Memory isolation method and device for embedded system and medium

Abstract

The invention discloses a memory isolation method and device for an embedded system and a medium, and relates to the technical field of computer information, and the method comprises the steps: generating a corresponding initial domain strategy for each memory region through a domain protection unit according to the configuration of a target system; receiving a memory access request, determining a source domain and a target domain requested to be accessed through a domain state controller, obtaining an execution task in the memory access request, and adjusting an operation mode of a target system according to the execution task; generating an access instruction based on the memory access request, and sending the access instruction to a domain protection unit; judging whether the source domain has the access authority of the target domain or not according to the initial domain strategy corresponding to the target domain through a domain protection unit; if yes, access is allowed, and the execution task corresponding to the access instruction is executed. The access instruction is checked through the domain protection unit according to the corresponding domain strategy, and unauthorized memory access operation can be directly and effectively prevented on hardware.

Description

Technical Field

[0001] The present application relates to the field of computer science and technology, and in particular to a memory isolation method, device and medium for an embedded system. Background Art

[0002] An embedded system is a microprocessor-based computer system that is usually embedded in other devices or products to control, monitor or perform specific tasks. It has the characteristics of being lightweight and highly specialized. With the booming development of the Internet of Things (IoT), embedded systems are widely used in many fields such as personal health care, home automation, smart transportation and large-scale industry. However, due to the lightweight characteristics of embedded systems, they are extremely vulnerable to serious security threats such as code injection, buffer overflow and memory leak. Therefore, in order to improve the security of embedded systems, it is particularly important to isolate the memory of embedded systems.

[0003] The existing memory isolation technology of embedded systems usually maps virtual memory to physical memory and controls the access rights of different tasks to memory through page tables, such as the memory protection unit (MPU). This method generates large overheads when switching domains because it requires privileged level intervention, which can become a serious bottleneck in application scenarios with high performance requirements. In addition, the protection granularity is coarse, which makes it difficult to meet the needs of complex systems for fine memory management. Summary of the invention

[0004] In order to solve the above problems, the present application proposes a memory isolation method for an embedded system, comprising: Generate a corresponding initial domain policy for each memory area according to the configuration of the target system through the domain protection unit; Receive a memory access request, determine a source domain and a target domain of the access request through a domain state controller, obtain an execution task in the memory access request, and adjust an operation mode of the target system according to the execution task; generating an access instruction based on the memory access request, and sending the access instruction to the domain protection unit; By means of the domain protection unit, judging whether the source domain has access rights to the target domain according to the initial domain policy corresponding to the target domain; If so, access is allowed and the execution task corresponding to the access instruction is executed.

[0005] On the other hand, the present application also proposes a memory isolation device for an embedded system, comprising: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a memory isolation method for an embedded system as described in the above example.

[0006] On the other hand, the present application also proposes a non-volatile computer storage medium storing computer executable instructions, wherein the computer executable instructions are configured as: a memory isolation method for an embedded system as described in the above example.

[0007] The present application proposes a memory isolation method for an embedded system, which can bring the following beneficial effects: By checking access instructions according to the corresponding domain policy through the domain protection unit, unauthorized memory access operations can be effectively blocked directly in the hardware, thereby effectively avoiding tampering and theft of critical system data by malicious or erroneous programs, and protecting the security of the system and the confidentiality of the data.

[0008] By isolating the memory, it is ensured that the data in each domain can only be accessed and modified by the domain with corresponding permissions, preventing other irrelevant or untrusted domains from interfering with and destroying the data, thus ensuring the integrity and accuracy of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 A schematic diagram of a flow chart of a memory isolation method for an embedded system in an embodiment of the present application; Figure 2 This is a schematic diagram of the memory isolation process in an embodiment of the present application; Figure 3 A schematic diagram of a memory isolation device for an embedded system in an embodiment of the present application. DETAILED DESCRIPTION

[0010] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0011] The technical solutions provided by various embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0012] like Figure 1 As shown, an embodiment of the present application provides a memory isolation method for an embedded system, comprising: S101: Generate a corresponding initial domain policy for each memory area according to the configuration of the target system through the domain protection unit.

[0013] Specifically, the target system is analyzed, including the system's hardware architecture, processor type, memory layout, and system functional requirements. According to the target system's memory layout, the physical memory is divided into several memory areas, each of which corresponds to different functions or modules. For example, the memory is divided into a kernel area, a user application area, a device driver area, a data storage area, etc. Through the domain protection unit, the corresponding address mapping is defined for each memory area, and the start address and end address of each memory area, as well as the boundaries between them, are clarified. The address space configuration strategy is generated based on the address space mapping.

[0014] Furthermore, according to the functional requirements of the memory area, the corresponding allocation ownership, trust object and protection level of the memory area are set, and the corresponding memory access protection policy is generated based on the allocation ownership, trust object and protection level to determine the access rights and security level of the memory segment. Among them, the permission indicates the permission to store code in the memory area, -x indicates execution permission, and -rw indicates read and write permission; the trust relationship indicates which domains can access the domain, such as Figure 2 As shown in the figure, domain R1 can only be accessed by itself, domain R2 can be accessed by R2 and R3, and domain R3 can be accessed by R1 and R3. Each of them can be accessed by itself, and trusted domains can be added in addition.

[0015] For example, for the kernel area, read, write, and execute permissions may be allowed in privileged mode, but any access in non-privileged mode may be prohibited; for the user application area, user programs are allowed to read and write in non-privileged mode, but execution permissions are prohibited (to prevent code injection). Figure 2 As shown, the ownership of code segment Region1 belongs to memory region Region1, and it has no ownership of memory region Region2 or Region3.

[0016] For example, in an IoT device, different functional modules may correspond to different domains. Assume that there are data acquisition modules (Region1), data processing modules (Region2), and communication modules (Region3) in the device. The data collected by the data acquisition module is stored in a specific memory segment, whose ownership belongs to Region1, and only Region1 and Region2 are trusted to access it, and the protection level is set to normal. When the data processing module (Region2) needs to process the collected data, it can access the memory segment because it is in the trust list; if the communication module (Region3) tries to access the memory segment, it will be blocked because it is not in the trust list, ensuring the security and isolation of the data.

[0017] It should be noted that the Region Protection Unit (Region Status Register) is responsible for configuring address space allocation and protecting memory access. The Region Protection Unit formulates detailed domain policies for each memory region, including important information such as domain ownership, trust relationship, and protection level. Through these policies, the Region Protection Unit can accurately control the access rights of different domains to each memory segment, achieving efficient memory isolation and protection.

[0018] It should be noted that the role of domain policy is to configure the address space and protect memory access. It assigns ownership, trust, and protection levels to each memory segment to determine the access rights and security level of the memory segment. Figure 2 As shown in the figure, if the access comes from an untrusted domain, such as Region2's access to certain code segments in Region1, the access will be blocked and an exception will be thrown. Figure 2 In the , the Control States Register (CSR) is used for domain state management and domain protection policy implementation. Domain state management includes the following RSR (domain state controller) and PRSR (pre-domain state controller), which limit the processor's switching between privileged and non-privileged. Domain protection includes information and policies such as ownership, trust and protection level of the control memory area. The real-time domain indicates the domain that the current processor is in; the address range indicates the address number corresponding to the domain, in order to correspond to the memory segment encoding in the memory.

[0019] It should be noted that after generating the corresponding initial domain strategy for each memory area, at the software level, the driver completes the initialization of the hardware and is ready to accept calls from the application. The application can perform operations such as domain creation and memory allocation through the API interface, where the API interface refers to the software-encapsulated function library.

[0020] S102: Receive a memory access request, determine a source domain and a target domain of the access request through a domain state controller, obtain an execution task in the memory access request, and adjust an operation mode of the target system according to the execution task.

[0021] Specifically, after receiving a memory access request, the domain state controller determines the source domain of the program that issued the access request based on the relevant information carried in the request, or by querying specific registers, data structures, etc., and determines the target domain of the access request by parsing the memory address in the request. The execution task in the memory access request is obtained, and the operation mode of the target system is adjusted according to the execution task.

[0022] The target system's operating modes include privileged mode and non-privileged mode, and the processor has different access rights to system resources in different modes. In privileged mode, the processor can access hardware resources and execute special instructions without restrictions, which is used for the operation of key components such as the operating system kernel; non-privileged mode strictly restricts resource access for ordinary user programs to run.

[0023] It should be noted that during the operation of a computer system, various programs, processes or hardware devices continuously generate memory access needs, such as reading data for calculation, or writing calculation results, because various programs or processes will send memory access requests to the target system.

[0024] It should be noted that the Region State Register (RSR) is used to indicate the current active domain of the processor in non-privileged mode. It plays a key identification role in the memory access process, restricting the processor to perform operations only within the specified domain, thereby realizing domain-based memory access control.

[0025] S103: Generate an access instruction based on the memory access request, and send the access instruction to the domain protection unit.

[0026] Specifically, the memory access request is analyzed to obtain the request information, including the target memory address to be accessed, the access type (read, write or execute) and other basic information, as well as the associated execution task, and the corresponding access instruction is generated according to the parsed request information. For example, if the execution task is to load the executable code of an application, then the access type is likely to be "read" and the target memory address should be the area where the application code is stored.

[0027] Furthermore, the generated access instruction is sent to the domain protection unit.

[0028] S104: Determine, by the domain protection unit, whether the source domain has access rights to the target domain according to the initial domain policy corresponding to the target domain.

[0029] Specifically, the domain protection unit checks the access instruction according to the initial domain policy to determine whether the source domain of the request has access rights to the target domain, that is, whether it has the right to perform the requested operation on the specified memory address of the target domain.

[0030] If yes, access is allowed and the execution task corresponding to the access instruction is executed. If no, access is denied and an exception report is generated. Based on the exception report, the exception corresponding to the access request is determined and the corresponding exception handling is triggered. When the exception is cross-border access or unauthorized domain access, the process corresponding to the access request is terminated and an error report is generated based on the request information corresponding to the access request. When the exception is insufficient authority, the error code corresponding to the insufficient authority is returned.

[0031] For example, if the target memory area belongs to the kernel domain of the operating system and only a specific domain in privileged mode has access, the domain protection unit will check whether the source domain of the request is in privileged mode and has the corresponding permissions. If the access instruction complies with the domain policy, the domain protection unit will allow the instruction to continue to execute, thereby achieving access to the target memory area; if it does not comply, access will be denied and the corresponding exception handling operation will be performed.

[0032] S105: If yes, the access is allowed, and the execution task corresponding to the access instruction is executed.

[0033] Specifically, if the source domain corresponding to the access instruction has access rights to the target domain, the access task corresponding to the access instruction number is executed.

[0034] In addition, during the task execution, when a task switching event is triggered, the switching target domain corresponding to the target task to be switched is obtained, and it is determined whether the switching target domain is consistent with the target domain. If not, the domain switching is performed through the previous domain status register.

[0035] Further, the domain identification field in the previous domain status register is obtained, the domain identification field is set to the switching target domain identification corresponding to the switching target domain, the task execution type of the target task is determined, the operation mode of the target system is adjusted according to the execution type, and the target task is executed based on the switching target domain.

[0036] When the target system's operating mode is privileged mode and the target task is executed by a user program, the target system's operating mode is converted to non-privileged mode, and the domain status register is backed up through the pre-domain status register. When the target system's operating mode is non-privileged mode and the target task is executed by a system call, the target system's operating mode is converted to privileged mode, and the domain status register is restored through the pre-domain status register.

[0037] During the register data copy process, some verification operations will be performed to check whether the domain identifier in the previous domain status register is valid and whether it is consistent with the domain information configured by the system to ensure the integrity and correctness of the data. If an abnormality is found, the error handling mechanism will be triggered, the domain switching process will be suspended, and troubleshooting will be carried out.

[0038] It should be noted that the Previous Region State Register (PRSR) is mainly used for communication and state backup between privileged levels. When the processor switches from privileged mode to non-privileged mode, the Previous Region State Register will back up the value of the Domain State Register; conversely, when switching from non-privileged mode back to privileged mode, the Domain State Register will restore the corresponding value from the Previous Region State Register to ensure the stability and correct switching of the domain state.

[0039] It should be noted that as the domain switches, the domain status register needs to reconfigure memory access permissions based on the new domain status. The domain status register will look for domain policies related to the new domain, which have been pre-set when the system is initialized or the domain is created. The domain policy contains information about the access permissions of each memory segment for different domains, such as read, write, and execute permissions. According to the new domain policy, the domain status register will adjust the accessibility settings of the memory area. For memory segments that the new domain has access to, the processor will enable the corresponding access path. For memory segments that the new domain does not have access to, the processor will disable their access paths to ensure data security and isolation.

[0040] It should be noted that in this specification, in terms of domain-enforced memory isolation, the domain status register and the domain protection unit, which are tightly managed by the processor, work together. As the core domain identifier in non-privileged mode, the domain status register accurately reflects the current active domain state, while the pre-domain status register plays a vital role in the privilege level conversion process, ensuring the stable transmission and seamless connection of the domain state. The domain protection unit carefully configures domain policies for each area of ​​the system memory, including key elements such as ownership, trust, and protection level. This unique design architecture enables efficient and accurate memory access management in a multi-domain environment, successfully eliminates the high overhead generated in the traditional domain switching process, and effectively guarantees the smoothness and stability of the system operation. In terms of domain isolation function, the system can effectively support the isolation operations of multiple non-privileged domains. During the execution of the system, the processor intelligently applies the corresponding protection and occupation mechanism based on the ownership information of the code. The domain status register accurately activates the memory segment according to this mechanism, quickly builds a legal address space, and realizes efficient and reliable domain switching. For example, when performing a domain switch, the domain's accessible memory area can be instantly reconfigured by quickly updating the domain identifier. Compared with traditional methods, this greatly reduces the switching overhead and significantly improves the system's response speed and operating efficiency.

[0041] By checking access instructions according to the corresponding domain policy through the domain protection unit, unauthorized memory access operations can be effectively blocked directly in the hardware, thereby effectively avoiding tampering and theft of critical system data by malicious or erroneous programs, and protecting the security of the system and the confidentiality of the data.

[0042] By isolating the memory, it is ensured that the data in each domain can only be accessed and modified by the domain with corresponding permissions, preventing other irrelevant or untrusted domains from interfering with and destroying the data, thus ensuring the integrity and accuracy of the data.

[0043] like Figure 3 As shown, the embodiment of the present application also proposes a memory isolation device for an embedded system, including: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a memory isolation method for an embedded system as described in any of the above embodiments.

[0044] An embodiment of the present application further provides a non-volatile computer storage medium storing computer executable instructions, wherein the computer executable instructions are configured as: a memory isolation method for an embedded system as described in any of the above embodiments.

[0045] Each embodiment in this application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0046] The devices and media provided in the embodiments of the present application correspond one-to-one to the methods. Therefore, the devices and media also have similar beneficial technical effects as the corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be repeated here.

[0047] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0048] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0049] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0050] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0051] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0052] Memory may include non-permanent storage in a computer-readable medium, in the form of random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0053] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0054] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0055] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A memory isolation method for an embedded system, characterized in that: include: Generate a corresponding initial domain policy for each memory area according to the configuration of the target system through the domain protection unit; Receive a memory access request, determine a source domain and a target domain of the access request through a domain state controller, obtain an execution task in the memory access request, and adjust an operation mode of the target system according to the execution task; generating an access instruction based on the memory access request, and sending the access instruction to the domain protection unit; By means of the domain protection unit, judging whether the source domain has access rights to the target domain according to the initial domain policy corresponding to the target domain; If so, access is allowed and the execution task corresponding to the access instruction is executed.

2. The memory isolation method of an embedded system according to claim 1, characterized in that: After executing the current task corresponding to the access instruction, the method further includes: When a task switching event is triggered, a switching target domain corresponding to the target task to be switched is obtained, and it is determined whether the switching target domain is consistent with the target domain; If not, a domain switch is performed through the previous domain status register.

3. The memory isolation method of an embedded system according to claim 2, characterized in that: The performing of domain switching through the previous domain status register specifically includes: Obtaining a domain identification field in a previous domain status register, and setting the domain identification field to a switching target domain identification corresponding to a switching target domain; Determine a task execution type of the target task, and adjust an operation mode of the target system according to the execution type; Based on the switching target domain, the target task is executed.

4. The memory isolation method of an embedded system according to claim 3, characterized in that: The operation mode includes a privileged mode and a non-privileged mode; the task execution type includes user program execution and system call execution; The adjusting the operation mode of the target system according to the target task specifically includes: When the operation mode of the target system is a privileged mode and the target task is executed by a user program, converting the operation mode of the target system to a non-privileged mode, and backing up the domain status register through the pre-domain status register; When the operation mode of the target system is a non-privileged mode and the target task is executed by a system call, the operation mode of the target system is converted to a privileged mode, and the domain status register is restored through the previous domain status register.

5. The memory isolation method of an embedded system according to claim 4, characterized in that: Before obtaining the domain identification field in the pre-domain status register and setting the domain identification field to the switching target domain identification corresponding to the switching target domain, the method further includes: Obtaining a switching target domain identifier corresponding to the switching target domain through the domain status register; The domain identifier value corresponding to the switching target domain identifier is extracted by base conversion, and it is determined whether the domain identifier value is within a valid domain identifier range.

6. The memory isolation method of an embedded system according to claim 1, characterized in that: The initialization and strategy include address space configuration strategy and memory access protection strategy; The domain protection unit generates a corresponding initial domain policy for each memory area according to the configuration of the target system, specifically including: Divide the physical memory into several memory areas according to the memory layout of the target system; By means of a domain protection unit, corresponding address space mappings are defined for the plurality of memory regions, and corresponding address space configuration policies are generated based on the address space mappings; According to the functional requirements corresponding to the memory area, the allocation ownership, trust object and protection level corresponding to the memory area are set, and the corresponding memory access protection policy is generated based on the allocation ownership, the trust object and the protection level.

7. The memory isolation method of an embedded system according to claim 1, characterized in that: After determining whether the source domain has access rights to the target domain, the method further includes: If not, access is denied and an exception report is generated; Based on the exception report, an exception situation corresponding to the access request is determined, and corresponding exception processing is triggered.

8. The memory isolation method of an embedded system according to claim 7, characterized in that: The abnormal situations include out-of-bounds access, insufficient permissions, and unauthorized domain access; When the abnormal situation is the cross-border access or the unauthorized domain access, terminating the process corresponding to the access request, and generating an error report based on the request information corresponding to the access request; When the abnormal situation is insufficient authority, an error code corresponding to the insufficient authority is returned.

9. A memory isolation device for an embedded system, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a memory isolation method for an embedded system as described in any one of claims 1 to 8.

10. A non-volatile computer storage medium storing computer executable instructions, characterized in that: The computer executable instructions are configured as: a memory isolation method for an embedded system as described in any one of claims 1 to 8.

Images