Processor

Abstract

The invention provides a processor. The processor comprises an execution module and a memory checking module, in response to a calling operation of a first function on a second function in the application program, the execution module is used for executing the access constraint instruction generated by the compiler and determining a security execution strategy; when the second function is executed, the memory checking module is used for analyzing the access address of the second function according to the security execution strategy to obtain an analysis result and controlling execution of the second function according to the analysis result. Therefore, an isolation means with finer granularity is realized. In addition, the security isolation means is quick to execute and does not need to fall into a kernel mode, so that the performance is relatively high, and the response is relatively quick.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more particularly to a processor. Background Technology

[0002] The programming languages ​​used in the underlying software stack expose many programming details to facilitate flexible manipulation of the underlying hardware. These include direct pointer manipulation, arbitrary modification of stack contents, and unrestricted use of inline assembly. While this brings ease of use, it also poses significant security risks to the system.

[0003] Among the relevant technologies, Solution 1 can use process isolation technology to solve the security problem, making processes independent of each other; Solution 2 can use virtualization technology to achieve intra-process isolation, thereby solving the security problem.

[0004] However, Option 1 results in significant performance loss and a long response time; Option 2 requires entering kernel mode and can only achieve container-level protection, making its protection granularity relatively coarse and its operating overhead relatively large. Summary of the Invention

[0005] In view of the above problems, embodiments of the present invention are proposed to provide a processor that overcomes or at least partially solves the above problems.

[0006] In a first aspect, embodiments of the present invention disclose a processor, the processor comprising: Execution module and memory check module; In response to a call operation from a first function to a second function in an application, the execution module is used to execute access constraint instructions generated by the compiler and determine a safe execution strategy; When the second function is executed, the memory checking module is used to analyze the access address of the second function according to the secure execution policy, obtain the analysis result, and control the execution of the second function according to the analysis result.

[0007] Secondly, embodiments of the present invention also disclose a processor, comprising: The decoder decodes the access constraint instruction, including the opcode, according to the access constraint instruction. The access constraint instruction also includes a first operand that identifies a general-purpose register and a second operand that represents the security domain information of the callee. General-purpose registers store the memory addresses of the parameters to be passed to the callee; The CSW table is used to record the security domain information that the callee is allowed to access. The execution circuit executes the decoded instructions, reads the storage address in the general-purpose register, writes the storage address into the CSW table in association with security domain information, and allows or denies the callee's memory access based on the information in the CSW table.

[0008] Thirdly, embodiments of the present invention also disclose a processor, comprising: The decoder decodes the ICall instruction, including the opcode, and the ICall instruction also includes a third operand for specifying the entry address of the callee; The first security domain status register stores the current security domain identifier; The second security domain status register stores the security domain identifier of the callee; The execution circuit executes the decoded instructions, updates the first security domain status register to the newly allocated security domain identifier of the callee, and switches the pointer of the CSW table to the entry associated with the newly allocated security domain identifier, thus completing the security domain switch.

[0009] Fourthly, embodiments of the present invention also disclose a processor, comprising: The decoder decodes the IRet instruction based on the IRet instruction, including the opcode. The third security domain status register stores the current security domain identifier; The fourth security domain status register stores the security domain identifier of the callee; The execution circuit executes the decoded instructions, updates the third security domain status register to the caller's security domain identifier, switches the pointer of the CSW table to the entry associated with the caller's security domain identifier, and releases the callee's security domain identifier from the fourth security domain status register, thus completing the exit from the security domain.

[0010] Fifthly, embodiments of the present invention also disclose an electronic device, including: a processor.

[0011] In this embodiment of the invention, regarding the function call process, when jumping to the called second function, the processor can execute access constraint instructions generated by the compiler to determine a safe execution policy. Subsequently, the execution process of the second function is constrained by the safe execution policy, ensuring that the execution of the called second function is safe and reliable compared to the first function, which is the caller, and that they do not interfere with each other. This embodiment of the invention can provide a relatively isolated safe execution environment for application execution at the function call granularity, thereby achieving a finer-grained isolation method. Furthermore, the safe isolation method of this invention executes quickly, without needing to enter kernel mode, thus achieving high performance and a rapid response. Attached Figure Description

[0012] Figure 1 This is a block diagram of a processor provided in an embodiment of the present invention; Figure 2 This is a flowchart illustrating the steps of a function calling method provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of a CSW table provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of code execution provided by an embodiment of the present invention; Figure 5 This is another code execution diagram provided by an embodiment of the present invention; Figure 6 This is a block diagram of another processor provided in an embodiment of the present invention; Figure 7 This is a block diagram of another processor provided in an embodiment of the present invention; Figure 8 This is a block diagram of another processor provided in an embodiment of the present invention. Detailed Implementation

[0013] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0014] The terms "first," "second," etc., used in the specification and claims of this invention are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, the first object can be one or more. Furthermore, the term "and / or" in the specification and claims is used to describe the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. In embodiments of this invention, the term "multiple" refers to two or more, and other quantifiers are similar.

[0015] The concepts involved in this invention are explained below.

[0016] Context Strains Windows (CSWs) are objects consisting of a set of register or cache entries managed and maintained by the hardware. Each entry is dynamically created at function call time and defines the range (base address, size) and access attributes (read, write) of a contiguous memory region that the called function is explicitly allowed to access outside its own security domain context. It is the core hardware mechanism for enabling secure data sharing across security domains in a fine-grained memory isolation environment. In simpler terms, the CSW table defines the external memory regions that functions within the current security domain are allowed to access that do not belong to their own security domain.

[0017] Memory Check Unit (MCU): A dedicated hardware security coprocessor integrated into the CPU memory access path. It consists of multiple independent units responsible for executing multiple security check rules in parallel during each memory access (Load / Store) operation.

[0018] Security Critical Data (SCD): This refers to data that, if maliciously modified, would compromise the system's security attributes. It is also the core data object protected by this invention. Examples include: function return addresses, function pointers, virtual function tables, permission flags, and encryption keys.

[0019] The Global Domain Manager (GDM) is a unit included in the MCU. Its main responsibility is to check whether the Global Function Identifier (GFID) of the current security domain matches the security domain identifier of the memory page to be accessed. It is also responsible for managing the initialization of the GFID register.

[0020] The Context Strains Windows Manager (CSWM) is a unit included in the MCU that manages and inspects secure access to cross-domain data sharing. The CSWM is specifically responsible for managing the Context Strains Windows (CSW) table. This includes handling access constraint instructions to add CSW table entries, handling function calls toggling or clearing the CSW table, interacting with the kernel to swap in and out entries when the CSW table overflows, and checking whether each memory access falls within any memory window defined by the CSW table.

[0021] The Global Data and Stack Pointer Manager (G&PM) is a unit included in the MCU. Its core responsibility is to protect the integrity of the stack and manage access to global data. It monitors stack pointer operations, ensuring that functions can only access their own stack frame space and preventing them from tampering with the caller's stack (especially the return address). It also maintains a view of global data accessibility.

[0022] The Compare and Check Manager (CCM) acts as the decision center of the MCU, aggregating the conclusions of all other units and issuing a final pass or block instruction. The CCM receives preliminary check results from the GDM, CSWM, and G&PM units and makes a final comprehensive judgment. Only if all unit checks pass will it allow the memory access to continue; if any unit reports a violation, the CCM will immediately trigger a hardware exception.

[0023] Global Function Identifier (GFID): A globally unique security domain identifier. It is a numerical label implemented and managed at the hardware level, whose main function is to dynamically bind physical memory pages to specific, isolated secure execution environments (i.e., "domains").

[0024] refer to Figure 1 , Figure 1 The diagram illustrates a structural block diagram of a processor provided by an embodiment of the present invention, including an execution module and a memory checking module.

[0025] In response to a call from a first function to a second function in the application, the execution module executes the access constraint instructions generated by the compiler to determine a safe execution strategy.

[0026] When the second function is executed, the memory check module is used to analyze the access address of the second function according to the safe execution policy, obtain the analysis results, and control the execution of the second function based on the analysis results.

[0027] To address the issues of high isolation performance overhead and coarse isolation granularity in related technologies, embodiments of this invention provide a processor employing a finer-grained isolation method. This method uses function calls as isolation boundaries. Compared to the isolation of the entire virtualization container in related technologies, this invention provides a finer-grained isolation means, namely, triggering an isolation response when the first function in the application calls the second function, thereby imposing security constraints on memory access during the execution of the second function.

[0028] In this embodiment of the invention, intra-process isolation is implemented. Intra-process isolation refers to the situation where, within a single process, the execution results of some called functions are unknown. For example, a call to an insecure library (such as a typical .so file in Linux) or the execution of a code snippet that maliciously tampers with core data is possible. Therefore, a relatively secure environment needs to be provided to ensure that calling an insecure function does not affect the original sensitive data of the current process.

[0029] First, this invention introduces GFID to identify memory security domains. GFID is a hardware concept whose value is stored in a specific processor register (such as GFIDR) and encoded into reserved bits of the Page Table Entry (PTE) of the memory management unit. Each assigned GFID value (e.g., 5, 100, 2001) uniquely identifies a security domain in memory. A security domain is typically an independent environment created for a single function call. This invention can implement up to 4096 relatively independent security domain spaces in memory. These spaces can be adjacent or span multiple domains, offering flexible application. Furthermore, GFID is the core basis for permission judgment by the memory checking module. During each memory access, the memory checking module compares the GFID (current security domain) of the called second function with the GFID (page tag) of the accessed page; if they do not match, access is denied. That is, this invention can add a 12-bit GFID to the hardware page table. During each memory allocation, the page table is set according to the global GFIDR register. Those without the necessary permissions cannot access other isolated spaces, thus achieving a distinction between memory-safe domains and untrusted domains.

[0030] Specifically, when a function in an application calls a second function, the compiler can generate constraint access instructions. Constraint access instructions are a set of special instructions supported by the processor, explicitly used to define and manage security domains and their resource access permissions. They constitute the operating language for hardware-software co-security. By generating these instructions, the compiler declares the security intent of the function call to the processor, which is then responsible for executing these constraint access instructions. Furthermore, these constraint access instructions can have a dedicated execution pipeline, thereby reducing performance overhead.

[0031] When the processor's execution module executes the constraint access instruction, it can determine the safe execution policy. The safe execution policy is a set of dynamic and temporary safety rules formed by the processor after executing the access constraint instruction and enforced by the memory check module. During the execution of the safe execution policy, the memory check module can analyze the access address of the second function according to the safe execution policy, obtain the analysis results, and control the execution of the second function according to the analysis results, that is, allow access or disallow access.

[0032] A secure execution policy is not a static configuration, but a security context maintained by a hardware state machine that evolves continuously as the function call chain unfolds and returns. Its core purpose is to limit the "scope of capabilities" of the currently executing function (the second function), implementing the principle of least privilege.

[0033] In some implementations, the secure execution policy encompasses multiple aspects, such as: Identity policy: It restricts the second function that is called to access memory pages whose labels match its own GFID.

[0034] Data sharing strategy: It restricts the second function that is called to access only the address range explicitly listed in the CSW table, and the access method (read / write) must conform to the attributes of the record in the CSW table.

[0035] Control flow protection strategy: It restricts the called second function to operate only on its own stack frame space and must not destroy the caller's stack structure (such as the return address).

[0036] Global policy: restricts all domains to read-only access to certain global configuration data.

[0037] Reference Figure 2 A method for calling functions in a compiler according to an embodiment of the present invention is provided, including: Step 101: In response to the call operation of the first function to the second function in the application, determine the parameter type of the parameter passed to the first function.

[0038] Step 102: Generate an access constraint instruction that matches the parameter type, execute the access constraint instruction, and record the access strategy of the transmitted parameter.

[0039] Step 103: When executing the second function, access the passed parameters according to the access strategy.

[0040] In this embodiment of the invention, for steps 101-103, when the compiler parses the source code and encounters a function call, it triggers the corresponding security management policy. At this time, the compiler does not immediately generate ordinary call instructions, but starts a security analysis process: determining the parameter type of the first function's passed parameters, generating access constraint instructions that match the parameter type, executing the access constraint instructions, and recording the access policy of the passed parameters.

[0041] The compiler identifies function calls that require security analysis by analyzing specific function attributes of the called function. These specific function attributes (such as __attribute__((secure_call))) are added by the developer in advance in the function declaration of the untrusted function. That is, when a function with this specific function attribute is called, the compiler will automatically perform the security analysis process based on this specific function attribute.

[0042] Furthermore, ensuring relative independence while the parent function passes data to the called function is one of the main security concerns in the design. That is, when the first function calls the second function, the parent function passes parameters to the called second function (e.g., the parent function passes a data pointer to the called function via parameters such as `void B(int* ptr)`). These parameters can be understood as defining the data that the parent function allows the called function to access, thus defining which external data from the parent function the called function can access.

[0043] Optionally, the access constraint instruction includes: a pointer to the passed parameter and an immediate value, wherein the immediate value is used to characterize the storage address range and access attributes of the passed parameter, and the allowed access address range is used to characterize the address range of the memory segment where the passed parameter is stored; the pointer is used to characterize the storage address of the passed parameter.

[0044] During the security analysis process, the compiler first determines the parameter type of the passed parameters and generates access constraint instructions based on the parameter type. This is because passed parameters can have two different types: 1. The data structure has no pointer members; 2. The data structure contains nested pointer members. Different access constraint instructions are generated for different parameter types, resulting in different access strategies for the passed parameters determined by these instructions. The access constraint instructions define the access strategy for the corresponding passed parameter, including the pointer to the passed parameter and an immediate value. The immediate value characterizes the storage address range and access attributes of the passed parameter; the allowed access address range characterizes the address range of the memory segment storing the passed parameter; the pointer characterizes the storage address of the passed parameter.

[0045] Furthermore, after the compiler generates access constraint instructions that match the parameter types, the processor can execute these instructions to record the access strategy for the passed parameters. Specifically, the access strategy defined in the access constraint instructions can be recorded in the CSW table as an entry. When the second function is executed subsequently, the MCU can decide to execute the memory access operation of the second function if it determines that the memory access address of the second function is within the memory segment constrained by an entry in the CSW table. If it determines that the memory access address of the second function is not within the memory segment constrained by any entry in the CSW table, it decides not to execute the memory access operation of the second function. This achieves a safe access mechanism, ensuring the relative independence of the parent function and the called function while the parent function passes data to the called function. The called function can access the memory space constrained by the parent function, thereby reducing unsafe data access.

[0046] In summary, in this embodiment of the invention, regarding the function call process, when jumping to the called second function, the processor can execute access constraint instructions generated by the compiler to determine a safe execution policy. Subsequently, the execution process of the second function is constrained by the safe execution policy, ensuring that the execution of the called second function is safe and reliable from the perspective of the first function as the caller, and that they do not interfere with each other. This embodiment of the invention can provide a relatively isolated safe execution environment for application execution at the function call granularity, thereby achieving a finer-grained isolation method. Furthermore, the safe isolation method of this invention executes quickly, without needing to enter kernel mode, thus achieving high performance and a rapid response.

[0047] Optional, refer to Figure 1 The memory inspection module includes multiple inspection units and comparison units; different inspection units correspond to different security execution strategies. The inspection unit is used to analyze the access address of the second function according to the corresponding security execution policy, obtain the analysis result, and send the analysis result to the inspection comparison unit; The comparison unit is used to control the execution of the second function based on the detection results of each of the plurality of inspection units.

[0048] In this embodiment of the invention, each inspection unit has a corresponding security execution policy. A security execution policy reflects a judgment condition for secure memory access under a corresponding dimension. For example, under the global domain access dimension, the corresponding judgment condition is used to determine whether a function is accessing its own stack frame space; under the constraint window access dimension, the corresponding judgment condition is used to determine whether a function is accessing the memory space recorded in the CSW table; under the security domain access dimension, the corresponding judgment condition is used to determine whether the security domain identifier of the current security domain matches the security domain identifier of the memory page to be accessed.

[0049] The Comparison Unit (CCM) acts as the decision center of the MCU. It connects to each inspection unit and receives their analysis results. The CCM processes these results, and if all inspection units' results meet the requirements of their respective security execution policies, it allows memory access to the currently invoked second function. If any inspection unit reports a violation, the CCM immediately triggers a hardware exception and prevents memory access to the currently invoked second function.

[0050] Optional, refer to Figure 1 The multiple inspection units include: the Constraint Window Management Unit (CSWM), the Domain Management Unit (GDM), and the Global Management Unit (G&PM). The constraint window management unit is used to compare the access address of the second function with the CSW table to obtain the first detection result; The global management unit is used to compare the access address of the second function with a preset global memory segment to obtain a second detection result; the global memory segment is configured to be accessible by all functions. The domain management unit is used to detect whether the second function is running in the target security domain and obtain a third detection result. The target security domain is a memory area allocated to the second function by the constraint window management unit.

[0051] In this embodiment of the invention, the constraint window management unit is primarily responsible for maintaining the CSW table. If a memory request is needed, it initiates a memory access request to the next lower-level cache. Secondly, the constraint window management unit maintains CSW pointers and is also responsible for monitoring function calls. The constraint window management unit has a built-in CAM table that stores the contents of the current CSW. The safe execution strategy of the constraint window management unit is to determine whether the called second function accesses the memory space recorded in the CSW table entry. If so, a first detection result indicating that the check has passed is generated; otherwise, a first detection result indicating that the check has failed is generated.

[0052] Optionally, the access constraint instruction defines the memory window accessible to the second function; the secure execution policy includes: allowing the second function to access data in the accessible memory window; the execution module is specifically used to execute the access constraint instruction and add the memory window accessible to the second function to the CSW table by calling the constraint window management unit.

[0053] Optionally, if the CSW table does not have any free entries, the constraint window management unit is used to: call the kernel to encrypt at least some of the historical entries in the CSW table and move them to a preset memory segment to obtain new free entries; and add the memory window accessible by the second function to the new free entries in the CSW table.

[0054] The CSW table is an object consisting of register or cache entries managed and maintained by the hardware. Each entry is dynamically created during a function call and defines the range (base address, size) and access attributes (read, write) of a contiguous memory region that the called function is explicitly allowed to access outside its security domain context. The CSW table primarily serves as an access window for interaction between security domains. Each time a function switches security domains, the pointer parameters passed, along with the associated memory size and attribute values, are stored here. Its specific structure is as follows: Figure 3 As shown: Before a function call occurs and the security domain is switched, the compiler analyzes the parameters required to enter the called second function. At this time, the compiler generates access constraint instructions that match the parameter types of the passed parameters, such as: Ciprii a0, imm_attri; Access constraint instructions create an entry in the CSW table, recording the access policy for passed parameters. This entry indicates which second functions are allowed to access the passed parameters according to the requirements recorded in the entry. When creating an entry in the CSW table, relevant registers can be set simultaneously. Figure 3 As shown in the diagram. If the passed parameter is not a single pointer parameter, pointer-related metadata also needs to be loaded. When the compiler has finished analyzing all the parameters, it releases the ICall instruction (used to put the called second function into a security domain), at which point the pointer of the CSW table points to a new entry. When the IRet instruction (used to put the called second function out of a security domain) is used, the original pointer is restored. Considering that the memory design of this embodiment supports a maximum of 4096 security domains, the size of the CSW table can be set to 128 entries. If the CSW table is full, previous entries can be written to memory, and when an empty CSW entry appears, it can be read from memory.

[0055] Each time a CSW requests memory, it is saved as a complete CSW. For example, if five parameters are passed when switching to a security domain, all five entries need to be written at once. To support unequal numbers of parameters, the first entry stored in memory must be the current number of CSWs, which allows for prefetching during subsequent CSW memory requests. Furthermore, for design security, the location of the CSW table in memory is inaccessible and unmodifiable by user space. When the kernel creates a process, it allocates memory space for the CSW table; this space is modifiable and readable only by the kernel. If a CSW requests memory and finds this space full, an exception is triggered, and other memory is allocated.

[0056] The constraint window management unit in this embodiment of the invention can be used to manage the CSW table. When processing the ICall instruction, the constraint window management unit can switch the CSW table pointer to point to the corresponding entry. When processing the IRet instruction, it can clear the entries in the CSW table. Besides the above functions, the constraint window management unit is mainly used to execute the corresponding safe execution policy. That is, each time the called second function initiates memory access, the access address of the called second function is compared with the CSW table to determine whether the memory access address falls into the memory space corresponding to any entry in the CSW table, thus obtaining a first detection result.

[0057] For example, if the called second function initiates a write operation (STORE) at memory address 0x4000_0100, the constraint window management unit can traverse the CSW table and check whether memory address 0x4000_0100 falls within a window of the CSW table. After checking, if it is found that memory address 0x4000_0100 falls within the range (0x4000_0000 to 0x4000_1FFF) of Entry1 table entry in the CSW table, and the attribute of this table entry is RW (read and write), which matches STORE (write operation), then the first detection result can be that the detection is passed.

[0058] Optionally, the global management unit is also used for: Record the stack space of the second function, and configure the second function to only allow access to the stack space of the second function, prohibit the second function from modifying the stack space of the first function, and prohibit operation on the stack space adjacent to the second function.

[0059] Furthermore, the Global Management Unit (GMU) is primarily responsible for monitoring the information of the current stack frame and maintaining the global address space accessibility table. This table mainly provides an accessibility window for global data variables. In other words, the core responsibility of the GMU is to protect the integrity of the stack and manage access to global data. By monitoring stack pointer operations, it ensures that the called second function can only access its own stack frame space, preventing it from tampering with the caller's stack (especially the return address).

[0060] First, when the global management unit executes its corresponding security execution policy, it can check whether the called second function is accessing global data, compare the access address of the second function with the preset global memory segment, and obtain the second detection result.

[0061] For example, the address range of the global read-only data area .rodata is [0x2000_0000, 0x2001_0000]. If the called second function initiates a memory access operation at memory address 0x2000_1234, the global management unit can recognize that memory access address 0x2000_1234 is within the address range of the global read-only data area .rodata: [0x2000_0000, 0x2001_0000]. In this case, it is determined that the called second function is accessing global data, and this access is safe. The check of the global access item can be set to pass in the second detection result.

[0062] Furthermore, when executing its corresponding secure execution policy, the global management unit can also perform security checks on the stack space accessed by the second function. Specifically, the global management unit configures the second function to only allow access to its own stack space, prohibiting the second function from modifying the first function's stack space and from operating on stack spaces adjacent to the second function. This ensures that the called second function can only operate within its own dedicated stack frame, which is the last line of hardware defense against control flow hijacking attacks.

[0063] Specifically, when the Global Management Unit performs stack checks, whenever the processor enters the security domain of the called second function via the ICall instruction, the processor hardware automatically records the value of the stack pointer at that time and, based on compilation information or fixed rules, defines a legal stack frame range for the function: [SP_upper_bound,SP_lower_bound] This range defines the stack boundaries of the second function.

[0064] Subsequently, during the execution of this second function, the target address of each memory access will be sent to the global management unit for judgment to determine whether the memory access exceeds the constraint boundary of the stack space.

[0065] For example, suppose the security domain of the second function is GFID=5; the current stack frame range registered by the global management unit is [0x8001_F00, 0x8002_000]; and the instruction being executed by the second function is swa1,8(sp) (writing the value of register a1 to the address sp+8). The internal decision-making process of the global management unit includes: First, address classification: The global management unit receives the target address 0x8001_FF8 (assuming SP=0x8001_FF0, SP+8=0x8001_FF8). Then, the global management unit determines whether the target address belongs to the stack address. The global management unit has a built-in judgment logic that knows the stack is usually located in a specific region of the virtual address space (e.g., the high-order bits of the address are 0x8...). When it finds the target address 0x8001_FF8 within this range, it determines that this is a stack access.

[0066] The global management unit then performs a boundary check: comparing the target address 0x8001_FF8 with the currently registered stack frame boundary [0x8001_F00, 0x8002_000].

[0067] If 0x8001_F00 <= 0x8001_FF8 <= 0x8002_000, the target address is determined to be within the legal range. The global management unit allows this memory access and outputs PASS.

[0068] Examples of violations of stack access rules are provided below: Suppose malicious code attempts to modify the return address via a stack overflow. The return address is usually stored in the caller's stack frame, such as address 0x8002_008.

[0069] When the global management unit receives address 0x8002_008, it first determines that it is a stack access, and then compares it with the current boundary [0x8001_F00, 0x8002_000], and finds that: If 0x8002_008 > 0x8002_000, it is determined that the boundary has been exceeded. The global management unit immediately outputs FAIL-StackBoundaryViolation and sends this result to the comparison unit to trigger an exception.

[0070] The domain management unit will now be described in detail: The Domain Management Unit (DMU) is primarily used to check whether the Current Security Domain ID (GFID) of the called second function matches the GFID of the security domain to which the memory page to be accessed belongs. It also manages the initialization of the GFID register. The DMU provides the most basic and stringent isolation boundary, ensuring that the called second function executes within its own security domain.

[0071] Optionally, the domain management unit is specifically used to: obtain the target security domain identifier allocated to the second function, and compare whether the target security domain identifier is consistent with the security domain identifier of the memory segment to be accessed by the memory access address of the second function; if they are consistent, it is determined that the second function is running in the target security domain; if they are inconsistent, it is determined that the second function is not running in the target security domain.

[0072] The target security domain identifier assigned to the second function can be obtained by incrementing the security domain label of the first function.

[0073] For example, suppose the target security domain identifier GFID allocated to the second function is 5, and the memory access address of the second function is 0x4000_1000. After querying the page table, it is determined that the security domain identifier GFID of the memory segment accessed by the memory segment accessed by the memory segment 0x4000_1000 is 3. Then, the target security domain identifier GFID=5 allocated to the second function is inconsistent with the security domain identifier GFID=3 of the memory segment accessed by the second function. Therefore, the domain management unit outputs the third detection result as failed.

[0074] It should be noted that ensuring the independence of the isolated spaces is key to achieving this independence. This embodiment of the invention ensures that function executions do not interfere with each other, based on memory usage during program execution. First, function execution needs to guarantee data access in three areas: 1. Global data variables, stored in the executable file's data segment, thus ensuring accessibility during program initialization. 2. The stack space for function execution, which needs to store parameter passing, temporary variables, data temporarily stored in the stack due to limited instruction set registers, and critical information such as the stack pointer and function return address. 3. Memory dynamically allocated during execution, such as through malloc or related interfaces, ultimately allocated via system calls mmap or brk.

[0075] Optionally, the execution module is specifically used to call the domain management unit to allocate a corresponding target security domain for the second function when executing the ICall instruction generated by the compiler, so that the second function can be executed in the target security domain, wherein the target security domain is a memory segment allocated to the second function by the constraint window management unit; The constraint window management unit is also used to execute the IRet instruction generated by the compiler when the second function is completed, cancel the target security domain of the second function, and switch to the target security domain of the first function.

[0076] In this embodiment of the invention, the compiler designs and develops the ICall and IRet instructions (user-level instructions). ICall is an instruction that controls entry into the target security domain of the called second function, and IRet is an instruction that unregisters from the target security domain of the second function. The IRet instruction executes after the ICall instruction, and the ICall instruction executes after the ciprii or ciprr instruction. These two instructions, in addition to normal function calls and returns, can also switch execution environments. Compared to other isolation methods in related technologies, using ICall and IRet instructions allows for rapid switching without entering a privileged state, thus resulting in higher performance.

[0077] Specifically, when the execution module executes ICall, it can first call the domain management unit to allocate the corresponding target security domain for the second function, then switch to the target security domain and set the basic environment parameters for the target security domain (such as initializing some register states), and set it to only allow the second function to access the global data area (a common area that all functions can use) and the stack space that it will use.

[0078] When the execution module executes IRet, the hardware first automatically exits the target security domain and switches back to the caller's (first function's) security domain, then clears the temporary access permissions of the target security domain. Because ICall / IRet are ordinary user-mode instructions, they are executed directly and quickly by the processor hardware, without needing to run to the operating system kernel (privileged mode) for processing as in virtual machine solutions, resulting in a very fast response time.

[0079] To achieve fine-grained switching, this invention employs a simpler approach, similar to ordinary function call (Call) and return (Ret) instructions. This invention abstracts entry and exit as function calls: entering a function means entering another isolation domain (security domain), and returning from the function means exiting the current isolation domain (security domain). Unlike ordinary system calls or virtual machine call instructions, which involve switching privileges and require complex kernel-level decision-making, the ICall and IRet instructions in this invention prepare the isolation environment simultaneously with the function call, requiring only a few simple instructions.

[0080] Optionally, the comparison unit is specifically used to: access memory through the memory address of the second function when at least one of the following conditions is met: The first detection result indicates that the access address is located in the memory window of the CSW table.

[0081] The second detection result indicates that the access address is located in the global memory segment.

[0082] The third detection result indicates that the access address is within the target security domain.

[0083] When the first detection result is that the access address is within the memory window of the CSW table, it indicates that the memory access of the current second function is within the constraints of the memory window recorded in the CSW table. The memory window recorded in the CSW table represents the memory space that the second function is allowed to access. Therefore, the memory access of the second function is a safe access and is allowed.

[0084] The second detection result indicates that when the access address is in the global memory segment, it means that the memory access of the current second function is an access to a public area that can be used by all functions. Therefore, the memory access of the second function at this time is a safe access and is allowed.

[0085] The third detection result indicates that when the access address is within the target security domain, it signifies that the current memory access of the second function is performed within the target security domain of the second function, and the second function's access to its own target security domain is a safe access and is permitted.

[0086] Optionally, the comparison unit is further configured to: perform exception handling when at least one of the following conditions is met: The first detection result is that the access address is not in the memory window of the CSW table.

[0087] The second detection result is that the access address is not located in the global memory segment.

[0088] The third detection result is that the access address is not in the target security domain.

[0089] Similar to the above logic, if the first detection result indicates that the access address is not within the memory window of the CSW table, it means that the memory access of the current second function is outside the constraints of the memory window recorded in the CSW table. In this case, the memory access of the second function is not a safe access and is not allowed to be executed. Exception handling must be performed.

[0090] If the second detection result indicates that the access address is not within the global memory segment, it means that the memory access of the current second function is not a safe access and is not allowed; exception handling must be performed. Additionally, if the stack space operated on by the second function is not its own stack space—for example, if the second function modifies the stack space of the first function or operates on the stack space adjacent to the second function—execution is also not allowed, and exception handling must be performed.

[0091] If the third detection result indicates that the access address is not in the target security domain, it means that the memory access of the current second function is performed in other unsafe memory spaces. This access is not safe and is not allowed to be executed. Exception handling must be performed.

[0092] Optional exception handling includes: Terminate the instruction pipeline of the second function; Jump to the operating system exception handler.

[0093] When the comparison unit decides to trigger an exception due to a violation reported by any check unit, the processor hardware will immediately and automatically execute a freeze on the current execution flow, that is, immediately suspend the instruction that is being executed and caused the violation, and any effect of the instruction (including register updates) will not be committed.

[0094] In addition, the processor can save the exception context, meaning the processor hardware automatically saves critical processor states to the privileged kernel stack. The saved content typically includes: Program counter: Points to the address of the instruction that caused the exception.

[0095] Exception Cause Register: Write a specific exception code to the operating system to clearly tell it what kind of violation occurred.

[0096] Invalid address register: Stores the illegal memory address that is being attempted to be accessed.

[0097] Current GFID value: Records the security domain in which the violation occurred.

[0098] Afterward, the processor hardware can switch execution modes, switching the processor from user mode to kernel mode. This means that subsequent code will run with the highest privileges, unrestricted by any user-mode security domain rules.

[0099] Finally, the processor hardware can jump to the exception handler, which automatically jumps to a specific address in the exception vector table pre-set in the operating system, based on the exception code. This address points to dedicated code in the kernel that handles such security violations. This allows subsequent software operations, such as diagnosing the cause of the exception, determining and executing a handling strategy, and system recovery, to be performed through the exception handler.

[0100] Optionally, the parameter type of the passed parameter includes: nested data type or non-nested data type; the nested data type is a multi-level pointer structure data type; the non-nested data type is a single-level pointer structure data type; step 102 may specifically include: Sub-step 1021: When the parameter type is the non-nested data type, generate a first access constraint instruction including the storage address, storage address range, and access attributes of the passed parameter.

[0101] Sub-step 1022: When the parameter type is the nested data type, traverse the pointer chain of the passed parameter and generate a corresponding second access constraint instruction for each pointer on the pointer chain; the second access constraint instruction includes: the storage address, storage address range and access attribute of the data corresponding to the pointer.

[0102] Optionally, step 102 may specifically include: Sub-step 1023: When executing the first access constraint instruction, record the storage address, storage address range and access attribute of the passed parameters included in the first access constraint instruction in the CWS table.

[0103] Sub-step 1024: When executing the second access constraint instruction, record the storage address, storage address range, and access attributes of the data corresponding to the pointer included in each of the second access constraint instructions in the CWS table.

[0104] In this embodiment of the invention, for sub-steps 1021-1022 and 1023-1024, the first function, as the caller, passes parameters to the called second function. How to securely implement parameter passing is an important research topic in this embodiment. For example, how to allow the second function to access the data provided by the first function within its own target security domain, while simultaneously preventing the second function from accessing data it is not permitted to access.

[0105] Specifically, the embodiments of this invention identify two types of passed parameters: non-nested data types and nested data types. Non-nested data types refer to data structures without pointer members; nested data types refer to data structures containing nested pointer members. Different access constraint instructions are generated for different parameter types, resulting in different access strategies for the passed parameters determined by these instructions. In some embodiments, when the parameter type is the non-nested data type, the structure foo_obj for passing the parameter is as follows: 1: struct foo_obj{int RTID;int size}; 2: void func(foo_obj* prt,int size) 3:{ 4:if(prt->type){ 5: prt->size = size; / / Access memory objects via pointers 6:} 7:{ 8: void main() 9:{ 10: struct foo_obj local_obj; 11:struct foo_obj* lptr; 12:lptr=malloc(sizeof(foo_obj)); 13:… 14:func(&local_obj, sizeof(local_obj)); 15:… 16:} The structure `foo_obj` contains only basic data and can contain nested data structures, but these structures cannot contain pointer variables. The compiler generates a first access constraint instruction that includes the memory address, memory address range, and access attributes of the passed parameters. Specifically, when the function is called (e.g., line 14), only a pointer needs to be passed. The compiler only needs to assign the pointer to register `a0` during the call, then use `a0` as the pointer space and release the `ciprii` instruction to ensure that the address, space size, and attributes take effect before the `ICall` instruction is executed. This embodiment of the invention considers this situation as using local constraints, where the metadata is all data and does not contain pointers. In the second function, the address space outside of `foo_obj` cannot be accessed via pointer, thus ensuring independence from other address spaces.

[0106] This applies when the first function passes a structure or data block that does not contain any pointers. For example, `struct Point { int x; int y;} point;` Before calling the `ICall` instruction, the compiler automatically inserts a `ciprii` instruction: `ciprii a0, imm_attri;` where register `a0` stores a pointer to this structure (`&point`); and `imm_attri` is an immediate value that represents: 1. The memory range that the second function is allowed to access (this memory range starts from the address pointed to by `a0` and has the size defined by `sizeof(Point)`). 2. How the second function is allowed to access the memory (read-only / read-write, etc.). Through the above operations, the processor hardware records the information of this instruction in the CSW table. This is equivalent to issuing a temporary "pass" with strict scope restrictions to the second function, allowing it to access only the memory window recorded in the CSW table. If the second function attempts to access a memory area outside the memory window recorded in the CSW table, the MCU will immediately block the access, thereby ensuring the security of the access.

[0107] In some implementations, when the parameter type is a nested data type, the structure foo_obj for passing the parameter is as follows: 1: struct foo_obj{int RTID;int size}; 2:foo_obj* nextptr; 3:long obj_metadata; 4: char*data; 5: long data_metadata; 6: void func(foo_obj* prt,char* data); 8:… 9:prt->datd=data; 10: / / Compiler implicit auto-addition 11:prt->datd_metadata=sizeof(data) | attr0; 12: prt->nextptr = ptr; 13: / / Compiler implicit auto-addition 14:prt->obj_metadata=sizeof(foo_obj*) | attr1; 15:… 16:{ 17: void main(); 18:} 19: struct foo_obj* lptr; 20: char stack_data

[32] ; 21:lptr=malloc(sizeof(foo_obj)); twenty two:… 23:func(lptr, sizeof(lptr)); twenty four:… 25:} When the structure `foo_obj` contains pointer data or nested structures, the handling differs. The main difference is that without pointers, only one `ciprii` instruction needs to be inserted before the function call. However, with pointers, to ensure the second function can correctly access the data passed to it by the first function, the `ciprii` instruction must be generated, and it must also be ensured that the second function can handle data like `ptr->nextptr->data`. This is because the compiler first loads the value of `nextptr` into a register, and then accesses the member variable `data` based on the space arrangement of the structure `foo_obj`. During this process, access is done through the `nextptr` pointer. However, in this embodiment of the invention, only the space accessible to the first function by the second function is determined before calling the `ICall` instruction. Therefore, before handling this situation, the structure can be traversed first, and for such pointers, additional `ciprii` instructions can be generated to ensure program correctness. This constraint is called a globally shared constraint. In this case, the compiler traverses the pointer chain that passes parameters and generates a corresponding second access constraint instruction for each pointer in the pointer chain; the second access constraint instruction includes: the storage address, storage address range and access attribute of the data corresponding to the pointer.

[0108] That is, when the structure passed to the first function contains a pointer, such as struct DataPacket { inttype; char *buffer; int length;} packet; where packet.buffer points to another block of memory.

[0109] If only the `packet` itself is granted permission according to the strategy in sub-step 1021, the second function can see the value of the `packet.buffer` pointer, but it doesn't have permission to access the memory pointed to by `packet.buffer`, thus the second function cannot function. To solve this problem, the compiler can analyze the `packet` structure before inserting the `ICall` instruction. When it finds a pointer member `buffer`, the compiler will generate one or more additional `ciprii` instructions, one corresponding to `packet` itself and another to the memory pointed to by `packet.buffer`.

[0110] Based on the above operations, the processor hardware also records this information in the CSW table. This is equivalent to issuing two temporary passes to the second function: one allowing access to the packet structure itself, and the other allowing access to the memory data pointed to by packet.buffer. Thus, the second function can safely access memory data through packet.buffer[i]. However, if the second function attempts to use packet.buffer to access other memory that does not belong to it, or to access other parts of the packet structure that it should not access, the MCU will still block the access.

[0111] In summary, while ensuring security, the embodiments of this invention require the underlying hardware to provide constraint checks to support data sharing strategies. During function calls, parameters are primarily passed to the second function, which then processes the data according to these parameters. As described above, passing pointer parameters is equivalent to providing the second function with an accessible memory address space. This embodiment of the invention provides an accessible memory range in hardware and a Control Window (CSW) at the underlying level. Each time a function is called, if the parameters passed to the function include a pointer (memory space), the CSW must contain an accessible address window established by the caller. Any other access is considered illegal.

[0112] Optionally, step 103 may specifically include: Sub-step 1031: Compare the access address of the second function with the CSW table to obtain the first detection result.

[0113] Sub-step 1032: When the first detection result indicates that the access address of the second function is located in the entry of the CSW table, execute the second function.

[0114] Sub-step 1033: When the first detection result indicates that the access address of the second function is not in the entry of the CSW table, stop executing the second function and perform exception handling.

[0115] In this embodiment of the invention, sub-steps 1031-1033 can refer to the relevant description of the constraint window management unit in the above embodiments, and will not be repeated here.

[0116] Optionally, each memory region is assigned a corresponding security domain label, which is used to identify the memory region as a security domain; the second function has a corresponding assigned target security domain label; step 103 may specifically include: Sub-step 1034: In response to the memory access operation of the second function, obtain the second detection result of the target security domain label of the second function and the security domain label of the accessed memory segment.

[0117] Sub-step 1035: When the second detection result shows that the target security domain label is the same as the security domain label of the accessed memory segment, execute the second function.

[0118] Sub-step 1036: When the second detection result is that the target security domain label is different from the security domain label of the accessed memory segment, stop executing the second function and perform exception handling.

[0119] In this embodiment of the invention, sub-steps 1034-1036 can refer to the relevant description of the domain management unit in the above embodiments, and will not be repeated here.

[0120] Optionally, step 103 may specifically include: Sub-step 1037: In response to the memory access operation of the second function, the access address of the second function is compared with a preset global memory segment to obtain a third detection result; the global memory segment is configured to be accessible by all functions.

[0121] Sub-step 1038: When the third detection result indicates that the access address is located in the global memory segment, execute the second function.

[0122] Sub-step 1039: When the third detection result indicates that the access address is not in the global memory segment, stop executing the second function and perform exception handling.

[0123] In this embodiment of the invention, sub-steps 1037-1039 can refer to the relevant description of the global management unit in the above embodiments, and will not be repeated here.

[0124] Optional, Figure 2 The compiler function calling method provided in the embodiment may further include: Step 104: Select the target function from the function library and add a security protection mark to the function declaration of the target function; Regarding step 104, step 101 may specifically include: Sub-step 1011: When the second function is the target function, determine the parameter type of the passed parameters of the first function based on the security protection flag in the function declaration of the target function.

[0125] In this embodiment of the invention, for steps 104 and sub-step 1011, developers only need to select the target function that needs security protection from the function library and add a security protection marker (such as __attribute__((secure_call))) to the function declaration of the target function. The compiler will automatically recognize the security protection marker in the function declaration of the target function and automatically perform the operation of inserting ICall / IRet and ciprii instructions, so that developers do not need to rewrite code on a large scale, thus improving project development efficiency.

[0126] In some embodiments, examples are provided to demonstrate how the security mechanisms of this invention protect against operations outside the security domain: Reference Figure 4 Assume the `main` function is secure and trustworthy, and that it stores the local variable `local_obj` and a pointer to the dynamically allocated memory object `lptr` within its own stack. When the `main` function calls `untrust`, it can switch security domains while passing the pointer. Conversely, assume the `untrust` function contains instruction streams of unknown security, which could be intercepted. Furthermore... Figure 5 The code segment shown is normal disassembled code, including the security-protected assembly code. The untrust instruction stream indirectly modifies data within the main site by manipulating the pointer to local_obj. For example... Figure 4 As shown in the code. Similarly, suppose there is important data attached to foo_obj. Manipulating the surrounding memory area through the pointer of foo_obj will cause a data leak.

[0127] If the safety protections of the embodiments of the present invention are used, such as Figure 5 As shown in the diagram. First, assume that `untrust` forces the operation to access the return address stored in `main` via the stack pointer ( Figure 4 (Regarding the stack layout in the memory), the global management unit of the memory check module cannot pass the check and reports an exception. Suppose untrust tries to access the main stack data through the pointer of foo_obj out of bounds ( Figure 4 (Code at address 10400 in the code). At this point, the safety check will detect an out-of-bounds operation within the constraint window management unit and pass the stack out-of-bounds information to the comparison unit. If dynamic memory is accessed through an lptr pointer, the domain management unit will report a handling exception.

[0128] In summary, in this embodiment of the invention, regarding the function call process, when jumping to the called second function, the processor can execute access constraint instructions generated by the compiler to determine a safe execution policy. Subsequently, the execution process of the second function is constrained by this safe execution policy, ensuring that the execution of the called second function is safe and reliable compared to the first function, which acts as the caller, and that they do not interfere with each other. This embodiment of the invention can provide a relatively isolated safe execution environment for application execution at the function call granularity, thereby achieving a finer-grained isolation method. Furthermore, the safe isolation method of this invention executes quickly, without needing to enter kernel mode, thus achieving high performance and a rapid response.

[0129] Reference Figure 6 The present invention also provides a processor, including: a decoder, for decoding the access constraint instruction including an opcode, wherein the access constraint instruction further includes a first operand identifying a general-purpose register and a second operand characterizing the security domain information of the callee.

[0130] A general-purpose register stores the memory address of the parameters to be passed to the callee.

[0131] The CSW table is used to record the security domain information that the callee is allowed to access.

[0132] The execution circuit executes the decoded instructions, reads the storage address in the general-purpose register, writes the storage address into the CSW table in association with security domain information, and allows or denies the callee's memory access based on the information in the CSW table.

[0133] Optionally, the first operand is in pointer form; the second operand is in register form or immediate form.

[0134] In this embodiment of the invention, the format of the access constraint instruction is as follows: cipriia0,imm_attri; ciprra0,t0; Here, a0 represents the parameter passed to the callee, usually represented as the first operand, which can be a pointer. Imm_attri is the second operand, representing the security domain information of the callee. The second operand can be a multi-bit immediate value. The first N bits of the immediate value represent the size of the address space pointed to by a0 (the address range of the security domain), and the last M bits represent the access attributes, including read-only, read-write, etc.

[0135] Alternatively, the second operand can also be in register form. When the number of bits in the immediate value is greater than K bits (e.g., 10 bits), it can be stored in register form. When the second operand is in register form, it still represents the security domain information of the callee.

[0136] The instruction `ciprr` is similar to `ciprii`, except that it first stores the immediate value in register `t0`. This is done to allow for address spaces larger than 10 bits. This is primarily used to provide a larger address space.

[0137] During execution, the circuit first reads the storage address of the passed parameters from a general-purpose register and writes this storage address, along with security domain information (including the storage address range and access attributes), into the CSW table as an entry. Subsequently, when the callee accesses memory, the system can allow or deny its memory access based on the information in the CSW table. For example, if the callee's access address falls within the memory window of a record in the CSW table, its memory access is allowed or denied. If the callee's access address does not fall within the memory window of any record in the CSW table, its memory access is denied.

[0138] Optional, refer to Figure 3 The CSW table includes multiple entries, each of which represents a security domain; The CSW table is associated with a first pointer Base PTR and a second pointer Current PTR; the first pointer Base is used to indicate the starting address of the current security domain in the CSW table; the second pointer Current PTR is used to indicate the next available free entry in the CSW table.

[0139] Optional, refer to Figure 3 Each entry in the CSW table includes: Addr-Size-Attrs; Wherein, Addr represents the storage address of the passed parameter; Size represents the storage address range; Attrs represents the access attribute; the storage address range is used to represent the address range of the memory segment where the passed parameter is stored.

[0140] The CSW table is an object consisting of a set of register or cache entries managed and maintained by the hardware. Each entry is dynamically created at function call time, defining the range (base address, size) and access attributes (read, write) of a contiguous memory region that the called function is explicitly allowed to access outside its security domain context. The CSW table is primarily used as an access window for interaction between security domains. Each time a function switches security domains, the pointer parameters passed, along with the associated memory size and attribute values, are stored here.

[0141] The CSW table consists of multiple entries, each in the format Addr-Size-Attrs. Addr represents the storage address of the passed parameters (data the callee is allowed to access), Size represents the range of storage addresses for the passed parameters, and Attrs represents access attributes such as readable or writable. Addr defines the starting address of the passed parameters, and Addr+Size defines the ending address of the passed parameters.

[0142] In addition, the CSW table is associated with a first pointer, BasePTR, and a second pointer, CurrentPTR. The first pointer, BasePTR, is a physical base address pointer that points to the starting address of the CSW table backup area in memory for the current security domain. Its function is to locate the memory backup. When the CSW table needs to be swapped out, BasePTR provides the memory target address; when it needs to be swapped in, it provides the memory source address. When each security domain is created, the kernel allocates a dedicated CSW backup space for it in the privileged memory area, and BasePTR records the starting address of this space.

[0143] The second pointer, Current PTR, is an offset pointer that points to the next available free entry in the current CSW table. Its function is entry allocation; for example, when executing the ciprii instruction, the hardware can write window information to the entry pointed to by Current PTR and then increment Current PTR. Additionally, the offset of Current PTR reflects the utilization rate of the CSW table (e.g., an offset of 80 indicates that 80 entries have been used).

[0144] Reference Figure 7 The present invention also provides a processor, including: a decoder, which decodes the ICall instruction including an opcode, wherein the ICall instruction further includes a third operand for specifying the entry address of the callee.

[0145] The first security domain status register stores the current security domain identifier.

[0146] The second security domain status register stores the security domain identifier of the callee.

[0147] The execution circuit executes the decoded instructions, updates the first security domain status register to the newly allocated security domain identifier of the callee, and switches the pointer of the CSW table to the entry associated with the newly allocated security domain identifier, thus completing the security domain switch.

[0148] In this embodiment of the invention, when the compiler has finished analyzing all the parameters, it will release the ICall instruction to enable the called second function to enter the security domain. At this time, the pointer of the CSW table will be made to point to a new entry, that is, the first security domain status register will be updated to the newly allocated security domain identifier of the callee, and the pointer of the CSW table will be switched to the entry associated with the newly allocated security domain identifier, thus completing the security domain switching.

[0149] Reference Figure 8 This invention also provides a processor, comprising: The decoder decodes the IRet instruction based on the IRet instruction, including the opcode. The third security domain status register stores the current security domain identifier; The fourth security domain status register stores the security domain identifier of the callee; The execution circuit executes the decoded instructions, updates the third security domain status register to the caller's security domain identifier, switches the pointer of the CSW table to the entry associated with the caller's security domain identifier, and releases the callee's security domain identifier from the fourth security domain status register, thus completing the exit from the security domain.

[0150] In this embodiment of the invention, the IRet instruction is used to cause the called second function to exit the security domain. This restores the original pointer pointer. At this time, the third security domain status register is updated to the caller's security domain identifier, and the pointer of the CSW table is switched to the entry associated with the caller's security domain identifier to restore the original pointer pointer. Furthermore, the caller's security domain identifier is released from the fourth security domain status register, causing the called second function to exit the security domain, thus completing the exit from the security domain.

[0151] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the method described above.

[0152] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the following claims.

[0153] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A processor, characterized in that, include: Execution module and memory check module; In response to a call operation from a first function to a second function in an application, the execution module is used to execute access constraint instructions generated by the compiler and determine a safe execution strategy; When the second function is executed, the memory checking module is used to analyze the access address of the second function according to the secure execution policy, obtain the analysis result, and control the execution of the second function according to the analysis result.

2. The processor according to claim 1, characterized in that, The memory inspection module includes: multiple inspection units and comparison units; different inspection units correspond to different security execution strategies; The inspection unit is used to analyze the access address of the second function according to the corresponding security execution policy, obtain the analysis result, and send the analysis result to the inspection comparison unit; The comparison unit is used to control the execution of the second function based on the detection results of each of the plurality of inspection units.

3. The processor according to claim 2, characterized in that, The plurality of inspection units include: Constraint window management unit, domain management unit, and global management unit; The constraint window management unit is used to compare the access address of the second function with the CSW table to obtain the first detection result; The global management unit is used to compare the access address of the second function with a preset global memory segment to obtain a second detection result; the global memory segment is configured to be accessible by all functions. The domain management unit is used to detect whether the second function is running in the target security domain and obtain a third detection result. The target security domain is a memory area allocated to the second function by the constraint window management unit.

4. The processor according to claim 3, characterized in that, The access constraint instruction defines the memory window that the second function can access; the safe execution policy includes: allowing the second function to access data in the accessible memory window; The execution module is specifically used to execute the access constraint instruction and add the memory window accessible by the second function to the CSW table by calling the constraint window management unit.

5. The processor according to claim 3, characterized in that, Specifically, the execution module is used to call the domain management unit to allocate a corresponding target security domain for the second function when executing the ICall instruction generated by the compiler, so that the second function can be executed in the target security domain. The target security domain is a memory area allocated to the second function by the constraint window management unit. The constraint window management unit is also used to execute the IRet instruction generated by the compiler when the second function is completed, cancel the target security domain of the second function, and switch to the target security domain of the first function.

6. The processor according to claim 3, characterized in that, The domain management unit is specifically used for: Obtain the target security domain identifier allocated to the second function, and compare whether the target security domain identifier is consistent with the security domain identifier of the memory segment to be accessed by the memory access address of the second function; If they match, then the second function is determined to be running in the target security domain; If there is a discrepancy, it is determined that the second function is not running in the target security domain.

7. The processor according to claim 3, characterized in that, The comparison unit is specifically used for: Memory access is performed through the memory access address of the second function when at least one of the following conditions is met: The first detection result indicates that the access address is located in the memory window of the CSW table; The second detection result is that the access address is located in the global memory segment; The third detection result indicates that the access address is within the target security domain.

8. The processor according to claim 3, characterized in that, The comparison unit is also used for: Exception handling is performed when at least one of the following conditions is met: The first detection result is that the access address is not in the memory window of the CSW table; The second detection result is that the access address is not located in the global memory segment; The third detection result is that the access address is not in the target security domain.

9. The processor according to claim 4, characterized in that, When the CSW table has no empty entries, the constraint window management unit is used to: The kernel is invoked to encrypt at least some of the historical entries in the CSW table and move them to a preset memory segment to obtain newly added free entries; Add the memory window accessible by the second function to the new free entry in the CSW table.

10. The processor according to claim 3, characterized in that, The global management unit is also used for: Record the stack space of the second function, and configure the second function to only allow access to the stack space of the second function, prohibit the second function from modifying the stack space of the first function, and prohibit operation on the stack space adjacent to the second function.

11. A processor, characterized in that, include: The decoder decodes the access constraint instruction, including the opcode, according to the access constraint instruction. The access constraint instruction also includes a first operand that identifies a general-purpose register and a second operand that represents the security domain information of the callee. General-purpose registers store the memory addresses of the parameters to be passed to the callee; The CSW table is used to record the security domain information that the callee is allowed to access. The execution circuit executes the decoded instructions, reads the storage address in the general-purpose register, writes the storage address into the CSW table in association with security domain information, and allows or denies the callee's memory access based on the information in the CSW table.

12. The processor according to claim 11, characterized in that, The first operand is in pointer form; the second operand is in register form or immediate form.

13. The processor according to claim 11, characterized in that, The CSW table includes multiple entries, each of which represents a security domain. The CSW table is associated with a first pointer Base PTR and a second pointer Current PTR; The first pointer Base is used to indicate the starting address of the current security domain in the CSW table; the second pointer Current PTR is used to indicate the next available free entry in the CSW table.

14. The processor according to claim 11, characterized in that, Each entry in the CSW table includes: Addr-Size-Attrs; Wherein, Addr represents the storage address of the passed parameter; Size represents the storage address range; Attrs represents the access attribute; the storage address range is used to represent the address range of the memory segment where the passed parameter is stored.

15. A processor, characterized in that, include: The decoder decodes the ICall instruction, including the opcode, and the ICall instruction also includes a third operand for specifying the entry address of the callee; The first security domain status register stores the current security domain identifier; The second security domain status register stores the security domain identifier of the callee; The execution circuit executes the decoded instructions, updates the first security domain status register to the newly allocated security domain identifier of the callee, and switches the pointer of the CSW table to the entry associated with the newly allocated security domain identifier, thus completing the security domain switch.

16. A processor, characterized in that, include: The decoder decodes the IRet instruction based on the IRet instruction, including the opcode. The first security domain status register stores the current security domain identifier; The second security domain status register stores the security domain identifier of the callee; The execution circuit executes the decoded instructions, updates the first security domain status register to the caller's security domain identifier, switches the pointer of the CSW table to the entry associated with the caller's security domain identifier, and releases the callee's security domain identifier, thus completing the exit from the security domain.

Images