A task stack protection method and device, a storage medium, an equipment and a vehicle

Abstract

The application provides a task stack protection method and device, a storage medium, equipment and a vehicle. In the method, a trust level parameter is configured for a task in a system, and a range of an MPU stack protection area is configured. When a task is switched, a current switching scenario is accurately identified according to the trust level parameters of a task to be exited and a task to be switched in. After identifying the scenario of switching from a trusted task to an untrusted task, the range of the MPU stack protection area is reconfigured, so that the MPU stack protection area covers the expected access range of the untrusted task, and does not overlap with the stack data area retained by the trusted task. The MPU is configured to prohibit the untrusted task from accessing the stack space except the MPU stack protection area. In this way, by dynamically adjusting the MPU stack protection area configuration, the stack space of the trusted task and the untrusted task is accurately isolated, thereby effectively guaranteeing the integrity of the trusted task data on the stack.

Description

Technical Field

[0001] This application relates to the field of functional safety technology, and more specifically, to a task stack protection method, apparatus, storage medium, device, and vehicle. Background Technology

[0002] In embedded systems, the stack is a core memory resource used to store critical data such as local variables, function call context, and parameter passing during task execution. The integrity of the stack data directly determines the stability and security of the system. With the increasing popularity of functional safety concepts, embedded systems must strictly distinguish between trusted and untrusted tasks to prevent abnormal behavior of untrusted tasks, such as out-of-bounds access or malicious tampering, from compromising system security.

[0003] Existing stack protection technologies mainly include stack overflow detection and memory partitioning isolation based on MPUs (Memory Protection Units). These solutions can protect against buffer overflow attacks. However, when faced with scenarios where trusted tasks switch to untrusted tasks, these solutions cannot accurately address the stack data protection requirements in such scenarios. Trusted task data on the stack is easily corrupted by untrusted tasks, affecting the integrity of the trusted task data on the stack. Summary of the Invention

[0004] The purpose of this application is to provide a task stack protection method, apparatus, storage medium, device, and vehicle, aiming to solve the problem that stack protection technologies in related technologies cannot accurately cope with the stack data protection needs in scenarios where trusted tasks switch to untrusted tasks, and that trusted task data on the stack is easily damaged by untrusted tasks, affecting the integrity of trusted task data on the stack.

[0005] In a first aspect, this application provides a task stack protection method, comprising: configuring a trust level parameter for a task in the embedded system and configuring the range of an MPU stack protection area; wherein the trust level parameter is used to distinguish between trusted tasks and untrusted tasks; when the operating system triggers a task switch, identifying the current switching scenario based on the trust level parameter of the task to be exited and the trust level parameter of the task to be switched into; if the current switching scenario is a target scenario, reconfiguring the range of the MPU stack protection area, and then, through MPU configuration, restricting the task to be switched into to only access the reconfigured MPU stack protection area; wherein the reconfigured MPU stack protection area covers the expected access range of the untrusted task and does not overlap with the stack data area retained by the trusted task; the target scenario includes a scenario where the trusted task switches to the untrusted task.

[0006] In the above implementation process, trust level parameters are configured for tasks in the system, and the range of the MPU stack protection area is configured. During task switching, the current switching scenario is accurately identified based on the trust level parameters of the task to be exited and the task to be switched into. After identifying the scenario of switching from a trusted task to an untrusted task, the range of the MPU stack protection area is reconfigured so that the MPU stack protection area covers the expected access range of the untrusted task, while not overlapping with the stack data area reserved by the trusted task. The MPU configuration prohibits the untrusted task from accessing the stack space outside the MPU stack protection area. In this way, by dynamically adjusting the MPU stack protection area configuration, the stack space of trusted and untrusted tasks is precisely isolated, thereby effectively ensuring the integrity of the trusted task data on the stack.

[0007] Furthermore, in some examples, the scope of the configured MPU stack protection region includes: configuring the starting address of the MPU stack protection region as the original starting address, and configuring the ending address of the MPU stack protection region as the target ending address; wherein, the original starting address is the starting address of the shared stack; and the target ending address is determined based on the original starting address and the preset length of the shared stack.

[0008] In the above implementation process, a specific method is provided for configuring the MPU stack protection area during the initialization phase of an embedded system.

[0009] Furthermore, in some examples, adjusting the range of the MPU stack protection region includes: adjusting the starting address of the MPU stack protection region to the stack pointer value, while keeping the ending address of the MPU stack protection region unchanged; wherein the stack pointer value is the current stack pointer value when the operating system triggers a task switch.

[0010] In the above implementation process, after identifying the target scenario, the starting address of the MPU stack protection area is reconfigured based on the current stack pointer value. This ensures that the stack space of trusted and untrusted tasks is accurately isolated while matching the reconfigured MPU stack protection area with the current stack usage state.

[0011] Furthermore, in some examples, before adjusting the range of the MPU stack protection region, the method further includes: reading the current protection configuration parameters of the MPU stack protection region and storing the protection configuration parameters in a temporary cache of the secure storage area; wherein, the protection configuration parameters include a start address, an end address, and a protection mode; after adjusting the range of the MPU stack protection region, the method further includes: after adjusting the range of the MPU stack protection region, and when the task to be switched out exits and switches back to the task to be exited, reading the saved protection configuration parameters from the temporary cache; calling the MPU's configuration interface to restore the start address, end address, and protection mode of the MPU stack protection region to the configuration corresponding to the protection configuration parameters.

[0012] In the above implementation process, before reconfiguring the MPU stack protection area, the current stack MPU protection configuration is saved. When the untrusted task exits, the MPU stack protection configuration is restored to its original state to ensure that the MPU stack protection environment when the trusted task is executed subsequently is consistent with that before the switch, thus ensuring the stability of the system operation.

[0013] Furthermore, in some examples, configuring trust level parameters for tasks in the embedded system includes: configuring a first parameter value as a trust level parameter for trusted tasks in the embedded system, and configuring a second parameter value as a trust level parameter for untrusted tasks in the embedded system.

[0014] In the above implementation process, the trust level parameter can take the first parameter value or the second parameter value. The first parameter value represents a trusted task, and the second parameter value represents an untrusted task. In this way, when switching tasks, the CPU can accurately identify the scenario based on the trust level parameter.

[0015] Furthermore, in some examples, the trust level parameters of the task to be exited and the trust level parameters of the task to be switched in are obtained from the task scheduler of the operating system by the MPU stack protection monitoring module; the MPU stack protection monitoring module establishes communication with the task scheduler during the embedded system initialization phase and associates the configuration interface and status reading interface of the MPU.

[0016] In the above implementation process, by linking independent modules with the MPU to monitor access behavior, illegal access can be responded to quickly, thereby enhancing the real-time performance and reliability of MPU stack protection.

[0017] Furthermore, in some examples, identifying the current switching scenario based on the trust level parameter of the task to be exited and the trust level parameter of the task to be switched in includes: if the trust level parameter of the task to be exited is the first parameter value and the trust level parameter of the task to be switched in is the second parameter value, then the current switching scenario is identified as the target scenario.

[0018] In the above implementation process, if the trust level parameter of the preceding task is the first parameter value and the trust level parameter of the subsequent task is the second parameter value, it indicates that the preceding task is a trustworthy task and the subsequent task is an untrustworthy task. Therefore, the current switching scenario is determined to be the target scenario. This achieves accurate identification of high-risk scenarios.

[0019] Secondly, this application provides a task stack protection device, comprising: a configuration module, configured to configure trust level parameters for tasks in the embedded system and configure the range of an MPU stack protection area during the embedded system initialization phase; the trust level parameters are used to distinguish between trusted and untrusted tasks; an identification module, configured to identify the current switching scenario based on the trust level parameters of the task to be exited and the task to be switched in when the operating system triggers a task switch; and an adjustment module, configured to reconfigure the range of the MPU stack protection area when the current switching scenario is a target scenario, and then, through MPU configuration, restrict the task to be switched in to only access the reconfigured MPU stack protection area; wherein the reconfigured MPU stack protection area covers the expected access range of the untrusted task and does not overlap with the stack data area retained by the trusted task; the target scenario includes a scenario where the trusted task switches to the untrusted task.

[0020] Thirdly, this application provides an electronic device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of the method described in any of the first aspects.

[0021] Fourthly, this application provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method described in any of the first aspects.

[0022] Fifthly, this application provides a vehicle including an embedded system; the embedded system includes a processor configured to perform the method as described in any of the first aspects.

[0023] Other features and advantages disclosed in this application will be set forth in the following description, or some features and advantages may be inferred from the description or determined without doubt, or may be learned by practicing the above-described technology disclosed in this application.

[0024] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 A flowchart illustrating a task stack protection method provided in this application embodiment; Figure 2 A schematic diagram illustrating the workflow of a functional safety-based stack protection scheme provided in an embodiment of this application; Figure 3 A block diagram of a task stack protection device provided in an embodiment of this application; Figure 4 This is a structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0027] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0028] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0029] In embedded systems, the stack is a core memory resource responsible for storing critical data such as local variables, function call context, and parameter passing during task execution. The integrity of stack data directly determines the stability and security of system operation. With the increasing popularity of functional safety concepts, embedded systems must strictly distinguish between trusted and untrusted tasks. For example, core control tasks and security monitoring tasks are classified as trusted tasks, while third-party extension tasks and non-critical auxiliary tasks are classified as untrusted tasks. This prevents untrusted tasks from compromising system security due to abnormal behaviors such as out-of-bounds access or malicious tampering.

[0030] Existing stack protection technologies mainly include stack overflow detection and MPU-based memory partitioning isolation. Among them, stack overflow detection technology can only trigger an alarm after a stack overflow occurs, and cannot prevent untrusted tasks from accessing trusted task data, such as core control parameters and security status indicators, in advance. Although MPU-based memory partitioning isolation technology can achieve memory isolation between tasks, it is a fixed partition under normal configuration. When a trusted task calls an untrusted task, the two will share part of the stack space. If the untrusted task goes out of bounds or makes malicious access, it is very easy to destroy the trusted task data left on the stack.

[0031] To address the aforementioned issues, this application provides a task stack protection scheme. During the embedded system initialization phase, a trust level parameter is configured for tasks in the system to distinguish between trusted and untrusted tasks, and the range of the MPU stack protection area is configured. During task switching, the scenario of switching from a trusted task to an untrusted task is accurately identified based on the trust level parameter. For this scenario, the range of the MPU stack protection area is reconfigured so that the MPU stack protection area covers the expected access range of the untrusted task, while not overlapping with the stack data area reserved by the trusted task. The MPU configuration prohibits the untrusted task from accessing the stack space outside the MPU stack protection area. In this way, by dynamically adjusting the MPU stack protection area configuration, precise isolation of the stack space of trusted and untrusted tasks is achieved, ensuring the integrity of the trusted task data on the stack.

[0032] The embodiments of this application will be described below: like Figure 1 As shown, Figure 1 This is a flowchart illustrating a task stack protection method provided in an embodiment of this application. The method can be applied to the CPU (Central Processing Unit) in an embedded system. The method includes: Step 101: Configure trust level parameters for tasks in the embedded system and configure the range of the MPU stack protection area; wherein, the trust level parameters are used to distinguish between trusted tasks and untrusted tasks; The embedded system mentioned in this step can be any embedded system that requires distinguishing task trust levels and meeting functional safety standards, such as embedded systems in the automotive electronics field, embedded systems in the industrial control field, etc. To meet functional safety standards, embedded systems need to classify all tasks in the system according to predefined classification rules to distinguish between trusted and untrusted tasks. For example, in the automotive electronics field, safety-related tasks such as braking control and safety monitoring tasks in the vehicle controller are trusted tasks, while non-safety-related tasks such as entertainment function extension tasks are classified as untrusted tasks. Existing embedded systems only distinguish between trusted and untrusted tasks, without differentiating task trust levels, and adopt a uniform stack protection strategy for all tasks. However, the embodiments of this application configure trust level parameters for all tasks in the system during the initialization phase of the embedded system, using these parameters as identifiers of task trust levels. This allows for accurate identification of high-risk scenarios such as switching from trusted to untrusted tasks during task switching, and the activation of special protection mechanisms for these scenarios. This ensures stack data security while avoiding resource waste in normal scenarios.

[0033] In some embodiments, configuring trust level parameters for tasks in the embedded system mentioned in this step may include: configuring a first parameter value as the trust level parameter for trusted tasks in the embedded system, and configuring a second parameter value as the trust level parameter for untrusted tasks in the embedded system. That is, the trust level parameter can take either the first parameter value or the second parameter value. For example, if the first parameter value is 1 and the second parameter value is 0, then parameter value "1" represents a trusted task and parameter value "0" represents an untrusted task. Thus, during task switching, the CPU can accurately identify the scenario based on the trust level parameter. Furthermore, in implementation, this parameter can be stored in a Task Control Block (TCB).

[0034] During the embedded system initialization phase, the MPU stack protection region needs to be configured to set the MPU stack protection boundary during the normal execution of trusted tasks. In some embodiments, configuring the range of the MPU stack protection region mentioned in this step may include: configuring the start address of the MPU stack protection region as the original start address, and configuring the end address of the MPU stack protection region as the target end address; wherein, the original start address is the start address of the shared stack; the target end address is determined based on the original start address and the preset length of the shared stack. That is, the start address of the shared stack can be used as the start address of the MPU stack protection region configured during system initialization, denoted as Stack_Protect_Orig_Start. This parameter can be recorded by the operating system when the trusted task starts and stored in a secure storage area to ensure that it cannot be tampered with; then, based on the start address and preset length of the shared stack, the end address of the shared stack is obtained, and the end address of the shared stack is used as the end address of the MPU stack protection region, denoted as Stack_Protect_Curr_End. Thus, the range of the MPU stack protection region is [Stack_Protect_Orig_Start, Stack_Protect_Curr_End]. The preset length of the shared stack represents the number of bytes reserved in the shared stack, which can be determined through task stack occupancy simulation tests and adjusted according to task complexity.

[0035] Step 102: When the operating system triggers a task switch, the current switching scenario is identified based on the trust level parameters of the task to be exited and the trust level parameters of the task to be switched into. This step refers to the following: When the OS (Operating System) triggers a task switch, the CPU obtains the trust level parameters of the task to be exited (i.e., the preceding task) and the trust level parameters of the task to be switched in (i.e., the subsequent task), and then determines the switching scenario type based on the trust level parameters of the preceding and subsequent tasks.

[0036] In some embodiments, the trust level parameters of the task to be exited and the task to be switched over mentioned in this step can be obtained from the task scheduler of the operating system through the MPU stack protection monitoring module. The MPU stack protection monitoring module establishes communication with the task scheduler during the embedded system initialization phase and associates the MPU's configuration interface and status reading interface. Here, the MPU stack protection monitoring module is an independent module integrated into the embedded system's SoC (System on Chip). The CPU connects to the MPU stack protection monitoring module. During the embedded system initialization phase, the MPU stack protection monitoring module establishes communication with the OS's task scheduler. Thus, during task switching, the CPU can obtain the trust level parameters of the preceding and subsequent tasks from the OS's task scheduler based on the MPU stack protection monitoring module. Furthermore, during the embedded system initialization phase, the MPU stack protection monitoring module also associates the MPU's configuration interface and status reading interface to ensure that the MPU configuration status can be obtained in real time during task switching. In this way, by linking an independent module with the MPU to monitor access behavior, illegal access can be responded to quickly, thereby enhancing the real-time performance and reliability of MPU stack protection.

[0037] This application aims to achieve precise isolation of the stack space between trusted and untrusted tasks to ensure the integrity of trusted task data on the stack. Based on this, this application defines the scenario of switching from a trusted task to an untrusted task as the target scenario. During task switching, the trust level parameters of the preceding and subsequent tasks are used to determine whether the current switching scenario is the target scenario. When the trust level parameter is either a first parameter value or a second parameter value, the step of identifying the current switching scenario based on the trust level parameters of the task to be exited and the task to be entered can include: if the trust level parameter of the task to be exited is the first parameter value and the trust level parameter of the task to be entered is the second parameter value, then the current switching scenario is identified as the target scenario. In other words, following the previous example, if the trust level parameter of the preceding task is "1" and the trust level parameter of the subsequent task is "0", it indicates that the preceding task is a trusted task and the subsequent task is an untrusted task, thus determining the current switching scenario as the target scenario. This achieves precise identification of high-risk scenarios.

[0038] Step 103: When the current switching scenario is the target scenario, reconfigure the range of the MPU stack protection area, and then restrict the task to be switched to only access the reconfigured MPU stack protection area through MPU configuration; wherein, the reconfigured MPU stack protection area covers the expected access range of the untrusted task and does not overlap with the stack data area left by the trusted task; the target scenario includes the scenario of switching from the trusted task to the untrusted task.

[0039] In this embodiment, after identifying a high-risk scenario, the scope of the MPU stack protection area is reconfigured. This reconfigured MPU stack protection area covers the expected access range of the untrusted task while not overlapping with the stack data area stored by the trusted task, forming a boundary. Then, the MPU is configured to prevent untrusted tasks from accessing this boundary. In this way, by fully utilizing the hardware isolation features of the MPU, precise isolation of stack data is achieved in scenarios where trusted tasks switch to untrusted tasks. This ensures the normal execution of untrusted tasks while preventing them from corrupting the trusted task data on the stack.

[0040] In some embodiments, adjusting the range of the MPU stack protection region mentioned in this step may include: adjusting the starting address of the MPU stack protection region to the stack pointer value, while keeping the ending address of the MPU stack protection region unchanged; wherein, the stack pointer value is the current stack pointer value when the operating system triggers a task switch. In other words, when the OS triggers a task switch, the CPU can read the current stack pointer value. This stack pointer value is the real-time value of the stack pointer register at the moment of task switch, reflecting the actual stack usage position. It can be directly read by the MPU stack protection monitoring module through the hardware interface. When reconfiguring the range of the MPU stack protection region, the CPU can call the MPU configuration interface through the MPU stack protection monitoring module to reinitialize the starting address of the MPU stack protection region to the acquired stack pointer value, while keeping the ending address unchanged. Let the read stack pointer value be Current_SP. Then, the range of the reconfigured MPU stack protection region is [Current_SP, Stack_Protect_Curr_End]. This region covers the stack space that the untrusted task may access during execution and forms a strict boundary with the stack data area left by the trusted task, i.e., Stack_Protect_Orig_Start to Current_SP. In this way, while achieving precise isolation of the stack space between trusted and untrusted tasks, it ensures that the reconfigured MPU stack protection region matches the current stack usage state.

[0041] When configuring untrusted tasks to access stack space outside the reconfigured MPU stack protection area via MPU, the highest level of monitoring can be enabled for the reconfigured MPU stack protection area. That is, if an untrusted task's out-of-bounds access behavior is detected, the MPU interrupt and preset exception handling strategies will be triggered immediately, such as suspending the untrusted task and notifying the security monitoring task.

[0042] Furthermore, in some embodiments, before adjusting the range of the MPU stack protection region mentioned in this step, the method may include: reading the current protection configuration parameters of the MPU stack protection region and storing the protection configuration parameters in a temporary cache of the secure storage area; wherein, the protection configuration parameters include a start address, an end address, and a protection mode. That is, before reconfiguring the MPU stack protection region, the current stack MPU protection configuration can be saved first. Specifically, the CPU can read the start address, end address, and protection mode of the current MPU stack protection region from the MPU stack protection monitoring module and store them in a temporary cache of the secure storage area to ensure accurate recovery of the MPU configuration later. Further, in some embodiments, after adjusting the range of the MPU stack protection region, the method may also include: when the task to be switched out exits and switches back to the task to be switched out, reading the saved protection configuration parameters from the temporary cache; calling the MPU's configuration interface to restore the start address, end address, and protection mode of the MPU stack protection region to the configuration corresponding to the protection configuration parameters. In other words, when the untrusted task exits and switches back to the original trusted task, the CPU, through the MPU stack protection monitoring module, reads the previously saved protection configuration parameters from the temporary cache in the secure storage area, and then calls the MPU configuration interface to restore the parameters of the MPU stack protection area to their original configuration. Specifically, the start address is restored to Stack_Protect_Orig_Start, the end address to Stack_Protect_Curr_End, and the protection mode to the corresponding configuration. In this way, when the untrusted task exits, the MPU stack protection configuration is restored to its original state, ensuring that the MPU stack protection environment during subsequent execution of the trusted task is consistent with that before the switch, thus guaranteeing the stability of system operation.

[0043] Additionally, in some embodiments, the method may further include: clearing the protection configuration parameters stored in the temporary cache when restoring the configuration of the MPU stack protection region. That is, when restoring the original configuration of the MPU stack protection, the CPU can clear the switchover configuration data stored in the temporary cache, thereby preventing residual data from affecting subsequent MPU configurations.

[0044] In this embodiment of the application, during the embedded system initialization phase, trust level parameters are configured for tasks in the system, and the range of the MPU stack protection area is configured. During task switching, the current switching scenario is accurately identified based on the trust level parameters of the task to be exited and the task to be switched into. After identifying a scenario where a trusted task switches to an untrusted task, the range of the MPU stack protection area is reconfigured so that the MPU stack protection area covers the expected access range of the untrusted task, while not overlapping with the stack data area reserved by the trusted task. The MPU configuration prohibits the untrusted task from accessing the stack space outside the MPU stack protection area. In this way, by dynamically adjusting the MPU stack protection area configuration, precise isolation of the stack space of trusted and untrusted tasks is achieved, thereby effectively ensuring the integrity of the trusted task data on the stack.

[0045] To provide a more detailed explanation of the solution in this application, a specific embodiment is described below: This embodiment provides a stack protection scheme based on functional safety. The workflow of this scheme is as follows: Figure 2 As shown, it includes: S201. During the initialization phase of the embedded system, configure the trust level parameters for the tasks in the system and configure the initial MPU stack protection parameters. Specifically, the trust level parameter takes the value of "1" or "0", where "1" represents a trusted task and "0" represents an untrusted task. This parameter is stored in the task control block and serves as the basis for judgment when switching tasks. The starting address of the MPU stack protection region is configured as the original starting address, denoted as Stack_Protect_Orig_Start, and the ending address is determined based on the original starting address and the protection length, denoted as Stack_Protect_Curr_End. The original starting address is the starting address of the shared stack, and the protection length is the preset length of the shared stack. S202. Initialize the MPU stack protection monitoring module and enable MPU protection; Specifically, the access monitoring function of the MPU stack protection area is enabled; exception handling policies are set, such as triggering MPU interruption, task suspension, and recording security logs when illegal access is detected; the MPU stack protection monitoring module establishes communication with the OS task scheduler, and at the same time associates the MPU configuration interface and status reading interface to ensure that task information, SP (Stack Pointer) value and current MPU configuration status can be obtained in real time when switching tasks. S203, Execution of each task cycle; S204. When the OS triggers a task switch, obtain the task switch information; Specifically, the task scheduler of the OS obtains the current task to be exited, i.e. the identifier (Prev_Task_ID) and trust level (Prev_Security_Level) of the preceding task, and the task to be switched in, i.e. the identifier (Next_Task_ID) and trust level (Next_Security_Level) of the subsequent task; at the same time, the current stack pointer value (Current_SP) is read through the stack pointer register. S205. Determine whether the scene to be switched is the target scene. If yes, execute S207; otherwise, execute S206. Specifically, based on the trust levels of the preceding and subsequent tasks, it is determined whether the switching scenario is a scenario of switching from a trusted task to an untrusted task. If the value of Prev_Security_Level is 1 and the value of Next_Security_Level is 0, it is determined to be the target scenario. S206. Execute according to the normal task switching process, and keep the original configuration of the stack protection area. S207. Save the current MPU stack protection configuration; Specifically, the start address (Stack_Protect_Orig_Start), end address (Stack_Protect_Curr_End), and protection mode of the current MPU stack protection zone are read from the MPU stack protection monitoring module and stored in the temporary cache of the secure storage area to ensure that the MPU configuration can be accurately restored in the future. S208. Reinitialize the starting point of the MPU stack protected region; Specifically, the MPUC stack protection monitoring module calls the MPU configuration interface to reinitialize the starting address of the MPU stack protection region to the Current_SP value obtained by S204, while the preset ending address (Stack_Protect_Curr_End) remains unchanged. After reconfiguration, the range of the MPU stack protection region is [Current_SP, Stack_Protect_Curr_End]. This region covers the stack space that the untrusted task may access during execution and forms a strict boundary with the stack data area left by the trusted task. The MPU will strictly control the stack access range of the untrusted task. S209. Start targeted MPU stack monitoring; Specifically, the MPU stack protection monitoring module updates the MPU's monitoring rules and enables the highest level of monitoring for the reconfigured MPU stack protection area. This means that untrusted tasks are prohibited from accessing the stack space outside this area through MPU configuration. If an out-of-bounds access is detected, the MPU interrupt and the preset exception handling strategy are immediately triggered. S210, Complete task switching; Specifically, after the stack protection configuration is completed, the OS performs a task context switch, transferring CPU control to an untrusted task, which then executes within the newly configured stack protection boundary. S211. When the untrusted task completes execution, exits, and switches back to the original trusted task, obtain the identifier of the exited task and the corresponding identifier of the preceding task. S212, Read the cached MPU stack to protect the original configuration; Specifically, the MPU stack protection monitoring module reads the original MPU stack protection parameters saved in S207 from the temporary cache of the secure storage area; S213. Restore the original configuration of MPU stack protection; Specifically, the MPU configuration interface is called to restore the starting address, protection length, and protection mode of the MPU stack protection area to their original configurations. At the same time, the configuration data stored in the temporary cache is cleared to prevent residual data from affecting subsequent MPU configurations. S214. Resume trusted task execution; Specifically, after the stack protection configuration is restored, the OS loads the context of the original trusted task, that is, reads the retained call parameters, return addresses and other data from the stack, and the trusted task continues to execute under the original stack protection configuration.

[0046] This embodiment has at least the following advantages: First, by dynamically isolating at the MPU hardware level, it avoids the risk of trusted data on the stack being corrupted when a trusted task switches to an untrusted task, ensuring the integrity of critical data such as core control data and security status identifiers, and meeting the mandatory requirements of functional safety standards such as ISO 26262 and IEC 61508. Second, it does not require additional special hardware, making full use of the MPU unit standard in most embedded MCUs to achieve dynamic stack protection, applicable to various embedded systems, reducing system hardware costs and adaptation difficulty. Third, it only activates dynamic configuration for high-risk scenarios, while maintaining the original protection strategy in normal scenarios, avoiding unnecessary resource consumption, and supporting different types of embedded OS, such as FreeRTOS and Autosar OS, with wide adaptability. Fourth, by actively isolating stack data at the MPU hardware level rather than detecting it afterward, it significantly reduces system anomalies and functional failures caused by stack data corruption, significantly improving the functional safety level of embedded systems, especially suitable for scenarios with extremely high data security requirements such as automotive, industrial control, and aerospace fields.

[0047] Corresponding to the embodiments of the aforementioned methods, this application also provides embodiments of a task stack protection device and a terminal using the same: like Figure 3 As shown, Figure 3 This is a block diagram of a task stack protection device provided in an embodiment of this application. The device includes: Configuration module 31 is used to configure trust level parameters for tasks in the embedded system and configure the range of the MPU stack protection area during the embedded system initialization phase; the trust level parameters are used to distinguish between trusted tasks and untrusted tasks. The identification module 32 is used to identify the current switching scenario based on the trust level parameters of the task to be exited and the trust level parameters of the task to be switched into when the operating system triggers task switching. The adjustment module 33 is used to reconfigure the range of the MPU stack protection area when the current switching scene is the target scene, and then restrict the task to be switched to only access the reconfigured MPU stack protection area through MPU configuration. The reconfigured MPU stack protection area covers the expected access range of the untrusted task and does not overlap with the stack data area retained by the trusted task; the target scenario includes the scenario of switching from the trusted task to the untrusted task.

[0048] The specific implementation process of the functions and roles of each module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0049] This application also provides an electronic device, please refer to [link to application]. Figure 4 , Figure 4 This is a structural block diagram of an electronic device provided in an embodiment of this application. The electronic device may include a processor 410, a communication interface 420, a memory 430, and at least one communication bus 440. The communication bus 440 is used to enable direct communication between these components. In this embodiment, the communication interface 420 of the electronic device is used for signaling or data communication with other node devices. The processor 410 may be an integrated circuit chip with signal processing capabilities.

[0050] The processor 410 described above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor, or the processor 410 can be any conventional processor.

[0051] The memory 430 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc. The memory 430 stores computer-readable instructions. When these computer-readable instructions are executed by the processor 410, the electronic device can perform the aforementioned operations. Figure 1 The various steps involved in the method implementation examples.

[0052] Alternatively, the electronic device may also include a storage controller and an input / output unit.

[0053] The memory 430, storage controller, processor 410, peripheral interface, and input / output unit are electrically connected directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses 440. The processor 410 is used to execute executable modules stored in the memory 430, such as software function modules or computer programs included in electronic devices.

[0054] The input / output unit is used to provide users with the ability to create tasks and to set optional start periods or preset execution times for those tasks, thereby enabling user-server interaction. The input / output unit may be, but is not limited to, a mouse and keyboard.

[0055] Understandable. Figure 4 The structure shown is for illustrative purposes only; the electronic device may also include components that are more advanced than those shown. Figure 4 The more or fewer components shown, or having the same Figure 4 The different configurations shown. Figure 4 The components shown can be implemented using hardware, software, or a combination thereof.

[0056] This application also provides a storage medium storing instructions. When the instructions are run on a computer, the computer program is executed by a processor to implement the method described in the method embodiment. To avoid repetition, the method will not be described again here.

[0057] This application also provides a computer program product that, when run on a computer, causes the computer to perform the method described in the method embodiment.

[0058] This application also provides a vehicle including an embedded system; the embedded system includes a processor configured to perform the method described in the method embodiments.

[0059] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0060] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0061] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0062] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0063] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0064] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for protecting a task stack, characterized in that, include: Configure trust level parameters for tasks in the embedded system and configure the range of the MPU stack protection area; wherein, the trust level parameters are used to distinguish between trusted tasks and untrusted tasks; When the operating system triggers a task switch, the current switching scenario is identified based on the trust level parameters of the task to be exited and the task to be switched into. When the current switching scenario is the target scenario, the range of the MPU stack protection area is reconfigured, and then the task to be switched over is restricted to access only the reconfigured MPU stack protection area through MPU configuration. The reconfigured MPU stack protection area covers the expected access range of the untrusted task and does not overlap with the stack data area retained by the trusted task; the target scenario includes the scenario of switching from the trusted task to the untrusted task.

2. The method according to claim 1, characterized in that, The scope of the configured MPU stack protection area includes: Configure the starting address of the MPU stack protection region as the original starting address, and configure the ending address of the MPU stack protection region as the target ending address; Wherein, the original starting address is the starting address of the shared stack; the target ending address is determined based on the original starting address and the preset length of the shared stack.

3. The method according to claim 2, characterized in that, Adjusting the range of the MPU stack protection area includes: Adjust the starting address of the MPU stack protection region to the stack pointer value, while keeping the ending address of the MPU stack protection region unchanged; The stack pointer value is the current stack pointer value when the operating system triggers a task switch.

4. The method according to claim 2, characterized in that, Before adjusting the range of the MPU stack protection region, the method further includes: Read the current protection configuration parameters of the MPU stack protection area and store the protection configuration parameters in the temporary cache of the secure storage area; The protection configuration parameters include the start address, end address, and protection mode; After adjusting the range of the MPU stack protection region, the method further includes: When the task to be switched out exits and is switched back to the task to be exited, the saved protection configuration parameters are read from the temporary cache; Call the MPU configuration interface to restore the start address, end address, and protection mode of the MPU stack protection area to the configuration corresponding to the protection configuration parameters.

5. The method according to claim 1, characterized in that, The process of configuring trust level parameters for tasks in the embedded system includes: Configure a first parameter value as a trust level parameter for a trusted task in the embedded system, and configure a second parameter value as a trust level parameter for an untrusted task in the embedded system.

6. The method according to claim 5, characterized in that, in, The trust level parameters of the task to be exited and the trust level parameters of the task to be switched in are obtained from the task scheduler of the operating system by the MPU stack protection monitoring module; the MPU stack protection monitoring module establishes communication with the task scheduler during the embedded system initialization phase and associates the configuration interface and status reading interface of the MPU.

7. The method according to claim 5, characterized in that, The step of identifying the current switching scenario based on the trust level parameters of the task to be exited and the task to be switched in includes: If the trust level parameter of the task to be exited is the first parameter value, and the trust level parameter of the task to be switched to is the second parameter value, then the current switching scenario is identified as the target scenario.

8. A task stack protection device, characterized in that, include: The configuration module is used to configure trust level parameters for tasks in the embedded system and configure the range of the MPU stack protection area during the initialization phase of the embedded system. The trust level parameter is used to distinguish between trusted and untrusted tasks; The identification module is used to identify the current switching scenario based on the trust level parameters of the task to be exited and the task to be switched into when the operating system triggers a task switch. The adjustment module is used to reconfigure the range of the MPU stack protection area when the current switching scenario is the target scenario, and then restrict the task to be switched to only access the reconfigured MPU stack protection area through MPU configuration. The reconfigured MPU stack protection area covers the expected access range of the untrusted task and does not overlap with the stack data area retained by the trusted task; the target scenario includes the scenario of switching from the trusted task to the untrusted task.

9. A computer-readable storage medium, characterized in that, It stores a computer program thereon, which, when executed by a processor, implements the method as described in any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method as described in any one of claims 1 to 7.

11. A vehicle, characterized in that, The vehicle includes an embedded system; the embedded system includes a processor configured to perform the method as described in any one of claims 1 to 7.

Images