82 results about "Memory protection" patented technology

The invention discloses a solid state disk management system and a data processing method, and relates to the technical field of solid state disk management. Flexible task scheduling and resource management are provided through a lightweight operating system module, and a computing task program defined by a user is supported to be dynamically loaded; edge computing or machine learning operators are efficiently executed in combination with a programmable hardware processing unit and a DMA channel of the computing acceleration engine module, the data preloading module is utilized to predict and preload data to DDR based on LBA access history, access delay is reduced, an NVMe protocol is expanded by means of the task unloading interface module, host task issuing and result returning are achieved, and the data processing efficiency is improved. And hardware-level memory protection is ensured through the security isolation module, so that the data calculation processing capacity of the solid state disk is remarkably improved, localized calculation tasks such as edge calculation and machine learning are supported, mass data transmission is effectively reduced, and bus and network loads are relieved.

The invention discloses a memory management method, device and equipment and a computer readable storage medium. The method comprises the following steps: when a mapping request exists, determining a target I / O virtual address corresponding to the mapping request and triggering an application identity identifier of the mapping request; detecting whether the target I / O virtual address is associated with the application identity label or not; and if yes, establishing mapping between the target I / O virtual address and the corresponding memory physical address. According to the method and the device, the memory protection capability of the equipment can be enhanced on a system without IOMMU (Input / Output Management Unit); and the complexity of hardware design can be reduced on a system with an IOMMU, and the hardware cost is reduced.

Computer-implemented methods and associated hardware for static trusted execution environment for inter-architecture processor program compatibility are disclosed herein. A device (e.g., a Reduced Instruction Set Computing-Five (RISC-V) device), may emulate a static trusted execution environment (e.g., ARM TrustZone) using physical memory protection (PMP). A regular world may have access to only a portion of an address space of the device, while a secure world may have access to the full address space. A secure world identifier (SWID) may be stored in a configuration status register (CSR) only accessible by a mode (e.g., machine mode). When an entry is added to a translation lookaside buffer (TLB), the SWID may be added as part of a tag to differentiate secure world entries from regular world entries.

A system controls access to a physical address (PA) space. The system includes multiple system resources addressable within the PA space, and multiple processing circuits executing multiple virtual machines (VMs). A given region of the PA space is dedicated to addressing the VMs. The system also includes multiple memory management units (MMUs) coupled to corresponding processing circuits. A given MMU is operative to translate a virtual address indicated in an access request from a processing circuit into a requested PA that is accessible by the processing circuit according to a configurable setting of the given MMU. The system further includes multiple memory protection units (MPUs). A given MPU, which is coupled to a target system resource allocated with the requested PA, is operative to grant or deny the request based on information indicating whether the requested PA is accessible to a requesting VM executed on the processing circuit.

The invention belongs to the technical field of program updating, and particularly relates to a method for flashing Bootloader software, which comprises the following steps of: judging the validity of an application program by an operation starting manager, judging the validity of a programming mark if the application program is valid, and skipping to the operation of the application program if the programming mark is invalid; flashing the software of the second version of the boot loader and the effective copy mark into the flash area, and resetting the micro-control unit; the application program judges whether the copy effective mark is effective or not, if yes, the software of the second-version boot loader is copied to the position where the software of the first-version boot loader is located, after copying is completed, the copy effective mark is removed, and the software of the second-version boot loader is copied. And starting a memory protection unit preset by the micro-control unit to perform write access protection of all memories except for using the EEPROM, and enabling the application program to wait for other tasks. According to the method, the problem that the brick is damaged due to power failure when the power failure occurs in the process of flashing the Bootloader by running the APP is solved.

The embodiment of the invention relates to the technical field of memory management, and provides a container memory protection method and device, electronic equipment and a medium. A pointer authentication code is embedded into a pointer to be accessed to obtain an authentication pointer with authentication information, and the pointer authentication code is generated according to the pointer and context information of the first access request; extracting a pointer authentication code from the authentication pointer, and verifying the authentication pointer based on the pointer authentication code; and when the verification is passed, temporarily inserting a mapping item which allows access to the memory of the target container in an expansion page table allocated for the target container, and performing access control on the memory of the target container through the mapping item. Consequently, container memory protection with light weight and low performance influence is achieved.

The invention discloses a memory protection method and device, equipment and a storage medium, and relates to the technical field of computers. The method comprises the following steps: receiving a memory access request initiated by a first kernel of an operating system, wherein the memory access request is used for requesting to access a first region of a memory; according to the memory access request, kernel-level barrier check is executed on the first kernel to obtain a first check result, and the kernel-level barrier check is used for determining whether the first kernel has the access permission of the first area or not; under the condition that the first check result is that the first kernel has the access permission of the first area, executing token permission check on the first kernel to obtain a second check result; and under the condition that the second check result is that the first kernel has the effective authorization token corresponding to the first area, executing an access operation on the first area according to the memory access request. According to the method, memory protection is realized, and the security of memory access is improved.

The invention relates to a software and hardware combined fine-grained memory protection mechanism, which realizes high-speed mapping from a physical address to a fine-grained permission label by integrating a metadata search unit and a metadata conversion lookup buffer on a critical path of a processor loading / storage unit. An operating system maintains a multi-level fine-grained permission metadata table in a main memory, and the minimum memory protection granularity is refined to a 64-byte sub-page level. When a processor executes a memory access instruction, address conversion and permission verification are completed in parallel, an access type and a permission label are compared in real time within 1-2 clock periods, and when permission conflicts are detected, high-priority abnormity is triggered immediately, and illegal addresses and fault types are reported accurately. The method supports instruction set extension, buffer overflow protection, multi-level metadata management and user mode and kernel mode differentiated authority control, reduces the influence on the performance of the processor while improving the security of the memory, and is suitable for a computing system with high security and high performance.

Enforcing attestation of read-only protected memory during attestation validity period. A client computer system identifies a change in a read-only protected memory protection status for a software component loaded at the client computer system. The client computer system then determines that a validity time period of an attestation report is unexpired. The attestation report comprises one or more attested properties, including one or more read-only memory protection (ROMP) attested properties for the software component. The client computer system also determines that at least one ROMP attested property for the software component is no longer valid due to the change in the read-only protected memory protection status for a software component. Based on the at least one ROMP attested property for the software component being no longer valid, the client computer system initiates a remedial action to prevent interaction of the software component with a relying party computer system.

During writeback in the storage system, this prevents logs from accumulating in the queue that stores the logs of cache memory updates. [Solution] Each of the multiple storage controllers is equipped with a first memory protection method that generates logs related to the writing and updating of data in memory, stores them in a memory queue, retrieves the logs from the queue, and writes them to a non-volatile storage medium. When the storage controller protects data in memory using the first memory protection method, it controls the execution of a first process that stores logs in the queue and a second process that retrieves logs from the queue and writes them to the storage medium, according to the capacity of the logs stored in the queue.

The application discloses a memory access method, a memory protection unit, a system on chip and a storage medium, and belongs to the chip technical field. The method is applied to the memory protection unit, the memory protection unit comprises at least one arbitration node, a plurality of input / output bridges and a plurality of checkers, the arbitration node is arranged between the plurality of input / output bridges and the plurality of checkers, and the method comprises the following steps: receiving a memory access request sent by an external device through an input / output bridge and sending the memory access request to the arbitration node; determining a target checker from the plurality of checkers according to traffic information of the plurality of checkers through the arbitration node, and forwarding the memory access request to the target checker; checking the memory access permission of the external device through the target checker, obtaining a checking result, and returning the checking result to the input / output bridge through the arbitration node; and the checking result is used to represent whether the external device passes the permission check. The application can solve the problem that the existing physical memory input / output protection method is low in efficiency.

The invention provides a vulnerability repair method of a memory, a computer device and a readable storage medium, the method comprises the following steps: obtaining an exception type corresponding to hardware exception trigger information, if the exception type is exception of a memory protection unit, obtaining information of a fault address recorded by a fault address register; if the exception type is breakpoint exception, inquiring information of a breakpoint address triggering the breakpoint exception; querying address information of the repair function from the vulnerability modification mapping table; obtaining a first vulnerability type of a vulnerability corresponding to the current abnormal condition, if the first vulnerability type is a function-level vulnerability, extracting a function parameter from a push register, and calling a repair function; if the first vulnerability type is an instruction-level vulnerability, analyzing a vulnerability instruction and calling a repair function; and executing the called repair function. The invention further provides a computer device and a readable storage medium for implementing the method. According to the method, bug repair is realized by multiplexing the original memory protection unit and the breakpoint module of the processor.

The application belongs to the chip security technical field, and particularly relates to a kind of MCU safety starting method of fusion function safety, by burning and verifying the security boot program and firmware program of main and redundant starting surface in factory environment, the safety and reliability of starting process are ensured.The security and reliability of starting process are ensured by burning and verifying the security boot program and firmware program of main and redundant starting surface in factory environment, and memory protection and privilege / user mode protection mechanism, reset counter fault detection mechanism and starting surface switching fault recovery logic are particularly emphasized, which effectively improves the security of system.The method solves the problem that CMAC check code cannot be dynamically updated in the prior art, while supporting clearing the corresponding hash value during firmware update, and realizing dynamic updating of trust chain.The application realizes the collaborative enhancement of functional safety and information security, and adapts to the ASIL-B and above grade functional safety requirements of vehicle-mounted MCU.

This invention provides a method and computing system capable of enhancing memory protection related to the operating system kernel, thereby ensuring system security. The computing system provided by this invention may include: a processor configured to execute a guest virtual machine (VM), wherein an operating system (OS) runs on the guest VM, and an application (APP) runs on the OS. The kernel of the OS includes: a protection service module configured to receive at least one virtual address and first size information sent by a client of the APP; and a memory management unit (MMU) manager. The computing system further includes a virtual machine manager configured to receive the at least one virtual address and the first size information sent by the protection service module. The computing system also includes a host VM, which includes: a protection manager configured to receive and obtain a physical address array and second size information based on the at least one virtual address and the first size information to protect memory allocated by the kernel of the OS.

Enforcing attestation of read-only protected memory during attestation validity period. A client computer system identifies a change in a read-only protected memory protection status for a software component loaded at the client computer system. The client computer system then determines that a validity time period of an attestation report is unexpired. The attestation report comprises one or more attested properties, including one or more read-only memory protection (ROMP) attested properties for the software component. The client computer system also determines that at least one ROMP attested property for the software component is no longer valid due to the change in the read-only protected memory protection status for a software component. Based on the at least one ROMP attested property for the software component being no longer valid, the client computer system initiates a remedial action to prevent interaction of the software component with a relying party computer system.

The invention discloses a physical memory protection table item screening device, a processor and a method, and belongs to the technical field of computers. A matching module in the physical memory protection table item screening device is configured to judge whether a physical address carried by an access request is within a memory area address range defined by each of a plurality of PMP table items or not according to an address matching mode so as to determine at least one matched PMP table item matched with the physical address; the screening module is configured to screen out a target PMP table item with the minimum corresponding memory area address range from the matched PMP table items when at least one matched PMP table item exists, and the target PMP table item is used for checking the operation authority of the access request. By taking the PMP table item with the minimum corresponding memory area address range in the plurality of PMP table items as the target PMP table item, the permission error under the condition of area overlapping of the PMP table items is effectively avoided.

The invention provides a data processing method and system.The method comprises a master module, a memory protection module coupled to a bus and the master module, a safety processor coupled to the bus and a slave module coupled to the safety processor, and the master module comprises a plurality of control units; the security processor is used for configuring a protection table of the memory protection module; the protection table comprises permission information of each address in the slave module, and the permission information comprises a first identifier of a control unit capable of accessing each address and a permission type of the control unit; the memory protection module is used for judging whether the access permission of the corresponding control unit is met or not based on permission information of a target address in an access request after the access request of the control unit in the main module is received, and outputting the access permission of the corresponding control unit after judging that the access permission of the corresponding control unit is met. And allowing the corresponding control unit to access the target address.

The application provides a memory management method and a computer device. The method comprises the following steps: in response to a target program segment execution end event, obtaining memory protection area information in a physical memory; if it is detected that the memory protection area information is abnormal, obtaining execution context information corresponding to the target program segment; and based on the execution context information corresponding to the target program segment, determining position information of illegal memory access. The method can improve the positioning accuracy and universality of illegal memory access, reduce performance overhead, and ensure system stability and security.

The present disclosure relates to flexible counter systems for memory protection. Generally, using a flexible counter structure can make a counter system for supporting memory protection operations in a device more efficient. A device can include a processing module and a memory module. A flexible counter system in the memory module can include at least one data line that includes a plurality of counters. A bit size of the counters can be reduced and / or changed from existing implementations by an overflow counter that can account for a smaller counter going into an overflow state. A bit indicator can be used to identify a counter that uses the overflow counter. In at least one embodiment, a selector corresponding to each of the plurality of counters is capable of mapping a particular memory cell to a particular counter.

The application provides a vulnerability repair method of a memory, a computer device and a readable storage medium. The method comprises the following steps: obtaining an exception type corresponding to hardware exception trigger information, such as memory protection unit exception; obtaining information of a fault address recorded by a fault address register; when the exception type is a breakpoint exception, querying information of a breakpoint address triggering the breakpoint exception; querying address information of a repair function from a vulnerability modification mapping table; obtaining a first vulnerability type of a vulnerability corresponding to a current exception condition, such as a function-level vulnerability; extracting function parameters from a stack register and calling the repair function when the first vulnerability type is the function-level vulnerability; analyzing a vulnerability instruction and calling the repair function when the first vulnerability type is an instruction-level vulnerability; and executing the called repair function. The application also provides a computer device and a readable storage medium for implementing the above method. The application implements vulnerability repair by reusing a memory protection unit and a breakpoint module of an original processor.

The invention belongs to the technical field of computers, and provides a self-adaptive memory protection method and device for dynamically adjusting triple modular redundancy voting frequency, a management structural body is created and initialized for key data, and the management structural body comprises three data copy pointers and three data copies for managing the key data; monitoring system state parameters related to the key data in real time or periodically, wherein the system state parameters comprise a system load rate and a historical error rate of data inconsistency of the management structure body in historical voting; dynamically adjusting a voting frequency strategy for executing two-out-of-three voting operation on the three data copies according to the monitored system state parameters; and executing corresponding two-out-of-three voting operation on the three data copies according to the voting frequency strategy. According to the method, the voting frequency of triple modular redundancy can be dynamically adjusted according to the system load and the historical error rate, so that the system performance is remarkably optimized and the power consumption is reduced while the reliability of the memory is ensured.

A computer device includes a processor; a memory connected to the processor, where the memory includes a first memory region; and a plurality of network adapters connected to the processor. The processor is configured to: when registering the first memory region with the plurality of network adapters, record a first memory address in a first memory address translation table (MTT) into a memory protection table (MPT) of each network adapter in the plurality of network adapters, so that each of the network adapters is capable of accessing the first memory region by using the first memory address translation table. The first memory address translation table is used to indicate a correspondence between a virtual address of the first memory region and a physical address of the first memory region.

Embodiments of this application provide a kernel and task isolation method and an apparatus. A separate trusted base is added to a computer system, and the trusted base is independent of a kernel and a task. The trusted base, the task, and the kernel each have an independent memory, and the task and the kernel cannot access memories of each other. When task scheduling needs to be performed, the trusted base configures a memory protection apparatus based on memory switching configuration information stored in the memory of the trusted base. By configuring the memory protection apparatus, a memory access boundary may be switched from the memory of the kernel to the memory of the task, or may be switched from the memory of the task to the memory of the kernel. Access to the memories of the task and the kernel is implemented through memory boundary switching, so as to ensure safety of the task and the kernel.

The application relates to the technical field of memory management, in particular to a memory safety management device and method of an operating system. The device comprises a memory management module, a data safety module, an authority management module, a log system module and an exception processing module; when the memory management module allocates memory for a program, space record information is simultaneously allocated, including data verification information; after writing data is completed, the data safety module verifies the data of the whole memory to generate a unique signature of the data, and writes the signature into the data verification information; when accessing the memory data, the data safety module generates a unique signature of the memory data and compares the signature with the signature in the data verification information; if the signatures are consistent, the memory access can be normally carried out; if the signatures are inconsistent, the memory access is terminated, and the exception processing module is informed. The application can avoid abnormal memory access, solve the hidden danger of memory protection, avoid memory out-of-bound access and improve the safety of memory protection.

Described herein, in certain embodiments, are computer-implemented memory protection systems comprising: a memory; and circuitry comprising an encryption algorithm and configured to perform operations comprising: encrypt, using the encryption algorithm, write operations to the memory; and decrypt, using the encryption algorithm, read operations from the memory. Further provided herein, in certain embodiments, are computer implemented method for memory protection.

This invention relates to the field of chip technology and discloses a method, device, medium, and program product for memory out-of-bounds detection. The method includes: obtaining the operator semantics and input parameters corresponding to a target operator, and generating initial address attribute entries based on the operator semantics and input parameters; obtaining the computing core corresponding to the target operator, and storing each initial address attribute entry in a fine-grained memory protection unit corresponding to the computing core; and performing memory out-of-bounds detection on memory access requests of the computing core based on each initial address attribute entry to obtain the detection result. By pre-deriving the address attribute entries corresponding to the target operator based on the operator semantics and input parameters, adding a fine-grained memory protection unit for storing the address attribute entries, and implementing real-time memory out-of-bounds detection of memory access requests based on the address attribute entries, efficient and accurate memory out-of-bounds detection under a memory pool mechanism can be achieved, ensuring memory data security.

The invention provides a dynamic register allocation method and system based on an RISC-V architecture, and belongs to the technical field of computers. The method comprises the steps that task characteristic data are received in real time; predicting a register demand corresponding to the task based on the task characteristic data; determining a partition decision of a self physical register based on the register demand; and dividing the register based on the partition decision, controlling the partition control register to dynamically configure the physical address range and the access authority of each physical register partition, and controlling the physical memory protection unit to configure the access rule of each physical register partition. According to the invention, the register demand is predicted based on the task characteristic data, the register is partitioned based on the register demand, and the dynamic allocation of the register is realized by expanding the type of the control and state register and the function of the physical memory protection unit, so that the allocation of the register adapts to the dynamic change of the task load during operation; and resource waste or conflict is avoided.

The embodiment of the invention relates to a memory allocation method and device and a memory release method and device.The memory allocation method comprises the steps that in response to a memory allocation request, an idle first virtual memory block is determined; determining a first virtual memory space to which the first virtual memory block belongs; the first virtual memory space corresponds to a plurality of second virtual memory spaces, each virtual memory space points to the same physical memory area, and a memory protection mechanism is preset for each virtual memory space; randomly determining a target virtual memory space in each virtual memory space; determining a target virtual memory block located at a corresponding position in the target virtual memory space according to a first position of the first virtual memory block in the first virtual memory space; and removing the memory protection mechanism on the target virtual memory block and returning to the target virtual memory block.

The invention belongs to the technical field of chip security, and particularly relates to an MCU (Microprogrammed Control Unit) security starting method fusing function security, which ensures the security and reliability of a starting process by programming and checking security bootstrap programs and firmware programs of main and redundant starting surfaces in a factory environment. According to the method, security bootstrap programs and firmware programs of main and redundant starting surfaces are programmed and verified in a factory environment, so that the security and reliability of a starting process are ensured, and a memory protection and privilege / user mode protection mechanism, a reset counter fault detection mechanism and starting surface switching fault recovery logic are particularly emphasized; and the safety of the system is effectively improved. According to the method, the problem that the CMAC check code cannot be dynamically updated in the prior art is solved, and meanwhile, the corresponding hash value is cleared during firmware updating, so that the dynamic updating of the trust chain is realized. According to the invention, the cooperative enhancement of the function security and the information security is realized, and the ASlL-B and higher level function security requirements of the vehicle-mounted MCU are met.