WO2017020194A1 - 一种文件系统保护方法、装置及存储设备 - Google Patents
一种文件系统保护方法、装置及存储设备 Download PDFInfo
- Publication number
- WO2017020194A1 WO2017020194A1 PCT/CN2015/085781 CN2015085781W WO2017020194A1 WO 2017020194 A1 WO2017020194 A1 WO 2017020194A1 CN 2015085781 W CN2015085781 W CN 2015085781W WO 2017020194 A1 WO2017020194 A1 WO 2017020194A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- file system
- space
- address
- instruction
- access instruction
- Prior art date
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F12/00—Accessing, addressing or allocating within memory systems or architectures
- G06F12/14—Protection against unauthorised use of memory or access to memory
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F12/00—Accessing, addressing or allocating within memory systems or architectures
- G06F12/16—Protection against loss of memory contents
Definitions
- the present invention relates to the field of computer technologies, and in particular, to a file system protection method, apparatus, and storage device.
- the operating state of the operating system includes kernel mode and user mode.
- the kernel state is the mode in which the operating system kernel runs.
- the instructions running in this mode can access system memory, peripherals, etc. without limitation, but the reliability of the command.
- the security requirements are high; the user state refers to the non-privileged state, and the instructions running in this state are limited by hardware, and some privileged operations cannot be performed, but the reliability and security requirements of the instructions are low.
- the operating system virtual address space includes kernel space and user space, kernel space instructions run in kernel mode, and user space instructions run in user mode.
- the file system is the software organization responsible for managing and storing file information in the operating system.
- the security of the file system is very important to the stability of the operating system. Therefore, in order to ensure the security of the file system, the traditional file system works in the kernel mode. Since the file system works in the kernel mode, when the user needs to access the files in the file system, the operating system needs to be switched from the user mode to the kernel mode, and the lengthy I/O software stack processing is required, which increases the processing.
- the prior art also has a technical solution for making the file system work in the user mode.
- the embodiment of the invention discloses a file system protection method, device and storage device, which are used for improving the security of the file system.
- a first aspect of the embodiments of the present invention discloses a file system protection method, where the method is applied to a storage device having a file system in a memory, wherein the memory is a non-violate memory (NVM).
- NVM non-violate memory
- the access instruction includes an instruction address, the instruction address being a virtual address for mapping a physical address of the access instruction;
- the system virtual address space is a virtual continuous address space according to the physical space of the NVM;
- the access instruction does not belong to an instruction in the file system space, the access instruction is prohibited from accessing the file system.
- the method further includes:
- the access instruction is allowed to access the file system when the access instruction belongs to an instruction in the file system space.
- the method further includes:
- the library code in the file system is linked to the library code space in the file system space by means of a link library, where the library code space is A fixed virtual space in a file system space, wherein the library code is software logic for managing the file system.
- the preset register includes a first register and a second register.
- the obtaining an address range of the file system space from the preset register includes:
- the obtaining an address range of the file system space from the preset register includes: :
- a second aspect of the embodiments of the present invention discloses a file system protection device, where the device is disposed in a storage device, and a file system is disposed in a memory of the storage device, where the memory is an NVM, including:
- a receiving module configured to receive an access instruction, where the access instruction is used to access the file system, the access instruction includes an instruction address, where the instruction address is a virtual address used to map a physical address of the access instruction ;
- An obtaining module configured to obtain an address range of a file system space from a preset register, where the file system space is a virtual address space of the file system, and the file system space belongs to a user in an operating system virtual address space Space, the operating system virtual address space is a virtual continuous address space according to the physical space of the NVM;
- a determining module configured to determine, according to the instruction address and an address range of the file system space, whether the access instruction belongs to an instruction in the file system space;
- control module configured to prohibit the access instruction from accessing the file system when the access instruction does not belong to an instruction in the file system space.
- control module is further configured to: when the access instruction belongs to an instruction in the file system space Allowing the access instruction to access the file system.
- the device further includes:
- a link module configured to link the library code in the file system to a library in the file system space in a manner of a link library when the process to which the access instruction belongs first accesses the file system a code space, the library code space being a fixed virtual space in the file system space, wherein the library code is software logic for managing the file system.
- the preset register includes a first register and a second register.
- the obtaining module is specifically configured to:
- the acquiring module is specifically configured to use the operating system virtual address.
- the start address of the space and the end address of the file system space obtained from the preset register obtain the address range of the file system space.
- a third aspect of the embodiments of the present invention discloses a storage device, including:
- Memory for storing file systems and files, wherein the memory is NVM;
- the processor is coupled to the memory via a memory bus, the processor configured to:
- the access instruction including an instruction address, the instruction address being a virtual address for mapping a physical address of the access instruction
- the system virtual address space is a virtual continuous address space according to the physical space of the NVM;
- the access instruction does not belong to an instruction in the file system space, the access instruction is prohibited from accessing the file system.
- the processor is further configured to:
- the access instruction is allowed to access the file system when the access instruction belongs to an instruction in the file system space.
- the processor is further used to :
- the library code in the file system is linked to the library code space in the file system space by means of a link library, where the library code space is A fixed virtual space in a file system space, wherein the library code is software logic for managing the file system.
- the preset register includes a first register and a second register.
- the processor obtains an address of a file system space from a preset register.
- the scope of the specific method is:
- the address range of the file system space is obtained from the preset register, and according to the instruction address and the address range of the file system space, whether the access instruction belongs to the file is determined.
- the file system protection method provided by the embodiment of the present invention can prevent an illegal instruction from generating an erroneous operation on the file system, and improves the operation. The security of the file system in the user space of the operating system.
- FIG. 1 is a flowchart of a file system protection method according to an embodiment of the present invention.
- FIG. 2 is a flowchart of another file system protection method according to an embodiment of the present invention.
- FIG. 3 is a structural diagram of a file system protection device according to an embodiment of the present invention.
- FIG. 4 is a structural diagram of a storage device according to an embodiment of the present invention.
- FIG. 5 is a schematic diagram of a virtual address space of an operating system according to an embodiment of the present invention.
- FIG. 6 is a distribution diagram of an operating system virtual address space according to an embodiment of the present invention.
- FIG. 7 is a distribution diagram of another operating system virtual address space according to an embodiment of the present invention.
- the embodiment of the invention discloses a file system protection method and device for improving the security of a file system. The details are described below separately.
- a file system is disposed in a memory of the storage device, wherein the memory is an NVM, such as a phase-change memory (PCM) or a magnetic random access memory (magnetic random access memory). MRAM), resistive random-access memory (ReRAM), and the like.
- NVM phase-change memory
- MRAM magnetic random access memory
- ReRAM resistive random-access memory
- the physical space of the NVM can be virtualized into a contiguous address space, the operating system virtual address space.
- the address of the operating system virtual address space and the NVM physical address can be converted by the page table. Referring to FIG. 5, FIG. 5 is a schematic diagram of a virtual address space of an operating system according to an embodiment of the present invention.
- the operating system virtual address space can Including kernel space and user space, kernel space instructions run in kernel mode, and user space instructions run at a lower privilege level, user mode.
- the user space can include a process space and a file system space, where the process space is a space private to the process, that is, a space private to each process in the user space, used for process activity and stack allocation; the file system space is a space shared by the process. Is the space that all processes have access to in user space.
- the file system space is the virtual address space of the file system, and the file system space can include the data space and the library code space.
- the data space is used to map the data storage area of the file system
- the library code space is used to map the library code storage area of the file system.
- the library code storage area is used to store the library code of the file system, and the library code is the software logic for managing the file system.
- the library code of the file system is linked to the library code space by means of a link library, and the process can access the file system by calling a function in the library code space.
- FIG. 1 is a flowchart of a file system protection method according to an embodiment of the present invention. As shown in FIG. 1, the file system protection method may include the following steps.
- S101 Receive an access instruction, where the access instruction is used to access a file system, where the access instruction includes an instruction address, where the instruction address is a virtual address for mapping a physical address of the access instruction.
- the instruction address can be obtained according to the logical address of the library function called by the access instruction and the start address of the library code space.
- a register is added in advance for storing some or all addresses in the start address and the end address of the file system space, and after receiving the access instruction generated by the user operation, the storage is obtained from the register.
- the address determines the address range of the file system space.
- S103 Determine, according to the instruction address and the address range of the file system space, whether the access instruction belongs to an instruction in the file system space.
- the access instruction belongs to an instruction in the file system according to the instruction address included in the access instruction and the address range of the file system space, that is, whether the instruction address belongs to the file.
- the address range of the library code space in system space That is, it is judged whether the instruction address belongs to the address range of the file system space.
- the access instruction when the access instruction does not belong to an instruction in the file system space, that is, the instruction address does not belong to the address range of the file system space, it indicates that an illegal pointer exists, and the access instruction is prohibited from accessing the file system; when the access instruction belongs to the file system space
- the instruction in the instruction that is, the address of the instruction belongs to the address range of the file system space, indicates that there is no illegal pointer, and the access instruction is allowed to access the file system.
- the preset register includes a first register and a second register
- the address range of the file system space is obtained according to the start address of the file system space and the end address of the file system space.
- FIG. 6 is a distribution diagram of an operating system virtual address space according to an embodiment of the present invention.
- the address of the kernel space is larger than the address of the file system space
- the address of the file system space is larger than the address of the process space
- a preset register is added.
- the preset register includes a first register and a second register.
- the first register can be used to store the starting address of the file system space, that is, the end address of the process space
- the second register can be used to store the end address of the file system space, that is, the starting address of the kernel space.
- the instruction address is smaller than the end address of the file system space and larger than the start address of the file system space, that is, whether the instruction address is smaller than the start address of the kernel space. And greater than the end address of the process space, when the instruction address is less than the end address of the file system space and greater than the start address of the file system space, indicating that there is no illegal pointer, the access instruction is allowed to access the file system; accordingly, when the instruction address is greater than The end address of the file system space, or less than the start address of the file system space, indicates that there is an illegal pointer that will prevent access commands from accessing the file system.
- the manner of obtaining the address range of the file system space from the preset register is specifically as follows:
- the address range of the file system space is obtained according to the start address of the operating system virtual address space and the end address of the file system space obtained from the preset register.
- FIG. 7 is a diagram of another operating system virtual address space according to an embodiment of the present invention.
- the address of the kernel space is larger than the address of the process space
- the address of the process space is larger than the address of the file system space
- the start address of the virtual address space of the operating system is the start address of the file system space
- the end of the file system space is the starting address of the process space.
- a preset register is added to store the end address of the file system space, that is, the start address of the process space.
- the instruction address is smaller than the end address of the file system space, that is, whether the instruction address is smaller than the start address of the process space, and the instruction address is smaller than the end address of the file system space.
- the access instruction will be allowed to access the file system; accordingly, when the instruction address is greater than the end address of the file system space, it indicates that there is an illegal pointer, and the access instruction is prohibited from accessing the file system.
- an address range of a file system space is obtained from a preset register, and according to the instruction address and an address range of the file system space, Determines whether the access instruction belongs to an instruction in the file system space.
- the access instruction is prohibited from accessing the file system.
- the file system protection method provided by the embodiment of the present invention can prevent the access instruction from accessing the file system when the access instruction of the access file system does not belong to the file system space, thereby preventing the illegal access instruction from generating an error on the file system. The operation improves the security of the file system running in the user space of the operating system.
- FIG. 2 is a flowchart of another file system protection method according to an embodiment of the present invention. As shown in FIG. 2, the file system protection can include the following steps.
- S201 Receive an access instruction that includes an access address that is a virtual address for mapping an NVM physical address, and an instruction address that is a virtual address for mapping a physical address of the access instruction.
- the instruction address can be obtained according to the logical address of the library function called by the access instruction and the start address of the library code space.
- the library code in the file system is linked to the library code space in the file system space by a link library, and the file system space is a virtual address space of the file system, and the file is The system space belongs to the user space in the operating system virtual address space.
- the operating system virtual address space is a virtual continuous address space according to the physical space of the NVM, and the library code space is a fixed virtual space in the file system space, wherein the library code is software logic for managing the file system.
- step S203 after receiving the access instruction generated by the user operation, it is determined whether the process to which the access instruction belongs is the first time accessing the file system, and when the process to which the access instruction belongs is the first time accessing the file system, the library code in the file system is used. Linking to the library code space in the file system space in the form of a link library, so that the access instruction accesses the file system; when the process to which the access instruction belongs is not the first time accessing the file system, step S203 is performed.
- a register is added in advance for storing some or all addresses in the start address and the end address of the file system space, after receiving an access instruction generated by a user operation, or a library in the file system. After the code is linked to the library code space in the file system space as a link library, the stored address is retrieved from this register to determine the address range of the file system space.
- S204 Determine, according to the access address and the address range of the file system space, whether the access instruction is an instruction to access the file system.
- the access instruction is an instruction to access the file system according to the access address and the address range of the file system space, that is, whether the access address belongs to The address range of the file system space.
- the access instruction is an instruction to access the file system
- the access instruction when the access instruction is an instruction to access the file system, it is determined whether the access instruction belongs to an instruction in the file system space according to the instruction address and the address range of the file system space, that is, whether the instruction address belongs to the file system space.
- the address range of the library code space that is, whether the instruction address belongs to the address range of the file system space; when the access instruction is not an instruction to access the file system, normal access will be performed.
- the access instruction when the access instruction does not belong to an instruction in the file system space, it indicates that the access address is an illegal address, and the access instruction is prohibited from accessing the file system; when the access instruction belongs to an instruction in the file system space, the access address is legal. Address, which allows access to the file system.
- the preset register includes a first register and a second register
- the address range of the file system space is obtained according to the start address of the file system space and the end address of the file system space.
- FIG. 6 is a distribution diagram of an operating system virtual address space according to an embodiment of the present invention.
- the address of the kernel space is larger than the address of the file system space
- the address of the file system space is larger than the address of the process space
- a preset register is added.
- the preset register includes a first register and a second register.
- the first register can be used to store the starting address of the file system space, that is, the end address of the process space
- the second register can be used to store the end address of the file system space, that is, the starting address of the kernel space.
- the access address is smaller than the end address of the file system space and larger than the start address of the file system space, that is, whether the access address is smaller than the start address of the kernel space. And greater than the end address of the process space.
- the access address is smaller than the end address of the file system space and larger than the start address of the file system space
- it is determined whether the instruction address is smaller than the end address of the file system space and larger than the start of the file system space.
- the address that is, whether the instruction address is smaller than the start address of the kernel space, and is greater than the end address of the process space.
- the access address is a legal address. Access commands are allowed to access the file system; correspondingly, when the instruction address is greater than the end address of the file system space, or less than the start address of the file system space, indicating that the access address is an illegal address, access commands are prohibited from accessing the file system.
- the manner of obtaining the address range of the file system space from the preset register is specifically as follows:
- the address range of the file system space is obtained according to the start address of the operating system virtual address space and the end address of the file system space obtained from the preset register.
- FIG. 7 is another virtual operating system virtual address disclosed in the embodiment of the present invention. Distribution map between. As shown in Figure 7, the address of the kernel space is larger than the address of the process space, the address of the process space is larger than the address of the file system space, the start address of the virtual address space of the operating system is the start address of the file system space, and the end of the file system space. The address is the starting address of the process space. A preset register is added to store the end address of the file system space, that is, the start address of the process space.
- the access address is smaller than the end address of the file system space, that is, whether the access address is smaller than the start address of the process space, and the access address is smaller than the end address of the file system space.
- the instruction address is smaller than the end address of the file system space, that is, whether the instruction address is smaller than the start address of the process space, and when the instruction address is smaller than the end address of the file system space, the access address is a legal address, and access is permitted.
- the instruction accesses the file system; accordingly, when the instruction address is greater than the end address of the file system space, indicating that the access address is an illegal address, access commands are prohibited from accessing the file system.
- the address range of the file system space is obtained from the preset register, and according to the instruction address and the address range of the file system space, Determines whether the access instruction belongs to an instruction in the file system space.
- the access instruction is prohibited from accessing the file system.
- the file system protection method provided by the embodiment of the present invention can prevent the access instruction from accessing the file system when the access instruction of the access file system does not belong to the file system space, thereby preventing the illegal access instruction from generating an error on the file system. The operation improves the security of the file system running in the user space of the operating system.
- FIG. 3 is a structural diagram of a file system protection apparatus according to an embodiment of the present invention.
- the file system protection device 300 can include:
- the receiving module 301 is configured to receive an access instruction, where the access instruction is used to access a file system, where the access instruction includes an instruction address, where the instruction address is a virtual address used to map a physical address of the access instruction;
- the obtaining module 302 is configured to obtain an address range of the file system space from the preset register, where the file system space is a virtual address space of the file system, and the file system space belongs to a user space in the operating system virtual address space, and the operating system is virtualized.
- the address space is a virtual continuous address space according to the physical space of the NVM;
- the determining module 303 is configured to determine, according to the instruction address and the address range of the file system space, whether the access instruction belongs to an instruction in the file system space;
- the control module 304 is configured to prohibit the access instruction from accessing the file system when the access instruction does not belong to an instruction in the file system space.
- control module 304 is further configured to allow the access instruction to access the file system when the access instruction belongs to an instruction in the file system space.
- the file system protection device 300 may further include:
- the link module 305 is configured to link the library code in the file system to the library code space in the file system space by using a link library when the process to which the access instruction belongs first accesses the file system, where the library code space is in the file system space.
- a fixed virtual space in which the library code is the software logic that manages the file system.
- the preset register includes a first register and a second register
- the obtaining module 302 is specifically configured to:
- the address range of the file system space is obtained according to the start address of the file system space and the end address of the file system space.
- the obtaining module 302 is specifically configured to obtain an address range of the file system space according to a start address of the operating system virtual address space and an end address of the file system space acquired from the preset register.
- the address range of the file system space is obtained from the preset register, and according to the instruction address and the address range of the file system space, Determines whether the access instruction belongs to an instruction in the file system space.
- the access instruction is prohibited from accessing the file system.
- the file system protection device provided by the embodiment of the present invention can prevent the access instruction from accessing the file system when the access instruction of the file system does not belong to the file system space, thereby preventing the illegal access instruction from generating an erroneous operation on the file system. Improves the security of file systems running in user space.
- FIG. 4 is a structural diagram of a storage device according to an embodiment of the present invention.
- the storage device 400 can include:
- the memory 401 is configured to store a file system and a file, where the memory 401 is an NVM;
- the processor 402 is coupled to the memory 401 via a memory bus 403, and the processor 402 is configured to:
- the access instruction includes an instruction address, and the instruction address is a virtual address for mapping a physical address of the access instruction
- the file system space is a virtual address space of the file system
- the file system space belongs to a user space in the operating system virtual address space
- the operating system virtual address space is according to the NVM Virtual continuous address space of physical space
- the processor 402 is further configured to:
- the access instruction When an access instruction belongs to an instruction in the file system space, the access instruction is allowed to access the file system.
- the processor 402 is further configured to:
- the library code in the file system is linked to the library code space in the file system space by a link library, and the library code space is a fixed virtual space in the file system space.
- the library code is the software logic of the management file system.
- the preset register includes a first register and a second register
- the manner in which the processor 402 obtains the address range of the file system space from the preset register is specifically:
- the address range of the file system space is obtained according to the start address of the file system space and the end address of the file system space.
- the manner in which the processor 402 obtains the address range of the file system space from the preset register is specifically:
- the address range of the file system space is obtained according to the start address of the operating system virtual address space and the end address of the file system space obtained from the preset register.
- the address range of the file system space is obtained from the preset register, and the access is determined according to the instruction address and the address range of the file system space. Whether the instruction belongs to an instruction in the file system space, when the access instruction does not belong to an instruction in the file system space, the access instruction is prohibited from accessing the file system.
- the storage device provided by the embodiment of the present invention can prevent the illegal access instruction from accessing the file system when the access instruction of the access file system does not belong to the instruction in the file system space, so as to prevent the illegal access instruction from generating an erroneous operation on the file system. , thereby improving the security of the file system running in user space.
- the embodiment of the invention further discloses a computer storage medium, which stores a computer program, and when the computer program in the computer storage medium is read into the computer, can enable the computer to complete the data transmission method disclosed in the embodiment of the invention. All steps.
- the storage medium may include a flash disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like. There is no limit here.
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Computer Security & Cryptography (AREA)
- Storage Device Security (AREA)
Abstract
一种文件系统保护方法及装置，该方法包括：接收访问指令，其中，访问指令用于访问文件系统，访问指令包含有指令地址，指令地址是用于映射访问指令的物理地址的虚拟地址（S101）；从预设的寄存器中获取文件系统空间的地址范围，其中，文件系统空间为文件系统的虚拟地址空间，文件系统空间属于操作系统虚拟地址空间中的用户空间，操作系统虚拟地址空间是根据NVM的物理空间虚拟的连续地址空间（S102）；根据指令地址以及文件系统空间的地址范围，判断访问指令是否属于文件系统空间中的指令（S103）；当访问指令不属于文件系统空间中的指令时，禁止访问指令访问文件系统（S104）。可以提高文件系统的安全性。
Description
本发明涉及计算机技术领域，尤其涉及一种文件系统保护方法、装置及存储设备。
操作系统的工作状态包括内核态和用户态，内核态是操作系统内核所运行的模式，运行在该模式的指令，可以无限制地对系统内存、外设等进行访问，但对指令的可靠性和安全性要求较高；用户态指非特权状态，运行在该状态下的指令被硬件限制，不能进行某些特权操作，但对指令的可靠性和安全性要求较低。操作系统虚拟地址空间包括内核空间和用户空间，内核空间的指令运行在内核态，用户空间的指令运行在用户态。
文件系统是操作系统中负责管理和存储文件信息的软件机构，文件系统的安全性对操作系统的稳定性非常重要，因此，为了保证文件系统的安全性，传统的文件系统工作在内核态。由于文件系统工作在内核态，当用户需要访问文件系统中的文件时，操作系统需要由用户态切换到内核态，并需要冗长的I/O软件栈处理，增加了处理过程。目前，为了简化用户访问文件系统中文件的处理过程，现有技术中也有使文件系统工作在用户态的技术方案。然而，由于用户进程和内核线程都具有访问工作在用户态的文件系统的权限，因此，当用户进程或内核线程存在非法指针，且该非法指针指向文件系统时，如果该操作为写操作，文件系统将会被修改，导致文件系统出现错误，降低了文件系统的安全性。
发明内容
本发明实施例公开了一种文件系统保护方法、装置及存储设备，用于提高文件系统的安全性。
本发明实施例第一方面公开一种文件系统保护方法，所述方法应用于内存中设置有文件系统的存储设备，其中，所述内存为非易失性存储器(non-violate memory，NVM)，包括：
接收访问指令，其中，所述访问指令用于访问所述文件系统，所述访问指令包含有指令地址，所述指令地址是用于映射所述访问指令的物理地址的虚拟地址；
从预设的寄存器中获取文件系统空间的地址范围，其中，所述文件系统空间为所述文件系统的虚拟地址空间，所述文件系统空间属于操作系统虚拟地址空间中的用户空间，所述操作系统虚拟地址空间是根据所述NVM的物理空间虚拟的连续地址空间；
根据所述指令地址以及所述文件系统空间的地址范围，判断所述访问指令是否属于所述文件系统空间中的指令；
当所述访问指令不属于所述文件系统空间中的指令时，禁止所述访问指令访问所述文件系统。
结合本发明实施例第一方面，在本发明实施例第一方面的第一种可能的实现方式中，所述方法还包括：
当所述访问指令属于所述文件系统空间中的指令时，允许所述访问指令访问所述文件系统。
结合本发明实施例第一方面或本发明实施例第一方面的第一种可能的实现方式，在本发明实施例第一方面的第二种可能的实现方式中，所述方法还包括：
在所述访问指令所属的进程首次访问所述文件系统时，将所述文件系统中的库代码以链接库的方式链接到所述文件系统空间中的库代码空间，所述库代码空间为所述文件系统空间中的一段固定的虚拟空间，其中，所述库代码为管理所述文件系统的软件逻辑。
结合本发明实施例第一方面的第二种可能的实现方式，在本发明实施例第一方面的第三种可能的实现方式中，所述预设的寄存器包含有第一寄存器和第二寄存器；
所述从预设的寄存器中获取文件系统空间的地址范围包括：
从所述第一寄存器中获取所述文件系统空间的起始地址；
从所述第二寄存器中获取所述文件系统空间的结束地址；
根据所述文件系统空间的起始地址以及所述文件系统空间的结束地址获
得所述文件系统空间的地址范围。
结合本发明实施例第一方面的第二种可能的实现方式，在本发明实施例第一方面的第四种可能的实现方式中，所述从预设的寄存器获取文件系统空间的地址范围包括：
根据所述操作系统虚拟地址空间的起始地址以及从预设的寄存器中获取的所述文件系统空间的结束地址获得所述文件系统空间的地址范围。
本发明实施例第二方面公开一种文件系统保护装置，所述装置设置于存储设备中，所述存储设备的内存中设置有文件系统，其中，所述内存为NVM，包括：
接收模块，用于接收访问指令，其中，所述访问指令用于访问所述文件系统，所述访问指令包含有指令地址，所述指令地址是用于映射所述访问指令的物理地址的虚拟地址；
获取模块，用于从预设的寄存器中获取文件系统空间的地址范围，其中，所述文件系统空间为所述文件系统的虚拟地址空间，所述文件系统空间属于操作系统虚拟地址空间中的用户空间，所述操作系统虚拟地址空间是根据所述NVM的物理空间虚拟的连续地址空间；
判断模块，用于根据所述指令地址以及所述文件系统空间的地址范围，判断所述访问指令是否属于所述文件系统空间中的指令；
控制模块，用于当所述访问指令不属于所述文件系统空间中的指令时，禁止所述访问指令访问所述文件系统。
结合本发明实施例第二方面，在本发明实施例第二方面的第一种可能的实现方式中，所述控制模块，还用于当所述访问指令属于所述文件系统空间中的指令时，允许所述访问指令访问所述文件系统。
结合本发明实施例第二方面或本发明实施例第二方面的第一种可能的实现方式，在本发明实施例第二方面的第二种可能的实现方式中，所述装置还包括：
链接模块，用于在所述访问指令所属的进程首次访问所述文件系统时，将所述文件系统中的库代码以链接库的方式链接到所述文件系统空间中的库代
码空间，所述库代码空间为所述文件系统空间中的一段固定的虚拟空间，其中，所述库代码为管理所述文件系统的软件逻辑。
结合本发明实施例第二方面的第二种可能的实现方式，在本发明实施例第二方面的第三种可能的实现方式中，所述预设的寄存器包含有第一寄存器和第二寄存器；
所述获取模块具体用于:
从所述第一寄存器中获取所述文件系统空间的起始地址；
从所述第二寄存器中获取所述文件系统空间的结束地址；
根据所述文件系统空间的起始地址以及所述文件系统空间的结束地址获得所述文件系统空间的地址范围。
结合本发明实施例第二方面的第二种可能的实现方式，在本发明实施例第二方面的第四种可能的实现方式中，所述获取模块，具体用于根据所述操作系统虚拟地址空间的起始地址以及从预设的寄存器中获取的所述文件系统空间的结束地址获得所述文件系统空间的地址范围。
本发明实施例第三方面公开一种存储设备，包括：
内存，用于存储文件系统和文件，其中，所述内存为NVM；
处理器通过内存总线与所述内存连接，所述处理器用于：
接收访问指令，所述访问指令用于访问所述文件系统，所述访问指令包含有指令地址，所述指令地址是用于映射所述访问指令的物理地址的虚拟地址；
从预设的寄存器中获取文件系统空间的地址范围，其中，所述文件系统空间为所述文件系统的虚拟地址空间，所述文件系统空间属于操作系统虚拟地址空间中的用户空间，所述操作系统虚拟地址空间是根据所述NVM的物理空间虚拟的连续地址空间；
根据所述指令地址以及所述文件系统空间的地址范围，判断所述访问指令是否属于所述文件系统空间中的指令；
当所述访问指令不属于所述文件系统空间中的指令时，禁止所述访问指令访问所述文件系统。
结合本发明实施例第三方面，在本发明实施例第三方面的第一种可能的实
现方式中，所述处理器还用于：
当所述访问指令属于所述文件系统空间中的指令时，允许所述访问指令访问所述文件系统。
结合本发明实施例第三方面或本发明实施例第三方面的第一种可能的实现方式，在本发明实施例第三方面的第二种可能的实现方式中，所述处理器还用于：
在所述访问指令所属的进程首次访问所述文件系统时，将所述文件系统中的库代码以链接库的方式链接到所述文件系统空间中的库代码空间，所述库代码空间为所述文件系统空间中的一段固定的虚拟空间，其中，所述库代码为管理所述文件系统的软件逻辑。
结合本发明实施例第三方面的第二种可能的实现方式，在本发明实施例第三方面的第三种可能的实现方式中，所述预设的寄存器包含有第一寄存器和第二寄存器；
所述处理器从预设的寄存器中获取文件系统空间的地址范围的方式具体为：
从所述第一寄存器中获取所述文件系统空间的起始地址；
从所述第二寄存器中获取所述文件系统空间的结束地址；
根据所述文件系统空间的起始地址以及所述文件系统空间的结束地址获得所述文件系统空间的地址范围。
结合本发明实施例第三方面的第二种可能的实现方式，在本发明实施例第三方面的第四种可能的实现方式中，所述处理器从预设的寄存器获取文件系统空间的地址范围的方式具体为：
根据所述操作系统虚拟地址空间的起始地址以及从预设的寄存器中获取的所述文件系统空间的结束地址获得所述文件系统空间的地址范围。
本发明实施例中，接收到包含有指令地址的访问指令之后，将从预设的寄存器中获取文件系统空间的地址范围，并根据指令地址以及文件系统空间的地址范围，判断访问指令是否属于文件系统空间中的指令，当访问指令不属于文件系统空间中的指令时，禁止访问指令访问文件系统。通过本发明实施例提供的文件系统保护方法可以避免非法指令对文件系统产生错误的操作，提高了运
行于操作系统的用户空间的文件系统的安全性。
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例的附图。
图1是本发明实施例公开的一种文件系统保护方法的流程图；
图2是本发明实施例公开的另一种文件系统保护方法的流程图；
图3是本发明实施例公开的一种文件系统保护装置的结构图；
图4是本发明实施例公开的一种存储设备的结构图；
图5是本发明实施例公开的一种操作系统虚拟地址空间的划分图；
图6是本发明实施例公开的一种操作系统虚拟地址空间的分布图；
图7是本发明实施例公开的另一种操作系统虚拟地址空间的分布图。
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅是本发明一部分实施例，而不是全部的实施例。
本发明实施例公开了一种文件系统保护方法及设备，用于提高文件系统的安全性。以下分别进行详细说明。
为了更好地理解本发明实施例，下面先对本发明实施例的应用场景进行描述。在本发明实施例中，存储设备的内存中设置有文件系统，其中，该内存为NVM，如：相变存储器(phase-change memory，PCM)、磁阻随机存取存储器(magnetic random access memory，MRAM)、可变电阻式存储器(resistive random-access memory，ReRAM)等。NVM的物理空间可以被虚拟为连续的地址空间，即操作系统虚拟地址空间。可以通过页表实现操作系统虚拟地址空间的地址与NVM物理地址的转换。请参阅图5，图5是本发明实施例公开的一种操作系统虚拟地址空间的划分图。如图5所示，操作系统虚拟地址空间可以
包括内核空间和用户空间，内核空间的指令运行在内核态，用户空间的指令运行在较低的特权级别上，即用户态。用户空间可以包括进程空间和文件系统空间，其中，进程空间为进程私有的空间，即为用户空间中为每个进程私有的空间，用于进程活动和堆栈分配；文件系统空间为进程共享的空间，即为所有进程在用户空间中都有权限访问的空间。文件系统空间为文件系统的虚拟地址空间，文件系统空间可以包括数据空间和库代码空间。其中，数据空间用于映射文件系统的数据存储区，库代码空间用于映射文件系统的库代码存储区。库代码存储区用于存储文件系统的库代码，库代码为管理文件系统的软件逻辑。在本发明实施例中，文件系统的库代码以链接库的方式链接到库代码空间，进程可以通过调用库代码空间内的函数访问文件系统。
请参阅图1，图1是本发明实施例公开的一种文件系统保护方法的流程图。如图1所示，该文件系统保护方法可以包括以下步骤。
S101、接收访问指令，其中，访问指令用于访问文件系统，访问指令包含有指令地址，指令地址是用于映射访问指令的物理地址的虚拟地址。
本实施例中，指令地址可以根据访问指令调用的库函数的逻辑地址以及库代码空间的起始地址获得。
S102、从预设的寄存器中获取文件系统空间的地址范围，其中，文件系统空间为文件系统的虚拟地址空间，文件系统空间属于操作系统虚拟地址空间中的用户空间，操作系统虚拟地址空间是根据NVM的物理空间虚拟的连续地址空间。
本实施例中，预先增加了寄存器，该寄存器用于存储文件系统空间的起始地址和结束地址中的部分或全部地址，接收到由用户操作产生的访问指令之后，将从该寄存器获取存储的地址以确定文件系统空间的地址范围。
S103、根据指令地址以及文件系统空间的地址范围，判断访问指令是否属于文件系统空间中的指令。
本实施例中，获取到文件系统空间的地址范围之后，将根据访问指令包含有的指令地址和文件系统空间的地址范围，判断访问指令是否属于文件系统中的指令，即判断指令地址是否属于文件系统空间中的库代码空间的地址范围，
也即是判断指令地址是否属于文件系统空间的地址范围。
S104、当访问指令不属于文件系统空间中的指令时，禁止访问指令访问文件系统。
本实施例中，当访问指令不属于文件系统空间中的指令，即指令地址不属于文件系统空间的地址范围时，表明存在非法指针，将禁止访问指令访问文件系统；当访问指令属于文件系统空间中的指令，即指令地址属于文件系统空间的地址范围时，表明不存在非法指针，允许访问指令访问文件系统。
在一个实施例中，预设的寄存器包含有第一寄存器和第二寄存器；
从预设的寄存器中获取文件系统空间的地址范围的方式具体为：
从第一寄存器中获取文件系统空间的起始地址；
从第二寄存器中获取文件系统空间的结束地址；
根据文件系统空间的起始地址以及文件系统空间的结束地址获得文件系统空间的地址范围。
例如，请参阅图6，图6是本发明实施例公开的一种操作系统虚拟地址空间的分布图。如图6所示，内核空间的地址大于文件系统空间的地址，文件系统空间的地址大于进程空间的地址，增加了预设的寄存器，该预设的寄存器包含有第一寄存器和第二寄存器。其中，第一寄存器可以用于存储文件系统空间的起始地址，即进程空间的结束地址；第二寄存器可以用于存储文件系统空间的结束地址，即内核空间的起始地址。当获取到文件系统空间的起始地址和结束地址之后，将判断指令地址是否小于文件系统空间的结束地址且大于文件系统空间的起始地址，即判断指令地址是否小于内核空间的起始地址，且大于进程空间的结束地址，当指令地址小于文件系统空间的结束地址且大于文件系统空间的起始地址时，表明不存在非法指针，将允许访问指令访问文件系统；相应地，当指令地址大于文件系统空间的结束地址，或小于文件系统空间的起始地址时，表明存在非法指针，将禁止访问指令访问文件系统。
在一个实施例中，从预设的寄存器获取文件系统空间的地址范围的方式具体为：
根据操作系统虚拟地址空间的起始地址以及从预设的寄存器中获取的文件系统空间的结束地址获得文件系统空间的地址范围。
例如，请参阅图7，图7是本发明实施例公开的另一种操作系统虚拟地址空间的分布图。如图7所示，内核空间的地址大于进程空间的地址，进程空间的地址大于文件系统空间的地址，操作系统虚拟地址空间的起始地址即文件系统空间的起始地址，文件系统空间的结束地址即进程空间的起始地址。增加了预设的寄存器，用于存储文件系统空间的结束地址，即进程空间的起始地址。获取到文件系统空间的起始地址和结束地址之后，将判断指令地址是否小于文件系统空间的结束地址，即判断指令地址是否小于进程空间的起始地址，当指令地址小于文件系统空间的结束地址时，表明不存在非法指针，将允许访问指令访问文件系统；相应地，当指令地址大于文件系统空间的结束地址时，表明存在非法指针，将禁止访问指令访问文件系统。
在图1所描述的文件系统保护方法中，接收到包含有指令地址的访问指令之后，将从预设的寄存器中获取文件系统空间的地址范围，并根据指令地址以及文件系统空间的地址范围，判断访问指令是否属于文件系统空间中的指令，当访问指令不属于文件系统空间中的指令时，禁止访问指令访问文件系统。采用本发明实施例提供的文件系统保护方法，当访问文件系统的访问指令不属于文件系统空间中的指令时，可以禁止该访问指令访问文件系统，从而可以避免非法的访问指令对文件系统产生错误的操作，提高了运行于操作系统的用户空间的文件系统的安全性。
请参阅图2，图2是本发明实施例公开的另一种文件系统保护方法的流程图。如图2所示，该文件系统保护可以包括以下步骤。
S201、接收包含有访问地址和指令地址的访问指令，其中，访问地址是用于映射NVM物理地址的虚拟地址，指令地址是用于映射访问指令的物理地址的虚拟地址。
本实施例中，指令地址可以根据访问指令调用的库函数的逻辑地址以及库代码空间的起始地址获得。
S202、在访问指令所属的进程是首次访问文件系统时，将文件系统中的库代码以链接库的方式链接到文件系统空间中的库代码空间，文件系统空间为文件系统的虚拟地址空间，文件系统空间属于操作系统虚拟地址空间中的用户空
间，操作系统虚拟地址空间是根据NVM的物理空间虚拟的连续地址空间，库代码空间为文件系统空间中的一段固定的虚拟空间，其中，库代码为管理文件系统的软件逻辑。
本实施例中，接收到由用户操作产生的访问指令之后，将判断访问指令所属的进程是否是首次访问文件系统，当访问指令所属的进程是首次访问文件系统时，将文件系统中的库代码以链接库的方式链接到文件系统空间中的库代码空间，以便访问指令访问文件系统；当访问指令所属的进程不是首次访问文件系统时，将执行步骤S203。
S203、从预设的寄存器中获取文件系统空间的地址范围。
本实施例中，预先增加了寄存器，该寄存器用于存储文件系统空间的起始地址和结束地址中的部分或全部地址，接收到由用户操作产生的访问指令之后，或将文件系统中的库代码以链接库的方式链接到文件系统空间中的库代码空间之后，将从该寄存器获取存储的地址以确定文件系统空间的地址范围。
S204、根据访问地址以及文件系统空间的地址范围，判断访问指令是否为访问文件系统的指令。
本实施例中，从预设的寄存器中获取到文件系统空间的地址范围之后，将根据访问地址以及文件系统空间的地址范围，判断访问指令是否为访问文件系统的指令，即判断访问地址是否属于文件系统空间的地址范围。
S205、当访问指令为访问文件系统的指令时，将根据指令地址以及文件系统空间的地址范围，判断访问指令是否属于文件系统空间中的指令。
本实施例中，当访问指令为访问文件系统的指令时，将根据指令地址以及文件系统空间的地址范围，判断访问指令是否属于文件系统空间中的指令，即判断指令地址是否属于文件系统空间中的库代码空间的地址范围，也即是判断指令地址是否属于文件系统空间的地址范围；当访问指令不是访问文件系统的指令时，将进行正常访问。
S206、当访问指令不属于文件系统空间中的指令时，禁止访问指令访问文件系统。
S207、当访问指令属于文件系统空间中的指令时，允许访问指令访问文件系统。
本实施例中，当访问指令不属于文件系统空间中的指令时，表明访问地址为非法地址，将禁止访问指令访问文件系统；当访问指令属于文件系统空间中的指令时，表明访问地址为合法地址，允许访问指令访问文件系统。
在一个实施例中，预设的寄存器包含有第一寄存器和第二寄存器；
从预设的寄存器中获取文件系统空间的地址范围的方式具体为：
从第一寄存器中获取文件系统空间的起始地址；
从第二寄存器中获取文件系统空间的结束地址；
根据文件系统空间的起始地址以及文件系统空间的结束地址获得文件系统空间的地址范围。
例如，请参阅图6，图6是本发明实施例公开的一种操作系统虚拟地址空间的分布图。如图6所示，内核空间的地址大于文件系统空间的地址，文件系统空间的地址大于进程空间的地址，增加了预设的寄存器，该预设的寄存器包含有第一寄存器和第二寄存器。其中，第一寄存器可以用于存储文件系统空间的起始地址，即进程空间的结束地址；第二寄存器可以用于存储文件系统空间的结束地址，即内核空间的起始地址。当获取到文件系统空间的起始地址和结束地址之后，将判断访问地址是否小于文件系统空间的结束地址，且大于文件系统空间的起始地址，即判断访问地址是否小于内核空间的起始地址，且大于进程空间的结束地址，当访问地址小于文件系统空间的结束地址且大于文件系统空间的起始地址时，将判断指令地址是否小于文件系统空间的结束地址且大于文件系统空间的起始地址，即判断指令地址是否小于内核空间的起始地址，且大于进程空间的结束地址，当指令地址小于文件系统空间的结束地址且大于文件系统空间的起始地址时，表明访问地址为合法地址，将允许访问指令访问文件系统；相应地，当指令地址大于文件系统空间的结束地址，或小于文件系统空间的起始地址时，表明访问地址为非法地址，将禁止访问指令访问文件系统。
在一个实施例中，从预设的寄存器获取文件系统空间的地址范围的方式具体为：
根据操作系统虚拟地址空间的起始地址以及从预设的寄存器中获取的文件系统空间的结束地址获得文件系统空间的地址范围。
例如，请参阅图7，图7是本发明实施例公开的另一种操作系统虚拟地址空
间的分布图。如图7所示，内核空间的地址大于进程空间的地址，进程空间的地址大于文件系统空间的地址，操作系统虚拟地址空间的起始地址即文件系统空间的起始地址，文件系统空间的结束地址即进程空间的起始地址。增加了预设的寄存器，用于存储文件系统空间的结束地址，即进程空间的起始地址。获取到文件系统空间的起始地址和结束地址之后，将判断访问地址是否小于文件系统空间的结束地址，即判断访问地址是否小于进程空间的起始地址，当访问地址小于文件系统空间的结束地址时，将判断指令地址是否小于文件系统空间的结束地址，即判断指令地址是否小于进程空间的起始地址，当指令地址小于文件系统空间的结束地址时，表明访问地址为合法地址，将允许访问指令访问文件系统；相应地，当指令地址大于文件系统空间的结束地址，表明访问地址为非法地址，将禁止访问指令访问文件系统。
在图2所描述的文件系统保护方法中，接收到包含有指令地址的访问指令之后，将从预设的寄存器中获取文件系统空间的地址范围，并根据指令地址以及文件系统空间的地址范围，判断访问指令是否属于文件系统空间中的指令，当访问指令不属于文件系统空间中的指令时，禁止访问指令访问文件系统。通过本发明实施例提供的文件系统保护方法，当访问文件系统的访问指令不属于文件系统空间中的指令时，可以禁止该访问指令访问文件系统，从而避免了非法的访问指令对文件系统产生错误的操作，提高了运行于操作系统的用户空间的文件系统的安全性。
请参阅图3，图3是本发明实施例公开的一种文件系统保护装置的结构图。如图3所示，该文件系统保护装置300可以包括：
接收模块301，用于接收访问指令，其中，访问指令用于访问文件系统，访问指令包含有指令地址，指令地址是用于映射访问指令的物理地址的虚拟地址；
获取模块302，用于从预设的寄存器中获取文件系统空间的地址范围，其中，文件系统空间为文件系统的虚拟地址空间，文件系统空间属于操作系统虚拟地址空间中的用户空间，操作系统虚拟地址空间是根据NVM的物理空间虚拟的连续地址空间；
判断模块303，用于根据指令地址以及文件系统空间的地址范围，判断访问指令是否属于文件系统空间中的指令；
控制模块304，用于当访问指令不属于文件系统空间中的指令时，禁止访问指令访问文件系统。
作为一种可能的实施方式，控制模块304，还用于当访问指令属于文件系统空间中的指令时，允许访问指令访问文件系统。
作为一种可能的实施方式，文件系统保护装置300还可以包括：
链接模块305，用于在访问指令所属的进程首次访问文件系统时，将文件系统中的库代码以链接库的方式链接到文件系统空间中的库代码空间，库代码空间为文件系统空间中的一段固定的虚拟空间，其中，库代码为管理文件系统的软件逻辑。
作为一种可能的实施方式，预设的寄存器包含有第一寄存器和第二寄存器；
获取模块302具体用于:
从第一寄存器中获取文件系统空间的起始地址；
从第二寄存器中获取文件系统空间的结束地址；
根据文件系统空间的起始地址以及文件系统空间的结束地址获得文件系统空间的地址范围。
作为一种可能的实施方式，获取模块302，具体用于根据操作系统虚拟地址空间的起始地址以及从预设的寄存器中获取的文件系统空间的结束地址获得文件系统空间的地址范围。
在图3所描述的文件系统保护装置中，接收到包含有指令地址的访问指令之后，将从预设的寄存器中获取文件系统空间的地址范围，并根据指令地址以及文件系统空间的地址范围，判断访问指令是否属于文件系统空间中的指令，当访问指令不属于文件系统空间中的指令时，禁止访问指令访问文件系统。本发明实施例提供的文件系统保护装置可以在访问文件系统的访问指令不属于文件系统空间中的指令时，禁止该访问指令访问文件系统，从而避免了非法的访问指令对文件系统产生错误的操作，提高了运行于用户空间的文件系统的安全性。
请参阅图4，图4是本发明实施例公开的一种存储设备的结构图。如图4所示，该存储设备400可以包括：
内存401，用于存储文件系统和文件，其中，内存401为NVM；
处理器402通过内存总线403与内存401连接，处理器402用于：
接收访问指令，访问指令用于访问文件系统，访问指令包含有指令地址，指令地址是用于映射访问指令的物理地址的虚拟地址；
从预设的寄存器中获取文件系统空间的地址范围，其中，文件系统空间为文件系统的虚拟地址空间，文件系统空间属于操作系统虚拟地址空间中的用户空间，操作系统虚拟地址空间是根据NVM的物理空间虚拟的连续地址空间；
根据指令地址以及文件系统空间的地址范围，判断访问指令是否属于文件系统空间中的指令；
当访问指令不属于文件系统空间中的指令时，禁止访问指令访问文件系统。
作为一种可能的实施方式，处理器402还用于：
当访问指令属于文件系统空间中的指令时，允许访问指令访问文件系统。
作为一种可能的实施方式，处理器402还用于：
在访问指令所属的进程首次访问文件系统时，将文件系统中的库代码以链接库的方式链接到文件系统空间中的库代码空间，库代码空间为文件系统空间中的一段固定的虚拟空间，其中，库代码为管理文件系统的软件逻辑。
作为一种可能的实施方式，预设的寄存器包含有第一寄存器和第二寄存器；
处理器402从预设的寄存器中获取文件系统空间的地址范围的方式具体为：
从第一寄存器中获取文件系统空间的起始地址；
从第二寄存器中获取文件系统空间的结束地址；
根据文件系统空间的起始地址以及文件系统空间的结束地址获得文件系统空间的地址范围。
作为一种可能的实施方式，处理器402从预设的寄存器获取文件系统空间的地址范围的方式具体为：
根据操作系统虚拟地址空间的起始地址以及从预设的寄存器中获取的文件系统空间的结束地址获得文件系统空间的地址范围。
在图4所描述的存储设备中，接收到包含有指令地址的访问指令之后，将从预设的寄存器中获取文件系统空间的地址范围，并根据指令地址以及文件系统空间的地址范围，判断访问指令是否属于文件系统空间中的指令，当访问指令不属于文件系统空间中的指令时，禁止访问指令访问文件系统。本发明实施例提供的存储设备，当访问文件系统的访问指令不属于文件系统空间中的指令时，可以禁止该非法的访问指令访问文件系统，以避免非法的访问指令对文件系统产生错误的操作，从而提高了运行于用户空间的文件系统的安全性。
本发明实施例进一步公开一种计算机存储介质，该计算机存储介质存储有计算机程序，当计算机存储介质中的计算机程序被读取到计算机时，能够使得计算机完成本发明实施例公开的数据传输方法的全部步骤。存储介质可以包括：闪存盘、只读存储器(Read-Only Memory，ROM)、随机存取器(Random Access Memory，RAM)、磁盘或光盘等。在此不做限定。
需要说明的是，对于前述的各个方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本发明并不受所描述的动作顺序的限制，因为依据本发明，某一些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本发明所必须的。
以上对本发明实施例所提供的文件系统保护方法及设备进行了详细介绍，本文中应用了具体个例对本发明的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本发明的方法及其核心思想。
Claims (15)
- 一种文件系统保护方法，所述方法应用于内存中设置有文件系统的存储设备，其中，所述内存为非易失性存储器NVM，其特征在于，包括：接收访问指令，其中，所述访问指令用于访问所述文件系统，所述访问指令包含有指令地址，所述指令地址是用于映射所述访问指令的物理地址的虚拟地址；从预设的寄存器中获取文件系统空间的地址范围，其中，所述文件系统空间为所述文件系统的虚拟地址空间，所述文件系统空间属于操作系统虚拟地址空间中的用户空间，所述操作系统虚拟地址空间是根据所述NVM的物理空间虚拟的连续地址空间；根据所述指令地址以及所述文件系统空间的地址范围，判断所述访问指令是否属于所述文件系统空间中的指令；当所述访问指令不属于所述文件系统空间中的指令时，禁止所述访问指令访问所述文件系统。
- 根据权利要求1所述的方法，其特征在于，所述方法还包括：当所述访问指令属于所述文件系统空间中的指令时，允许所述访问指令访问所述文件系统。
- 根据权利要求1或2所述的方法，其特征在于，所述方法还包括：在所述访问指令所属的进程首次访问所述文件系统时，将所述文件系统中的库代码以链接库的方式链接到所述文件系统空间中的库代码空间，所述库代码空间为所述文件系统空间中的一段固定的虚拟空间，其中，所述库代码为管理所述文件系统的软件逻辑。
- 根据权利要求3所述的方法，其特征在于，所述预设的寄存器包含有第一寄存器和第二寄存器；所述从预设的寄存器中获取文件系统空间的地址范围包括：从所述第一寄存器中获取所述文件系统空间的起始地址；从所述第二寄存器中获取所述文件系统空间的结束地址；根据所述文件系统空间的起始地址以及所述文件系统空间的结束地址获得所述文件系统空间的地址范围。
- 根据权利要求3所述的方法，其特征在于，所述从预设的寄存器获取文件系统空间的地址范围包括：根据所述操作系统虚拟地址空间的起始地址以及从预设的寄存器中获取的所述文件系统空间的结束地址获得所述文件系统空间的地址范围。
- 一种文件系统保护装置，所述装置设置于存储设备中，所述存储设备的内存中设置有文件系统，其中，所述内存为非易失性存储器NVM，其特征在于，包括：接收模块，用于接收访问指令，其中，所述访问指令用于访问所述文件系统，所述访问指令包含有指令地址，所述指令地址是用于映射所述访问指令的物理地址的虚拟地址；获取模块，用于从预设的寄存器中获取文件系统空间的地址范围，其中，所述文件系统空间为所述文件系统的虚拟地址空间，所述文件系统空间属于操作系统虚拟地址空间中的用户空间，所述操作系统虚拟地址空间是根据所述NVM的物理空间虚拟的连续地址空间；判断模块，用于根据所述指令地址以及所述文件系统空间的地址范围，判断所述访问指令是否属于所述文件系统空间中的指令；控制模块，用于当所述访问指令不属于所述文件系统空间中的指令时，禁止所述访问指令访问所述文件系统。
- 根据权利要求6所述的装置，其特征在于，所述控制模块，还用于当所述访问指令属于所述文件系统空间中的指令时，允许所述访问指令访问所述文件系统。
- 根据权利要求6或7所述的装置，其特征在于，所述装置还包括：链接模块，用于在所述访问指令所属的进程首次访问所述文件系统时，将所述文件系统中的库代码以链接库的方式链接到所述文件系统空间中的库代码空间，所述库代码空间为所述文件系统空间中的一段固定的虚拟空间，其中，所述库代码为管理所述文件系统的软件逻辑。
- 根据权利要求8所述的装置，其特征在于，所述预设的寄存器包含有第一寄存器和第二寄存器；所述获取模块具体用于:从所述第一寄存器中获取所述文件系统空间的起始地址；从所述第二寄存器中获取所述文件系统空间的结束地址；根据所述文件系统空间的起始地址以及所述文件系统空间的结束地址获得所述文件系统空间的地址范围。
- 根据权利要求8所述的装置，其特征在于，所述获取模块，具体用于根据所述操作系统虚拟地址空间的起始地址以及从预设的寄存器中获取的所述文件系统空间的结束地址获得所述文件系统空间的地址范围。
- 一种存储设备，其特征在于，包括：内存，用于存储文件系统和文件，其中，所述内存为非易失性存储器NVM；处理器通过内存总线与所述内存连接，所述处理器用于：接收访问指令，所述访问指令用于访问所述文件系统，所述访问指令包含有指令地址，所述指令地址是用于映射所述访问指令的物理地址的虚拟地址；从预设的寄存器中获取文件系统空间的地址范围，其中，所述文件系统空间为所述文件系统的虚拟地址空间，所述文件系统空间属于操作系统虚拟地址空间中的用户空间，所述操作系统虚拟地址空间是根据所述NVM的物理空间虚拟的连续地址空间；根据所述指令地址以及所述文件系统空间的地址范围，判断所述访问指令是否属于所述文件系统空间中的指令；当所述访问指令不属于所述文件系统空间中的指令时，禁止所述访问指令访问所述文件系统。
- 根据权利要求11所述的存储设备，其特征在于，所述处理器还用于：当所述访问指令属于所述文件系统空间中的指令时，允许所述访问指令访问所述文件系统。
- 根据权利要求11或12所述的存储设备，其特征在于，所述处理器还用于：在所述访问指令所属的进程首次访问所述文件系统时，将所述文件系统中的库代码以链接库的方式链接到所述文件系统空间中的库代码空间，所述库代码空间为所述文件系统空间中的一段固定的虚拟空间，其中，所述库代码为管理所述文件系统的软件逻辑。
- 根据权利要求13所述的存储设备，其特征在于，所述预设的寄存器包含有第一寄存器和第二寄存器；所述处理器从预设的寄存器中获取文件系统空间的地址范围的方式具体为：从所述第一寄存器中获取所述文件系统空间的起始地址；从所述第二寄存器中获取所述文件系统空间的结束地址；根据所述文件系统空间的起始地址以及所述文件系统空间的结束地址获得所述文件系统空间的地址范围。
- 根据权利要求13所述的存储设备，其特征在于，所述处理器从预设的寄存器获取文件系统空间的地址范围的方式具体为：根据所述操作系统虚拟地址空间的起始地址以及从预设的寄存器中获取的所述文件系统空间的结束地址获得所述文件系统空间的地址范围。
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201580001165.3A CN107003950B (zh) | 2015-07-31 | 2015-07-31 | 一种文件系统保护方法、装置及存储设备 |
| PCT/CN2015/085781 WO2017020194A1 (zh) | 2015-07-31 | 2015-07-31 | 一种文件系统保护方法、装置及存储设备 |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| PCT/CN2015/085781 WO2017020194A1 (zh) | 2015-07-31 | 2015-07-31 | 一种文件系统保护方法、装置及存储设备 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2017020194A1 true WO2017020194A1 (zh) | 2017-02-09 |
Family
ID=57942307
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2015/085781 WO2017020194A1 (zh) | 2015-07-31 | 2015-07-31 | 一种文件系统保护方法、装置及存储设备 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN107003950B (zh) |
| WO (1) | WO2017020194A1 (zh) |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1581108A (zh) * | 2003-07-31 | 2005-02-16 | 深圳市中兴通讯股份有限公司南京分公司 | 一种具有内存保护功能的内存管理方法 |
| CN102184143A (zh) * | 2011-04-25 | 2011-09-14 | 深圳市江波龙电子有限公司 | 一种存储设备数据的保护方法、装置及系统 |
| CN103488588A (zh) * | 2013-10-09 | 2014-01-01 | 中国科学院计算技术研究所 | 一种内存保护方法、系统及网络接口控制器 |
| US9069983B1 (en) * | 2009-04-29 | 2015-06-30 | Symantec Corporation | Method and apparatus for protecting sensitive information from disclosure through virtual machines files |
Family Cites Families (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP1696320A1 (en) * | 2005-02-25 | 2006-08-30 | Moxa Technologies Co., Ltd. | Electronic device with an embedded linux application system |
| US20060195693A1 (en) * | 2005-02-28 | 2006-08-31 | Intel Corporation | Specter rendering |
| US8819670B2 (en) * | 2010-03-31 | 2014-08-26 | Verizon Patent And Licensing Inc. | Automated software installation with interview |
| US8312224B2 (en) * | 2010-05-27 | 2012-11-13 | International Business Machines Corporation | Recovery in shared memory environment |
| CN102541984B (zh) * | 2011-10-25 | 2013-08-28 | 曙光信息产业(北京)有限公司 | 一种分布式文件系统客户端的文件系统的实现方法 |
| CN102930205A (zh) * | 2012-10-10 | 2013-02-13 | 北京奇虎科技有限公司 | 一种监测单元及方法 |
-
2015
- 2015-07-31 WO PCT/CN2015/085781 patent/WO2017020194A1/zh active Application Filing
- 2015-07-31 CN CN201580001165.3A patent/CN107003950B/zh active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1581108A (zh) * | 2003-07-31 | 2005-02-16 | 深圳市中兴通讯股份有限公司南京分公司 | 一种具有内存保护功能的内存管理方法 |
| US9069983B1 (en) * | 2009-04-29 | 2015-06-30 | Symantec Corporation | Method and apparatus for protecting sensitive information from disclosure through virtual machines files |
| CN102184143A (zh) * | 2011-04-25 | 2011-09-14 | 深圳市江波龙电子有限公司 | 一种存储设备数据的保护方法、装置及系统 |
| CN103488588A (zh) * | 2013-10-09 | 2014-01-01 | 中国科学院计算技术研究所 | 一种内存保护方法、系统及网络接口控制器 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN107003950B (zh) | 2020-12-01 |
| CN107003950A (zh) | 2017-08-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111177029B (zh) | 用于管理软件定义的永久性存储器的系统及方法 | |
| JP6652491B2 (ja) | 目標メモリ・アドレスに対応するメモリ属性ユニットの領域を特定するための領域特定演算 | |
| EP2997477B1 (en) | Page table data management | |
| WO2020046761A1 (en) | Virtual machine register in a computer processor | |
| US9189426B2 (en) | Protected access to virtual memory | |
| US10606500B2 (en) | Direct access to de-duplicated data units in memory-based file systems | |
| US9721104B2 (en) | CPU-based measured boot | |
| US8719546B2 (en) | Substitute virtualized-memory page tables | |
| WO2020057394A1 (zh) | 监控样本进程的内存访问行为的方法和装置 | |
| WO2016000470A1 (zh) | 一种内存控制方法和装置 | |
| TWI640864B (zh) | 重疊輸入輸出記憶體管理單元映射及第二層記憶體讀取之二階命令緩衝器 | |
| US20190042415A1 (en) | Storage model for a computer system having persistent system memory | |
| WO2016173172A1 (zh) | 堆内存操作的检测方法及装置 | |
| CN116342365A (zh) | 用于经由使用可用设备存储器扩展系统存储器的技术 | |
| US9904622B2 (en) | Control method for non-volatile memory and associated computer system | |
| US10901914B2 (en) | Method for writing multiple copies into storage device, and storage device | |
| US9384015B2 (en) | Techniques for dynamically redirecting device driver operations to user space | |
| US20140181379A1 (en) | File Reading Method, Storage Device And Electronic Device | |
| WO2017020194A1 (zh) | 一种文件系统保护方法、装置及存储设备 | |
| US10146699B2 (en) | Mapping apertures of different sizes | |
| TWI506436B (zh) | 替代虛擬化記憶體分頁表 | |
| TWI497294B (zh) | 用於增加虛擬記憶體效能之電腦可讀儲存媒體、設備及電腦實施方法 | |
| US20200174920A1 (en) | Method for randomizing address space layout of embedded system based on hardware and apparatus for the same | |
| JP2019117664A5 (zh) | ||
| WO2019177608A1 (en) | Address verification for direct memory access requests |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 15899970 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 15899970 Country of ref document: EP Kind code of ref document: A1 |