Method for detecting memory safety bug and electronic device supporting same

Abstract

An embodiment of the present disclosure provides a method for detecting a memory safety bug and an electronic device supporting same. An electronic device supporting multiple domains according to an embodiment may comprise: a memory for storing instructions; and hardware including a processor operable in a first domain and a second domain. According to an embodiment, the instructions may cause the electronic device to detect a shared memory use request by the first domain or the second domain. According to an embodiment, the instructions may cause the electronic device to allocate a shared memory for communication between domains including the first domain and the second domain on the basis of a memory area designated in the memory on the basis of the shared memory use request. According to an embodiment, the instructions may cause the electronic device to register a tag for the shared memory in a first memory area of the first domain and a second memory area of the second domain. According to an embodiment, the instructions may cause the electronic device to detect, on the basis of the tag, a memory safety bug for the shared memory shared between the first domain and the second domain.

Description

Methods for detecting memory safety bugs and electronic devices supporting the same

[0001] Embodiments of the present disclosure provide a method for detecting a memory safety bug and an electronic device supporting the same.

[0002] With the advancement of digital technology, various types of electronic devices, such as smartphones, digital cameras, and / or wearable devices, are becoming widely used. The hardware and / or software components of these electronic devices are continuously being developed to support and enhance their functionality.

[0003] Portable electronic devices (hereinafter referred to as "electronic devices"), such as smartphones, can now be equipped with a variety of applications (or functions), potentially increasing the use of memory for data used by these applications. This increased use of memory in electronic devices has raised concerns about ensuring memory safety (or memory security). For example, electronic devices may be vulnerable to memory security vulnerabilities due to memory safety bugs. For example, memory safety bugs can negatively impact the quality and stability of electronic devices and account for a significant portion of abnormal terminations observed in electronic devices.

[0004] The above information may be provided as background art to aid in understanding the present disclosure. No claim or determination is made as to whether any of the above is applicable as prior art related to the present disclosure.

[0005] Therefore, in electronic devices, it may be necessary to provide a technology that can detect (or sense) memory safety bugs and thereby enhance the security of memory.

[0006] In one embodiment of the present disclosure, a method for detecting a memory safety bug in an electronic device and an electronic device supporting the same are provided.

[0007] In one embodiment of the present disclosure, a method for detecting a memory safety bug in a multi-domain environment within an electronic device and an electronic device supporting the same are provided.

[0008] In one embodiment of the present disclosure, a method for detecting a memory safety bug between multiple domains using a memory tagging extension (MTE) in an electronic device supporting multiple domains and an electronic device supporting the same are provided.

[0009] The technical problems to be achieved in this document are not limited to the technical problems mentioned above, and other technical problems not mentioned can be clearly understood by a person having ordinary skill in the technical field to which the present invention belongs from the description below.

[0010] According to one embodiment of the present disclosure, an electronic device supporting multiple domains is provided. The electronic device may include a memory storing one or more computer programs, and one or more processors communicatively coupled to the memory, operable in a first domain and a second domain, and including processing circuitry. The one or more computer programs may include computer-executable instructions that, when individually or collectively executed by the one or more processors, cause the electronic device to perform the following:

[0011] According to one embodiment, the instructions, when individually or collectively executed by the processor, may cause the electronic device to detect a request to use shared memory by the first domain or the second domain. The instructions, when individually or collectively executed by the processor, may cause the electronic device to allocate shared memory for communication between multiple domains including the first domain and the second domain based on a memory area designated in the memory based on the shared memory use request. The instructions, when individually or collectively executed by the processor, may cause the electronic device to register a tag for the shared memory in a first memory area of ​​the first domain and a second memory area of ​​the second domain. The instructions, when individually or collectively executed by the processor, may cause the electronic device to detect a memory safety bug for the shared memory shared between the first domain and the second domain based on the tag.

[0012] An operating method of an electronic device supporting multiple domains according to one embodiment of the present disclosure may include an operation of detecting a request for use of shared memory by a first domain or a second domain. The operating method may include an operation of allocating shared memory for communication between multiple domains including the first domain and the second domain based on a memory area designated in a memory based on the shared memory use request. The operating method may include an operation of registering a tag for the shared memory in a first memory area of ​​the first domain and a second memory area of ​​the second domain. The operating method may include an operation of detecting a memory safety bug for the shared memory shared between the first domain and the second domain based on the tag.

[0013] In order to solve the above-described problem, various embodiments of the present disclosure may include a computer-readable recording medium having recorded thereon a program for executing the method on a processor.

[0014] According to one embodiment, one or more non-transitory computer-readable storage media are provided that store computer-executable instructions that cause one or more processors of an electronic device to perform operations when individually or collectively executed. The operations may include one or more programs: detecting a request to use shared memory by a first domain or a second domain; allocating shared memory for communication between multiple domains including the first domain and the second domain based on a memory area designated in a memory based on the shared memory use request; registering a tag for the shared memory in a first memory area of ​​the first domain and a second memory area of ​​the second domain; and detecting a memory safety bug for the shared memory shared between the first domain and the second domain based on the tag.

[0015] Further scope of the applicability of the present disclosure will become apparent from the detailed description below. However, since various modifications and variations within the spirit and scope of the present disclosure will readily become apparent to those skilled in the art, it should be understood that the detailed description and specific examples, such as preferred embodiments of the present disclosure, are given by way of example only.

[0016] According to an electronic device, its operating method, and a recording medium according to one embodiment of the present disclosure, memory shared between multiple domains can also be protected by a memory tagging extension (MTE). According to one embodiment, memory security bugs that may occur in a multi-domain environment can be effectively detected, thereby enhancing security.

[0017] According to one embodiment, in a multi-domain environment where a first domain (e.g., Android) operating as a host within an electronic device exists as a primary domain and a second domain (e.g., an additional environment such as a Trustzone, a Virtual Machine, a Secure Element, and / or a Secure processor / SEE (secure execution environment)) operates, when communication is required between the multiple domains through shared memory, it can be implemented so that there is no interference with the shared memory in the multiple domains. According to one embodiment, by effectively detecting a memory safety bug, abnormal termination due to a memory safety bug can be prevented, thereby improving the convenience of a user's use of the electronic device.

[0018] In addition, various effects may be directly or indirectly realized through this document. The effects obtained through this disclosure are not limited to those mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art to which this disclosure pertains, based on the description below.

[0019] In connection with the description of the drawings, the same or similar reference numerals may be used for identical or similar components.

[0020] FIG. 1 is a block diagram of an electronic device within a network environment according to various embodiments.

[0021] FIG. 2 is a diagram schematically illustrating the configuration of an electronic device according to one embodiment of the present disclosure.

[0022] FIG. 3 is a diagram illustrating an MTE technology used to detect memory safety bugs in an electronic device according to one embodiment.

[0023] FIG. 4 is a diagram illustrating an example of an architecture in an electronic device according to one embodiment.

[0024] FIG. 5 is a diagram illustrating an example of an operation for memory safety bug detection in a multi-domain environment supported by an electronic device according to one embodiment.

[0025] FIG. 6 is a diagram illustrating an example of an operation for memory safety bug detection in a multi-domain environment supported by an electronic device according to one embodiment.

[0026] FIG. 7 is a diagram illustrating an example of a method for supporting multi-domain memory safety bugs in an electronic device according to one embodiment of the present disclosure.

[0027] FIG. 8 is a diagram illustrating an example of a configuration for supporting a multi-domain memory safety bug in an electronic device according to one embodiment of the present disclosure.

[0028] FIG. 9 is a diagram illustrating an example operation of detecting a memory safety bug for shared memory in an electronic device according to one embodiment of the present disclosure.

[0029] FIG. 10 is a diagram illustrating an example operation of detecting a memory safety bug for shared memory in an electronic device according to one embodiment of the present disclosure.

[0030] FIG. 11 is a flowchart illustrating an operation method of an electronic device according to one embodiment of the present disclosure.

[0031] FIG. 12 is a flowchart illustrating an operation method of an electronic device according to one embodiment of the present disclosure.

[0032] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings so that those skilled in the art can easily implement the present disclosure. However, the present disclosure may be implemented in various different forms and is not limited to the embodiments described herein. In connection with the description of the drawings, the same or similar reference numerals may be used for identical or similar components. Furthermore, in the drawings and related descriptions, descriptions of well-known functions and configurations may be omitted for clarity and conciseness.

[0033] FIG. 1 is a block diagram of an electronic device (101) within a network environment (100) according to various embodiments.

[0034] Referring to FIG. 1, in a network environment (100), an electronic device (101) may communicate with an electronic device (102) via a first network (198) (e.g., a short-range wireless communication network), or may communicate with at least one of an electronic device (104) or a server (108) via a second network (199) (e.g., a long-range wireless communication network). According to one embodiment, the electronic device (101) may communicate with the electronic device (104) via the server (108). According to one embodiment, the electronic device (101) may include a processor (120), a memory (130), an input module (150), an audio output module (155), a display module (160), an audio module (170), a sensor module (176), an interface (177), a connection terminal (178), a haptic module (179), a camera module (180), a power management module (188), a battery (189), a communication module (190), a subscriber identification module (196), or an antenna module (197). In some embodiments, the electronic device (101) may omit at least one of these components (e.g., the connection terminal (178)), or may have one or more other components added. In some embodiments, some of these components (e.g., the sensor module (176), the camera module (180), or the antenna module (197)) may be integrated into one component (e.g., the display module (160)).

[0035] The processor (120) may, for example, execute software (e.g., a program (140)) to control at least one other component (e.g., a hardware or software component) of the electronic device (101) connected to the processor (120) and perform various data processing or operations. According to one embodiment, as at least a part of the data processing or operations, the processor (120) may store commands or data received from other components (e.g., a sensor module (176) or a communication module (190)) in a volatile memory (132), process the commands or data stored in the volatile memory (132), and store result data in a non-volatile memory (134). According to one embodiment, the processor (120) may include a main processor (121) (e.g., a central processing unit (CPU) or an application processor (AP)) or an auxiliary processor (123) (e.g., a graphic processing unit (GPU), a neural processing unit (NPU), an image signal processor (ISP), a sensor hub processor, or a communication processor (CP)) that can operate independently or together with the main processor (121). For example, when the electronic device (101) includes the main processor (121) and the auxiliary processor (123), the auxiliary processor (123) may be configured to use less power than the main processor (121) or to be specialized for a given function. The auxiliary processor (123) may be implemented separately from the main processor (121) or as a part thereof.

[0036] The auxiliary processor (123) may control at least a part of functions or states related to at least one component (e.g., a display module (160), a sensor module (176), or a communication module (190)) of the electronic device (101), for example, on behalf of the main processor (121) while the main processor (121) is in an inactive (e.g., sleep) state, or together with the main processor (121) while the main processor (121) is in an active (e.g., application execution) state. In one embodiment, the auxiliary processor (123) (e.g., an image signal processor or a communication processor) may be implemented as a part of another functionally related component (e.g., a camera module (180) or a communication module (190)). In one embodiment, the auxiliary processor (123) (e.g., a neural network processing unit) may include a hardware structure specialized for processing artificial intelligence models. The artificial intelligence models may be generated through machine learning. This learning can be performed, for example, on the electronic device (101) itself where the artificial intelligence model is executed, or can be performed through a separate server (e.g., server (108)). The learning algorithm can include, for example, supervised learning, unsupervised learning, semi-supervised learning, or reinforcement learning, but is not limited to the examples described above. The artificial intelligence model can include multiple artificial neural network layers.The artificial neural network may be one of a deep neural network (DNN), a convolutional neural network (CNN), a recurrent neural network (RNN), a restricted Boltzmann machine (RBM), a deep belief network (DBN), a bidirectional recurrent deep neural network (BRDNN), a deep Q-network, or a combination of two or more of the above, but is not limited to the examples described above. In addition to, or alternatively to, a hardware structure, an artificial intelligence model may include a software structure.

[0037] The memory (130) can store various data used by at least one component (e.g., processor (120) or sensor module (176)) of the electronic device (101). The data can include, for example, software (e.g., program (140)) and input data or output data for commands related thereto. The memory (130) can include volatile memory (132) or non-volatile memory (134).

[0038] The program (140) may be stored as software in the memory (130) and may include, for example, an operating system (OS) (142), middleware (144), or an application (146).

[0039] The input module (150) can receive commands or data to be used in a component of the electronic device (101) (e.g., a processor (120)) from an external source (e.g., a user) of the electronic device (101). The input module (150) can include, for example, a microphone, a mouse, a keyboard, a key (e.g., a button), or a digital pen (e.g., a stylus pen).

[0040] The audio output module (155) can output audio signals to the outside of the electronic device (101). The audio output module (155) can include, for example, a speaker or a receiver. The speaker can be used for general purposes, such as multimedia playback or recording playback. The receiver can be used to receive incoming calls. In one embodiment, the receiver can be implemented separately from the speaker or as part of the speaker.

[0041] The display module (160) can visually provide information to an external party (e.g., a user) of the electronic device (101). The display module (160) may include, for example, a display, a holographic device, or a projector and a control circuit for controlling the device. In one embodiment, the display module (160) may include a touch sensor configured to detect a touch, or a pressure sensor configured to measure the intensity of a force generated by the touch.

[0042] The audio module (170) can convert sound into an electrical signal, or vice versa, convert an electrical signal into sound. According to one embodiment, the audio module (170) can acquire sound through the input module (150), output sound through the sound output module (155), or an external electronic device (e.g., electronic device (102)) (e.g., speaker or headphone) directly or wirelessly connected to the electronic device (101).

[0043] The sensor module (176) can detect the operating status (e.g., power or temperature) of the electronic device (101) or the external environmental status (e.g., user status) and generate an electrical signal or data value corresponding to the detected status. According to one embodiment, the sensor module (176) can include, for example, a gesture sensor, a gyro sensor, a barometric pressure sensor, a magnetic sensor, an acceleration sensor, a grip sensor, a proximity sensor, a color sensor, an IR (infrared) sensor, a biometric sensor, a temperature sensor, a humidity sensor, or an illuminance sensor.

[0044] The interface (177) may support one or more designated protocols that may be used to directly or wirelessly connect the electronic device (101) with an external electronic device (e.g., the electronic device (102)). In one embodiment, the interface (177) may include, for example, a high definition multimedia interface (HDMI), a universal serial bus (USB) interface, a secure digital (SD) card interface, or an audio interface.

[0045] The connection terminal (178) may include a connector through which the electronic device (101) may be physically connected to an external electronic device (e.g., electronic device (102)). According to one embodiment, the connection terminal (178) may include, for example, an HDMI connector, a USB connector, an SD card connector, or an audio connector (e.g., a headphone connector).

[0046] A haptic module (179) can convert electrical signals into mechanical stimuli (e.g., vibration or movement) or electrical stimuli that a user can perceive through tactile or kinesthetic sensations. In one embodiment, the haptic module (179) can include, for example, a motor, a piezoelectric element, or an electrical stimulation device.

[0047] The camera module (180) can capture still images and videos. According to one embodiment, the camera module (180) may include one or more lenses, image sensors, image signal processors, or flashes.

[0048] The power management module (188) can manage power supplied to the electronic device (101). According to one embodiment, the power management module (188) can be implemented, for example, as at least a part of a power management integrated circuit (PMIC).

[0049] A battery (189) may power at least one component of the electronic device (101). In one embodiment, the battery (189) may include, for example, a non-rechargeable primary battery, a rechargeable secondary battery, or a fuel cell.

[0050] The communication module (190) may support the establishment of a direct (e.g., wired) communication channel or a wireless communication channel between the electronic device (101) and an external electronic device (e.g., electronic device (102), electronic device (104), or server (108)), and the performance of communication through the established communication channel. The communication module (190) may operate independently from the processor (120) (e.g., application processor) and may include one or more communication processors that support direct (e.g., wired) communication or wireless communication. According to one embodiment, the communication module (190) may include a wireless communication module (192) (e.g., a cellular communication module, a short-range wireless communication module, or a global navigation satellite system (GNSS) communication module) or a wired communication module (194) (e.g., a local area network (LAN) communication module, or a power line communication module). Among these communication modules, the corresponding communication module can communicate with an external electronic device (104) via a first network (198) (e.g., a short-range communication network such as Bluetooth, wireless fidelity (WiFi) direct, or infrared data association (IrDA)) or a second network (199) (e.g., a long-range communication network such as a legacy cellular network, a 5G network, a next-generation communication network, the Internet, or a computer network (e.g., a LAN or a wide area network (WAN))). These various types of communication modules can be integrated into a single component (e.g., a single chip) or implemented as multiple separate components (e.g., multiple chips). The wireless communication module (192) can verify or authenticate the electronic device (101) within a communication network such as the first network (198) or the second network (199) by using subscriber information (e.g., an international mobile subscriber identity (IMSI)) stored in the subscriber identification module (196).

[0051] The wireless communication module (192) can support 5G networks and next-generation communication technologies following the 4G network, such as NR access technology (new radio access technology). NR access technology can support high-speed transmission of high-capacity data (eMBB, enhanced mobile broadband), minimizing terminal power and connecting multiple terminals (mMTC, massive machine type communications), or high reliability and low latency communications (URLLC, ultra-reliable and low-latency communications). The wireless communication module (192) can support, for example, a high-frequency band (e.g., mmWave band) to achieve a high data transmission rate. The wireless communication module (192) can support various technologies for securing performance in a high-frequency band, such as beamforming, massive multiple-input and multiple-output (MIMO), full dimensional MIMO (FD-MIMO), array antenna, analog beam-forming, or large scale antenna. The wireless communication module (192) can support various requirements specified in the electronic device (101), an external electronic device (e.g., the electronic device (104)), or a network system (e.g., the second network (199)). According to one embodiment, the wireless communication module (192) can support a peak data rate (e.g., 20 Gbps or more) for eMBB realization, a loss coverage (e.g., 164 dB or less) for mMTC realization, or a U-plane latency (e.g., 0.5 ms or less for downlink (DL) and uplink (UL), or 1 ms or less for round trip) for URLLC realization.

[0052] The antenna module (197) can transmit or receive signals or power to or from an external device (e.g., an external electronic device). In one embodiment, the antenna module (197) may include an antenna including a radiator formed of a conductor or a conductive pattern formed on a substrate (e.g., a PCB). In one embodiment, the antenna module (197) may include a plurality of antennas (e.g., an array antenna). In this case, at least one antenna suitable for a communication method used in a communication network, such as the first network (198) or the second network (199), may be selected from the plurality of antennas by, for example, the communication module (190). A signal or power may be transmitted or received between the communication module (190) and an external electronic device through the selected at least one antenna. In some embodiments, in addition to the radiator, another component (e.g., a radio frequency integrated circuit (RFIC)) may be additionally formed as a part of the antenna module (197).

[0053] According to various embodiments, the antenna module (197) may form a mmWave antenna module. According to one embodiment, the mmWave antenna module may include a printed circuit board, an RFIC disposed on or adjacent a first side (e.g., a bottom side) of the printed circuit board and capable of supporting a designated high frequency band (e.g., a mmWave band), and a plurality of antennas (e.g., an array antenna) disposed on or adjacent a second side (e.g., a top side or a side side) of the printed circuit board and capable of transmitting or receiving signals in the designated high frequency band.

[0054] At least some of the above components can be interconnected and exchange signals (e.g., commands or data) with each other via a communication method between peripheral devices (e.g., a bus, GPIO (general purpose input and output), SPI (serial peripheral interface), or MIPI (mobile industry processor interface)).

[0055] According to one embodiment, commands or data may be transmitted or received between the electronic device (101) and an external electronic device (104) via a server (108) connected to a second network (199). Each of the external electronic devices (102 or 104) may be the same or a different type of device as the electronic device (101). According to one embodiment, all or part of the operations executed in the electronic device (101) may be executed in one or more of the external electronic devices (102, 104, or 108). For example, when the electronic device (101) is to perform a certain function or service automatically or in response to a request from a user or another device, the electronic device (101) may, instead of or in addition to executing the function or service itself, request one or more external electronic devices to perform the function or at least a part of the service. One or more external electronic devices that receive the request may execute at least a portion of the requested function or service, or an additional function or service related to the request, and transmit the result of the execution to the electronic device (101). The electronic device (101) may process the result as is or additionally and provide it as at least a portion of a response to the request. For this purpose, cloud computing, distributed computing, mobile edge computing (MEC), or client-server computing technology may be used, for example. The electronic device (101) may provide an ultra-low latency service by using distributed computing or mobile edge computing, for example. In another embodiment, the external electronic device (104) may include an Internet of Things (IoT) device. The server (108) may be an intelligent server using machine learning and / or a neural network. According to one embodiment, the external electronic device (104) or the server (108) may be included in the second network (199).The electronic device (101) can be applied to intelligent services (e.g., smart home, smart city, smart car, or healthcare) based on 5G communication technology and IoT-related technology.

[0056] FIG. 2 is a diagram schematically illustrating the configuration of an electronic device according to one embodiment of the present disclosure.

[0057] Referring to FIG. 2, an electronic device (101) according to one embodiment of the present disclosure may include a memory (130) (e.g., the memory (130) of FIG. 1) and a processor (120) (e.g., the processor (120) of FIG. 1). According to one embodiment, the electronic device (101) may include all or at least a portion of the components of the electronic device (101) as described in the description with reference to FIG. 1.

[0058] According to one embodiment, the memory (130) may correspond to the memory (130) of FIG. 1. According to one embodiment, the memory (130) may store various data used by at least one component (e.g., processor (120)) of the electronic device (101). In one embodiment, the data may include, for example, input data or output data for software (e.g., program (140) of FIG. 1 (e.g., operating system (142), middleware (144), and / or application (146) of FIG. 1), and commands related to the software.

[0059] According to one embodiment, the memory (130) may include a volatile memory (132) (e.g., the volatile memory (132) of FIG. 1) or a non-volatile memory (134) (e.g., the non-volatile memory (134) of FIG. 1). According to one embodiment, the memory (130) may store instructions or data received from the processor (120) in the volatile memory (132), and may store result data of instructions or data stored in the volatile memory (132) being processed by the processor (120) in the non-volatile memory (134).

[0060] According to one embodiment, the memory (130) is a dynamic memory (e.g., volatile memory, RAM, or DRAM) that can manage memory areas for software based on memory allocation or memory release. According to one embodiment, the memory (130) can be protected (e.g., to prevent memory handling errors in a programming language) through memory tagging extension (MTE) technology. In one embodiment, the MTE technology is described with reference to the drawings described below.

[0061] According to one embodiment, the memory (130) may store instructions that, when executed, cause the processor (120) to operate. For example, the instructions may be stored as software (e.g., the program (140) of FIG. 1) on the memory (130) and may be executable by the processor (120).

[0062] According to one embodiment, the processor (120) may perform an application layer processing function requested by a user of the electronic device (101). According to one embodiment, the processor (120) may provide control and commands of functions for various blocks of the electronic device (101). According to one embodiment, the processor (120) may perform operations or data processing related to control and / or communication of each component of the electronic device (101). For example, the processor (120) may include at least a portion of the configuration and / or functions of the processor (120) of FIG. 1. According to one embodiment, the processor (120) may be operatively connected to components of the electronic device (101). According to one embodiment, the processor (120) may load commands or data received from other components of the electronic device (101) into the memory (130), process the commands or data stored in the memory (130), and store result data.

[0063] In one embodiment, the processor (120) may include processing circuitry and / or executable program elements. In one embodiment, the processor (120) may control (or process) the overall operations related to detecting memory safety bugs in a multi-domain environment based on the processing circuitry and / or executable program elements.

[0064] According to one embodiment, the processor (120) may perform an operation corresponding to a control module (or controller) described below (e.g., the control module (800) of FIG. 8).

[0065] According to one embodiment, the detailed operation of the processor (120) (or control module (800)) of the electronic device (101) is described with reference to the drawings described below.

[0066] According to one embodiment, the processor (120) may operate individually and / or collectively. According to one embodiment, the processor (120) may include an application processor (410) and / or a communication processor (420). According to one embodiment, the communication processor (420) may be included and operated in the communication circuit (430).

[0067] According to one embodiment, the processor (120) may be an application processor (AP). According to one embodiment, the processor (120) may be a system semiconductor that performs operations and multimedia driving functions of the electronic device (101). According to one embodiment, the processor (120) may be configured in the form of a system-on-chip (SoC), and may include a technology-intensive semiconductor chip that integrates multiple semiconductor technologies into one and implements system blocks into a single chip.

[0068] According to one embodiment, the system blocks of the processor (120) may include a graphics processing unit (GPU) (210), an image signal processor (ISP) (220), a central processing unit (CPU) (230), a neural processing unit (NPU) (240), a digital signal processor (DSP) (250), a modem (260), a connectivity (270), and / or a security (280) block, as illustrated in FIG. 2.

[0069] According to one embodiment, the GPU (210) can perform graphics processing. According to one embodiment, the GPU (210) can receive commands from the CPU (230) and perform graphics processing to express the shape, position, color, shade, movement, and / or texture of objects (or objects) on the display.

[0070] In one embodiment, the ISP (220) can perform image processing and correction of images and videos. In one embodiment, the ISP (220) can correct unprocessed data (e.g., raw data) transmitted from an image sensor of a camera (e.g., the camera module (180) of FIG. 1) to generate an image in a form more preferred by the user. In one embodiment, the ISP (220) can perform post-processing, such as adjusting partial brightness of an image and emphasizing detailed parts. For example, the ISP (220) can independently perform a process of tuning and correcting the image quality of an image acquired through a camera to generate a result preferred by the user.

[0071] According to one embodiment, the ISP (220) may support artificial intelligence (AI)-based image processing technology. According to one embodiment, the ISP (220) may support scene segmentation (e.g., image segmentation) technology that recognizes and / or classifies parts of a scene being captured in conjunction with the NPU (240). For example, the ISP (220) may include a function that processes objects such as the sky, bushes, and / or skin by applying different parameters to them. According to one embodiment, the ISP (220) may detect and display a human face when capturing an image through the AI ​​function, or adjust the brightness, focus, and / or color of the image using the coordinates and information of the face.

[0072] According to one embodiment, the CPU (230) can perform functions corresponding to the processor (120). According to one embodiment, the CPU (230) can decode a user's command, perform arithmetic and logical operations, and / or data processing. For example, the CPU (230) can perform functions such as memory, interpretation, calculation, and control. According to one embodiment, the CPU (230) can control the overall function of the electronic device (101). For example, the CPU (230) can execute all software (e.g., application (146) of FIG. 1) of the electronic device (101) on an operating system (e.g., operating system (142) of FIG. 1) and control hardware devices. According to one embodiment, the CPU (230) can execute an application and control the overall operation of the processor (120) to perform neural network-based tasks required according to the execution of the application.

[0073] According to one embodiment, the CPU (230) may store instructions or data in volatile memory (132) of the memory (130), process the instructions or data stored in the volatile memory (132), and store result data in non-volatile memory (134) of the memory (130) as at least part of data processing or calculation.

[0074] According to one embodiment, the CPU (230) may include a single processor core or multiple processor cores (multi-core). According to one embodiment, the CPU (230) may be a programmable processor capable of storing executable instructions (e.g., instructions capable of performing operations of the CPU (230)) and executing the instructions. According to one embodiment, the CPU (230) may operate on multiple domains.

[0075] According to one embodiment, the CPU (230) can operate in a multi-domain environment of a normal world (e.g., a non-secure world, a framework, or a non-secure environment) and a secure world (e.g., a secure framework or a secure environment). In one embodiment, the domain of the secure world can include one or more domains (e.g., a trusted OS, a trustzone, and / or a virtualization framework). According to one embodiment, the CPU (230) can be shared among the multiple domains. According to one embodiment, the CPU (230) can detect a memory safety bug for the shared memory of the memory (130) (e.g., a dynamic memory) by using a memory tagging extension (MTE) capable of detecting a memory safety bug through the CPU (230). According to one embodiment, a detailed operation of detecting a memory safety bug is described with reference to the drawings described below.

[0076] According to one embodiment, the NPU (240) can perform processing optimized for artificial intelligence deep-learning algorithms. According to one embodiment, the NPU (240) is a processor optimized for deep-learning algorithm operations (e.g., artificial intelligence operations) and can process big data quickly and efficiently like a human neural network. For example, the NPU (240) can be mainly used for artificial intelligence operations. According to one embodiment, the NPU (240) can recognize objects, environments, and / or people in the background when taking a video through a camera and automatically adjust the focus, automatically switch the shooting mode of the camera module (180) to food mode when taking a picture of food, and / or perform processing to erase only unnecessary subjects from the captured results.

[0077] According to one embodiment, the electronic device (101) can support integrated machine learning processing by interacting with all processors such as the GPU (210), the ISP (220), the CPU (230), and the NPU (240).

[0078] In one embodiment, the DSP (250) may represent an integrated circuit that facilitates rapid processing of digital signals. In one embodiment, the DSP (250) may perform the function of converting analog signals into digital signals and performing high-speed processing.

[0079] In one embodiment, the modem (260) may enable various communication functions in the electronic device (101). For example, the modem (260) may support communications such as phone calls and data transmission and reception by exchanging signals with a base station. In one embodiment, the modem (260) may include an integrated modem (e.g., a cellular modem, an LTE modem, a 5G modem, a 5G-Advanced modem, and a 6G modem) that supports communication technologies such as long term evolution (LTE) and 2G to 5G. In one embodiment, the modem (260) may include an artificial intelligence modem that applies an artificial intelligence algorithm.

[0080] In one embodiment, the connectivity (270) may support wireless data transmission based on IEEE 802.11. In one embodiment, the connectivity (270) may support communication services based on IEEE 802.11 (e.g., Wi-Fi) and / or 802.15 (e.g., Bluetooth, ZigBee, UWB). For example, the connectivity (270) may support communication services targeting an unspecified number of people in a localized area, such as indoors, using an unlicensed band.

[0081] According to one embodiment, security (280) can provide an independent security execution environment between data or services stored in the electronic device (101). According to one embodiment, security (280) can prevent external hacking through software and hardware security during user authentication when providing services such as biometrics, mobile identification, and / or payment of the electronic device (101). For example, security (280) can provide an independent security execution environment for device security for reinforcing the security of the electronic device (101) itself and for security services based on user information such as mobile identification, payment, and car keys in the electronic device (101).

[0082] According to one embodiment, operations performed by the processor (120) (e.g., CPU (230)) may be implemented by executing instructions stored in a recording medium (or a computer program product or storage medium). For example, the recording medium may include a non-transitory computer-readable recording medium having recorded thereon a program for executing various operations performed by the processor (120).

[0083] The embodiments described in the present disclosure may be implemented in a computer-readable recording medium using software, hardware, or a combination thereof. In a hardware implementation, the operations described in one embodiment may be implemented using at least one of application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, micro-controllers, microprocessors, and / or other electrical units for performing functions.

[0084] In one embodiment, a computer-readable recording medium (or computer program product) is provided, which records a program that causes an electronic device (101) to perform (or execute) various operations. The operations may include an operation of providing shared memory for communication between multiple domains based on a memory area designated in a memory (130), and an operation of detecting a memory safety bug for the shared memory shared between the multiple domains through hardware (430, 760).

[0085] In one embodiment, the operations may include: receiving a shared memory allocation request from a first domain of the multi-domain; managing a table for converting addresses, and allocating a tag for the shared memory through address conversion in the table; setting a shared memory tag in the shared memory based on tag information related to the allocated tag; transmitting the shared memory allocation request to a second domain of the multi-domain; receiving a commit message from the second domain; determining whether a memory area for which an allocation request was made in the first domain matches a memory area for which an allocation request was made in the second domain; completing a final registration for the shared memory when the memory areas for which an allocation request was made match; and transmitting a registration completion response for shared memory having the same shared memory tag in the first domain and the second domain to the first domain and the second domain.

[0086] FIG. 3 is a diagram illustrating an MTE technology used to detect memory safety bugs in an electronic device according to one embodiment.

[0087] According to one embodiment, the memory tagging extension (MTE) technology is a technology (or function) that supports a memory protection function (or memory safety issue resolution) of a memory (130) (e.g., dynamic memory) in an electronic device (101), and may be, for example, a technology (or function) that can effectively detect a memory safety bug using hardware (e.g., hardware (430) of FIG. 4) (e.g., CPU (230), memory management unit (MMU)). For example, the MTE technology may include a technology that prevents a pointer (or variable) used to access a memory area (or memory space) from accessing a memory area other than the memory area for which allocation was requested.

[0088] In one embodiment, a pointer may represent a variable (or function) that designates an arbitrary address value in memory (130) (e.g., the address of a variable to be referenced). For example, in a programming language, a pointer may mean a variable (or function) that points to another variable, or the memory area address (or memory space address) of that variable.

[0089] According to one embodiment, FIG. 3 may illustrate an example of the basic operation of MTE technology. According to one embodiment, FIG. 3 illustrates an example in which a memory area corresponding to 16 bytes among the memory areas of the memory (130) is allocated, and a random tag is assigned to the memory area, so that access is permitted only for the memory area.

[0090] Referring to FIG. 3, in order to allow access to an area requested for allocation in a memory area (or space) of a memory (130) (e.g., volatile memory (132) of FIG. 2, dynamic memory, RAM or DRAM), a random tag (or tag value) may be assigned to the upper bit of a pointer (or function or variable) address when allocating a pointer (or function or variable) address, and the same tag may also be assigned to an actual memory address (S301). In one embodiment, the pointer address may include the first address (or first address value) of the memory area (or space) to be allocated (e.g., the start address of the allocated size (e.g., 16 bytes)) and the size (e.g., the size of the allocated memory area, such as 16 bytes). For example, the pointer address may be expressed as {start, size}, and the point address may mean the space of the allocated bytes at the first address of the allocated bytes. In one embodiment, a tag may be represented in one way recognizable by software (e.g., program (140) of FIG. 1), such as a specified color or a specified pattern, and may be defined as a value, for example, a color value representing a specified color or a pattern value representing a specified pattern.

[0091] According to one embodiment, color values ​​may be defined based on color codes associated with various colors. According to one embodiment, tags may be defined with codes such as “RRGGBB” indicating a specified color. For example, when representing a tag with the color “red,” the code “FF0000” indicating red may be used as the color value, when representing a tag with the color “blue,” the code “0000FF” indicating blue may be used as the color value, when representing a tag with the color “black,” the code “000000” indicating black may be used as the color value, and when representing a tag with the color “white,” the code “FFFFFF” indicating white may be used as the color value.

[0092] In one embodiment, a pattern value may represent a value that defines a pattern. For example, a pattern value may represent a structure of a value (e.g., a pattern) that is not in the form of a specific value, but rather a range of values ​​(e.g., (x, y) or (1, 2, ..., n)) of a pattern that can be processed (or understood) by software (e.g., a program (140) of FIG. 1) or an identifier of the pattern (e.g., n, where n is a natural number).

[0093] Thereafter, if an access (S302) occurs beyond the memory area allocated to the pointer (e.g., the address value area allocated to the pointer), access to the memory area beyond the memory area for which allocation was requested may not be permitted because the tag of the memory area beyond the memory area for which allocation was requested is different from the tag previously allocated. For example, if a tagged pointer is used, it is easier to detect incorrect use of the most significant byte of the pointer (e.g., detect a memory safety bug), and thus reject (or deny) the access. For example, detection of a memory safety bug may include detecting access to a memory area other than the memory area allocated by memory tagging (e.g., MTE).

[0094] Additionally, when a pointer is released from an allocated memory area (S303), the memory area may also be re-set to a different tag (or tag value). Therefore, subsequent access to the memory area using the same pointer may be denied (S304). For example, after a pointer is released, access using the same pointer may no longer be permitted even within the memory area of ​​the previously allocated address value because the tag value is set differently.

[0095] According to one embodiment, MTE technology is a technology for solving memory security issues, and can operate by tagging the memory area requested for allocation. Hardware (e.g., the CPU (230) of FIG. 2) can automatically verify that the correct tag is used whenever a memory access occurs in an application (e.g., an application in the non-secure world or an application in the secure world (e.g., trusted services)).

[0096] FIG. 4 is a diagram illustrating an example of an architecture in an electronic device according to one embodiment.

[0097] Referring to FIG. 4, the architecture (or framework) of an electronic device (101) according to one embodiment can be divided into a hardware layer (A) and a software layer (B).

[0098] In one embodiment, the hardware layer (A) may include at least one hardware (430) included in the electronic device (101). According to one embodiment, the hardware (430) may include a processor (120) (e.g., CPU (230) of FIG. 2) and / or an MMU (not shown). According to one embodiment, the hardware (430) (e.g., CPU (230) of FIG. 2) may store instructions (e.g., executable instructions or CPU instructions) that may perform operations related to pointer allocation / deallocation (e.g., load, store, add, sub, jump, halt, access, mov (move), push, pop). In one embodiment, the hardware (430) (e.g., the CPU (230) of FIG. 2) can read and compare tags in the memory area and pointers for each instruction that accesses the memory area. For example, the hardware (430) (e.g., the CPU (230) of FIG. 2) can verify that the correct tag is used whenever a memory access occurs in an application (e.g., an application in the non-secure world or an application in the secure world (e.g., trusted services)).

[0099] In one embodiment, the software layer (B) may be implemented through software (e.g., primarily a memory manager and allocator, such as a memory allocator) that calls instructions to allocate or free tags accordingly when allocating or freeing pointers. According to one embodiment, the software layer (B) may include an exception level 0 (EL0) layer (440), an EL1 layer (450), an EL2 layer (460), and an EL3 layer (470). According to one embodiment, the EL0 layer (440) may include an application layer. According to one embodiment, the EL1 layer (450) may include an operating system layer. According to one embodiment, the EL2 layer (460) may include a virtualization layer (or mode layer). According to one embodiment, the EL3 layer (470) may include a monitor layer.

[0100] According to one embodiment, the EL0 layer (440) and the EL1 layer (450) can be divided into a trusted execution environment (TEE). For example, the EL0 layer (440) and the EL1 layer (450) can be divided into two worlds, such as a non-secure (NS) world (410) (or non-secure environment, normal world, or framework) and a secure (S) world (420) (or secure environment, secure framework). For example, the two worlds can provide a multi-domain environment, such as a domain of the non-secure world (410) and one or more domains of the secure world (420).

[0101] In one embodiment, the EL0 layer (440) may include applications. In one embodiment, in the non-secure world (410), general applications (e.g., applications (441)) may run (or be executed), and in the secure world (420), trusted services (or applications), such as financial applications or services requiring information security (e.g., trusted services (443)) may run (or be executed).

[0102] In one embodiment, the EL1 layer (450) may include an operating system. For example, an operating system may be required to run applications (or services). In one embodiment, a general operating system (e.g., operating system (451)) (e.g., Android, Linux kernel) may run in the non-secure world (410), and a trusted operating system (e.g., secure OS (453)) (e.g., trusted OS, trustzone, virtual machine, secure element) may run in the secure world (420).

[0103] In one embodiment, the EL2 layer (460) may support a mode (465) required to execute an operating system and / or application (or service) of the EL1 layer (450). For example, the EL2 layer (460) may support a hypervisor mode (e.g., a virtual machine monitor or a virtual machine manager), which is a logical platform for executing multiple operating systems (or multiple domains) simultaneously. According to one embodiment, the EL2 layer (460) may support a privileged mode, which is related to detecting memory safety bugs in shared memory between multiple domains. In one embodiment, the hypervisor mode may be supported in the non-secure world (410) and / or the secure world (420), and the privileged mode may be supported in the secure world (420). In one embodiment, the commands available in hypervisor mode may be limited, while in privileged mode, all commands of the hardware (430) may be available without any restrictions. According to one embodiment, an example of a configuration to support privileged mode is described below.

[0104] In one embodiment, the EL3 layer (470) may include a monitor (e.g., monitor (475)), which is a class (or gate) for protecting information. According to one embodiment, the monitor (475) of the EL3 layer (470) may control switching between the non-secure world (410) and the secure world (420).

[0105] As illustrated in FIG. 4, the hardware (430) (e.g., CPU (230), MMU) of the hardware layer (A) can be shared between multiple domains according to the non-secure world (410) and the secure world (420), and the software of the software layer (B) can be separated into the non-secure world (410) and the secure world (420) in the EL0 layer (440) and the EL1 layer (450), respectively.

[0106] Recently, as the security environment within electronic devices (101) has diversified, multiple security architectures / frameworks are being supported. For example, in addition to the existing operating system-based mobile environment, trust zones and virtualization frameworks have been added as security frameworks, enabling support for multiple domains (or frameworks) within the electronic device (101). Such an environment can be defined as a multi-domain environment. Below, MTE technology in a multi-domain environment is described.

[0107] FIGS. 5 and 6 are diagrams illustrating an example of operation for memory safety bug detection in a multi-domain environment supported by an electronic device according to one embodiment.

[0108] According to one embodiment, FIGS. 5 and 6 illustrate examples of security vulnerabilities of MTE technology in a multi-domain environment divided into a first domain (510) and a second domain (520).

[0109] Referring to FIG. 5, in a multi-domain environment, the MTE implementation is such that a first domain (510) (e.g., Domain-1) protects (e.g., protected by domain-1 MTE (560)) a memory area (530) (e.g., domain-1 memory) belonging to the first domain (510), and a second domain (520) (e.g., domain-2) protects (e.g., protected by domain-2 MTE (570)) a memory area (540) (e.g., domain-2 memory) belonging to the second domain (520), which can be managed through hardware (430) (e.g., MMU). Additionally, a portion of the memory (130) within the electronic device (101) called shared memory (550) (e.g., shared memory) may be designated between the first domain (510) and the second domain (520) to be used for communication purposes between multiple domains (e.g., the first domain (510) and the second domain (520)).

[0110] In one embodiment, the shared memory (550) may belong to a domain that has requested communication (e.g., a first domain (510) or a second domain (520)). In one embodiment, FIG. 5 illustrates an example in which communication is requested by the first domain (510) and the shared memory (550) belongs to the first domain (510).

[0111] According to the example of FIG. 5, the shared memory (550) may be allocated to the first domain (510) that requested communication and may be protected by a tag of the first domain (510). However, if the sanity and permission for the portion transferred to the second domain (520) are insufficient, a memory safety bug may not be detected for a memory operation requested by the second domain (520). For example, in the case of the shared memory (550), it is designated by a tag of the first domain (510), and the pointer control requested by the second domain (520) may not be performed normally. For example, since the shared memory (550) is not an allocated memory area in the second domain (520), the pointer requested by the second domain (520) may not have a tag (or tag information) for the shared memory (550). Therefore, since the pointer requested by the second domain (520) does not contain tag information, the shared memory (550) may not be protected by MTE technology. For example, hardware (430) (e.g., MMU) belonging to the second domain (520) may not be able to detect a memory safety bug. An example of this is illustrated in FIG. 6.

[0112] As illustrated in FIG. 6, a memory operation (e.g., tag (610) tagging) allocated in a first domain (510) (e.g., domain-1) allows only normal memory access (S601) due to the MTE of the first domain (510), and a memory safety bug (S603) that is not a permitted memory operation can be detected by the MTE of the first domain (510). Similarly, a memory operation (e.g., tag (620) (e.g., yellow) tagging) allocated in a second domain (520) (e.g., domain-2) allows only normal memory access (S605) due to the MTE of the second domain (520), and a memory safety bug (S607) that is not a permitted memory operation can be detected by the MTE of the second domain (520).

[0113] According to one embodiment, as illustrated in FIG. 6, when the operating system (e.g., secure OS, trusted OS) of the second domain (520) is registered (S609) through the shared memory (550) in the first domain (510), the memory operation (e.g., tag (610)) allocated in the first domain (510) may not be tagged (e.g., hatched area (630)) in the second domain (520). For example, the shared memory (550) may be simply mapped to the hardware (430) (e.g., MMU) belonging to the second domain (520). In this case, the shared memory (550) may not be controlled by the first domain (510) and may be registered in the second domain (520) with a size larger than the memory allocated (e.g., hatching area (630)), and a memory safety bug (S611) accessed through the mapped shared memory (550) in the second domain (520) may not be protected. For example, the second domain (520) does not have a tagged memory area, and the shared memory (550) may not be protected by the MTEs of the first domain (510) and the second domain (520). Therefore, in this case, due to a memory operation (e.g., tagging of a tag (630) (e.g., red)) due to a malicious memory safety bug (S611), an error is propagated (S613) from the second domain (520) to the first domain (510), so that the memory of the first domain (610) (e.g., the memory area (530) belonging to the first domain (510) of FIG. 5) is compromised and can be exploited by being exposed to the memory safety bug.

[0114] As described above, the registration of shared memory (550) is difficult to control across multiple domains, and a programmer's mistake or attack code may cause the registration of a shared memory (e.g., hatching area (630)) larger than the size allowed for the actual domain (e.g., first domain (510) or second domain (520)) when registering the shared memory (550), and other domains (e.g., second domain (520) or first domain (510)) may not be able to distinguish this. Due to such an undetected memory safety bug (e.g., attack) situation, a response to a user's input (e.g., identification information, financial information, or personal information) in a service running in the second domain (520) may be leaked to the first domain (510). For example, in a situation where identification information (e.g., ID) is input through shared memory (550) and then secret information (e.g., password, financial information, or personal information) is computed in a second domain through a continuous memory area, the secret information may be propagated to the shared memory (550) through a memory security bug, thereby exposing user secret information in the first domain (510).

[0115] In one embodiment, the above describes an example of two multi-domains, one from the non-secure world and one from the secure world, but it can include three or more multi-domain environments. For example, the secure world domain can include one or more multiple domains. For example, if there are three or more domains, if memory operations are registered from the first domain to the second and third domains for the same memory area, the mutual memory security between the second and third domains may not be guaranteed due to the security vulnerability described above. In this case, a multiple error propagation situation may occur, such as the memory security of the third domain not being guaranteed by the second domain.

[0116] According to one embodiment of the present disclosure, a method for configuring a multi-domain memory architecture and implementing software using MTE technology is provided to detect a memory safety bug in an environment where the domain environment within an electronic device (101) is diversified (e.g., a multi-domain environment).

[0117] FIG. 7 is a diagram illustrating an example of a method for supporting multi-domain memory safety bugs in an electronic device according to one embodiment of the present disclosure.

[0118] FIG. 8 is a diagram illustrating an example of a configuration for supporting a multi-domain memory safety bug in an electronic device according to one embodiment of the present disclosure.

[0119] Referring to FIG. 7, FIG. 7 may illustrate an example of configuring an EL2 layer (e.g., EL2 layer (460) of FIG. 4) for detecting memory safety bugs between multiple domains in an electronic device (101) that supports multiple domains, such as a first domain (710) (e.g., linux kernel) of a non-secure world (A) and a second domain (720) (e.g., trustzone), a third domain (730) (e.g., virtual machine) and a fourth domain (740) (e.g., secure element) of a secure world (B).

[0120] The multi-domain environment according to the embodiment of the present disclosure is not limited to the multi-domain environment illustrated in FIG. 7, and the multi-domain environment illustrated in FIG. 7 is merely a specific example presented to help understand the present disclosure and is not intended to limit the scope of the present disclosure. For example, the multi-domain environment may include other multi-domain environments that are not mentioned. According to one embodiment, the multi-domain environment may be implemented in various multi-domain environments based on different multiple domains, such as a non-secure world (A) with multiple domains and memory safety bug detection between multiple domains within the non-secure world (A), memory safety bug detection between multiple domains within the secure world (B), and / or memory safety bug detection between domains of the non-secure world (A) and the secure world (B), and is not limited to the above-described examples.

[0121] As illustrated in FIG. 7, a multi-domain environment such as a first domain (710), a second domain (720), a third domain (730), and a fourth domain (740) is configured in the EL1 layer, and a plurality of modes (750) required to execute operating systems and / or applications (or services) related to the multiple domains (710, 720, 730, 740) may be supported in the EL2 layer. For example, the EL2 layer may support a hypervisor mode, which is a logical platform for simultaneously executing multiple operating systems (or multiple domains), and a privileged mode related to detecting memory safety bugs in shared memory between multiple domains. In one embodiment, the hypervisor mode may be supported in the non-secure world (A) and / or the secure world (B), and the privileged mode may be supported in the secure world (B).

[0122] In one embodiment, the commands that can be used in hypervisor mode may be restricted, but in privileged mode, all commands of the hardware (760) may be available without restrictions. For example, the electronic device (101) may perform limited operations of shared memory based on privileged mode operations in the EL2 layer. According to one embodiment, the electronic device (101) may include a control module (or controller) for supporting privileged mode (e.g., the control module (800) of FIG. 8). An example of this is illustrated in FIG. 8.

[0123] Referring to FIG. 8, the EL2 layer (e.g., mode (750)) may include a control module (800) to support a privileged mode capable of detecting memory safety bugs in shared memory across multiple domains. In one embodiment, the control module (800) may be a controller capable of monitoring and detecting memory safety bugs that are exploited across multiple domains. For example, the control module (800) may perform operations of requesting, registering, managing, and / or rejecting shared memory.

[0124] According to one embodiment, the control module (800) (or controller) may include an interface (810) (e.g., a memory API interface), a management module (or manager) (820), and a tag processing module (830) (or tag agent) (e.g., a shared memory tag). In one embodiment, the interface (810) may be a configuration that checks memory requests, permissions, and tag information. In one embodiment, the management module (820) may be a manager that processes requests transmitted through the interface (810). In one embodiment, the tag processing module (830) may be a tag agent that detects memory safety bugs for shared memory. According to one embodiment, an operation of detecting a memory safety bug for shared memory using the control module (800) is described with reference to the drawings described below.

[0125] Referring to FIGS. 7 and 8, an electronic device (101) according to one embodiment may protect a memory area belonging to a first domain (710) of a non-secure world (A), and may protect memory areas belonging to a second domain (720), a third domain (730), and a fourth domain (740) of a secure world (B), as described in the description referring to FIG. 5 above. According to one embodiment, the electronic device (101) may manage and protect memory (e.g., element 701) for a memory area belonging to each of the multiple domains. For example, each of the domains (710, 720, 730, 740) may monitor and detect memory safety bugs of the corresponding domain while directly transmitting instructions (e.g., CPU instructions) to hardware (760) (e.g., MMU). For example, an operation according to element 701 may represent an operation of detecting a memory safety bug using an MTE in each domain.

[0126] According to one embodiment, the electronic device (101) can be configured to manage shared memory that is not managed in each domain (710, 720, 730, 740) through a control module (800) of the EL2 layer, as indicated by element 702, and to monitor and detect memory safety bugs in shared memory that are invaded between multiple domains. For example, the operation according to element 702 can represent an operation of detecting memory safety bugs using MTE between multiple domains.

[0127] According to one embodiment, the electronic device (101) may include operations capable of requesting, registering, managing, and rejecting shared memory via the control module (800), as represented by element 702. For example, the electronic device (101) may be configured with a memory manager / allocator corresponding to each domain (710, 720, 730, 740) in the EL1 layer (e.g., operating system layer). For example, the electronic device (101) may be implemented with the control module (800) in the EL2 layer (e.g., mode layer).

[0128] FIGS. 9 and 10 are diagrams illustrating an example operation of detecting a memory safety bug for shared memory in an electronic device according to one embodiment of the present disclosure.

[0129] According to one embodiment, FIG. 9 may illustrate an example of operations for requesting, registering, and managing shared memory in an electronic device (101) according to one embodiment.

[0130] In the following examples, the operations may be performed sequentially, but are not necessarily sequential. For example, the order of the operations may be changed, and at least two operations may be performed in parallel.

[0131] According to one embodiment, FIG. 9 may illustrate an example of an operation when requesting a security service (e.g., a user authentication service such as biometrics, mobile ID, or payment) from a first domain (910) to a second domain (920). According to one embodiment, a command between multiple domains, such as requesting a security service from the first domain (910) to the second domain (920), may be transmitted, for example, via shared memory. According to one embodiment, when a security service is used between multiple domains, a memory area to be used as shared memory may be allocated in the first domain (910) requesting the security service and may be registered in the second domain (920). For example, according to one embodiment of the present disclosure, the electronic device (101) may detect a memory security bug for the shared memory through related tag registration between multiple domains. Conventionally, tags can only be registered for the first domain (910), and tag registration is not possible in the second domain (920), making it impossible to detect a memory security bug.

[0132] Referring to FIG. 9, in operation 901, the first domain (910) may transmit a shared memory allocation request to the control module (800) (e.g., the interface (810)). According to one embodiment, the first domain (910) may transmit a shared memory allocation request according to service execution to the control module (800) for supporting the privileged mode of the EL2 layer. According to one embodiment, the first domain (910) may request shared memory allocation by transmitting memory information (e.g., information indicating {start, size}) for a memory area belonging to the first domain (910) to the control module (800).

[0133] In operation 903, the control module (800) (e.g., interface (810), management module (820)) may perform page table management and tag allocation in response to a shared memory allocation request received from the first domain (910). In one embodiment, the page table may represent a system for translating addresses. For example, the page table may represent a table that stores page information of a process (or task).

[0134] According to one embodiment, a page table may exist for every program of the electronic device (101), and the CPU (230) may read information in the table from the start address of the page table. For example, the memory of a process may be divided into pages, and the actual physical memory may also be divided into pages, and the divided physical memory may be called a page or page frame. For example, a virtual page number (VPN) may be mapped to a physical frame number (PFN), and a table for such mapping may be called a page table. According to one embodiment, each process may independently have its own page table. According to one embodiment, the page table is managed by the operating system, and hardware (e.g., MMU) may access and read it. The page table according to one embodiment will be described below.

[0135] According to one embodiment, the control module (800) may receive a shared memory allocation request from the first domain (910) via the interface (810). According to one embodiment, the interface (810) may forward the shared memory allocation request to the management module (820) to manage (e.g., create) a page table. According to one embodiment, the management module (820) of the control module (800) may assign a tag to a designated memory area of ​​the shared memory through address translation (e.g., page-walk modification) in the page table. According to one embodiment, the management module (820) may assign a tag to the shared memory and return it to the interface (810).

[0136] In operation 905, the interface (810) of the control module (800) may transmit a registration request to the tag processing module (830) of the control module (800) in response to the tag of the shared memory being assigned by the management module (820). According to one embodiment, the interface (810) may transmit memory information (e.g., information indicating {start, size}) and tag information to the tag processing module (830) and request registration.

[0137] In operation 907, the tag processing module (830) (or tag agent) of the control module (800) receives a registration request from the interface (810), and configures a page table (e.g., configures {start, size, tag information}) based on the memory information and tag information received along with the registration request, thereby registering and managing shared memory in the page table. For example, the tag processing module (830) may set a tag for a memory area of ​​the first domain in the shared memory based on the memory information and tag information.

[0138] In operation 909, the tag processing module (830) of the control module (800) may transmit a registration completion response to the interface (810) in response to completing the page table registration.

[0139] In operation 911, the interface (810) of the control module (800) may receive a registration completion response indicating that shared memory registration is complete, and may transmit a shared memory allocation request to the second domain (920).

[0140] In operation 913, the second domain (920) may receive a shared memory allocation request from the control module (800) (e.g., the interface (810)) and transmit a commit message to the control module (800) (e.g., the interface (810)) for shared memory mapping to a memory area belonging to the second domain (920). According to one embodiment, the second domain (920) may include memory information (e.g., {start, size} information) allocated by the second domain (920) (e.g., a memory manager / allocator) in the commit message and transmit the information to the interface (810).

[0141] In operation 915, the interface (810) of the control module (800) may receive a commit message from the second domain (920) and determine whether the memory area for which the first domain (910) requested allocation in operation 901 and the memory area for which the second domain (920) requested allocation in operation 913 match. For example, the interface (810) may determine whether memory information (e.g., {start, size} information for which the first domain (910) requested allocation) requested by the first domain (910) and registered in the tag processing module (830) match the memory information (e.g., {start, size} information for which the second domain (920) requested allocation).

[0142] In operation 917, the control module (800) (e.g., interface (810), management module (820)) may complete the final registration. According to one embodiment, if the memory areas requested for allocation in the first domain (910) and the second domain (920) match, the interface (810) may transmit a registration request to the management module (820), and the management module (820) may complete the final registration for the memory areas requested for allocation.

[0143] In operation 919, the interface (810) of the control module (800) transmits a tag registration request to the second domain (920) in response to completing the final registration, and the second domain (920) can register a shared memory having the same tag as the tag registered in the first domain (910).

[0144] In operation 921, the interface (810) of the control module (800) transmits a registration completion response to the first domain (910) in response to completing the final registration, and the first domain (910) can receive a response indicating that the requested shared memory registration has been completed.

[0145] As illustrated in FIG. 9, the electronic device (101) can register and manage memory areas having the same tag in the first domain (910) and the second domain (920) through the control module (800), and transmit a response regarding the completion of registration to the first domain (910) and the second domain (920). Through this, memory areas having the same tag in the first domain (910) and the second domain (920) are registered, and when a shared memory operation is performed, a memory safety bug can be detected for both the first domain (910) and the second domain (920), and when a memory safety bug is detected, the corresponding access can not be permitted, unlike in the past. An example of this is illustrated in FIG. 10.

[0146] As illustrated in FIG. 10, a memory area (e.g., shared memory (1000)) requested for allocation in a first domain (1010) (e.g., domain-1) may first be requested for registration in an EL1 layer (e.g., secure OS) of a second domain (1020) to a control module (800) (e.g., tag processing module (830)) of an EL2 layer (S1001). In the EL2 layer, a tag (1030) may be recorded corresponding to the memory area requested for allocation by the first domain through the control module (800) (e.g., tag processing module (830)), and in the same manner, the tag (1030) may be registered as a shared memory (1000) in an EL1 layer (e.g., secure OS) of the second domain (1020) (S1002). For example, the control module (800) may perform shared memory mapping in the second domain (1020).

[0147] According to one embodiment, in the EL1 layer (e.g., secure OS) of the second domain (1020), unlike the operation illustrated in FIG. 6, the second domain (1020) can allocate and manage memory based on tag information identical to that of the first domain (1010). Through this, the second domain (1020) can also protect against memory security bugs accessed through shared memory (1000). Accordingly, the memory security bug (S1003) in the first domain (910) and the memory security bug (S1004) in the second domain (920) can be detected.

[0148] According to one embodiment, an example of a shared memory tag (e.g., tag (1030)) managed by a control module (800) of the EL2 layer (e.g., tag processing module (830)) is illustrated in .

[0149] Domain IDMemory addressMemory sizeMemory tagID 10xffff_ffff_0000_00000x1000xaaID 30xffff_ffff_0000_10000x1000xabID 20xffff_ffff_0000_20000x4000xacID 40xffff_ffff_0000_30000x1000xba

[0150] According to one embodiment, as described in the description with reference to FIGS. 9 and 10, the EL2 layer of a domain of the secure world (e.g., the second domain) may include a control module (800). According to one embodiment, the control module (800) (or controller) may include an interface (810), a management module (820) (or manager), and a tag processing module (830) (or tag agent). According to one embodiment, the interface (810) may perform a shared memory request and permission check transmitted from another domain of the secure world or another domain of the non-secure world (e.g., the first domain). According to one embodiment, the electronic device (101) may perform a memory address translation (e.g., page-walk) procedure through the management module (820) for a request transmitted through the interface (810), and finally register a shared memory tag through the tag processing module (830).

[0151] According to one embodiment, the tag processing module (830) may configure a shared memory tag including a domain identification number (e.g., domain ID) of the requested domain, a shared memory address (e.g., memory address), a shared memory size (e.g., memory size), and a tag (e.g., a random tag value (e.g., 16 bits)) assigned to the shared memory, as illustrated in . In one embodiment, the tag may be defined as a designated value recognizable by software (e.g., the program (140) of FIG. 1), such as a color value indicating a designated color or a pattern value indicating a designated pattern.

[0152] According to one embodiment, color values ​​may be defined based on color codes associated with various colors. According to one embodiment, tags may be defined with codes such as “RRGGBB” indicating a specified color. For example, when representing a tag with the color “red,” the code “FF0000” indicating red may be used as the color value, when representing a tag with the color “blue,” the code “0000FF” indicating blue may be used as the color value, when representing a tag with the color “black,” the code “000000” indicating black may be used as the color value, and when representing a tag with the color “white,” the code “FFFFFF” indicating white may be used as the color value.

[0153] In one embodiment, a pattern value may represent a value that defines a pattern. For example, a pattern value may represent a range of values ​​of a pattern or an identifier of a pattern that software (e.g., a program (140) of FIG. 1) can process (or understand) rather than a specific value form (e.g., a pattern).

[0154] According to one embodiment, although not included in Table 1, the shared memory tag may further include a translation address (e.g., a stage-2 translation address) required for intermediate address translation in the EL2 layer.

[0155] An electronic device (101) supporting multiple domains according to one embodiment of the present disclosure may include hardware (430, 760) including at least one processor (e.g., CPU (230) of FIG. 2) including processing circuitry operable in a first domain and a second domain, and a memory (130) that stores instructions that cause the electronic device (101) to perform operations when individually and / or collectively executed by the at least one processor.

[0156] According to one embodiment, the instructions, when executed by the processor (230), may cause the electronic device (101) to detect a request for use of shared memory by the first domain or the second domain. According to one embodiment, the instructions, when executed by the processor (230), may cause the electronic device (101) to allocate shared memory for communication between multiple domains including the first domain and the second domain based on a memory area designated in the memory (130) based on the shared memory use request. According to one embodiment, the instructions, when executed by the processor (230), may cause the electronic device (101) to register a tag for the shared memory in a first memory area of ​​the first domain and a second memory area of ​​the second domain. According to one embodiment, the instructions, when executed by the processor (230), may cause the electronic device (101) to detect a memory safety bug for the shared memory shared between the first domain and the second domain based on the tag.

[0157] In one embodiment, the multiple domains may include a domain of a non-secure world (410) and a domain of a secure world (420). In one embodiment, the domain of the non-secure world (410) and the domain of the secure world (420) may include one or more domains.

[0158] According to one embodiment, the instructions may cause the electronic device (101) to detect a memory safety bug for the shared memory using a memory tagging extension (MTE) capable of detecting a memory safety bug through the hardware (430, 760).

[0159] According to one embodiment, each of the multiple domains may be comprised of a software layer and a hardware layer. According to one embodiment, the hardware layer may be shared across the multiple domains. According to one embodiment, the software layer may be differentiated for each of the multiple domains and may include an application layer (440), an operating system layer (450), a virtualization layer (460), and a monitor layer (470).

[0160] According to one embodiment, the virtualization layer (460) may operate in a privileged mode capable of performing limited operations of the shared memory, and may include a controller (800) (e.g., a control module (800)) that monitors and detects memory safety bugs that are exploited between the multiple domains.

[0161] According to one embodiment, the controller (800) can process operations of requesting, registering, managing, and / or rejecting the shared memory.

[0162] According to one embodiment, the controller (800) may include an interface (810) that checks memory requests, permissions, and tag information. According to one embodiment, the controller (800) may include a manager (e.g., a management module (820)) that processes requests transmitted through the interface. According to one embodiment, the controller (800) may include a tag agent (e.g., a tag processing module (830)) that detects memory security bugs for the shared memory.

[0163] According to one embodiment, the tag agent can manage a table based on the identification number of the domain that requested to allocate a memory area for shared memory, the memory address, the memory size, the tag that requested to allocate the shared memory, and / or the translation address.

[0164] According to one embodiment, the controller (800) may receive a shared memory allocation request from a first domain of the multi-domain. According to one embodiment, the controller (800) may manage a table for converting addresses and assign tags to shared memory through address conversion in the table. According to one embodiment, the controller (800) may set a shared memory tag in the shared memory based on tag information related to the assigned tag. According to one embodiment, the controller (800) may transmit the shared memory allocation request to a second domain of the multi-domain. According to one embodiment, the controller (800) may receive a commit message from the second domain.

[0165] According to one embodiment, the controller (800) can determine whether the memory area requested for allocation in the first domain and the memory area requested for allocation in the second domain match. According to one embodiment, the controller (800) can complete the final registration for the shared memory if the memory areas requested for allocation match. According to one embodiment, the controller (800) can transmit a registration completion response for the shared memory having the same shared memory tag in the first domain and the second domain to the first domain and the second domain.

[0166] According to one embodiment, a memory area having the same tag in the shared memory can be registered by the first domain and the second domain.

[0167] In one embodiment, the controller (800) can detect a memory security bug for each multi-domain based on the registered tag. In one embodiment, if a memory security bug is detected, the control module (800) can deny access to a memory area by the corresponding domain due to a tag mismatch.

[0168] According to one embodiment, the hardware (430, 760) may include a programmable first processor (e.g., CPU (230) of FIG. 2) that stores executable instructions and is capable of executing the instructions. According to one embodiment, the hardware (430, 760) may include a second processor (e.g., MMU) that manages memory allocation and deallocation for each of the multiple domains. According to one embodiment, the first processor and the second processor may be shared between the multiple domains.

[0169] According to one embodiment, the memory (130) may include dynamic memory used in the operation of the first processor.

[0170] Hereinafter, the operating method of the electronic device (101) according to various embodiments will be described in detail. The operations performed in the electronic device (101) according to various embodiments may be executed by the processor (120) including various processing circuitry and / or executable program elements of the electronic device (101). According to one embodiment, the operations performed in the electronic device (101) may be stored as instructions in the memory (130) and individually and / or collectively executed by the processor (120).

[0171] FIG. 11 is a flowchart illustrating an operation method of an electronic device according to one embodiment of the present disclosure.

[0172] According to one embodiment, FIG. 11 may illustrate an example of operations for allocating, registering, and managing shared memory between multiple domains in an electronic device (101) according to one embodiment.

[0173] An operation method supported by an electronic device (101) (e.g., a control module (800) (or controller) of FIG. 8 or 9) according to an embodiment of the present disclosure may be performed, for example, according to a flowchart illustrated in FIG. 11. The flowchart illustrated in FIG. 11 is an example according to an embodiment of an operation of the electronic device (101), and the order of at least some operations may be changed or performed in parallel, performed as independent operations, or at least some other operations may be performed complementarily to at least some operations. According to an embodiment of the present disclosure, operations 1101 to 1155 may be performed by a control module (e.g., a control module (800) (or controller) of FIG. 8 or 9) of the electronic device (101) and / or at least one processor (e.g., a processor (120) of FIG. 1 or 2).

[0174] According to one embodiment, the operations described in FIG. 11 may be heuristically performed in combination with the operations described in FIGS. 7 to 10, for example, or heuristically performed as a replacement for at least some of the operations described and combined with at least some other operations, or heuristically performed as a detailed operation of at least some of the operations described.

[0175] As illustrated in FIG. 11, an operation method performed by an electronic device (101) according to an embodiment may include an operation of receiving a shared memory allocation request from a first domain (1101), an operation of performing page table management and tag allocation (1103), an operation of configuring a page table based on memory information and tag information (1105), an operation of registering shared memory (1107), an operation of requesting shared memory allocation to a second domain (1109), an operation of receiving a commit message from the second domain (1111), an operation of comparing memory areas (1113), and an operation of performing shared memory registration between multiple domains based on memory area matching (1115).

[0176] Referring to FIG. 11, in operation 1101, the control module (800) (or controller) of the electronic device (101) may receive a shared memory allocation request from the first domain. According to one embodiment, the first domain may transmit the shared memory allocation request to the control module (800) of the EL2 layer according to the execution of a service (or application). According to one embodiment, the shared memory allocation request of the first domain may include memory information (e.g., information indicating {start, size}) for a memory area belonging to the first domain.

[0177] In operation 1103, the control module (800) may perform page table management and tag allocation. According to one embodiment, the control module (800) may, in response to a shared memory allocation request from the first domain, allocate a shared memory tag to a designated memory area of ​​the shared memory in the page table.

[0178] In operation 1105, the control module (800) may configure a page table based on memory information and tag information. According to one embodiment, in response to the allocation of a shared memory tag, the control module (800) may register memory information (e.g., information indicating {start, size}) and tag information (e.g., a random tag value (e.g., a color value or a pattern value)).

[0179] In operation 1107, the control module (800) may register shared memory. According to one embodiment, the control module (800) may configure a page table (e.g., configure {start, size, tag information}) and register and manage shared memory in the page table. For example, the control module (800) may set a shared memory tag for a memory area of ​​the first domain in the shared memory based on the memory information and tag information.

[0180] In operation 1109, the control module (800) may request a shared memory allocation to the second domain. In one embodiment, in response to completing the shared memory registration, the control module (800) may forward the shared memory allocation request to the second domain of the multi-domain.

[0181] In operation 1111, the control module (800) may receive a commit message from the second domain. In one embodiment, the second domain may, in response to a shared memory allocation request from the control module (800), transmit a commit message for mapping shared memory to a memory area belonging to the second domain to the control module (800). In one embodiment, the commit message may include memory information (e.g., {start, size} information) allocated by the second domain.

[0182] In operation 1113, the control module (800) may compare memory areas. According to one embodiment, in response to receiving a commit message, the control module (800) may determine whether the memory area requested for allocation by the first domain matches the memory area requested for allocation by the second domain. For example, the control module (800) may determine whether memory information requested by the first domain and managed by the control module (830) (e.g., {start, size} information requested for allocation by the first domain) matches the memory information requested by the second domain via the commit message (e.g., {start, size} information requested for allocation by the second domain).

[0183] In operation 1115, the control module (800) may perform shared memory registration between multiple domains based on memory area matching. According to one embodiment, if the memory areas requested for allocation by the first domain and the second domain match, the control module (800) may complete the final registration for the memory area for which allocation has been requested. According to one embodiment, in response to completing the final registration, the control module (800) may transmit a response regarding the completion of the shared memory registration to the first domain and the second domain. For example, the control module (800) may transmit a tag registration request to the second domain, and the second domain may register a shared memory having the same tag as the tag registered in the first domain. For example, the control module (800) may transmit a registration completion response to the first domain, and the first domain may confirm that the registration of the shared memory for which allocation has been requested has been completed.

[0184] FIG. 12 is a flowchart illustrating an operation method of an electronic device according to one embodiment of the present disclosure.

[0185] According to one embodiment, FIG. 12 may illustrate an example of an operation for allocating shared memory between multiple domains (e.g., a first domain and a second domain) and detecting a memory safety bug for the shared memory in an electronic device (101) according to one embodiment.

[0186] An operation method supported by an electronic device (101) (e.g., a control module (800) (or controller) of FIG. 8 or 9) according to an embodiment of the present disclosure may be performed, for example, according to a flowchart illustrated in FIG. 12. The flowchart illustrated in FIG. 12 is an example according to an embodiment of an operation of the electronic device (101), and the order of at least some operations may be changed or performed in parallel, performed as independent operations, or at least some other operations may be performed complementarily to at least some operations. According to an embodiment of the present disclosure, operations 1201 to 1207 may be performed by a control module (e.g., a control module (800) (or controller) of FIG. 8 or 9) of the electronic device (101) and / or at least one processor (e.g., a processor (120) of FIG. 1 or 2).

[0187] According to one embodiment, the operations described in FIG. 12 may be heuristically performed in combination with the operations described in FIGS. 7 to 11, for example, or heuristically performed as a replacement for at least some of the operations described and combined with at least some other operations, or heuristically performed as a detailed operation of at least some of the operations described.

[0188] As illustrated in FIG. 12, an operation method performed by an electronic device (101) according to an embodiment may include an operation (1201) of detecting a request for use of shared memory by a first domain or a second domain, an operation (1203) of allocating shared memory for communication between multiple domains including the first domain and the second domain based on a designated memory area based on the request for use of shared memory, an operation (1205) of registering a tag for the shared memory in a first memory area of ​​the first domain and a second memory area of ​​the second domain, and an operation (1207) of detecting a memory safety bug for the shared memory shared between the first domain and the second domain based on the tag.

[0189] Referring to FIG. 12, in operation 1201, the control module (800) (or controller) of the electronic device (101) may detect a shared memory usage request by the first domain or the second domain. According to one embodiment, the control module (800) may receive a shared memory allocation request according to the execution of a service (or application) from the first domain or the second domain. According to one embodiment, the shared memory allocation request may include memory information (e.g., information indicating {start, size}) for a memory area (e.g., the first memory area or the second memory area) belonging to the corresponding domain (e.g., the first domain or the second domain).

[0190] In operation 1203, the control module (800) may allocate shared memory for communication between multiple domains including the first domain and the second domain based on a memory area designated in the memory (130) based on a shared memory usage request. According to one embodiment, the control module (800) may allocate shared memory for the purpose of communication between multiple domains (e.g., the first domain and the second domain) by designating a portion of the memory (130) of the electronic device (101).

[0191] In operation 1205, the control module (800) may register a tag for shared memory in a first memory area of ​​a first domain and a second memory area of ​​a second domain. According to one embodiment, the control module (800) may assign a tag to a designated memory area of ​​the shared memory in response to a request for using the shared memory. According to one embodiment, the control module (800) may operate to set the same tag for the shared memory in each memory area of ​​the multiple domains based on memory information (e.g., information indicating {start, size}) for each memory area belonging to the multiple domains (e.g., the first domain and the second domain) related to the use of the shared memory.

[0192] According to one embodiment, the control module (800) may compare memory information of the first domain (e.g., {start, size} information requested for allocation by the first domain) with memory information of the second domain (e.g., {start, size} information requested for allocation by the second domain). According to one embodiment, the control module (800) may operate so that the first domain and the second domain register shared memory having the same tag when the memory areas requested for allocation by the first domain and the second domain match.

[0193] In operation 1207, the control module (800) may perform an operation to detect a memory safety bug for shared memory shared between the first domain and the second domain based on the tag.

[0194] According to one embodiment of the present disclosure, as described in the description with reference to FIG. 12, the control module (800) may monitor tags for shared memory and perform related operations (e.g., reading, comparing, and / or detecting). According to one embodiment of the present disclosure, the operation corresponding to the control module (800) may monitor tags when accessing shared memory and perform related operations (e.g., reading, comparing, and / or detecting) through hardware (430) including an MMU, as described in the description with reference to FIG. 4 and FIG. 5.

[0195] An operating method performed in an electronic device (101) supporting multiple domains according to one embodiment of the present disclosure may include an operation of detecting a shared memory usage request by a first domain or a second domain. According to one embodiment, the operating method may include an operation of allocating shared memory for communication between multiple domains including the first domain and the second domain based on a memory area designated in a memory (130) based on the shared memory usage request. According to one embodiment, the operating method may include an operation of registering a tag for the shared memory in a first memory area of ​​the first domain and a second memory area of ​​the second domain. According to one embodiment, the operating method may include an operation of detecting a memory safety bug for the shared memory shared between the first domain and the second domain based on the tag.

[0196] In one embodiment, the multiple domains may include a domain of a non-secure world (410) and a domain of a secure world (420). In one embodiment, the domain of the non-secure world (410) and the domain of the secure world (420) may include one or more domains.

[0197] According to one embodiment, the operating method may include an operation of detecting a memory safety bug for the shared memory using a memory tagging extension (MTE) capable of detecting a memory safety bug through the hardware (430, 760).

[0198] According to one embodiment, each of the multiple domains may be comprised of a software layer and a hardware layer. According to one embodiment, the hardware layer may be shared across the multiple domains. According to one embodiment, the software layer may be differentiated for each of the multiple domains and may include an application layer (440), an operating system layer (450), a virtualization layer (460), and a monitor layer (470).

[0199] According to one embodiment, the virtualization layer (460) may operate in a privileged mode capable of performing limited operations of the shared memory, and may include a controller (e.g., control module (800)) that monitors and detects memory safety bugs that are exploited between the multiple domains.

[0200] According to one embodiment, the method of operation may include, by the controller, operations of requesting, registering, managing, and / or rejecting the shared memory.

[0201] According to one embodiment, the operating method may include an operation of receiving a shared memory allocation request from a first domain of the multi-domain. According to one embodiment, the operating method may include an operation of managing a table for converting addresses and assigning a tag for the shared memory through address conversion in the table. According to one embodiment, the operating method may include an operation of setting a shared memory tag in the shared memory based on tag information related to the assigned tag. According to one embodiment, the operating method may include an operation of transmitting a shared memory allocation request to a second domain of the multi-domain. According to one embodiment, the operating method may include an operation of receiving a commit message from the second domain.

[0202] According to one embodiment, the operating method may include an operation of determining whether a memory area requested for allocation in the first domain and a memory area requested for allocation in the second domain match. According to one embodiment, the operating method may include an operation of completing a final registration for the shared memory if the memory areas requested for allocation match. According to one embodiment, the operating method may include an operation of transmitting a registration completion response for a shared memory having the same shared memory tag in the first domain and the second domain to the first domain and the second domain.

[0203] According to one embodiment, the operating method may include an operation of registering a memory area having the same tag in the shared memory by the first domain and the second domain.

[0204] In one embodiment, the operating method may include an operation for detecting a memory security bug for each multi-domain based on the registered tag. In one embodiment, the operating method may include an operation for denying access to a memory area by the corresponding domain due to a tag mismatch when a memory security bug is detected.

[0205] In one embodiment of the present disclosure, a non-transitory computer-readable medium storing instructions that, when executed by a processor (230) of an electronic device (101), cause the processor (230) to perform operations, the instructions, when executed by the processor, may cause the electronic device to perform the following operations: detecting a request for use of shared memory by a first domain or a second domain; allocating shared memory for communication between multiple domains including the first domain and the second domain based on a memory area designated in a memory (130) based on the request for use of shared memory; registering a tag for the shared memory in a first memory area of ​​the first domain and a second memory area of ​​the second domain; and detecting a memory safety bug for the shared memory shared between the first domain and the second domain based on the tag.

[0206] Electronic devices according to the various embodiments disclosed in this document may take various forms. Electronic devices may include, for example, portable communication devices (e.g., smartphones), computer devices, portable multimedia devices, portable medical devices, cameras, wearable devices, or home appliances. Electronic devices according to the embodiments of this document are not limited to the aforementioned devices.

[0207] The various embodiments of this document and the terminology used therein are not intended to limit the technical features described in this document to specific embodiments, but should be understood to include various modifications, equivalents, or substitutes of the embodiments. In connection with the description of the drawings, similar reference numerals may be used for similar or related components. The singular form of a noun corresponding to an item may include one or more of the items, unless the context clearly indicates otherwise. In this document, each of the phrases “A or B,” “at least one of A and B,” “at least one of A or B,” “A, B, or C,” “at least one of A, B, and C,” and “at least one of A, B, or C” may include any one of the items listed together in the corresponding phrase among those phrases, or all possible combinations thereof. Terms such as “first,” “second,” or “first” or “second” may be used merely to distinguish one component from another, and do not limit the components in any other respect (e.g., importance or order). When a component (e.g., a first component) is referred to as “coupled” or “connected” to another component (e.g., a second component), with or without the terms “functionally” or “communicatively,” it means that the component can be connected to the other component directly (e.g., wired), wirelessly, or through a third component.

[0208] The term "module" used in various embodiments of this document may include a unit implemented in hardware, software, or firmware, and may be used interchangeably with terms such as logic, logic block, component, or circuit. A module may be an integral component, or a minimum unit or part of such a component that performs one or more functions. For example, according to one embodiment, a module may be implemented in the form of an application-specific integrated circuit (ASIC).

[0209] Various embodiments of the present document may be implemented as software (e.g., a program (140)) including one or more instructions stored in a storage medium (e.g., an internal memory (136) or an external memory (138)) readable by a machine (e.g., an electronic device (101)). For example, a processor (e.g., a processor (120)) of the machine (e.g., an electronic device (101)) may call at least one instruction among the one or more instructions stored from the storage medium and execute it. This enables the machine to operate to perform at least one function according to the at least one called instruction. The one or more instructions may include code generated by a compiler or code executable by an interpreter. The machine-readable storage medium may be provided in the form of a non-transitory storage medium. Here, 'non-transitory' simply means that the storage medium is a tangible device and does not contain signals (e.g., electromagnetic waves), and the term does not distinguish between cases where data is stored semi-permanently or temporarily on the storage medium.

[0210] According to one embodiment, the method according to various embodiments disclosed in this document may be provided as a computer program product. The computer program product may be traded between sellers and buyers as a product. The computer program product may be distributed in the form of a device-readable storage medium (e.g., compact disc read-only memory (CD-ROM)) or may be provided through an application store (e.g., Play Store). TM ) or directly between two user devices (e.g., smart phones), online distribution (e.g., downloading or uploading). In the case of online distribution, at least a portion of the computer program product may be at least temporarily stored or temporarily created in a machine-readable storage medium, such as the memory of a manufacturer's server, an application store's server, or an intermediary server.

[0211] According to various embodiments, each component (e.g., a module or a program) of the above-described components may include one or more entities, and some of the entities may be separated and arranged in other components. According to various embodiments, one or more components or operations of the aforementioned components may be omitted, or one or more other components or operations may be added. Alternatively or additionally, a plurality of components (e.g., a module or a program) may be integrated into a single component. In such a case, the integrated component may perform one or more functions of each of the plurality of components identically or similarly to those performed by the corresponding component among the plurality of components prior to the integration. According to various embodiments, the operations performed by a module, program, or other component may be executed sequentially, in parallel, iteratively, or heuristically, or one or more of the operations may be executed in a different order, omitted, or one or more other operations may be added.

[0212] The various embodiments of the present disclosure disclosed in this specification and drawings are merely specific examples to facilitate easy explanation of the technical content of the present disclosure and aid understanding of the present disclosure, and are not intended to limit the scope of the present disclosure. Therefore, the scope of the present disclosure should be interpreted to include all modifications or variations derived based on the technical concepts of the present disclosure, in addition to the embodiments disclosed herein.

Claims

1. In an electronic device supporting multiple domains, At least one processor operable in a first domain and a second domain, the processor comprising processing circuitry; and Contains memory that stores instructions, The above instructions, when individually or collectively executed by the at least one processor, cause the electronic device to: Detecting a request for shared memory use by the first domain or the second domain, Based on the above shared memory usage request, shared memory is allocated for communication between multiple domains including the first domain and the second domain based on a memory area designated in the memory, Registering a tag for the shared memory in the first memory area of ​​the first domain and the second memory area of ​​the second domain, and An electronic device for detecting a memory safety bug for the shared memory shared between the first domain and the second domain based on the tag.

2. In paragraph 1, The above multi-domain includes a domain of the non-secure world and a domain of the secure world, An electronic device, wherein the domain of the above non-secure world and the domain of the above secure world include one or more domains.

3. In the first paragraph, when the instructions are individually or collectively executed by the at least one processor, the electronic device, An electronic device that detects memory safety bugs for shared memory by using a memory tagging extension (MTE) capable of detecting memory safety bugs through hardware.

4. In paragraph 1, Each of the above multi-domains consists of a software layer and a hardware layer, The above hardware layer is shared for the above multi-domain, The above software layer is divided into the above multi-domain and includes an application layer, an operating system layer, a virtualization layer, and a monitor layer.

5. In paragraph 4, The above virtualization layer operates in a privileged mode that can perform limited operations of the shared memory, An electronic device, wherein the virtualization layer includes a controller that monitors and detects memory safety bugs that are exploited between the multiple domains.

6. An electronic device according to claim 5, wherein the instructions, when individually or collectively executed by the at least one processor, cause the electronic device to process operations of requesting, registering, managing, and / or rejecting the shared memory.

7. In paragraph 5, the controller, Interface for checking memory requests, permissions and tag information; A manager that processes requests transmitted through the above interface; An electronic device comprising a tag agent for detecting memory safety bugs in said shared memory.

8. In paragraph 7, the tag agent, An electronic device set to manage a table based on the identification number of the domain requesting allocation of a memory area for shared memory, the memory address, the memory size, the tag requested for allocation to the shared memory, and / or the translation address.

9. In the 7th paragraph, when the instructions are individually or collectively executed by the at least one processor, the electronic device, Receive a shared memory allocation request from the first domain of the above multi-domain, Manage a table for address translation, and assign tags to shared memory through address translation in the table. Setting a shared memory tag in the shared memory based on tag information related to the above allocated tag, Forwards a shared memory allocation request to the second domain of the multi-domain, Receive a commit message from the second domain, Determine whether the memory area requested for allocation in the first domain and the memory area requested for allocation in the second domain match, If the requested memory area matches, the final registration for the shared memory is completed. An electronic device that transmits a registration completion response for a shared memory having the same shared memory tag in the first domain and the second domain to the first domain and the second domain.

10. In paragraph 9, An electronic device characterized in that a memory area having the same tag in the shared memory is registered by the first domain and the second domain.

11. In the 9th paragraph, the instructions, when individually or collectively executed by the at least one processor, cause the electronic device to: Detecting the multi-domain memory safety bug based on the above registered tags, An electronic device that denies access to memory regions by domains with mismatched tags when a memory safety bug is detected.

12. In paragraph 1, The electronic device comprises hardware, the hardware comprising: A programmable first processor storing executable instructions and executing said instructions; and A second processor is included to manage the allocation and release of memory for each of the above multi-domains, An electronic device, wherein the first processor and the second processor are shared between multiple domains.

13. In the 12th paragraph, the memory, An electronic device characterized by including a dynamic memory used in the operation of the first processor.

14. In a method of operating an electronic device supporting multiple domains, Action to detect a request to use shared memory by either the first or second domain; An operation of allocating shared memory for communication between multiple domains including the first domain and the second domain based on a memory area specified in the memory based on the shared memory usage request; An operation of registering a tag for the shared memory in the first memory area of ​​the first domain and the second memory area of ​​the second domain; and A method comprising an action of detecting a memory safety bug for the shared memory shared between the first domain and the second domain based on the tag.

15. A non-transitory computer-readable medium storing instructions that, when individually or collectively executed by a processor of an electronic device, cause the processor to perform operations, The above instructions, when executed by the processor, cause the electronic device to: Action to detect a request to use shared memory by the first or second domain; An operation of allocating shared memory for communication between multiple domains including the first domain and the second domain based on a memory area designated in the memory (130) based on the shared memory usage request. An operation of registering a tag for the shared memory in the first memory area of ​​the first domain and the second memory area of ​​the second domain, and A recording medium that performs an operation of detecting a memory safety bug for the shared memory shared between the first domain and the second domain based on the above tag.

Images