Programmable sandbox instruction generation method and device

Abstract

The invention discloses a programmable sandbox instruction generation method and device, relates to the technical field of computers, and aims to reduce generation of metadata search instructions and reduce the overhead of instruction generation in a scene that a sandbox program calls an auxiliary function. The method comprises the steps that M memory access instructions and auxiliary function calling instructions of the programmable sandbox program are obtained, the M memory access instructions are used for accessing a first memory segment, and M is an integer larger than 1; the auxiliary function calling instruction is used for calling an auxiliary function; according to a first memory access instruction in the M memory access instructions, generating a first metadata search instruction corresponding to the first memory access instruction and a first boundary check instruction corresponding to the first memory access instruction; if the auxiliary function does not change the validity of the first memory segment, generating a second boundary check instruction corresponding to the second memory access instruction according to the second memory access instruction; the second memory access instruction is a memory access instruction after the first memory access instruction in the M memory access instructions.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular to a method and device for generating programmable sandbox instructions. Background Art

[0002] In the process of injecting the programmable sandbox program into the programmable sandbox host program, in order to ensure the safety of the host's memory space, the programmable sandbox host program needs to perform boundary checks on the programmable sandbox program's memory access instructions. If the programmable sandbox program calls an auxiliary function, when compiling the programmable sandbox program, metadata search instructions and boundary check instructions are generated for each memory access bytecode instruction, which consumes more host resources. Summary of the invention

[0003] The present application provides a method and device for generating a programmable sandbox instruction, which can consume less overhead when a programmable sandbox program calls an auxiliary function.

[0004] In order to achieve the above objectives, the embodiments of the present application provide the following technical solutions:

[0005] In a first aspect, a method for generating a programmable sandbox instruction is provided, comprising: obtaining M memory access instructions and auxiliary function calling instructions of a programmable sandbox program, the M memory access instructions being used to access a first memory segment, where M is an integer greater than 1; the auxiliary function calling instruction being used to call an auxiliary function; generating, according to a first memory access instruction among the M memory access instructions, a first metadata search instruction corresponding to the first memory access instruction and a first boundary check instruction corresponding to the first memory access instruction; if the auxiliary function will not change the validity of the first memory segment, generating, according to the second memory access instruction, a second boundary check instruction corresponding to the second memory access instruction; the second memory access instruction is a memory access instruction subsequent to the first memory access instruction among the M memory access instructions.

[0006] This solution determines that the auxiliary function will not change the validity of the first memory segment. In the scenario where the sandbox program calls the auxiliary function, it generates a first metadata search instruction and a first boundary check instruction corresponding to the first memory access instruction. For the second memory access instruction following the first memory access instruction, it generates a boundary check instruction corresponding to each second memory access instruction. The host no longer needs to generate a metadata search instruction for the second memory access instruction, thereby reducing the generation of the second metadata search instruction and reducing the overhead of generating instructions.

[0007] In combination with the first aspect, in one possible design, the method also includes: executing a second boundary check instruction based on first metadata found by a first metadata search instruction; the first metadata includes an address of a first memory segment to which M memory access instructions are allocated.

[0008] Through this solution, when the machine code generated by the second memory search instruction is running, it can use the first metadata found by the first metadata search instruction to perform a boundary check, thereby implementing the boundary check operation of the second memory search instruction.

[0009] In combination with the first aspect, in a possible design, the method also includes: if the auxiliary function will change the validity of the first memory segment, then generating a second metadata search instruction and a second boundary check instruction corresponding to the second memory access instruction according to the second memory access instruction.

[0010] Through this solution, when the auxiliary function will change the validity of the first memory segment, the compiler can program and generate metadata search instructions and boundary check instructions for the memory access instructions after the auxiliary function call instruction. Therefore, when the auxiliary function call may cause memory changes, the memory address corresponding to the correct metadata can be found for the memory access instruction, thereby achieving accuracy of the boundary check.

[0011] In combination with the first aspect, in a possible design, the method also includes: if the auxiliary function will change the validity of the first memory segment, then based on the third memory access instruction, generating a third boundary check instruction corresponding to the third memory access instruction; the third memory access instruction is a memory access instruction after the second memory access instruction among the M memory access instructions; executing the third boundary check instruction according to the second metadata found by the second metadata search instruction; the second metadata includes the address of the first memory segment of the M memory access instructions after the auxiliary function is run.

[0012] Through this solution, if there are two or more memory access instructions that still access the same memory segment after the auxiliary function call instruction, the metadata search instruction can still be reused, so there is no need to generate the metadata search instruction corresponding to the third memory access instruction, thereby reducing the overhead of generating instructions.

[0013] In combination with the first aspect, in one possible design, the auxiliary function includes a label, which is used to indicate whether calling the auxiliary function will change the validity of the memory segment; the method also includes: determining whether the auxiliary function will change the validity of the first memory segment based on the label of the auxiliary function.

[0014] In combination with the first aspect, in one possible design, the labeling of the auxiliary function includes the labeling of the auxiliary function calling instruction.

[0015] In combination with the first aspect, in a possible design, if the auxiliary function does not call the sandbox runtime interface for canceling the authorization of the memory segment, the auxiliary function will not change the validity of the first memory segment.

[0016] Through this solution, the compiler can determine whether the auxiliary function changes the validity of the first memory segment based on whether the auxiliary function calls the sandbox runtime interface that cancels the memory segment authorization. If the auxiliary function does not change the validity of the first memory segment, the metadata search instruction corresponding to the memory segment access instruction after the auxiliary function call instruction may not be generated.

[0017] In combination with the first aspect, in a possible design, the first metadata includes one or more of the following data: a starting address of the first memory segment, an ending address of the first memory segment, and a size of the first memory segment.

[0018] In combination with the first aspect, in a possible design, the method also includes: before obtaining the M memory access instructions of the programmable sandbox program, it also includes: obtaining the programmable sandbox program and creating an instance for the programmable sandbox program; allocating a first memory space for the instance, and the M memory access instructions are the memory access instructions of the instance; after obtaining the M memory access instructions of the programmable sandbox program, it also includes: generating a fourth boundary check instruction for a fourth memory access instruction, the fourth boundary check instruction includes the first memory space, or performing a boundary check on the fourth memory access instruction according to the first memory space, and the fourth boundary check instruction is a memory access instruction among the M memory access instructions.

[0019] Through this solution, the host can first create an instance for the programmable sandbox program and allocate memory space for the instance, so that when compiling the sandbox program, a boundary check instruction is generated according to the memory space address that has been allocated to the instance, thereby eliminating the need to generate metadata search instructions, thereby achieving instruction optimization. Alternatively, a boundary check is performed according to the memory space address that has been allocated to the instance, thereby eliminating the need to generate a boundary check instruction, thereby achieving instruction optimization.

[0020] In combination with the first aspect, in a possible design, the method also includes: the first memory space includes stack memory, and the fourth memory access instruction accesses the stack memory; generating a fourth boundary check instruction for the fourth memory access instruction includes: generating a fourth boundary check instruction based on the address of the stack memory; the fourth boundary check instruction includes the address of the stack memory.

[0021] Through this solution, a boundary check instruction corresponding to the bytecode memory access instruction for accessing the stack memory is generated according to the address of the stack memory, thereby reducing the generation of metadata search instructions for the memory access instruction whose access address is the stack memory, thereby achieving instruction optimization.

[0022] In combination with the first aspect, in a possible design, the method also includes: the first memory space includes a static data segment, and the fourth memory access instruction accesses the static data segment; generating a fourth boundary check instruction for the fourth memory access instruction includes: generating the fourth boundary check instruction according to the address of the static data segment, and the fourth boundary check instruction includes the address of the static data segment.

[0023] Through this solution, a boundary check instruction corresponding to the bytecode memory access instruction for accessing the static data segment is generated according to the address of the static data segment, thereby reducing the generation of metadata search instructions for memory access instructions whose access address is the static data segment, thereby achieving instruction optimization.

[0024] In a second aspect, a device is provided, comprising: a processor, the processor being coupled to a memory, the processor being configured to execute a computer program stored in the memory, so that the device executes the method described in the first aspect and any one of the implementations thereof.

[0025] In a third aspect, an electronic device is provided, comprising a memory and a processor; the memory and the processing unit are coupled; the memory is used to store computer program code, the computer program code comprises computer instructions, and when the processing unit executes the computer instructions, the electronic device executes the method as described in the first aspect and any one of its implementations.

[0026] In a fourth aspect, a chip system is provided, comprising: a processor and an interface circuit; the processor and the interface circuit are interconnected via a line; the interface circuit is used to read instructions stored in a memory, and when the instructions are executed by the processor, the chip system executes the method described in the first aspect and any one of its implementations.

[0027] In a fifth aspect, a chip system is provided, the chip system including a processor for supporting an electronic device to implement the functions involved in the first aspect. In a possible design, the chip system also includes a memory for storing program instructions and data necessary for the electronic device. The chip system may be composed of a chip, or may include a chip and other discrete devices.

[0028] In a sixth aspect, an electronic device is provided, which has the function of implementing any one of the methods in the first aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0029] In a seventh aspect, a computer-readable storage medium is provided, comprising computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes the method as described in the first aspect and any one of its implementations.

[0030] In an eighth aspect, a computer program product is provided. When the computer program product is run on a computer, the computer is enabled to execute the method as described in the above aspects and any possible implementation thereof.

[0031] It can be understood that the beneficial effects that can be achieved by the devices, chip systems, electronic devices, computer-readable storage media, and computer program products provided in the second to eighth aspects mentioned above can refer to the beneficial effects of the first aspect provided above and any possible implementation method, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A schematic diagram of injecting a programmable sandbox program into a programmable sandbox host program;

[0033] Figure 2 Schematic diagram of pointer tracking scheme in memory safety;

[0034] Figure 3 Schematic diagram of the object tracking scheme in memory safety;

[0035] Figure 4 A schematic diagram of programmable injection in a cross-process scenario according to an embodiment of the present application;

[0036] Figure 5 A schematic diagram of programmable injection in a cross-network node scenario according to an embodiment of the present application;

[0037] Figure 6 A schematic diagram of the structure of a device provided in an embodiment of the present application;

[0038] Figure 7 A schematic diagram of the structure of another device provided in an embodiment of the present application;

[0039] Figure 8 A system architecture diagram provided for an embodiment of the present application;

[0040] Fig. 9 A schematic diagram of a flow chart of a method for generating programmable sandbox instructions provided in an embodiment of the present application;

[0041] Fig.10 A schematic diagram of another flow chart of the method for generating a programmable sandbox instruction provided in an embodiment of the present application;

[0042] Fig.11 A schematic diagram of the annotated storage location of the auxiliary function provided in an embodiment of the present application;

[0043] Fig.12 A schematic diagram of another flow chart of the method for generating a programmable sandbox instruction provided in an embodiment of the present application;

[0044] Fig.13 A schematic diagram of a scenario of a method for generating programmable sandbox instructions provided in an embodiment of the present application;

[0045] Fig.14A schematic diagram of a boundary check provided in an embodiment of the present application;

[0046] Fig.15 A schematic diagram of another flow chart of the method for generating a programmable sandbox instruction provided in an embodiment of the present application;

[0047] Fig.16 A schematic diagram of searching metadata provided in an embodiment of the present application;

[0048] Fig.17 A schematic diagram of another flow chart of the method for generating a programmable sandbox instruction provided in an embodiment of the present application;

[0049] Fig.18 A schematic diagram of another flow chart of the method for generating a programmable sandbox instruction provided in an embodiment of the present application;

[0050] Fig.19 A schematic diagram of a device provided in an embodiment of the present application;

[0051] Fig. 20 A schematic diagram of the structure of a chip system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] First, some of the terms involved in the embodiments of the present application are explained to facilitate understanding by those skilled in the art.

[0053] 1. Software Sandbox

[0054] Software sandbox is a security isolation technology for software programs. It creates a restricted sandbox environment in a computer system by providing a set of secure execution environments and rules to limit the access rights and operation scope of code (or program), so that the code can be executed in an isolated environment to prevent the software in the sandbox from damaging the software outside the sandbox and prevent malicious code from harming the system. For example, isolated environments include: memory isolation, file system isolation, network isolation, etc. Memory isolation means that the code can only access the memory allocated to the code, and the way to achieve memory isolation is to perform memory security checks on the code.

[0055] Programmable sandbox is a software sandbox technology. Figure 1, the programmable sandbox is implemented as an operation of adding a program outside the host program (called a programmable sandbox program, referred to as a sandbox program or sandbox data for short, and a sandbox program can be a program provided by a client program, and a sandbox program can also be called a programmable client program or a programmable sandbox client) to a programmable sandbox host program (referred to as host program, host for short), which can be called programmable injection (referred to as injection). After the programmable sandbox program is injected into the host, the host will first compile the programmable sandbox bytecode program, compile the bytecode program into a machine code program, and insert a boundary check instruction before the memory access machine instruction, so that the programmable sandbox machine code can access the host's memory in a restricted manner during execution. When the host needs to call the sandbox program, it creates an instance for the sandbox program, allocates memory for the machine code program, and then runs the sandbox program. Through programmable injection, the host program can call the sandbox program at runtime, thereby expanding the functions and policies of the host program, while ensuring that the programmable sandbox program cannot endanger the security of the host. Among them, the sandbox program and the host program belong to different processes. The host and the sandbox program can occupy different address spaces, such as the host occupies memory address space 1 and the sandbox program occupies memory address space 2. The sandbox program can be injected into the host in the form of bytecode, and the host program can perform real-time compilation and sandboxing on the injected bytecode program by calling the programmable sandbox runtime program (runtime). Through real-time compilation and sandboxing, the host program can call the sandbox program at runtime and use the sandbox program to implement corresponding functions. In the programmable sandbox technology, the host program can provide auxiliary functions for the sandbox program to help the sandbox program complete some specific functions, wherein the auxiliary functions provided by the host program can be called programmable sandbox auxiliary functions. Real-time compilation is to compile the bytecode program before it is executed, usually compiling the bytecode program into a machine code program in real time. In the process of sandboxing the sandbox program, the host program can allocate a static data segment for the sandbox program, and the static data segment can be used to store static variables, global variables and constants in the sandbox program. The compiler compiles the memory access instructions of the programmable sandbox bytecode program, which can be implemented as: generating corresponding metadata search machine instructions, boundary check machine instructions and memory access machine instructions for the memory access instructions of the programmable sandbox bytecode program, so that the programmable sandbox program complies with memory safety. For example, a programmable sandbox program is placed in a loop body, and the loop performs operations such as metadata search and boundary check for each sandbox program.

[0056] The sandbox runtime is a software used to implement software sandboxes and manage sandbox programs. Imposing restrictions on software in a sandbox can be called software sandboxing, which includes sandboxing for memory security and sandboxing for control flow security.

[0057] 2. Memory safety: refers to the safety of software when accessing memory, mainly including three aspects: space safety, time safety and pointer integrity. Memory safety involves faults such as: out-of-bounds access (such as buffer overflow, stack overflow), lost pointers, wild pointers, and access after release. The above faults may damage the memory safety of the system.

[0058] Bounds checking (also known as range validity checking) is a basic mechanism in memory safety technology, which is used to ensure the spatial security of memory access. Memory access refers to the act of reading and writing memory data, which can be referred to as memory access. Bounds checking refers to performing a range check on the address of memory access before the memory access operation to confirm that the address of the memory access is within the valid range. If the address of the memory access is not within the valid range, the memory access is rejected and fails. Memory access can be understood as the program's access to a memory segment. The memory segment that the program is allowed to access can be determined using metadata such as the starting address (base), the ending address (bound) or the memory segment size (size) of the memory segment, so as to implement memory access within the memory segment. For example, memory access is implemented using the starting address and the ending address of the memory segment, or memory access is implemented using the starting address and the memory segment size. Among them, the memory segment size can also be called the memory segment length. Bounds checking can be implemented as: performing a boundary check on the instruction according to the metadata corresponding to the instruction. If the memory access address of the instruction is within the range of the memory segment, the instruction passes the bounds check; if the memory access address of the instruction is not within the range of the memory segment, the instruction fails the bounds check.

[0059] Bounds checking mainly includes the following implementation methods: static program analysis, pointer tracking, and object tracking. Among them, static program analysis is a static memory safety mechanism that verifies memory access behavior during program loading. Pointer tracking and object tracking are dynamic memory safety mechanisms that verify memory access behavior during runtime.

[0060] Static program analysis: refers to the static analysis of the source code or binary code of the program when the program is initialized (program loading period) to confirm whether the program is absolutely impossible to violate memory safety. If it is possible to violate memory safety, or it is impossible to determine whether it is absolutely impossible to violate memory safety, then the program is considered to be risky and rejected or an error is thrown. Among them, behaviors that violate memory safety include out-of-bounds access, etc. Exemplarily, the extended Berkeley packet filter (eBPF) programmable sandbox uses a static program analysis mechanism.

[0061] Pointer tracking: When a compiler compiles a program (e.g., a bytecode program), pointer tracking instructions can be generated. Figure 2 As shown, pointer tracking refers to storing metadata such as the starting address and the end address of memory access or the starting address and the memory segment size of memory access in a pointer variable, and forming a fat pointer together with the above metadata and the object address in the pointer variable. When the pointer variable is dereferenced to access memory, check whether the object address is within the range of [starting address, end address], or within the range of [starting address, starting address + memory segment size]. If the object address is within the above range, it means that the memory access operation is safe, and the memory access of the object address is executed. If the object address is not within the above range, it means that the memory access operation is unsafe, and the memory access of the object address is rejected and an error is thrown. Among them, the pointer dereference operation refers to the operation of using pointer variables to access memory in the software.

[0062] In the pointer tracking solution, each object pointer needs to store the same metadata (such as the start address and the end address) in the fat pointer, which takes up more storage space. The metadata stored in the fat pointer is easily damaged and has low security. The pointer tracking solution is mostly used in scenarios such as C security enhancement and software fault isolation. Software fault isolation refers to the technology of isolating the fault of a component within a software program to avoid affecting other components and the entire program.

[0063] Object tracking: The difference from pointer tracking mechanism lies in the way metadata is stored. Figure 3 The object tracking mechanism only stores tag information used to find metadata in the pointer. When accessing memory by dereferencing the pointer variable, it is necessary to first find the metadata based on the tag information in the pointer, that is, perform a metadata search operation, and then perform a boundary check on the instruction based on the found metadata. The tag information is small in size, so the fat pointer space occupies less storage space, but the metadata search operation consumes more resources during execution.

[0064] 3. Compiler optimization: refers to reducing overhead and improving program performance through some optimization methods when compiling programming language programs or bytecode programs. Compiler optimization methods include the following implementation methods: loop invariant code extraction, constant folding and bounds check elimination.

[0065] Loop-invariant code extraction: Move loop-invariant statements or expressions in a software program outside the loop body to reduce loop overhead and improve program performance without changing the program semantics and functionality.

[0066] Constant folding: Calculate and simplify constant expressions at compile time, and pass and replace constants throughout the program, so that constant calculations can be completed as much as possible during compilation, eliminating the need for these constant calculations at runtime, thereby reducing runtime overhead and optimizing performance.

[0067] Bounds check elimination: Optimize the bounds check operations introduced by the memory safety mechanism, reduce the number of bounds checks without reducing security, thereby reducing the overhead of memory access operations and improving performance. Bounds check elimination technology often uses loop invariant code extraction technology.

[0068] The above-mentioned boundary checking mechanism faces some difficulties in programmable sandbox scenarios, which makes these compilation optimization methods ineffective or limited in scope. For example, for the eBPF programmable sandbox scenario, the behaviors of many sandbox programs cannot be confirmed safe through static program analysis during loading. If static program analysis is used, many sandbox programs will be considered to have security risks and refused to load. Static program analysis has great limitations and poor development usability. For dynamic memory safety mechanisms, pointer tracking solutions need to rely on pointer integrity to provide complete memory safety. Since sandbox bytecode can modify pointers at will, it is difficult to ensure pointer integrity. The security of this solution is low and is not suitable for sandbox scenarios.

[0069] In contrast, the object tracking scheme does not need to rely on pointer integrity and is more suitable for application in programmable sandbox scenarios.

[0070] Based on this, in order to reduce the overhead of running sandbox programs, some solutions are provided in the relevant technology.

[0071] A related technology provides a solution for enhancing memory safety of C / C++ language. The solution adds metadata for managing memory object allocation and boundary checking code to C language program by software instrumentation.

[0072] This solution adopts an object tracking solution. This solution includes a label in the pointer variable used to access memory. By arranging the metadata, the address of the metadata can be calculated using the label. Before accessing the memory through the pointer variable, the location of the object metadata can be calculated based on the label in the object pointer, and a boundary check is completed based on the metadata, so that a small amount of data can be stored in the label to find the metadata, saving the overhead of finding the metadata. However, the memory safety enhancement solution for the C / C++ language is still not applicable to the sandbox scenario, because the programmable sandbox scenario needs to dynamically grant the sandbox program access to the host's memory segment, and the host's memory allocation is not within the management scope of the programmable sandbox. The programmable sandbox cannot plan the metadata location in advance, and thus cannot calculate the metadata address by arranging the metadata in advance.

[0073] In addition, the scheme proposes to migrate the metadata lookup and bounds check involved in the runtime check of the memory safety mechanism, and the corresponding codes of these two operations to the outside of the loop at the same time, so as to reduce the runtime overhead of the sandbox program. However, in some cases (for example, when the sandbox program calls an auxiliary function, the auxiliary function may modify the sandbox program's access to the memory address), in the sandbox program execution flow, the access addresses of the two dereference instructions before and after are different, and the bounds check cannot be merged, resulting in the inability to move the metadata lookup and bounds check of this part of the program to the outside of the loop, that is, metadata lookup instructions and bounds check instructions must still be generated for each instruction in this part of the sandbox program. As a result, the overhead of this part of the sandbox program cannot be reduced, and the performance is poor.

[0074] Another related technology uses the existing Java virtual machine as a basis to enhance the memory safety of non-memory-safe languages ​​(such as C / C++) based on low-level virtual machines (LLVM). The object metadata management of this related technology adopts a two-level pointer method, that is, when accessing memory, the metadata and object pointer are first found according to the pointer provided by the memory access operation, and then a boundary check is performed. The metadata management method adopted by this technology can be applied to programmable sandbox scenarios. This related technology mentions that the boundary check elimination technology in compiler optimization can be applied, but no specific solution is given.

[0075] As for the case where auxiliary function calls are involved in the sandbox program, it is impossible to identify whether the auxiliary function will modify the legitimacy of the memory segment, that is, it is legal to use a certain pointer to access memory before calling the auxiliary function, but it becomes illegal to use the same pointer to access memory after calling the auxiliary function. Therefore, it is impossible to apply the loop-invariant code extraction technology to the just-in-time compilation of programmable sandbox programs during sandbox runtime, and it is impossible to implement the compilation optimization of metadata search and boundary checking for sandbox programs involving auxiliary function calls.

[0076] It can be seen that the memory safety mechanism of the programmable sandbox requires two steps, metadata search and boundary check, before accessing the object memory. These two steps will introduce considerable additional overhead, and there is currently no good solution to reduce the overhead. Based on this, an embodiment of the present application provides a method for generating programmable sandbox instructions, which can be applied in a programmable sandbox scenario to perform security checks on sandbox programs that require security checks and consume low overhead. In the case where the sandbox program calls an auxiliary function, this solution determines the reusability of the metadata search operation by determining whether the auxiliary function changes the memory segment accessed by the memory access instruction. When multiple instructions use the same metadata, the metadata of these instructions is reused, so there is no need to perform metadata search operations for each instruction, thereby saving the overhead consumed by the metadata search. For multiple instructions that cannot be reused for boundary check operations, this solution can also reuse the metadata search operations of these instructions, thereby saving overhead.

[0077] The technical solution provided in the embodiment of the present application can be applied to the device 300 (which can be referred to as the electronic device 300 ), or to a system including the device 300 .

[0078] For example, device 300 may be a mobile phone, a tablet computer, a desktop computer, a laptop computer, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, and various types of terminal devices such as a personal digital assistant (PDA), an augmented reality (AR) device, a virtual reality (VR) device, an artificial intelligence (AI) device, a wearable device, an in-vehicle device, a smart home device, and / or a smart city device.

[0079] For another example, the device 300 in the present application may be a module, a module group, a component, or a chip, etc., which is built into any device as one or more components or units.

[0080] In some embodiments, the device 300 may be a fixed device or a portable device.

[0081] Optionally, the operating system installed on the device 300 includes but is not limited to Or other operating systems. This application does not limit the specific type of device 300 and the installed operating system.

[0082] For example, taking the device 300 as a computer, Figure 6A schematic diagram of the structure of a device 300 provided in an embodiment of the present application is shown.

[0083] The device 300 may include a processor 310, an external memory interface 320, an internal memory 321, a universal serial bus (USB) interface 330, a charging management module 340, a power management module 341, a battery 342, an antenna, a wireless communication module 350, an audio module 360, a display screen 370, and an input device 380, etc.

[0084] The processor 310 may include one or more processing units, for example, the processor 310 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0085] The controller can generate operation control signals according to the instruction operation code and timing signal to complete the control of instruction fetching and execution.

[0086] The processor 310 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 310 is a cache memory. The memory may store instructions or data that the processor 310 has just used or cyclically used. If the processor 310 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 310, and thus improves the efficiency of the system.

[0087] In some embodiments of the present application, the processor 310 may include an auxiliary function call instruction memory access instruction between multiple memory access instructions pointing to the same memory segment, and determine whether metadata search reuse can be performed according to the annotation of the auxiliary function (or the annotation of the auxiliary function call instruction). In some other embodiments of the present application, the processor 310 In some other embodiments of the present application, the processor 310 may generate memory access instructions for the static data segment and stack memory of the sandbox program that meet the memory segment address range.

[0088] In some embodiments, processor 310 may include one or more interfaces, such as, but not limited to, a USB interface 330 .

[0089] The charging management module 340 is used to receive charging input from a charger, where the charger can be a wireless charger or a wired charger.

[0090] The power management module 341 is used to connect the battery 342, the charging management module 340 and the processor 310. The power management module 341 receives input from the battery 342 and / or the charging management module 340 to power the processor 310, the internal memory 321, the display screen 370, and the wireless communication module 350.

[0091] The wireless communication function of the device 300 can be implemented through an antenna, a wireless communication module 350, a modem processor, a baseband processor, etc.

[0092] The antenna is used to transmit and receive electromagnetic wave signals. Each antenna in the device 300 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of the antenna. For example, the antenna can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0093] The wireless communication module 350 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the device 300. The wireless communication module 350 can be one or more devices integrating at least one communication processing module. The wireless communication module 350 receives electromagnetic waves via an antenna, modulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 310. The wireless communication module 350 can also receive the signal to be sent from the processor 310, modulate the frequency, amplify it, and convert it into electromagnetic waves for radiation through the antenna.

[0094] In some embodiments, the antenna of the device 300 is coupled to the wireless communication module 350 so that the device 300 can communicate with a network and other devices through wireless communication technology.

[0095] The device 300 implements the display function through a GPU, a display screen 370, and an application processor, etc. The display screen 370 is used to display images, videos, etc. The display screen 370 includes a display panel.

[0096] The external memory interface 320 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the device 300. The external memory card communicates with the processor 310 through the external memory interface 320 to implement a data storage function, such as storing music, video and other files in the external memory card.

[0097] The internal memory 321 can be used to store computer executable program codes, which include instructions. The processor 310 executes various functional applications and data processing of the device 300 by running the instructions stored in the internal memory 321. The internal memory 321 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.). The data storage area may store data created during the use of the device 300, etc. In addition, the internal memory 321 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc. The processor 310 executes various functional applications and data processing of the device 300 by running the instructions stored in the internal memory 321, and / or the instructions stored in the memory provided in the processor.

[0098] In some embodiments of the present application, the internal memory 321 may be used to store sandbox programs and host programs.

[0099] The device 300 can implement audio functions such as music playing and recording through the audio module 360, speakers, receivers, microphones, headphone interfaces, and application processors.

[0100] The audio module 360 ​​is used to convert digital audio information into analog audio signal output, and is also used to convert analog audio input into digital audio signal. The audio module 360 ​​can also be used to encode and decode audio signals. In some embodiments, the audio module 360 ​​can be arranged in the processor 310, or some functional modules of the audio module 360 ​​can be arranged in the processor 310.

[0101] The input device 380 may include a keyboard, a mouse, etc. The keyboard is used to input English letters, numbers, punctuation marks, etc. into the device 300, thereby issuing commands to the device 300, inputting data, etc. The mouse is an indicator for positioning the vertical and horizontal coordinates of the display system of the device 300, and is used to input instructions, etc. to the device 300. Among them, the input device 380 can be connected to the device 300 through a wired connection, for example, the input device 380 is connected to the device 300 through a GPIO interface, a USB interface, etc. The input device 380 can also be connected to the device 300 wirelessly, for example, the input device 380 is connected to the device 300 through Bluetooth, infrared, etc.

[0102] For example, the above only uses a computer as an example to illustrate the structure of the device 300 in the embodiment of the present application, but does not constitute a limitation on the structure and form of the device 300. The embodiment of the present application does not limit the structure and form of the device 300. For example, Figure 7 Another exemplary structure of the device 300 provided in the embodiment of the present application is shown. Figure 7 As shown, the device 300 includes a processor 401, a memory 402, and a communication interface 403. The implementation of the processor 401 and the memory 402 can refer to Figure 6 The implementation of the communication interface 403 can refer to Figure 6 The related implementations of the USB interface 330 and the wireless communication module 350 are shown.

[0103] In some other embodiments of the present application, the electronic device may include Figure 6 , Figure 7 More or fewer components are shown, or some components are combined, or some components are separated, or different component arrangements are arranged. The components shown in the figure can be implemented in hardware, software, or a combination of software and hardware.

[0104] In some embodiments, the software system of the device 300 may adopt a layered architecture, an event-driven architecture, a micro-kernel architecture, a micro-service architecture, or a cloud architecture, etc. The embodiment of the present application takes the layered architecture as an example to exemplify the software structure of the device 300.

[0105] The programmable sandbox instruction generation method of the present application can be applied to software platforms such as operating systems and databases, and can realize the injection of user-mode processes into kernel processes, or the injection of user-mode processes into user-mode processes.

[0106] For example, refer to Figure 4, the programmable sandbox instruction generation method of the present application can be applied in the cross-process programmable injection scenario. Taking the sandbox program as user state process 1 and the host program as kernel process 1 as an example, the sandbox program and the host program are both processes of network node 1. Taking the sandbox program as user state process 1 and the host program as user state process 2 as an example, the sandbox program and the host program are both processes of network node 1, and this scenario is cross-process programmable injection.

[0107] For example, refer to Figure 5 , the programmable sandbox instruction generation method of the present application can be applied in the programmable injection scenario across network nodes. The sandbox program can be the user state process 1 of network node 1, and the host program can be the kernel process 2 of network node 2, or the sandbox program can be the user state process 1 of network node 1, and the host program can be the user state process 3 of network node 2. In this case, the sandbox program and the host program belong to the processes of network node 1 and network node 2 respectively, and the scenario is programmable injection across network nodes.

[0108] Exemplarily, the network node may be the above-mentioned device 300 .

[0109] Reference Figure 8 , Figure 8 This is a system architecture diagram of an embodiment of the present application. Taking a programmable sandbox scenario as an example, the system architecture of an embodiment of the present application includes a programmable sandbox client and a programmable sandbox host.

[0110] The programmable sandbox host is a program entity for accepting programmable injection of the sandbox program. Exemplarily, the programmable sandbox host can be a user state process or a kernel process, etc. For example, referring to Figure 4 , the programmable sandbox host (user state process 2) obtains the machine code program of user state process 1 by just-in-time compiling the bytecode program of the programmable sandbox program (user state process 1). The programmable sandbox host has auxiliary function interfaces and programmable points. The auxiliary function is a function provided by the programmable sandbox host to the sandbox program. The sandbox program can call the auxiliary function through the auxiliary function interface to implement the corresponding function of the auxiliary function. The programmable point is the code point in the host that actively calls the programmable sandbox. The host can call the programmable sandbox by calling the code point.

[0111] The programmable sandbox host includes a programmable sandbox runtime manager.

[0112] The programmable sandbox runtime manager is used to provide the programmable sandbox host with basic capabilities for processing programmable sandboxes, including: parsing the bytecode program of the programmable sandbox program, generating the machine code program of the programmable sandbox program through just-in-time compilation, managing metadata such as the memory segments that the programmable sandbox program is allowed to access (for example, allocating memory space for the programmable sandbox program), etc.

[0113] The programmable sandbox runtime manager includes a sandbox manager, a just-in-time compiler, and a loading process manager.

[0114] The sandbox manager is used to manage the host program's calls to the sandbox program and limit the memory segments that the sandbox program can access. Various codes (such as auxiliary functions) of the programmable sandbox host program can call the sandbox manager's interface to grant or revoke the sandbox program's access rights to a certain memory segment, thereby modifying the legitimacy of the sandbox program's access to the memory segment.

[0115] The just-in-time compiler is used to compile bytecode programs into machine code programs, for example, to generate machine code for metadata lookup and bounds checking for memory safety mechanisms. This reduces the overhead of sandbox programs during runtime through compilation optimization.

[0116] The loading process manager is used to read and parse the sandbox bytecode program and allocate static data segments for the sandbox bytecode program. The loading process manager can also be used to initialize the static data segment.

[0117] In some embodiments, the load process manager is also used to create an instance for the programmable sandbox program.

[0118] In some embodiments, the load flow manager is also used to create stack memory.

[0119] The programmable sandbox client is a program entity for initiating programmable injection. Exemplarily, the programmable sandbox client may be a user-mode process. The programmable sandbox client injects the client program into the host by calling the interface of the programmable sandbox host. The client program injected into the programmable sandbox host may be a bytecode program. The programmable sandbox bytecode program may be compiled from a programming language (such as C / C++) program. The interface of the programmable sandbox host may be determined according to the programmable sandbox host type and usage scenario (e.g., cross-process injection, cross-network node injection, etc.). For example, when the programmable sandbox host and the programmable client belong to different processes, the interface of the programmable sandbox host may be an inter-process communication interface. When the programmable sandbox host and the programmable client belong to different systems (e.g., different network nodes), the interface of the programmable sandbox host may be a system call interface.

[0120] The programmable sandbox instruction generation method provided in the embodiment of the present application refers to Fig. 9 , the method comprises the following steps.

[0121] 1. The programmable sandbox client initiates a programmable injection request to the host, that is, the programmable sandbox client requests to inject the programmable sandbox bytecode program into the host.

[0122] 2. The loading process manager of the host's programmable sandbox runtime analyzes the bytecode program, identifies the static data segment configured in the bytecode program, and allocates memory for the static data segment in the host memory space and fills in initialization data. In some embodiments, the host creates an instance for the programmable sandbox program and allocates stack memory for the instance.

[0123] 3. The just-in-time compiler of the host's programmable sandbox runtime manager compiles the injected bytecode program just-in-time to generate a programmable sandbox machine code program. If the bytecode program includes memory access instructions, the compiler can generate metadata search machine instructions, boundary check machine instructions, and memory access machine instructions for the memory access instructions. When the sandbox program is executed, it will be executed only if the boundary check of the memory address is met.

[0124] In some embodiments, the host has already created an instance for the bytecode program by loading the process manager, and the instance corresponds to the stack memory allocated by the host for the instance. The host can create boundary check machine instructions and memory access machine instructions for the memory access instructions in the bytecode program in the just-in-time compiler according to the stack memory address corresponding to the instance. There is no need to generate metadata search instructions, so that the sandbox program reduces overhead during operation.

[0125] 4. During the execution of the host, at a certain programmable point, the host calls the sandbox program by calling the interface of the sandbox manager. The sandbox program executes machine instructions formed by the compiler, such as metadata search instructions, boundary check instructions, and memory access instructions. In some embodiments, when the programmable host calls the sandbox program, the sandbox program can be instantiated to create an instance for the sandbox program (for example, when the loading process manager does not create an instance for the sandbox program. For another example, after the loading process manager has created an instance for the sandbox program, an instance can still be created for the sandbox program at this step). The programmable host can allocate memory (such as static data segment memory, heap memory, stack memory) for the instance after creating the instance. The memory address can be stored in the memory segment metadata. The sandbox program can point to the memory segment metadata through pointers, references, etc., thereby realizing the search of the memory address space allocated by the host for the sandbox program.

[0126] 5. Jump from the sandbox manager to the programmable sandbox machine code program for execution. When executing the programmable sandbox machine code program, the memory address allocated by the host to the sandbox program can be found according to the metadata search instruction in the programmable sandbox machine code program. For example, check whether there is metadata stored in the memory segment metadata. If the memory segment metadata does not store metadata, the metadata search stage fails and the instruction is not executed. If the memory segment metadata stores metadata, a boundary check is performed based on the memory segment metadata. If the boundary check passes, the instruction is executed. That is, if the memory segment metadata stores metadata, the boundary check instruction is used to determine whether the memory address that the sandbox program wants to access is within the memory address allocated by the host to the sandbox program. If the memory address that the sandbox program wants to access is within the memory address allocated by the host to the sandbox program, the memory access instruction for the memory is executed.

[0127] 6. During the execution of the programmable sandbox machine code program, the host's auxiliary function can be called to complete certain specific functions provided by the auxiliary function. Calling the host's auxiliary function may cause the memory address (such as the metadata stored in the memory segment metadata) to change. For example, if the auxiliary function calls the instruction to revoke memory access rights, the memory address of the instruction that calls the auxiliary function will be revoked, causing the instruction to fail in the metadata search phase.

[0128] Reference Fig.10 The present application embodiment provides a method for generating a programmable sandbox instruction, which can be applied in Fig. 9 The just-in-time compilation phase of the method shown can optimize the metadata search operation of the instructions with auxiliary functions in the sandbox program, saving the metadata search overhead, and the method includes the following steps.

[0129] S501. The electronic device obtains a programmable sandbox program.

[0130] Instructions in a programmable sandbox program call helper functions provided by the host.

[0131] In some embodiments, the auxiliary function provided by the host includes a label, which is used to indicate whether the auxiliary function will destroy the legitimacy of the memory segment pointed to by the parameters of the auxiliary function or the return value of the auxiliary function.

[0132] In some embodiments, the possibility that an auxiliary function may (e.g., uncertainly) destroy the legitimacy of the memory segment pointed to by the auxiliary function's parameters or the auxiliary function's return value can be expressed as the auxiliary function destroying the legitimacy of the memory segment pointed to by the auxiliary function's parameters or the auxiliary function's return value.

[0133] For example, refer to Fig.13, the auxiliary function call instruction calls the auxiliary function, and the parameter of the auxiliary function (or the return value of the auxiliary function) can be an address (such as the starting address 1) and / or a reference (such as reference 1). The auxiliary function may change the legitimacy of the address during operation, or change the legitimacy of the memory segment pointed to by the reference (also called the validity of the memory segment). Exemplarily, changing the legitimacy of the memory segment pointed to by the reference may be to cancel the authorization of the memory segment pointed to by the reference. Canceling the authorization of a memory segment means releasing the memory segment, and the sandbox program can no longer access the memory segment.

[0134] In some embodiments, the parameter of the auxiliary function or the return value of the auxiliary function may also be the length of the memory segment, the end address of the memory segment, etc.

[0135] In some embodiments, the annotation of the auxiliary function may indicate the legitimacy of the memory segment pointed to by the auxiliary function's parameter or the auxiliary function's return value. Fig.13 , the parameter of auxiliary function 1 is reference 1, and the annotation of auxiliary function 1 can be used to indicate whether auxiliary function 1 is likely to destroy the legitimacy of the memory segment pointed to by reference 1 and start address 1. Exemplarily, the parameters of auxiliary function 1 can also include start address 1, reference 2, reference 3, and memory segment number 1.

[0136] The above description is based on the example that the auxiliary function parameter or the auxiliary function return value includes reference 1 and / or start address 1. It should be noted that the auxiliary function may include more or fewer parameters or return values. The annotation of the auxiliary function can be used to indicate whether the auxiliary function may destroy the legitimacy of more or fewer memory segments.

[0137] In some embodiments, the annotation is also used to identify whether the auxiliary function is likely to destroy the legitimacy of any memory segment (or cancel the authorization of any memory segment). Fig.13 , the annotation of auxiliary function 1 can be used to indicate that auxiliary function 1 may violate the legitimacy of any memory segment. Auxiliary function 2 may violate the legitimacy of the memory segment pointed to by reference 0, and the memory segment pointed to by reference 0 is different from the memory segment pointed to by reference 1. Both auxiliary function 1 and auxiliary function 2 can be marked as possibly violating the legitimacy of any memory segment. If auxiliary function 3 does not call parameters related to memory addresses and does not violate the legitimacy of each memory segment, auxiliary function 3 can be marked as not violating the legitimacy of any memory segment.

[0138] Exemplarily, the reference in the auxiliary function's parameter points to a memory segment within the range of memory segments allocated by the host to the programmable sandbox program, and the auxiliary function modifies the programmable sandbox runtime interface of the reference (e.g., from allocating memory to reclaiming memory), then the auxiliary function's parameter does not destroy the legitimacy of the memory segment pointed to by the reference in the parameter of the programmable sandbox program.

[0139] In some embodiments, the auxiliary function of the programmable sandbox program includes an interface description, and the annotation is set in the interface description.

[0140] In some embodiments, the annotation may be such that a developer can perform a compiler-based program analysis on the auxiliary function during the sandbox host program development phase.

[0141] For example, if the host recognizes that the auxiliary function directly or indirectly calls an interface such as the sandbox runtime interface that cancels memory segment authorization, the auxiliary function may reclaim the memory segment originally allocated to the instruction, destroying (or changing) the legitimacy of the memory segment pointed to by the reference in the parameter of the instruction that calls the auxiliary function, and changing the legitimacy of the memory segment pointed to by the reference in the parameter of the instruction from originally legal or illegal to illegal (canceling the legitimacy of the memory segment), so that the memory access instruction that calls the auxiliary function can no longer access the original memory address space.

[0142] Exemplarily, the host may determine whether the interface is a sandbox runtime interface (such as a revoke function) for canceling memory segment authorization through the name of the interface.

[0143] In some embodiments, the annotation may be a result of the host performing a compiler-based program analysis on the auxiliary function during the initialization phase of the host execution.

[0144] Exemplarily, the annotation may be implemented as a comment before the auxiliary function. When the electronic device compiles the sandbox program, it may parse the comment of the auxiliary function and obtain the annotation result.

[0145] In another exemplary embodiment, the annotation of the auxiliary function can be stored in a configuration file, and when the electronic device compiles the sandbox program, it can obtain the annotation result of the auxiliary function through the configuration file. In some embodiments, the annotations of multiple auxiliary functions are stored in the same configuration file. In other embodiments, the annotation of each auxiliary function is stored separately in a configuration file.

[0146] Reference Fig.11 , the annotations of the auxiliary functions can be stored in one or more of the following storage spaces: in the file system of the programmable sandbox host, in the program of the programmable sandbox host, and in the programmable sandbox runtime manager of the programmable sandbox host.

[0147] The programmable sandbox program acquired by the electronic device may be a bytecode program, that is, a programmable sandbox bytecode program.

[0148] Reference Fig. 9The programmable sandbox instruction generation method shown in the figure injects the programmable sandbox program into the host program, the host can allocate memory segments for the programmable sandbox program, and the host program's just-in-time compiler compiles the memory access instructions in the bytecode instructions of the programmable sandbox program into metadata lookup instructions, boundary check instructions, and memory access instructions of machine code instructions. Fig.12 , when the programmable sandbox program is running, the process of the electronic device executing the above instructions is as follows:

[0149] S1. The electronic device performs metadata search.

[0150] In some embodiments, the memory access instruction in the instruction execution stream of the bytecode program performs memory access by reference to access the memory segment of the electronic device. The reference may include a memory segment label and an offset.

[0151] The memory allocated by the host to the instance can be stored in the memory segment metadata, such as the metadata including the starting address and length of the memory segment. During the runtime of the sandbox program, when the metadata search machine instruction is executed, the memory address allocated by the host to the instance (the address between the starting address and the starting address plus the length of the memory segment) is found according to the memory segment number in the reference of the metadata search instruction.

[0152] S2. The electronic device performs a boundary check.

[0153] The electronic device compares the offset in the reference of the metadata search instruction with the memory address obtained by the metadata search to determine whether the offset in the reference is within the memory range indicated by the metadata. If the offset in the reference is within the memory range indicated by the metadata, the boundary check passes, and the electronic device continues to execute S3. If the offset in the reference is not within the memory range indicated by the metadata, the boundary check fails, and the electronic device no longer executes the program.

[0154] S3. The electronic device executes memory access.

[0155] The electronic device can find the corresponding memory according to the starting address plus the offset, and access the memory, for example, perform read and write operations on the memory.

[0156] Exemplarily, memory access is writing memory, or reading memory.

[0157] S502: The electronic device determines that multiple (eg, M, where M is an integer greater than 1) memory access instructions of the programmable sandbox program access the same memory segment.

[0158] Exemplarily, M memory access instructions accessing the same memory segment may be implemented as follows: the references in the M memory access instructions are references pointing to the same memory segment. The references pointing to the same memory segment may be the same reference or different references.

[0159] The memory access instruction may be a memory access instruction in an execution flow of a bytecode instruction of a sandbox program when the just-in-time compiler compiles the sandbox bytecode program.

[0160] Multiple memory access instructions may refer to multiple different instructions, for example, refer to Fig.13 , memory access instruction 1 to memory access instruction 3 are different memory access instructions. Memory access instruction 1 accesses the memory segment numbered as memory segment number 1 through reference 1, and the offset of the accessed memory address is offset 1. Memory access instruction 2 accesses the memory segment numbered as memory segment number 1 through reference 2, and the offset of the accessed memory address is offset 2. Memory access instruction 3 accesses the memory segment numbered as memory segment number 1 through reference 3, and the offset of the accessed memory address is offset 3. Reference 1 to reference 3 can be the same reference or different references. Reference 1 to reference 3 point to the same memory segment (such as the memory segment of memory segment number 1). Reference Fig.14 , Fig.14 Taking the memory segment with memory segment number 1 as an example, the relationship between the offset in the memory segment and the metadata of the memory segment is shown. For example, offset 1 and offset 2 are less than the length of the memory segment (the memory segment with memory segment number 1), and offset 1 and offset 2 do not exceed the range of the memory segment. Offset 3 is greater than the length of the memory segment (the memory segment with memory segment number 1), and offset 3 exceeds the range of the memory segment.

[0161] Multiple memory access instructions may also refer to the same memory access instruction being executed multiple times in a loop. For example, if memory access instruction 1 is executed twice in a loop, when the compiler compiles memory access instruction 1, it generates corresponding machine instructions for each loop of memory access instruction 1, that is, it generates two machine instructions for metadata lookup and two machine instructions for boundary checking. Fig.13 , Fig.13 It shows that the compiler generates machine code instructions for two memory access instructions 1 respectively.

[0162] For example, refer to Fig.13 , reference 1 of memory access instruction 1, reference 2 of memory access instruction 2, and reference 3 of memory access instruction 3 all point to the memory segment with memory segment number 1.

[0163] S503: The electronic device determines that there is a call to an auxiliary function between multiple memory access instructions.

[0164] Exemplarily, the sandbox program may call the auxiliary function through an auxiliary function calling instruction.

[0165] The electronic device may determine that one or more auxiliary function call instructions exist in the plurality of memory access instructions. Fig.13, the electronic device determines that there is an auxiliary function call instruction between memory access instruction 1 and memory access instruction 2.

[0166] For another example, the electronic device determines that an auxiliary function calling instruction exists after the memory access instruction 3.

[0167] For another example, memory access instruction 1 is followed by auxiliary function call instruction 1 and memory access instruction 3 is followed by auxiliary function call instruction 2 .

[0168] S504: The electronic device determines whether the auxiliary function call destroys the legitimacy of the memory segment.

[0169] That is, the electronic device determines whether the access to the memory segment accessed by the multiple memory access instructions is no longer legal after calling the auxiliary function.

[0170] The electronic device can determine, based on the annotation of the auxiliary function, whether the call of the auxiliary function destroys the legitimacy of the memory segment.

[0171] If the call of the auxiliary function does not destroy the legality of the memory segment, a metadata search instruction and a boundary check instruction are generated for one of the memory access instructions among the multiple instructions (such as the first memory access instruction), and only a boundary check instruction is generated for the other memory access instructions among the multiple memory access instructions.

[0172] If the call of the auxiliary function destroys the legitimacy of the memory segment, metadata lookup and bounds check instructions are generated for each of the above multiple instructions.

[0173] If the call of the auxiliary function destroys the legitimacy of the memory segment, a metadata search instruction and a boundary check instruction can also be generated for the multiple memory access instructions among the above multiple instructions that are located before the auxiliary function call instruction, and a boundary check instruction can be generated for other memory access instructions among the above multiple instructions that are located before the auxiliary function call instruction. Other memory access instructions can reuse the metadata search instruction.

[0174] If the call of the auxiliary function destroys the legitimacy of the memory segment, a metadata search instruction and a boundary check instruction can also be generated for the multiple memory access instructions located after the auxiliary function call instruction among the above multiple instructions, and a boundary check instruction can be generated for other memory access instructions among the multiple memory access instructions located after the auxiliary function call instruction among the above multiple instructions. Other memory access instructions can reuse the metadata search instruction.

[0175] By not generating metadata search instructions for some memory access instructions, during the running of the sandbox program, boundary check instructions generated by other memory access instructions reuse metadata found by the above memory access instructions through metadata search to perform boundary check.

[0176] For example, still referring to Fig.13 , multiple memory access instructions that point to references to the same memory segment include memory access instructions 1 to memory access instructions 3. Among them, there is an auxiliary function call instruction 1 between memory access instruction 1 and memory access instruction 2, and auxiliary function call instruction 1 calls auxiliary function 1. Then the electronic device determines whether auxiliary function 1 destroys the legitimacy of the memory segment according to the annotation of auxiliary function 1. If the annotation of auxiliary function 1 indicates that auxiliary function 1 does not destroy the legitimacy of the memory segment, the electronic device can generate metadata search instruction 1 (an example of the first metadata search instruction) and boundary check instruction 1 according to the first memory access instruction 1 (an example of the first memory access instruction), the electronic device generates boundary check instruction 1 according to the second memory access instruction 1, the electronic device generates boundary check instruction 2 according to memory access instruction 2, and generates boundary check instruction 3 according to memory access instruction 3. The metadata (an example of the first metadata) found by metadata search instruction 1 is the starting address 1 and the memory segment length 1. Boundary check instruction 1, boundary check instruction 2, and boundary check instruction 3 all use the metadata found by metadata search instruction 1 to perform boundary checks.

[0177] Still refer to Fig.13 , if the annotation of auxiliary function 1 indicates that auxiliary function 1 destroys the legitimacy of the memory segment, the electronic device can generate metadata search instruction 1 and boundary check instruction 1 according to the first memory access instruction 1 (an example of the first memory access instruction), and the electronic device can generate the second boundary check instruction 1 according to the second memory access instruction 1 (an example of the first memory access instruction). The electronic device generates metadata search instruction 2 (an example of the second metadata search instruction) and boundary check instruction 2 (an example of the second boundary check instruction) according to memory access instruction 2 (an example of the second memory access instruction), and generates boundary check instruction 3 (an example of the third boundary check instruction) according to memory access instruction 3 (an example of the third memory access instruction). Boundary check instruction 3 reuses the metadata found by metadata search instruction 2 for boundary check. If auxiliary function 1 destroys the legitimacy of the memory segment, the legitimacy of the address pointed to by reference 2 and reference 3 will be changed. For example, before calling the auxiliary function, references 1 to references 3 point to the memory segment of memory segment number 1. At this time, the metadata of memory segment number 1 is metadata 1. After calling the auxiliary function, the memory segment numbered 1 pointed to by references 1 to 3 may be recycled, so that the metadata of the memory segment numbered 1 pointed to by references 1 to 3 becomes metadata 2. Metadata 2 may not contain a valid memory segment address, and references 1 to 3 no longer point to a valid address. Memory access instructions need to look up metadata.

[0178] The sandbox manager's interface can be called within the auxiliary function to grant or revoke the sandbox program's access rights to a memory segment, thereby modifying the legality of the sandbox program's access to the memory segment. Therefore, the call of the auxiliary function will affect whether the metadata search results of two or more memory access instructions before and after can be reused.

[0179] The embodiment of the present application marks whether the auxiliary function will destroy the legitimacy of the memory segment pointed to by its parameters and / or whether it is possible to destroy the legitimacy of any memory segment. Therefore, in the scenario involving the memory access instruction calling the auxiliary function, it is judged whether the auxiliary function will destroy the legitimacy of the memory segment based on the annotation of the auxiliary function. If the call of the auxiliary function will not destroy the legitimacy of the memory segment, then for multiple memory access instructions with the same metadata, the electronic device only needs to obtain the metadata of one of the memory access instructions, and can perform boundary checks on multiple memory access instructions based on the metadata, without repeatedly obtaining the metadata of each instruction, thereby saving the resources of the electronic device. Using the solution of the present application, in the case where the boundary checks of the two dereference instructions before and after in the instruction stream cannot be merged, the program encoding process can also be optimized by reusing metadata search, thereby improving the compilation speed and saving electronic device resources.

[0180] The embodiment of the present application also provides a method for generating programmable sandbox instructions, which optimizes access to the static data segment of the sandbox program. The static data segment of the sandbox program is a frequently accessed memory segment. By optimizing access to the static data segment of the sandbox program, the overhead of the program's memory security mechanism is reduced, and the running performance of the sandbox program is improved. The execution process of the method is as follows:

[0181] S601. The electronic device obtains a programmable sandbox program.

[0182] S602: The electronic device allocates memory (such as a first memory space) for the static data segment of the programmable sandbox program.

[0183] After the electronic device receives the sandbox program, the loading process manager during the programmable sandbox runtime identifies the static data segment information of the sandbox program and allocates memory (such as the memory segment numbered 4) for the static data segment in the host memory space (such as the first memory space).

[0184] In some embodiments, the bytecode program includes initialization data of the static data segment, and the loading process manager fills the initial data into the memory of the static data segment and determines the starting address, ending address and memory segment length of the memory space of the static data segment (such as memory segment number 4).

[0185] S603. When the electronic device compiles a bytecode program, for a memory access instruction (an example of the fourth memory access instruction) whose access target is a static data segment, a machine instruction for boundary checking (an example of the fourth boundary checking instruction) is generated based on the metadata of the determined static data segment as a constant.

[0186] For example, refer to Fig.16 , the compiler can read from reference 4 that the host has allocated a memory segment with memory segment number 4 for the static data segment, and read the address of the static data segment, that is, the metadata of memory segment number 4 (such as reading the starting address and memory segment length of memory segment number 4, or reading the starting address and ending address, etc.), thereby generating a boundary check machine instruction based on the metadata of memory segment number 4.

[0187] The electronic device can set a fixed memory segment for storing static data segments, and identify whether the address accessed by the memory access instruction is a static data segment by the memory segment number. For example, the electronic device sets memory segments numbered 5 to 10 for storing static data segments. If the memory access instruction accesses the memory segment with memory segment number 6, the electronic device can determine that the memory segment is used to store static data segments. The electronic device reads the metadata of the memory segment with memory segment number 6 (such as the memory segment starting address and the memory segment length), and directly uses the metadata of the memory segment as the range of the memory segment address to generate a machine instruction for boundary checking.

[0188] Therefore, during the running of the sandbox program, the metadata search instruction corresponding to the memory access instruction whose access address is the static data segment may not be executed, and a boundary check may be performed directly based on known metadata, thereby reducing the running overhead of the sandbox program.

[0189] In some embodiments, the electronic device may not execute the above S603, that is, may not generate a machine instruction for boundary checking, but may execute S604.

[0190] S604: The electronic device determines that the value range of the offset of the location accessed by the memory access instruction in the static data segment does not exceed the length of the static data segment, and then generates a memory access instruction.

[0191] When the electronic device compiles a memory access instruction, it determines whether the offset of the memory access instruction whose access target is a static data segment exceeds the length of the static data segment. If the offset of the memory access instruction does not exceed the length of the static data segment, it will no longer compile and generate a boundary check instruction, but compile and generate a machine instruction for memory access.

[0192] For example, refer to Fig.16The compiler can determine whether the offset exceeds the range of the memory segment of memory segment number 4 based on the starting address of the memory segment of memory segment number 4 (e.g., 0X100FABC0), the memory segment length (e.g., 0X40), and the offset (e.g., 0X30) that have been obtained.

[0193] This solution performs boundary checks on memory access instructions that access static data segments with unchanged memory addresses during the compilation period of the sandbox program, thereby no longer generating boundary check machine instructions, so that the sandbox program has fewer execution processes during execution, thereby optimizing the sandbox program.

[0194] In some embodiments, if the offset of a memory access instruction that accesses a static data segment exceeds the length of the static data segment, no memory access machine instruction is compiled and generated.

[0195] The embodiment of the present application also provides a method for generating programmable sandbox instructions, which optimizes access to the stack memory of the sandbox program by creating an instance when loading the sandbox program, allocating stack memory for the instance, and performing a boundary check on the stack memory, so that the boundary check on the stack memory is reduced when the instance is running, reducing the overhead of the memory safety mechanism of the sandbox program and improving the running performance of the sandbox program. The execution process of the method is as follows:

[0196] S701. The electronic device obtains a programmable sandbox program.

[0197] The programmable sandbox program may be a bytecode program.

[0198] S702: The electronic device creates an instance for the bytecode program and allocates stack memory (an example of a first memory space) for the instance.

[0199] Exemplarily, the programmable sandbox runtime receives a bytecode program, creates an instance for the bytecode program, and allocates stack memory for the instance.

[0200] The instance may be one or more. When there are multiple instances, the loading process manager or the just-in-time compiler during the programmable sandbox runtime may create stack memories for the multiple instances. For example, the electronic device may create stack memory 1 for instance 1 and stack memory 2 for instance 2.

[0201] In some embodiments, the number of created instances can be obtained through a reserved interface. During the loading of the client program, the client program can call the interface and specify the number of instances.

[0202] In other embodiments, the host may continue to create instances for the sandbox program while running the sandbox program.

[0203] In other embodiments, the host may call a reserved interface to specify the number of instances.

[0204] S703: When compiling the sandbox program, the electronic device compiles the instance according to the stack memory corresponding to the instance.

[0205] When the compiler compiles a sandbox program, it performs a boundary check on the stack memory accessed by the memory access instruction. For the memory access instruction whose access target is the stack memory (an example of the fourth memory access instruction), a boundary check machine instruction (an example of the fourth boundary check instruction) is generated based on the stack memory.

[0206] Exemplarily, the compiler may determine, through a memory segment number in a reference of the memory access instruction, that the memory segment accessed by the memory access instruction is a stack memory.

[0207] For example, refer to Fig.16 , the compiler can read from reference 4 that the host has allocated a memory segment with memory segment number 4 for the stack memory, and read the address of the stack memory, that is, the metadata of memory segment number 4 (such as reading the starting address and memory segment length of the memory segment number 4, or reading the starting address and ending address, etc.), thereby generating a boundary check machine instruction based on the metadata of memory segment number 4.

[0208] When compiling a sandbox program, this solution compiles the sandbox program according to the address of the stack memory corresponding to the sandbox instance, and does not need to generate metadata search instructions. It can generate boundary check instructions according to the address already allocated for the stack memory. This saves resources consumed by the metadata search process and improves the processing performance of the sandbox program.

[0209] In some embodiments, the electronic device may not execute the above S703, that is, may not generate a machine instruction for boundary checking, but may execute S704.

[0210] S704: The just-in-time compiler determines that the value range of the offset of the location accessed by the memory access instruction in the stack memory does not exceed the length of the stack memory, and then generates a machine instruction for the memory access instruction.

[0211] The stack memory segment can store information related to local variables and function calls (such as local variables, function parameters, return addresses, etc.). The stack memory segment is created during program loading or program compilation, and during compilation, it is determined whether the stack memory accessed by the memory access instruction exceeds the length of the memory segment. If the offset of the memory access instruction does not exceed the length of the memory segment, no boundary check instruction is compiled and generated, and the machine instruction for accessing the stack memory is compiled.

[0212] This solution performs boundary checks on memory access instructions that access stack memory during the compilation period of the sandbox program, thereby no longer generating boundary check machine instructions, so that the sandbox program has fewer execution processes during execution, thereby optimizing the sandbox program.

[0213] In some embodiments, if the offset of a memory access instruction that accesses the stack memory exceeds the length of the memory segment, no memory access machine instruction for accessing the stack memory is compiled and generated.

[0214] The present application also provides a method for generating a programmable sandbox instruction. Fig.18 The method comprises the following steps:

[0215] S1801. The electronic device obtains M memory access instructions and auxiliary function call instructions of the programmable sandbox program.

[0216] The M memory access instructions are used to access the first memory segment, where M is an integer greater than 1. The auxiliary function call instruction is used to call an auxiliary function.

[0217] That is, each of the M memory access instructions accesses the same memory segment.

[0218] Exemplarily, when the electronic device compiles the sandbox program, it sequentially obtains instructions in the sandbox program, such as memory access instructions, auxiliary function call instructions, operation instructions, etc. In simple terms, there is a corresponding sequence between instructions (such as memory access instructions). For example, the sequence can be the compilation order of the instructions in the sandbox program.

[0219] In some embodiments, the M memory access instructions may be all memory access instructions of the programmable sandbox program, or may be part of the memory access instructions of the programmable sandbox program.

[0220] S1802. The electronic device generates, based on a first memory access instruction among the M memory access instructions, a first metadata search instruction corresponding to the first memory access instruction and a first boundary check instruction corresponding to the first memory access instruction.

[0221] S1803: If the auxiliary function will not change the validity of the first memory segment, the electronic device generates a second boundary check instruction corresponding to the second memory access instruction according to the second memory access instruction.

[0222] The second memory access instruction is a memory access instruction following the first memory access instruction among the M memory access instructions.

[0223] Exemplarily, the above-mentioned M memory access instructions and auxiliary function call instructions are bytecode instructions, and the first metadata search instruction, the first boundary check instruction and the second boundary check instruction are machine code instructions.

[0224] It should be noted that the above-mentioned multiple embodiments can be combined and the combined scheme can be implemented. Optionally, some operations in the process of each method embodiment are optionally combined, and / or the order of some operations is optionally changed. In addition, the execution order between the steps of each process is only exemplary and does not constitute a limitation on the execution order between the steps. There can also be other execution orders between the steps. It is not intended to indicate that the execution order is the only order in which these operations can be performed. Ordinary technicians in this field will think of many ways to reorder the operations of this article. In addition, it should be pointed out that the process details involved in a certain embodiment of this article are also applicable to other embodiments in a similar manner, or different embodiments can be used in combination.

[0225] Exemplarily, the above step S702 may include steps S502, S503 and S504. Further exemplary, the above step S602 may include steps S502, S503 and S504.

[0226] In addition, some steps in the method embodiment may be equivalently replaced by other possible steps. Alternatively, some steps in the method embodiment may be optional and may be deleted in certain usage scenarios. Alternatively, other possible steps may be added in the method embodiment. Alternatively, the execution subject (such as a functional module) of some steps in the method embodiment may be replaced by other execution subjects.

[0227] Furthermore, the above method embodiments may be implemented separately or in combination.

[0228] It is understandable that in order to implement the functions in the above embodiments, the electronic device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and method steps of each example described in the embodiments disclosed in this application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application scenario and design constraints of the technical solution.

[0229] Some other embodiments of the present application provide a device, which may be the above-mentioned electronic device, etc. The device may include: a memory and one or more processors. Optionally, the device may also include a display screen. The display screen, the memory and the processor are coupled. The memory is used to store computer program code, and the computer program code includes computer instructions. When the processor executes the computer instructions, the device may execute the various functions or steps executed by the corresponding device in the above-mentioned method embodiment. The structure of the device can be seen in Fig.19 The electronic device (device) shown.

[0230] The core structure of the device can be expressed as Fig.19 In the structure shown, the device includes: a processing module 1301, a storage module 1303 and an input module 1302.

[0231] The processing module 1301 may include at least one of a central processing unit, an application processor (AP) or a communication processor (CP). The processing module 1301 may perform operations or data processing related to the control and / or communication of at least one of other elements of the user electronic device. Specifically, the processing module 1301 may be used to control the content displayed on the main screen according to certain trigger conditions. The processing module 1301 is also used to process input instructions or data and determine the display style according to the processed data.

[0232] The storage module 1303 may include a volatile memory and / or a non-volatile memory. The storage module is used to store at least one instruction or data related to other modules of the user device. Specifically, the storage module may record information related to processes, services, businesses, and submodules.

[0233] The input module 1302 is used to obtain the instructions or data input by the user and / or obtain the instructions or data from other devices, and transmit the obtained instructions or data to other modules of the electronic device. Specifically, the input mode of the input module 1302 may include touch, gesture, approaching the screen, etc., or voice input. For example, the input module may be the screen of the electronic device, obtain the user's input operation and generate an input signal according to the obtained input operation, and transmit the input signal to the processing module 1301.

[0234] In some other embodiments, the device further includes a display module 1304. The display module 1304 may include, for example, a liquid crystal display (LCD), a light emitting diode (LED) display, an organic light emitting diode (OLED) display, a micro-electromechanical system (MEMS) display, or an electronic paper display, and is used to display content (e.g., text, images, videos, icons, symbols, etc.) that can be viewed by a user.

[0235] In other embodiments, the device also includes a communication module 1305 for supporting the device to communicate with other devices (through a communication network). For example, the communication module can be connected to a network via wireless communication or wired communication to communicate with other devices or network servers. Wireless communication can use at least one of cellular communication protocols, such as long-term evolution (LTE), advanced long-term evolution (LTE-A), code division multiple access (CDMA), wideband code division multiple access (WCDMA), universal mobile telecommunications system (UMTS), wireless broadband (WiBro) or global mobile communication system (GSM). Wireless communication may include, for example, short-range communication. Short-range communication may include at least one of wireless fidelity (Wi-Fi), Bluetooth, near field communication (NFC), magnetic stripe transmission (MST) or GNSS. The device can obtain programmable sandbox programs of other devices from client devices through the communication module to implement the host program's call to the programmable sandbox program. Exemplarily, the communication module 1305 can obtain instructions or data from other devices and transmit them to the input module 1302.

[0236] The present application also provides a chip system, such as Fig. 20 As shown, the chip system includes at least one processor 1401 and at least one interface circuit 1402. The processor 1401 and the interface circuit 1402 can be interconnected via lines. For example, the interface circuit 1402 can be used to receive signals from other devices (such as a memory of an electronic device). For another example, the interface circuit 1402 can be used to send signals to other devices (such as processor 1401). Exemplarily, the interface circuit 1402 can read instructions stored in the memory and send the instructions to the processor 1401. When the instructions are executed by the processor 1401, the electronic device can execute the various steps in the above embodiments. Of course, the chip system can also include other discrete devices, which are not specifically limited in the embodiments of the present application.

[0237] An embodiment of the present application also provides a computer storage medium, which includes computer instructions. When the computer instructions are executed on the above-mentioned electronic device, the electronic device executes each function or step executed by the mobile phone in the above-mentioned method embodiment, or the electronic device executes each function or step executed by the vehicle computer in the above-mentioned method embodiment.

[0238] An embodiment of the present application also provides a computer program product. When the computer program product is run on a computer, the computer is enabled to execute each function or step executed by the mobile phone in the above method embodiment, or the computer is enabled to execute each function or step executed by the vehicle computer in the above method embodiment.

[0239] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0240] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0241] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0242] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0243] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0244] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application shall be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

[0245] The terms "first" and "second" in the specification and drawings of this application are used to distinguish objects, or to distinguish the processing of the same object. The words "first" and "second" can distinguish the same or similar items with basically the same functions and effects. For example, the first device and the second device are only used to distinguish different devices, and their order is not limited. Those skilled in the art can understand that the words "first" and "second" do not limit the quantity and execution order, and the words "first" and "second" do not necessarily limit them.

[0246] "At least one" means one or more, and "plurality" means two or more.

[0247] "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or plural.

[0248] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0249] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

Claims

1. A method for generating a programmable sandbox instruction, characterized in that: include: Obtaining M memory access instructions and auxiliary function calling instructions of the programmable sandbox program, wherein the M memory access instructions are used to access the first memory segment, where M is an integer greater than 1; and the auxiliary function calling instructions are used to call an auxiliary function; According to a first memory access instruction among the M memory access instructions, generating a first metadata search instruction corresponding to the first memory access instruction and a first boundary check instruction corresponding to the first memory access instruction; If the auxiliary function will not change the validity of the first memory segment, then generate a second boundary check instruction corresponding to the second memory access instruction based on the second memory access instruction; the second memory access instruction is the memory access instruction after the first memory access instruction among the M memory access instructions.

2. The method according to claim 1, characterized in that Also includes: executing the second boundary checking instruction according to the first metadata found by the first metadata finding instruction; The first metadata includes the address of the first memory segment to which the M memory access instructions are allocated.

3. The method according to claim 1, characterized in that: Also includes: If the auxiliary function will change the validity of the first memory segment, a second metadata search instruction and a second boundary check instruction corresponding to the second memory access instruction are generated according to the second memory access instruction.

4. The method according to claim 3, characterized in that: Also includes: If the auxiliary function will change the validity of the first memory segment, then generate a third boundary check instruction corresponding to the third memory access instruction according to the third memory access instruction; the third memory access instruction is a memory access instruction after the second memory access instruction in the M memory access instructions; Execute the third boundary check instruction according to the second metadata found by the second metadata search instruction; The second metadata includes the address of the first memory segment of the M memory access instructions after the auxiliary function is executed.

5. The method according to any one of claims 1 to 4, characterized in that: The auxiliary function includes a label, and the label is used to indicate whether calling the auxiliary function will change the validity of the memory segment; The method further includes: determining, according to the annotation of the auxiliary function, whether the auxiliary function will change the validity of the first memory segment.

6. The method according to any one of claims 1 to 5, characterized in that: If the auxiliary function does not call the sandbox runtime interface for canceling the authorization of the memory segment, the auxiliary function will not change the validity of the first memory segment.

7. The method according to any one of claims 1 to 6, characterized in that: The first metadata includes one or more of the following data: a start address of the first memory segment, an end address of the first memory segment, and a size of the first memory segment.

8. The method according to any one of claims 1 to 7, characterized in that: Before obtaining the M memory access instructions of the programmable sandbox program, the method further includes: obtaining the programmable sandbox program and creating an instance for the programmable sandbox program; Allocating a first memory space for the instance, wherein the M memory access instructions are memory access instructions of the instance; After obtaining the M memory access instructions of the programmable sandbox program, the method further includes: generating a fourth boundary check instruction for a fourth memory access instruction, wherein the fourth boundary check instruction includes the first memory space, or A boundary check is performed on the fourth memory access instruction according to the first memory space, and the fourth boundary check instruction is a memory access instruction among the M memory access instructions.

9. The method according to claim 8, characterized in that The first memory space includes a stack memory, and the fourth memory access instruction accesses the stack memory; The generating of the fourth boundary check instruction of the fourth memory access instruction comprises: generating the fourth boundary check instruction according to the address of the stack memory; The fourth boundary check instruction includes the address of the stack memory.

10. The method according to claim 8 or 9, characterized in that: The first memory space includes a static data segment, and the fourth memory access instruction accesses the static data segment; The generating of the fourth boundary check instruction of the fourth memory access instruction comprises: generating the fourth boundary check instruction according to the address of the static data segment, wherein the fourth boundary check instruction comprises the address of the static data segment.

11. A device, characterized in that: include: A processor, the processor is coupled to a memory, and the processor is used to execute a computer program stored in the memory, so that the device performs the method according to any one of claims 1 to 10.

12. A computer-readable storage medium, characterized in that: The method comprises computer instructions, and when the computer instructions are executed on an electronic device, the electronic device executes the method according to any one of claims 1 to 10.

Images