of a module according to an RISC-V ISA standard, designing a module framework according to document requirements, and implementing the module by using a SystemVerilog language; performing property analysis on the PMP module according to the ISA specification, classifying the properties obtained by analysis, and describing the properties by using a formalized language; and based on the realized physical memory protection module, combining with the extracted properties, performing formalized verification on the properties by using an assertion-based formalized verification tool Symbiyosys, and integrating verification results to ensure the correctness of the RISC-V physical memory protection mechanism.

Enforcing attestation of read-only protected memory during attestation validity period. A client computer system identifies a change in a read-only protected memory protection status for a software component loaded at the client computer system. The client computer system then determines that a validity time period of an attestation report is unexpired. The attestation report comprises one or more attested properties, including one or more read-only memory protection (ROMP) attested properties for the software component. The client computer system also determines that at least one ROMP attested property for the software component is no longer valid due to the change in the read-only protected memory protection status for a software component. Based on the at least one ROMP attested property for the software component being no longer valid, the client computer system initiates a remedial action to prevent interaction of the software component with a relying party computer system.

Computer-implemented methods and associated hardware for static trusted execution environment for inter-architecture processor program compatibility are disclosed herein. A device (e.g., RISC-V), may emulate a static trusted execution environment (e.g., ARM TrustZone) using physical memory protection (PMP). A regular world may have access to only a portion of an address space of the device, while a secure world may have access to the full address space. A secure world identifier (SWID) may be a configuration status register (CSR) only accessible by a mode (e.g., machine mode). When an entry is added to a translation lookaside buffer (TLB), the SWID may be added as part of a tag to differentiate secure world entries from regular world entries.

Systems and methods are disclosed for memory protection for vector operations. For example, a method includes fetching a vector memory instruction using a processor core including a pipeline configured to execute instructions, including constant-stride vector memory instructions; partitioning a vector that is identified by the vector memory instruction into a subvector of a maximum length, greater than one, and one or more additional subvectors with lengths less than or equal to the maximum length; checking, using a memory protection circuit, whether accessing elements of the subvector will cause a memory protection violation; and accessing the elements of the subvector before checking, using the memory protection circuit, whether accessing elements of one of the one or more additional subvectors will cause a memory protection violation.

In one embodiment, an apparatus comprises a processor to execute instruction(s), wherein the instructions comprise a memory access operation associated with a memory location of a memory. The apparatus further comprises a memory encryption controller to: identify the memory access operation; determine that the memory location is associated with a protected domain, wherein the protected domain is associated with a protected memory region of the memory, and wherein the protected domain is identified from a plurality of protected domains associated with a plurality of protected memory regions of the memory; identify an encryption key associated with the protected domain; perform a cryptography operation on data associated with the memory access operation, wherein the cryptography operation is performed based on the encryption key associated with the protected domain; and return a result of the cryptography operation, wherein the result is to be used for the memory access operation.

During writeback in the storage system, this prevents logs from accumulating in the queue that stores the logs of cache memory updates. [Solution] Each of the multiple storage controllers is equipped with a first memory protection method that generates logs related to the writing and updating of data in memory, stores them in a memory queue, retrieves the logs from the queue, and writes them to a non-volatile storage medium. When the storage controller protects data in memory using the first memory protection method, it controls the execution of a first process that stores logs in the queue and a second process that retrieves logs from the queue and writes them to the storage medium, according to the capacity of the logs stored in the queue.

The invention discloses a null pointer access detection method and device, equipment and a storage medium, and the method comprises the steps: obtaining error information of abnormal interruption of a memory protection unit MPU when null pointer access of a current program is detected; determining an error type and an error position according to the error information; and positioning the specific position of the access null pointer according to the error type and the error position, so that value writing or operation execution on a zero address can be prevented, the stability and the safety of a system can be protected, the specific position of a problem can be quickly positioned, debugging and repairing are facilitated, developers are helped to quickly position the point and the reason of the problem, and the development efficiency is improved. The speed and efficiency of null pointer access detection are improved.

System, method, and circuitry for generating content for a programmable computing device based on user-selected memory regions. Contiguous regions that share memory access attributes are merged, interleaved contiguous regions that share at least one nested attribute are defined into combined regions, and remaining regions are defined as separate independent regions. A memory protection unit (MPU) region size closest to a size of each defined region is identified. If the start address of each region aligns with the address structure of the MPU region size, then those regions are assigned to MPU regions having the MPU region size; otherwise, another MPU size that aligns with the size of the regions is selected and those regions are assigned to MPU regions having that size. Content is generated to configure settings of MPU regions of the programmable computing device for the merged contiguous regions, the combined region, and the independent regions.

The application discloses a memory access method, a memory protection unit, a system on chip and a storage medium, and belongs to the chip technical field. The method is applied to the memory protection unit, the memory protection unit comprises at least one arbitration node, a plurality of input / output bridges and a plurality of checkers, the arbitration node is arranged between the plurality of input / output bridges and the plurality of checkers, and the method comprises the following steps: receiving a memory access request sent by an external device through an input / output bridge and sending the memory access request to the arbitration node; determining a target checker from the plurality of checkers according to traffic information of the plurality of checkers through the arbitration node, and forwarding the memory access request to the target checker; checking the memory access permission of the external device through the target checker, obtaining a checking result, and returning the checking result to the input / output bridge through the arbitration node; and the checking result is used to represent whether the external device passes the permission check. The application can solve the problem that the existing physical memory input / output protection method is low in efficiency.