CN115083463B

CN115083463B - Method, electronic system and storage medium for controlling memory access rights

Info

Publication number: CN115083463B
Application number: CN202211014482.7A
Authority: CN
Inventors: 喻学艺; 黄恒方; 韩伟; 汪泳江
Original assignee: Spin Tech Shenzhen Co ltd; Xuanzhi Electronic Technology Shanghai Co ltd
Current assignee: Spin Tech Shenzhen Co ltd; Xuanzhi Electronic Technology Shanghai Co ltd
Priority date: 2022-08-23
Filing date: 2022-08-23
Publication date: 2022-11-08
Anticipated expiration: 2042-08-23
Also published as: CN115083463A

Abstract

Embodiments of the present disclosure relate to methods, electronic systems, and storage media for controlling memory access rights. In the method, a first memory partition where an instruction to be executed currently is located is determined according to an instruction counter; determining a second memory partition where a target address is located according to the target address to be accessed by the current instruction to be executed; determining whether the first memory partition and the second memory partition belong to the same memory partition; and in response to determining that the first memory partition and the second memory partition do not belong to the same memory partition and that the operation type corresponding to the current instruction to be executed is a read data operation, generating a read inhibit signal to inhibit execution of the read data operation corresponding to the current instruction to be executed. The access authority of the memory partition can be reasonably managed, the safety of the program codes stored in the memory partition is improved, and the program codes are prevented from being leaked.

Description

Method, electronic system and storage medium for controlling access rights to a memory

Technical Field

Embodiments of the present disclosure relate generally to the field of memory access permission control, and more particularly, to a method, electronic system, and storage medium for controlling memory access permission.

Background

For a piece of electronic equipment, such as a mobile terminal, a server, etc., in order to upgrade, expand the functions of the electronic equipment, or optimize the performance of the electronic equipment, users or other development subjects are often allowed to perform secondary development. That is, it is allowed to implement function expansion by adding new program code to a memory (memory) of an electronic device already put into use, to implement new functions.

However, in the case of opening the secondary development right, the access right of the memory of the electronic device is often opened, and one developer can read the program codes set by other developers stored in the memory from the memory through technical means, so that the risk of technical result leakage exists.

In summary, at present, the access rights of the memory of the electronic device are often open, which has the following disadvantages: the secondary developer can read the program codes stored in the memory of the electronic device by the original developer or other developers through corresponding technical means, and the technical results such as the program codes stored in the memory are leaked, so that the secondary developer is not safe enough.

Disclosure of Invention

In view of the above problems, the present disclosure provides a method, an electronic system, and a storage medium for controlling access rights of a memory, which can effectively protect program codes stored in the memory and prevent the program codes from being illegally read and leaked.

According to a first aspect of the present disclosure, there is provided a method for controlling memory access rights, applied to an electronic system including a plurality of memory partitions, comprising: determining a first memory partition where a current instruction to be executed is located according to an instruction counter; determining a second memory partition where a target address is located according to the target address to be accessed by the current instruction to be executed; determining whether the first memory partition and the second memory partition belong to the same memory partition; and in response to determining that the first memory partition and the second memory partition do not belong to the same memory partition and that the operation type corresponding to the current instruction to be executed is a read data operation, generating a read inhibit signal to inhibit execution of the read data operation corresponding to the current instruction to be executed.

In some embodiments, the method for controlling memory access rights further comprises: and in response to determining that the operation type corresponding to the current instruction to be executed is the instruction fetching operation, generating an enabling signal to allow the instruction fetching operation to be executed.

In some embodiments, the method for controlling memory access rights further comprises: in response to determining that the first memory partition and the second memory partition belong to the same memory partition, an enable signal is generated to allow an operation corresponding to the currently-to-be-executed instruction to be executed.

In some embodiments, the method for controlling memory access rights further comprises: and in response to determining that the first memory partition and the second memory partition do not belong to the same memory partition and that the operation type corresponding to the current instruction to be executed is the erasing operation, generating an erasing prohibition signal to prohibit the erasing operation corresponding to the current instruction to be executed from being executed.

In some embodiments, the method for controlling memory access rights further comprises: generating a debug control signal gates the clock signal to generate a gated clock signal, and inputting the gated clock signal into a debug clock interface of the electronic system to enable or disable access to any of the memory partitions via the debug interface of the electronic system.

In some embodiments, the method for controlling memory access rights further comprises: in response to detecting an instruction to erase partition information stored in a non-volatile memory of an electronic system, an erase instruction is generated to erase program code stored in the non-volatile memory.

In some embodiments, the method for controlling memory access rights further comprises: in response to detecting a signal characterizing completion of initialization of the electronic system, a write disable signal is generated to disable writing to a partition register of the electronic system, wherein the partition register stores partition information loaded from non-volatile memory during initialization of the electronic system.

In some embodiments, the method for controlling memory access rights further comprises: loading mode information into a mode register of an electronic system via the electronic system initialization process; determining a mode characterized by mode information; in response to determining that the mode information characterizes a protected mode, generating a debug control signal characterizing disabling of debugging, and in response to determining that the mode information characterizes an open mode, generating a debug control signal characterizing enabling of debugging.

In some embodiments, the method for controlling memory access rights further comprises: in response to detecting a debug control signal that characterizes a prohibition of debugging, gating a clock signal to generate a first gated clock signal to prohibit access to any of the memory partitions via a debug interface of the electronic system; and gating the clock signal to generate a second gated clock signal to allow access to any of the memory partitions via a debug interface of the electronic system in response to detecting the debug control signal characterizing the enablement of the debugging.

In some embodiments, the method for controlling memory access rights further comprises: acquiring partition information set in a non-volatile memory of an electronic system to initialize partition registers of the electronic system based on the acquired partition information; confirming whether a signal for representing the completion of the initialization of the electronic system is detected; in response to detecting a signal indicative of completion of initialization of the electronic system, generating a write disable signal to disable writing to a partition register of the electronic system; determining whether an instruction for erasing partition information stored by a non-volatile memory of an electronic system is detected; and in response to detecting an instruction to erase partition information stored in a non-volatile memory of the electronic system, generating an erase instruction to erase program code stored in the non-volatile memory.

According to a second aspect of the present disclosure, an electronic system is provided. The electronic system includes: a memory comprising at least a plurality of memory partitions; and an electronic device; wherein the electronic equipment includes: at least one processor; and a memory unit communicatively coupled to the at least one processor; the memory unit stores instructions executable by the at least one processor to enable the at least one processor to perform the method of the first aspect of the disclosure.

In some embodiments, the memory further comprises: a non-volatile memory to store at least partition information and program code.

According to a third aspect of the present disclosure, a computer-readable storage medium is provided. The computer readable storage medium has stored thereon a computer program which, when executed by a machine, implements a method according to the first aspect of the disclosure.

It should be understood that the statements in this section are not intended to identify key or critical features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become apparent from the following description.

Drawings

The above and other features, advantages and aspects of various embodiments of the present disclosure will become more apparent by referring to the following detailed description when taken in conjunction with the accompanying drawings. In the drawings, like or similar reference characters designate like or similar elements.

Fig. 1 shows a schematic structural diagram of an electronic system 100 according to an embodiment of the present disclosure.

FIG. 2 shows a flow diagram of a method 200 for controlling memory access permissions, according to an embodiment of the disclosure.

Fig. 3 shows a schematic structural diagram of an electronic system 300 according to an embodiment of the present disclosure.

FIG. 4 shows a flow diagram of a method 400 for controlling access rights at debug in accordance with an embodiment of the present disclosure.

Fig. 5 shows a schematic structural diagram of an electronic system 500 according to an embodiment of the present disclosure.

FIG. 6 illustrates a flow chart of a method 600 for controlling electronic system initialization and erase operations in accordance with an embodiment of the present disclosure.

FIG. 7 shows a schematic block diagram of an example electronic device 700 that may be used to implement the methods for controlling memory access permissions of embodiments of the present disclosure.

Detailed Description

Exemplary embodiments of the present disclosure are described below with reference to the accompanying drawings, in which various details of the embodiments of the disclosure are included to assist understanding, and which are to be considered as merely exemplary. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the present disclosure. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.

The term "include" and variations thereof as used herein is meant to be inclusive in an open-ended manner, i.e., "including but not limited to". Unless specifically stated otherwise, the term "or" means "and/or". The term "based on" means "based at least in part on". The terms "one example embodiment" and "one embodiment" mean "at least one example embodiment". The term "another embodiment" means "at least one additional embodiment". The terms "first," "second," and the like may refer to different or the same objects. Other explicit and implicit definitions are also possible below.

As described above, in the prior art, the program code stored in the memory of the electronic device is at risk of being read illegally and leaked. For example, the secondary developer adds a new program code in the memory of the electronic device to read part or all of the program code in the memory of the electronic device, so as to obtain the program code that is formed and stored in the memory of the electronic device by the original developer or other developers for realizing the relevant functions, performances, etc. of the electronic device, thereby obtaining the technical result of the original developer or other developers.

To address, at least in part, one or more of the above problems and other potential problems, example embodiments of the present disclosure propose a scheme for controlling memory access permissions. In the scheme of the disclosure, for an electronic system including multiple memory partitions, during program running, by determining whether a first memory partition where a current instruction to be executed corresponding to an instruction counter is located and a second memory partition where a target address to be accessed by the current instruction to be executed is located belong to the same memory partition, and combining an operation type corresponding to the current instruction to be executed, managing access permissions of the memory partitions to improve security of program codes stored in the memory, where if the first memory partition and the second memory partition do not belong to the same memory partition, and it is determined that the operation type corresponding to the current instruction to be executed is a read data operation, execution of the read data operation corresponding to the current instruction to be executed is prohibited, so that a developer may be prohibited from reading program codes stored in its corresponding memory partition (e.g., the second memory partition) by setting a relevant program in its corresponding memory partition (e.g., the first memory partition). Therefore, the scheme provided by the example embodiment of the disclosure can reasonably manage the access authority of the memory partition, improve the security of the program codes stored in the memory partition, and avoid the leakage of the program codes.

Hereinafter, specific examples of the present scheme will be described in more detail with reference to the accompanying drawings.

Fig. 1 shows a schematic structural diagram of an electronic system 100 according to an embodiment of the present disclosure. As shown in fig. 1, electronic system 100 includes at least: electronic device 110, memory 120. The electronic device 110 is used to implement the electronic device 110 of the method for controlling memory access rights of the embodiments of the present disclosure. The memory 120 includes a plurality of memory partitions, which are a memory partition No. 1, a memory partition No. 2, and a memory partition No. 3 \8230 \ 8230; and a memory partition No. n. It should be understood that the electronic device 110 shown in FIG. 1 is merely exemplary and should not be construed as limiting in any way the functionality or scope of the implementations described in this disclosure. With respect to memory partitions, such as memory partition number 1, it may be a memory region in memory 120 having a contiguous range of addresses. For example, the address range corresponding to memory partition No. 1 is: 0x0000 to 0xAFFF. The memory partition No. 1 may also be formed by memory areas corresponding to a plurality of separate address segments in the memory 120. For example, the address range corresponding to memory partition No. 1 is: 0x0000 to 0x1FFF, 0x20F0 to 0x2FFF, and 0x40F1 to 0x5FF0. In addition, regarding the size relationship between different memory partitions, the disclosure is not limited, and the specific sizes of the memory partitions can be reasonably set as required.

The electronic device 110 may obtain, for example, an instruction counter (PC), a target address, and an operation type, where the instruction counter corresponds to an address of the electronic system 100 where an instruction to be executed currently is located, the target address is a target address to be accessed by the instruction to be executed currently, and the operation type is an operation type corresponding to the instruction to be executed currently. As an alternative embodiment, the electronic device 110 interacts data with the instruction counter register 102, the address register 104, and the operation type register 106 via one or more interfaces. For example, the electronic device 110 includes a first interface 112, a second interface 114, and a third interface 116. The electronic device 110 may be connected to the instruction counter register 102 of the electronic system 100 through the first interface 112, for example, to obtain the value of the instruction counter; the electronic device 110 may further be connected to the address register 104 of the electronic system 100 through the second interface 114 to obtain a target address, wherein the address register 104 stores the target address; and the electronic device 110 may be connected to the operation type register 106 of the electronic system 100, for example, through the third interface 116, to obtain the operation type, wherein the operation type register 106 stores the operation type. The electronic device 110 also has an output interface 118 for outputting the entitlement control signal.

In specific implementation, at least a target address and an operation type are indicated in the current instruction to be executed. An analyzer (not shown in the figure) of the electronic system 100 obtains the current instruction to be executed according to the instruction counter, analyzes the current instruction to be executed, obtains a target address and an operation type, and stores the target address and the operation type into the address register 104 and the operation type register 106, respectively.

FIG. 2 shows a flow diagram of a method 200 for controlling memory access permissions, according to an embodiment of the disclosure. Method 200 may be performed by electronic device 110 as shown in FIG. 1, and may also be performed at electronic device 310 shown in FIG. 3, electronic device 520 shown in FIG. 5, or electronic device 700 shown in FIG. 7. It should be understood that method 200 may also include additional steps not shown and/or may omit steps shown, as the scope of the present disclosure is not limited in this respect.

At step 202, electronic device 110 determines a first memory partition in which an instruction currently to be executed is located according to an instruction counter.

In some alternative embodiments, electronic device 110 may have partition information pre-stored with a plurality of memory partitions of electronic system 100. For example, the memory of the electronic system 100 is divided into n memory partitions according to the storage space, and each memory partition is allocated to a developer or a user. The address range corresponding to each memory partition is pre-stored in the electronic device 110 as partition information. The electronic device 110 may determine which memory partition the currently executed instruction is in based on the value of the instruction counter. For ease of presentation, the memory partition in which the instruction currently to be executed is located is characterized by the first memory partition.

In some alternative embodiments, electronic device 110 obtains partition information from a partition register of electronic system 100 to determine a first memory partition in which an instruction currently to be executed is located based on the obtained partition information.

At step 204, the electronic device 110 determines a second memory partition where the target address is located according to the target address to be accessed by the currently-to-be-executed instruction. For example, electronic device 110 determines the second memory partition in which the target address is located based on the target address and partition information obtained from partition registers of electronic system 100.

It should be understood that in some alternative embodiments, the order of step 202 and step 204 may be interchanged, or may be performed simultaneously.

At step 206, the electronic device 110 determines whether the first memory partition and the second memory partition belong to the same memory partition.

At step 208, electronic device 110 determines whether the operation type corresponding to the currently-to-be-executed instruction is a read data operation.

At step 210, if electronic device 110 determines that the first memory partition and the second memory partition do not belong to the same memory partition and that the operation type corresponding to the current instruction to be executed is a read data operation, a read disable signal is generated to disable execution of the read data operation corresponding to the current instruction to be executed. The read inhibit signal serves as an authority control signal which can inhibit the current instruction to be executed from performing a read data operation on the target address, for example.

In some alternative embodiments, the electronic device 110 outputs, for example, a low-level read disable signal on its output interface 118, where the read disable signal is used to disable the execution of the read data operation corresponding to the currently-to-be-executed instruction.

When the first memory partition and the second memory partition do not belong to the same memory partition, it is indicated that the memory partition where the current instruction to be executed is located and the target address of the data to be read by the current instruction to be executed are located in different memory partitions. Suppose the memory partition where the current instruction to be executed is located is memory partition No. 1, and the memory partition where the target address of the data which the current instruction to be executed wants to read is located is memory partition No. 2. For example, when the first memory partition and the second memory partition are usually allocated to different developers, the data in the second memory partition, which is intended to be read by the currently-to-be-executed instruction in the first memory partition, is prohibited, so that the developers corresponding to the first memory partition are prevented from acquiring the program codes stored in the second memory partition, the program codes are prevented from being leaked, and the security is improved.

At step 212, if it is determined that the first memory partition and the second memory partition belong to the same memory partition, an enable signal is generated to allow an operation corresponding to the currently-to-be-executed instruction to be executed. The enable signal serves as an authority control signal, which may, for example, allow an operation corresponding to a currently-to-be-executed instruction to be executed.

The first memory partition and the second memory partition belong to the same memory partition, meaning that the currently to-be-executed instruction is intended to access a target address within the same memory partition. Access rights are not restricted to facilitate the use of the same memory partition.

At step 214, if it is determined that the operation type corresponding to the currently executed instruction is an instruction fetch operation, an enable signal is generated to allow the instruction fetch operation to be performed. The enable signal serves as a kind of authority control signal, which may, for example, allow the execution of the instruction fetch operation for the currently to-be-executed instruction. Since the instruction fetching operation is only used for fetching the instruction from the target address to execute, but cannot obtain the program code stored in the target address, in order to facilitate developers corresponding to different memory partitions to call related instructions before, development processes are saved, storage resources are saved, and therefore, access rights are not limited for the instruction fetching operation crossing the memory partitions.

Fig. 3 shows a schematic structural diagram of an electronic system 300 of an embodiment of the disclosure. As shown in fig. 3, electronic system 300 includes at least: electronic device 310, memory 350. The electronic device 310 is used to implement the method for controlling memory access rights of embodiments of the present disclosure. Memory 350 includes multiple memory partitions, which are memory partition No. 1, memory partition No. 2, memory partition No. 3, memory partition No. 8230, and memory partition No. n. The memory 350 also includes non-volatile memory 336. The non-volatile memory 336 is implemented, for example, using flash memory (flash), and stores therein program codes and configuration information for the electronic system 300 to operate. As for the program code, it includes, for example, program codes respectively corresponding to each memory partition. When each memory partition is respectively allocated to a corresponding developer, the program code corresponding to each memory partition is the program code developed by the corresponding developer. As for the configuration information, it may include, for example, mode information and partition information. Wherein the mode information may for example comprise two states, wherein a first state represents a protected mode and a second state represents an open mode. It should be understood that the electronic device 310 shown in FIG. 3 is merely exemplary and should not be construed as limiting in any way the functionality or scope of the implementations described in this disclosure.

As for the electronic device 310, for example, it may obtain an instruction counter, a target address, and an operation type, where the instruction counter corresponds to an address of the electronic system 300 where an instruction to be executed currently is located, the target address is a target address to be accessed by the instruction to be executed currently, and the operation type is an operation type corresponding to the instruction to be executed currently. As an alternative embodiment, the electronic device 310 interacts with the instruction counter register 302, the address register 304, the operation type register 306, and the nonvolatile memory 336 via one or more interfaces. For example, the electronic device 310 includes a first interface 312, a second interface 314, a third interface 316, a fourth interface 318, and a fifth interface 330. The electronic device 310 may be connected to the instruction counter register 302 of the electronic system 300 through the first interface 312, for example, to obtain the value of the instruction counter; the electronic device 310 may also be connected to an address register 304 of the electronic system 300, for example, through the second interface 314, to obtain a target address, where the address register 304 stores the target address; the electronic device 310 may also be connected with the operation type register 306 of the electronic system 300, for example, through the third interface 316, to obtain the operation type, wherein the operation type register 306 stores the operation type. Further, the electronic device 310 may be connected with the partition register 308 of the electronic system 300, for example, through the fourth interface 318, to obtain the partition information, wherein the partition register 308 stores the partition information. And the electronic device 310 may be connected with the mode register 320 of the electronic system 300 through the fifth interface 330, for example, to acquire the mode information, wherein the mode register 320 stores the mode information. The electronic device 310 also includes a boot load module 332. The electronic device 310 may load the program codes and configuration information stored in the non-volatile memory 336 of the electronic system 300 into the memories and registers of the electronic system 300 to complete initialization of the electronic system 300, for example, by the boot load module 332 during startup of the electronic system 300. In some alternative embodiments, the boot loader module 332 is implemented by a boot loader (bootloader). The electronic device 310 also has an output interface 338 for outputting the entitlement control signal.

The electronic system 300 includes a debug interface 340, and an external device (e.g., a host computer) can access each memory partition of the electronic system 300 through the debug interface 340 if a preset condition is met. Where debug interface 340 includes a clock interface 342, for example, for receiving a clock signal for debugging.

In some embodiments, method 200 also includes method 400 for controlling access rights at debug. FIG. 4 shows a flow diagram of a method 400 for controlling access rights at debug in accordance with an embodiment of the present disclosure. The method 400 may be performed by the electronic device 310 shown in fig. 3, or may be performed at the electronic device 110 shown in fig. 1, the electronic device 520 shown in fig. 5, or the electronic device 700 shown in fig. 7. It should be understood that method 400 may also include additional steps not shown and/or may omit steps shown, as the scope of the disclosure is not limited in this respect.

At step 402, the electronic device 310 loads mode information into a mode register of the electronic system via the electronic system initialization process.

During the initialization process of the electronic system, the boot loading module 332 loads the mode information in the non-volatile memory 336 into the mode register 320 of the electronic system. In some alternative embodiments, the boot load module 332 also loads the partition information in the non-volatile memory 336 into the partition registers 308 of the electronic system and loads the corresponding program code into the corresponding memory partition.

At step 404, the electronic device 310 determines a mode characterized by mode information.

At step 406, if the electronic device 310 determines that the mode information characterizes a protected mode, a debug control signal is generated characterizing that debugging is disabled.

At step 408, if the electronic device 310 determines that the mode information characterizes open mode, a debug control signal is generated that characterizes the enabling of debugging.

At step 410, if the electronic device 310 detects a debug control signal that characterizes a prohibition of debugging, the clock signal is gated to generate a first gated clock signal to prohibit access to any of the memory partitions via a debug interface of the electronic system.

At step 412, if the electronic device 310 detects a debug control signal that characterizes a permission to debug, the clock signal is gated to generate a second gated clock signal to permit access to any of the memory partitions via a debug interface of the electronic system. In particular implementation, electronic device 310 includes a gating unit 344, which may be implemented, for example, by a two-input and gate 346. One input terminal of the two-input AND gate 346 receives the debug control signal TE, the other input terminal receives the clock signal CLK, and the gated clock signal GCLK output by the two-input AND gate 346 is coupled to the debug clock interface 342 of the electronic system 300.

When the debug control signal TE is in a high state, the debug control signal is a debug control signal that indicates that debugging is allowed. At this time, the gated clock signal GCLK outputted from the two-input and gate 346 is a clock signal having the same frequency as the clock signal CLK. Thus, the debug interface 340 of the electronic system 300 may operate normally, thereby enabling an external device to access the memory partitions of the electronic system 300 through the debug interface of the electronic system 300. When the debug control signal TE is in a low state, the gated clock signal GCLK outputted from the two-input and gate 346 is a low signal to represent the debug control signal for prohibiting debugging. Thus, the debug interface of the electronic system 300 cannot work because it cannot acquire a normal clock signal. Therefore, in the protection mode, the external device cannot access any memory partition of the electronic system 300 through the debugging interface 340 of the electronic system 300, that is, the way of acquiring the program code stored in the memory partition through the debugging interface 340 is eliminated, so that the program code is protected and prevented from being leaked.

By setting the mode register, the protection mode can be reasonably opened or closed as required, and the flexibility of setting the protection mode is improved. For example, in the product development stage, the mode information may be set to an open mode to allow access to a memory partition of the electronic system through a debugging interface, so as to facilitate debugging and verification through the upper computer; after the development is completed, the mode information is set to a protection mode so as to prohibit the access to the memory partition of the electronic system through the debugging interface and protect the program codes in the memory partition.

In some alternative embodiments, the electronic system 300 is provided with a key register, which may be, for example, a 32-bit binary register. A 32-bit binary number may be stored in a predetermined area of the non-volatile memory 336 of the electronic system 300. The boot load module 332 loads the 32-bit binary number into the key register of the electronic system 300 during initialization of the electronic system 300. The electronic device 310 has key information (e.g., having the same bit width as the key register) pre-stored therein. The electronic device 310 obtains the information stored by the key register from the key register of the electronic system 300. In response to determining that the information stored by the key register matches the key information, the electronic device 310 generates a debug control signal that characterizes the enablement of debugging; and in response to determining that the information stored by the key register does not match the key information, the electronic device 310 generates a debug control signal that characterizes the disabling of debugging.

By employing the above approach, the present disclosure can avoid accessing a memory partition of an electronic system using a debug interface.

In some embodiments, method 200 also includes method 600 for controlling electronic system initialization and erase operations. FIG. 6 illustrates a flow chart of a method 600 for controlling electronic system initialization and erase operations in accordance with an embodiment of the present disclosure. Method 600 may be performed by electronic device 310 as shown in FIG. 3, and may also be performed at electronic device 110 shown in FIG. 1, electronic device 520 shown in FIG. 5, or electronic device 700 shown in FIG. 7. It should be understood that method 600 may also include additional steps not shown and/or may omit steps shown, as the scope of the disclosure is not limited in this respect.

At step 602, the electronic device 310 obtains partition information set in a non-volatile memory of the electronic system to initialize partition registers of the electronic system based on the obtained partition information.

By setting the corresponding partition information in the nonvolatile memory 336 of the electronic system 300 and then initializing the partition register of the electronic system 300 based on the partition information set in the nonvolatile memory 336, the partition mode of the memory of the electronic system 300 can be reasonably adjusted, so that the partition mode of the memory of the electronic system 300 is not limited to a preset fixed partition mode, the flexibility of the partition mode is improved, and the storage resources corresponding to different memory partitions are fully utilized.

At step 604, the electronic device 310 confirms whether a signal is detected to characterize the completion of the initialization of the electronic system.

At step 606, if the electronic device 310 detects a signal indicating that the initialization of the electronic system is complete, a write disable signal is generated to disable writing to a partition register of the electronic system. Wherein the partition register stores partition information loaded from non-volatile memory during initialization of the electronic system. The write disable signal serves as a type of entitlement control signal that may, for example, disable writing to a partition register of the electronic system. After the electronic system initialization is completed, it means that the partition operation of the memory of the electronic system 300 according to the partition information set in the nonvolatile memory 336 has been performed. During the normal operation of the subsequent electronic system, the partition information stored in the nonvolatile memory is not allowed to be modified, so that the relevant developer is prevented from setting instructions in the corresponding memory partition to modify the partition information stored in the nonvolatile memory, and the limitation of the original partition is avoided. It should be understood that the original partition refers to a partition mode corresponding to the partition information set in the nonvolatile memory 336 solidified prior to initialization of the electronic system.

At step 608, the electronic device 310 confirms whether an instruction to erase partition information stored by a non-volatile memory of the electronic system is detected.

At step 610, if the electronic device 310 detects an instruction to erase partition information stored in a non-volatile memory of an electronic system, an erase instruction is generated to erase program code stored in the non-volatile memory. The erase command serves as a kind of authority control signal that can control, for example, an erase operation on the nonvolatile memory to erase the program code stored therein. After the electronic system initialization is completed, if the electronic device 310 detects an instruction to erase partition information stored in a non-volatile memory of the electronic system, an erase instruction is generated to erase program code stored in the non-volatile memory. This means that once the relevant developer aims to modify the partition information stored in the non-volatile memory by setting instructions in its corresponding memory partition, the program code stored in the non-volatile memory is entirely erased, and thus, the relevant developer cannot acquire the program code stored in the non-volatile memory.

By adopting the above means, the present disclosure can further improve the security of the program code in the memory.

Fig. 5 shows a schematic structural diagram of an electronic system 500 according to an embodiment of the disclosure. As shown in fig. 5, electronic system 500 includes at least: electronic device 520, memory 530. The electronic device 520 is used to implement the method for controlling memory access rights of embodiments of the present disclosure. The Memory 530 includes a RAM (Random Access Memory) Memory 531 and a flash Memory 533. For example, according to the partition information, the RAM is divided into 4 areas, RAM0, RAM1, RAM2, and RAM4; the flash is divided into 4 areas, flash0, flash1, flash2, and flash3. Wherein, RAM0 and flash0 constitute a memory partition, which is called partition No. 0 532, for example; RAM1 and flash1 constitute one memory partition, referred to as partition No. 1 534, for example; RAM2 and flash2 constitute a memory partition, referred to as partition number 2 536, for example; RAM3 and flash3 constitute one memory partition, which is referred to as partition No. 3 538, for example. Instruction counter register 502, address register 504, operation type register 506, partition register 508 as an alternative implementation, electronic device 520 interacts data with instruction counter register 502, address register 504, operation type register 506, partition register 508, respectively, via one or more interfaces. For example, the electronic device 520 includes a first interface 522, a second interface 524, a third interface 526, and a fourth interface 528. The electronic device 520 may be connected to the instruction counter register 502 of the electronic system 500 through the first interface 522, for example, to obtain the value of the instruction counter; the electronic device 520 may also be connected to the address register 504 of the electronic system 500 through the second interface 524 to obtain a target address, for example, where the address register 504 stores the target address; the electronic device 520 may also be connected with the operation type register 506 of the electronic system 500 through the third interface 526, for example, to obtain the operation type, where the operation type register 506 stores the operation type; and electronic device 520 may interface with partition register 508 of electronic system 500, for example, via fourth interface 528, to obtain partition information, where partition register 508 stores partition information. The electronic device 520 also has an output interface 518 for outputting the entitlement control signals.

Regarding the electronic device 520, it further includes, for example, a first determination module 542, a second determination module 544, and a rights output module 546. The first determining module 542, for example, may determine, according to the instruction counter, a first memory partition in which the instruction to be currently executed is located; a second determination module 544, which may determine, for example, a second memory partition where a target address to be accessed by the currently to-be-executed instruction is located according to the target address; a permission output module 546, e.g., for determining whether the first memory partition and the second memory partition belong to the same memory partition; and in response to determining that the first memory partition and the second memory partition do not belong to the same memory partition and that the operation type corresponding to the current instruction to be executed is a read data operation, generating a read inhibit signal to inhibit execution of the read data operation corresponding to the current instruction to be executed.

In some alternative embodiments, the first determining module 542, the second determining module 544 and the permission outputting module 546 are all implemented by digital logic circuits.

In particular implementations, partition registers 508 include RAM partition registers and flash partition registers. The RAM partition register comprises ramsep0 (corresponding to the lower limit of an address range of the RAM 0), ramsep1 (corresponding to the lower limit of an address range of the RAM 1), ramsep2 (corresponding to the lower limit of an address range of the RAM 2), ramsep3 (corresponding to the lower limit of an address range of the RAM 3) and ramsep4 (corresponding to the upper limit of an address range of the RAM 3), wherein the address ranges corresponding to the RAMs 0-3 are sequentially arranged from low to high. The flash partition register includes flash sep0 (corresponding to the lower limit of the flash0 address range), flash sep1 (corresponding to the lower limit of the flash1 address range), flash sep2 (corresponding to the lower limit of the flash2 address range), flash sep3 (corresponding to the lower limit of the flash3 address range), flash sep4 (corresponding to the upper limit of the flash3 address range).

The address register 504 includes a RAM address register haddr _ RAM and a flash address register haddr _ xip. The RAM address register haddr _ RAM stores a target address of a RAM memory to be accessed by a current instruction to be executed; the flash address register haddr _ xip is used for storing the target address of the flash memory to be accessed by the current instruction to be executed.

First determination module 542 generates an 8-bit signal based on instruction counter register 502 and partition register 508, the 8-bit signal received by privilege output module 546. The 8-bit signal includes pc _ in _ ram0, pc _ in _ ram1, pc _ in _ ram2, pc _ in _ ram3, pc _ in _ xip0, pc _ in _ xip1, pc _ in _ xip2, and pc _ in _ xip3.

With regard to pc _ in _ ram0, its expression based on Verilog HDL (a hardware description language), for example, is:

pc_in_ram0 = (ramsep0<=etmia) & (etmia<ramsep1)。

where "=" is a value operator, "< =" is a relational operator, "&" is a logical operator, and "<" is a relational operator. etmia characterizes the value of the instruction counter register 502. Pc _ in _ ram0 is assigned a value of 1 when etmia is greater than or equal to ramsep0 and etmia is less than ramsep 1; otherwise, pc _ in _ ram0 is assigned to 0. That is, when the value of the output signal pc _ in _ RAM0 is 1, the first memory partition where the current instruction to be executed is located is denoted as RAM0.

Similarly, regarding pc _ in _ ram1, pc _ in _ ram2, pc _ in _ ram3, their expressions based on Verilog HDL, for example, are:

pc_in_ram1 = (ramsep1<=etmia) & (etmia<ramsep2)；

pc_in_ram2 = (ramsep2<=etmia) & (etmia<ramsep3)；

pc_in_ram3 = (ramsep3<=etmia) & (etmia<=ramsep4)。

and, regarding pc _ in _ xip0, pc _ in _ xip1, pc _ in _ xip2, pc _ in _ xip3, for example, based on the expression of Verilog HDL, respectively:

pc_in_xip0 = (flashsep0<=etmia) & (etmia<flashsep1)；

pc_in_xip1 = (flashsep1<=etmia) & (etmia<flashsep2)；

pc_in_xip2 = (flashsep2<=etmia) & (etmia<flashsep3)；

pc_in_xip3 = (flashsep3<=etmia) & (etmia<=flashsep4)。

accordingly, the second determination module 544 generates an 8-bit signal based on the address register 504 and the partition register 508, the 8-bit signal being received by the privilege output module 546. The 8-bit signal includes access _ ram0, access _ ram1, access _ ram2, access _ ram3, access _ xip0, access _ xip1, access _ xip2, access _ xip3.

With respect to access _ ram0, it is expressed, for example, based on Verilog HDL as:

access_ram0 = (ramsep0<=haddr_ram) & (haddr_ram<ramsep1)

wherein access _ ram0 is assigned to 1 when haddr _ ram is greater than or equal to ramsep0 and haddr _ ram is less than ramsep 1. That is, when the value of the output signal access _ RAM0 is 1, the second memory partition where the representative target address is located is RAM0.

Similarly, regarding access _ ram1, access _ ram2, access _ ram3, their expressions based on Verilog HDL, for example, are respectively:

access_ram1 = (ramsep1<=haddr_ram) & (haddr_ram<ramsep2)；

access_ram2 = (ramsep2<=haddr_ram) & (haddr_ram<ramsep3)；

access_ram3 = (ramsep3<=haddr_ram) & (haddr_ram<=ramsep4)。

and access _ xip0, access _ xip1, access _ xip2, access _ xip3, which are, for example, based on the expression of Verilog HDL, respectively:

access_xip0 = (flashsep0<=haddr_xip) & (haddr_xip<flashsep1)；

access_xip1 = (flashsep1<=haddr_xip) & (haddr_xip<flashsep2)；

access_xip2 = (flashsep2<=haddr_xip) & (haddr_xip<flashsep3)；

access_xip3 = (flashsep3<=haddr_xip) & (haddr_xip<=flashsep4)。

taking access _ xip3 as an example, when the value is 1, the second memory partition where the representation target address is located is flash3. Other signals are not described in detail.

The rights output module 546 generates signals for rights management according to the first determination module 542 and the second determination module 544, the signals being two bits, ram _ access _ error and xip _ access _ error, respectively.

Regarding ram access error, it is expressed, for example, based on Verilog HDL as:

ram_access_error = |deny_access_ram。

where "|" characterizes a "reduction or" operation. The density _ access _ ram is a binary number of four bits, wherein the four bits are density _ access _ ram [0], density _ access _ ram [1], density _ access _ ram [2] and density _ access _ ram [3], respectively.

With respect to dense _ access _ ram [0], it is expressed, for example, based on Verilog HDL as:

deny_access_ram[0] = access_ram0 & ~(pc_in_ram0 | pc_in_xip0) & ~hmaster_ram。

wherein, "|" represents "or" operation, and "-" represents "negation" operation. hmaster ram comes from the operation type register 506, and the value of hmaster _ramis 0, which characterizes the operation type as "read data". When the second memory partition where the characteristic target address is located is RAM0, and the first memory partition where the current instruction to be executed is located is neither RAM0 nor flash0 (that is, the first memory partition and the second memory partition do not belong to the same memory partition), and the operation type is "read data", then the dense _ access _ RAM [0] is assigned to 1.

With respect to dense _ access _ ram [1], dense _ access _ ram [2], dense _ access _ ram [3], their expressions based on Verilog HDL are:

deny_access_ram[1] = access_ram1 & ~(pc_in_ram1 | pc_in_xip1) & ~hmaster_ram；

deny_access_ram[2] = access_ram2 & ~(pc_in_ram2 | pc_in_xip2) & ~hmaster_ram；

deny_access_ram[3] = access_ram3 & ~(pc_in_ram3 | pc_in_xip3) & ~hmaster_ram。

thus, if the value of any one of the bits, i.e., density _ access _ ram [0], density _ access _ ram [1], density _ access _ ram [2], and density _ access _ ram [3], is 1, then the value of ram _ access _ error is 1; otherwise, the value of ram _ access _ error is 0.

When the value of RAM _ access _ error is 1, it acts as a read inhibit signal to inhibit the execution of the operation of reading data from the RAM memory by the currently executed instruction. When the value of RAM access error is 0, it acts as an enable signal to allow the execution of the operation of the current instruction to be executed on the RAM memory.

With regard to xip _ access _ error, it is, for example, based on the expression of Verilog HDL:

xip_access_error = |deny_access_xip。

where "|" characterizes a "reduction or" operation. The density _ access _ xip is a binary number of four bits, wherein the four bits are density _ access _ xip [0], density _ access _ xip [1], density _ access _ xip [2], and density _ access _ xip [3].

With respect to dent _ access _ xip [0], it is expressed, for example, based on Verilog HDL as:

deny_access_xip[0] = access_xip0 & ~(pc_in_ram0 | pc_in_xip0) & ~hmaster_xip。

wherein, "|" represents "or" operation, and "-" represents "negation" operation. hmaster _ xip is from operation type register 506, and an operation type is characterized as "read data" when the value of hmaster _xipis 0. When the second memory partition where the characteristic target address is located is flash0, and the first memory partition where the current instruction to be executed is located is neither RAM0 nor flash0 (that is, the first memory partition and the second memory partition do not belong to the same memory partition), and the operation type is "read data", then the dense _ access _ xip [0] is assigned to 1.

Regarding the dense _ access _ xp [1], dense _ access _ xp [2], dense _ access _ xp [3], their expressions based on Verilog HDL are:

deny_access_xip[1] = access_xip1 & ~(pc_in_ram1 | pc_in_xip1) & ~hmaster_xip；

deny_access_xip[2] = access_xip2 & ~(pc_in_ram2 | pc_in_xip2) & ~hmaster_xip；

deny_access_xip[3] = access_xip3 & ~(pc_in_ram3 | pc_in_xip3) & ~hmaster_xip。

thus, if the value of any one of the bits, i.e., density _ access _ xip [0], density _ access _ xip [1], density _ access _ xip [2], and density _ access _ xip [3], is 1, then the value of xip _ access _ error is 1; otherwise, the value of xip _ access _ error is 0.

When the value of xip _ access _ error is 1, it is used as a read inhibit signal to inhibit the operation of executing the current instruction to be executed to read data from the flash memory. When the value of xip _ access _ error is 0, it acts as an enable signal to allow the operation of the current instruction to be executed on the flash memory to be executed.

FIG. 7 shows a schematic block diagram of an example electronic device 700 that may be used to implement the methods for controlling memory access permissions of embodiments of the present disclosure. As shown, electronic device 700 includes a central processing unit (i.e., CPU 701) that can perform various appropriate actions and processes in accordance with computer program instructions stored in a read-only memory (i.e., ROM 702) or loaded from storage unit 708 into a random access memory (i.e., RAM 703). In the RAM 703, various programs and data required for the operation of the electronic device 700 can also be stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input/output interface (i.e., I/O interface 705) is also connected to bus 704.

A plurality of components in the electronic device 700 are connected to the I/O interface 705, including: an input unit 706 such as a keyboard, a mouse, a microphone, and the like; an output unit 707 such as various types of displays, speakers, and the like; a storage unit 708 such as a magnetic disk, optical disk, or the like; and a communication unit 709 such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the electronic device 700 to exchange information/data with other devices via a computer network such as the internet and/or various telecommunication networks.

Various processes and processes described above, such as

methods

200, 400, and 600, may be performed by the CPU 701. For example, in some embodiments,

methods

200, 400, and 600 may be implemented as a computer software program tangibly embodied in a machine-readable medium, such as storage unit 708. In some embodiments, part or all of the computer program may be loaded and/or installed onto the electronic device 700 via the ROM 702 and/or the communication unit 709. When the computer program is loaded into RAM 703 and executed by CPU 701, one or more acts of

methods

200, 400, and 600 described above may be performed.

The present disclosure relates to methods, apparatuses, systems, electronic devices, computer-readable storage media and/or computer program products. The computer program product may include computer-readable program instructions for performing various aspects of the present disclosure.

The computer readable storage medium may be a tangible device that can hold and store the instructions for use by the instruction execution device. The computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, semiconductor memory device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a Static Random Access Memory (SRAM), a portable compact disc read-only memory (CD-ROM), a Digital Versatile Disc (DVD), a memory stick, a floppy disk, a mechanical coding device, such as a punch card or an in-groove protruding structure with instructions stored thereon, and any suitable combination of the foregoing. Computer-readable storage media as used herein is not to be construed as transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., optical pulses through a fiber optic cable), or electrical signals transmitted through electrical wires.

The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to a respective computing/processing device, or to an external computer or external storage device via a network, such as the internet, a local area network, a wide area network, and/or a wireless network. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers and/or edge computing devices. The network adapter card or network interface in each computing/processing device receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in the respective computing/processing device.

The computer program instructions for carrying out operations of the present disclosure may be assembler instructions, instruction Set Architecture (ISA) instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider). In some embodiments, the electronic circuitry that can execute the computer-readable program instructions implements aspects of the present disclosure by utilizing the state information of the computer-readable program instructions to personalize the electronic circuitry, such as a programmable logic circuit, a Field Programmable Gate Array (FPGA), or a Programmable Logic Array (PLA).

Various aspects of the present disclosure are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the disclosure. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions.

These computer-readable program instructions may be provided to a processing unit of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processing unit of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer-readable program instructions may also be stored in a computer-readable storage medium that can direct a computer, programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer-readable medium storing the instructions comprises an article of manufacture including instructions which implement the function/act specified in the flowchart and/or block diagram block or blocks.

The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer, other programmable apparatus or other devices implement the functions/acts specified in the flowchart and/or block diagram block or blocks.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The foregoing description of the embodiments of the present disclosure has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen in order to best explain the principles of the embodiments, the practical application, or technical improvements to the market, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for controlling memory access permissions for an electronic system including a plurality of memory partitions, comprising:

determining a first memory partition where a current instruction to be executed is located according to an instruction counter;

determining a second memory partition where a target address is located according to the target address to be accessed by the current instruction to be executed;

determining whether the first memory partition and the second memory partition belong to the same memory partition; and

in response to determining that the first memory partition and the second memory partition do not belong to the same memory partition and that the operation type corresponding to the current instruction to be executed is a read data operation, generating a read inhibit signal to inhibit the execution of the read data operation corresponding to the current instruction to be executed;

in response to determining that the first memory partition and the second memory partition do not belong to the same memory partition and that the operation type corresponding to the current instruction to be executed is an instruction fetching operation, generating an enable signal to allow the instruction fetching operation to be executed;

the method further comprises the following steps:

generating a write inhibit signal to inhibit a write operation to a partition register of an electronic system in response to detecting a signal characterizing completion of initialization of the electronic system, wherein the partition register stores partition information loaded from a non-volatile memory during the initialization of the electronic system;

loading mode information into a mode register of an electronic system via the electronic system initialization process;

determining a mode characterized by mode information; in response to determining that the mode information characterizes a protection mode, generating a debug control signal characterizing disabling debug, an

In response to determining that the mode information characterizes open mode, debug control signals are generated that characterize enable debugging.

2. The method of claim 1, further comprising:

in response to determining that the first memory partition and the second memory partition belong to the same memory partition, an enable signal is generated to allow an operation corresponding to the currently-to-be-executed instruction to be executed.

3. The method of claim 1, further comprising:

and in response to determining that the first memory partition and the second memory partition do not belong to the same memory partition and that the operation type corresponding to the current instruction to be executed is an erasing operation, generating an erasing prohibition signal to prohibit the erasing operation corresponding to the current instruction to be executed from being executed.

4. The method of claim 1, further comprising:

generating a debug control signal to gate a clock signal to generate a gated clock signal, an

A gated clock signal is input to a debug clock interface of an electronic system to enable or disable access to any of the memory partitions via the debug interface of the electronic system.

5. The method of claim 1, further comprising:

in response to detecting a signal characterizing completion of initialization of the electronic system and detecting an instruction to erase partition information stored in a non-volatile memory of the electronic system, an erase instruction is generated to erase program code stored in the non-volatile memory.

6. The method of claim 1, further comprising:

in response to detecting a debug control signal that characterizes a prohibition of debugging, gating a clock signal to generate a first gated clock signal to prohibit access to any of the memory partitions via a debug interface of the electronic system; and

in response to detecting a debug control signal characterizing that debugging is permitted, the clock signal is gated to generate a second gated clock signal to permit access to any of the memory partitions via a debug interface of the electronic system.

7. The method of claim 1, further comprising:

acquiring partition information set in a non-volatile memory of an electronic system to initialize a partition register of the electronic system based on the acquired partition information;

confirming whether a signal for representing the completion of the initialization of the electronic system is detected;

in response to detecting a signal indicative of completion of initialization of the electronic system, generating a write disable signal to disable writing to a partition register of the electronic system;

determining whether an instruction for erasing partition information stored by a non-volatile memory of an electronic system is detected; and

in response to detecting an instruction to erase partition information stored in a non-volatile memory of an electronic system, an erase instruction is generated to erase program code stored in the non-volatile memory.

8. A method for controlling memory access permissions for an electronic system including a plurality of memory partitions, comprising:

in response to determining that the first memory partition and the second memory partition do not belong to the same memory partition and that the operation type corresponding to the current instruction to be executed is a read data operation, generating a read inhibit signal to inhibit execution of the read data operation corresponding to the current instruction to be executed;

the method further comprises the following steps:

generating a write inhibit signal to inhibit writing to a partition register of an electronic system in response to detecting a signal characterizing completion of initialization of the electronic system, wherein the partition register stores partition information loaded from a non-volatile memory during initialization of the electronic system;

A gated clock signal is input to a debug clock interface of an electronic system to enable or disable access to any one of the memory partitions via the debug interface of the electronic system.

9. A method for controlling memory access permissions for an electronic system including a plurality of memory partitions, comprising:

the method further comprises the following steps:

generating a write inhibit signal to inhibit a write operation to a partition register of an electronic system in response to detecting a signal characterizing completion of initialization of the electronic system, wherein the partition register stores partition information loaded from a non-volatile memory during the initialization of the electronic system; and

10. An electronic system, comprising:

a memory comprising at least a plurality of memory partitions; and

an electronic device;

wherein the electronic equipment includes:

at least one processor; and

a memory unit communicatively coupled to the at least one processor;

the storage unit stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 9.

11. The electronic system of claim 10, the memory further comprising: a non-volatile memory to store at least the partition information and the program code.

12. A computer-readable storage medium having stored thereon a computer program which, when executed by a machine, implements the method of any of claims 1 to 9.