Memory protection unit with security delegation

Abstract

A memory protection unit with security delegation is provided. A memory protection unit (MPU) configuration request may be received, wherein the MPU configuration request may include a memory protection rule. A first entry in the first MPU circuit that matches the memory protection rule may be determined. A compliance result may be determined based on checking whether the memory protection rule conforms to the first entry. A memory protection rule may be written into the second MPU circuit based on the compliance result.

Description

Technical Field

[0001] The present disclosure relates generally to computer systems and more particularly to a memory protection unit utilizing security delegation. Background Art

[0002] A memory protection unit (MPU) may refer to a circuit device that can be used to enforce a set of memory protection rules for accessing a memory device. The memory protection rules in the set may specify lower and upper address limits for a memory region, as well as the access permissions applicable to the memory region. The MPU may enforce the set of memory protection rules when the memory device is accessed. BRIEF DESCRIPTION OF THE DRAWINGS

[0003] The present disclosure will be more fully understood from the detailed description given below and the accompanying drawings of the embodiments of the present disclosure. The drawings are intended to provide knowledge and understanding of the embodiments of the present disclosure and are not intended to limit the scope of the present disclosure to these specific embodiments. Further, the drawings are not necessarily drawn to scale.

[0004] Figure 1A A system according to some embodiments described herein is shown.

[0005] Figure 1B Circuitry for secure delegation is shown according to some embodiments described herein.

[0006] Figure 2A A process for MPU configuration utilizing secure delegation is shown according to some embodiments described herein.

[0007] Figure 2B Circuitry for an MPU configuration utilizing secure delegation is shown, according to some embodiments described herein.

[0008] Figure 3A Another process for MPU configuration utilizing secure delegation is shown in accordance with some embodiments described herein.

[0009] Figure 3B Another circuit for an MPU configuration utilizing secure delegation is shown according to some embodiments described herein.

[0010] Figure 4 A collection of example processes for converting and verifying design data and instructions representing an integrated circuit during the design, verification, and manufacture of an article of manufacture, such as an integrated circuit, is shown.

[0011] Figure 5An example machine of a computer system is shown within which a set of instructions, for causing the machine to perform any one or more of the methodologies discussed herein, may be executed. DETAILED DESCRIPTION

[0012] Aspects of the present disclosure relate to a memory protection unit utilizing security delegation. A computer system (e.g., an embedded computer system running a real-time operating system) may include hardware resources that may be used by multiple software stacks. The software stacks may not trust each other, so it is important to ensure that a particular hardware resource is only accessible to the software stack that has been explicitly granted permission to access the hardware resource.

[0013] The MPU can be used to enforce a memory protection rule set. Specifically, the MPU can include multiple entries, each of which can correspond to a memory protection rule in the memory protection rule set, and each of which can store a lower address limit and an upper address limit for a memory region and access permissions applicable to the memory region. The entries in the MPU can be populated with address regions and corresponding access permissions during a configuration phase, and the MPU can use the entries to enforce the memory protection rule set during an operation phase.

[0014] It may be desirable to enable a software stack to partition hardware resources in a hierarchical manner. A first software entity (which may include, but is not limited to, a process or thread running on a processing device) may pass control to a second software entity. The term "passing control" may refer to a context switch, for example, when a first software entity passes control to a second software entity, the operation of the first software entity may be paused or terminated, and the operation of the second software entity may be resumed or started. The term "delegator" may refer to the first software entity that passes control, and the term "delegate" may refer to the second software entity to which control is passed. For example, a parent process (first software entity) may create a child process (second software entity) and pass control to the child process. In this example, the parent process is the delegator and the child process is the delegate.

[0015] The delegator can set lower and upper limits for the memory area accessible to the assignee, and then pass control to the assignee to refine the lower and upper limits of the memory area (for example, based on the actual memory used by the assignee). It is desirable to ensure that the assignee cannot expand the memory area allocated to the assignee beyond the lower and upper limits set by the delegator. The term "delegater-assignee hierarchy" can refer to a scenario in which there are multiple levels of assignees, where an assignee at a particular level in the delegator-assignee hierarchy can act as a delegator for an assignee at the next level in the delegator-assignee hierarchy. The term "ancestor" can refer to a delegator at one or more previous levels in the previous level in the delegator-assignee hierarchy. For example, if a first process delegates to a second process, and the second process delegates to a third process, the first process and the second process can be referred to as the ancestors of the third process in the delegator-assignee hierarchy.

[0016] Some MPUs allow delegates to configure the MPU without respecting the boundaries set by the delegator. In these MPUs, two MPUs are checked during the operational phase—a first MPU configured by the delegator and a second MPU configured by the delegate. Memory access is allowed only if both MPUs approve it. Otherwise, the memory access is denied and an error is reported. In these systems, multiple MPUs are used, with a separate MPU for each level in the delegate hierarchy, and multiple MPUs are checked during the operational phase. Having multiple MPUs in the system and checking multiple MPUs during the operational phase increases the silicon area and power consumption of the system, which is disadvantageous.

[0017] Some embodiments described herein feature circuitry for use during an MPU configuration phase. The functionality of the circuitry may include, but is not limited to, the following: (1) upon receiving a request to configure the MPU with an entry, the memory address region and access permissions associated with the entry may be checked against the set of memory protection rules currently enforced by the MPU; (2) if the memory region and / or access permissions are found to violate the set of memory protection rules currently enforced by the MPU, the request to configure the MPU with the entry may be denied and an error may be reported; and (3) on the other hand, if the memory region and access permissions do not violate the set of memory protection rules currently enforced by the MPU, the request to configure the MPU with the entry may be allowed and the entry may be added to the MPU, or an existing entry in the MPU may be replaced with the received entry.

[0018] In some embodiments described herein, a delegator may configure an MPU with a set of memory-mapped resources. The delegator may then pass control to a delegate, which may continue to configure the MPU and may pass control to its own delegate, and so on, thereby creating a delegator-delegate hierarchy. The embodiments described herein ensure that a delegate can only reduce the amount of allocated memory-mapped resources and / or access to the memory-mapped resources, but the delegate may never increase the amount of allocated memory-mapped resources and / or access to the memory-mapped resources configured by any of the delegate's ancestors in the delegator-delegate hierarchy. In other words, regardless of the number of delegation levels in the delegator-delegate hierarchy, the embodiments described herein ensure that a delegate cannot configure an MPU to increase the amount of memory resources and / or access to the memory resources allocated by its ancestors in the delegator-delegate hierarchy. Therefore, the embodiments described herein use only a constant number of MPUs (e.g., one MPU or two MPUs, depending on the implementation), and the number of MPUs used in the system does not increase proportionally with the number of delegation levels in the delegator-delegate hierarchy.

[0019] The technical advantages of the embodiments described herein may include, but are not limited to: (1) reducing silicon area by eliminating the need to use multiple MPUs when the delegator-assignee hierarchy has multiple levels; (2) reducing power consumption by eliminating the need to check multiple MPUs during the operation phase when the delegator-assignee hierarchy has multiple levels; and (3) improving the security of systems using MPUs by ensuring that an assignee cannot configure an MPU to increase the amount of memory resources and / or access to such memory resources allocated by its ancestors in the delegator-assignee hierarchy.

[0020] Figure 1A A system according to some embodiments described herein is shown.

[0021] System 100 (e.g., an embedded system) may include a processing device 102, an MPU 104, and a memory 106. All accesses to the memory 106 may be transparently checked by the MPU 104. Specifically, the processing device 102 may provide a memory access request to the MPU 104, wherein the memory access request may include a memory address in the memory 106 and an access command. The MPU 104 may check whether the memory address and the access command comply with a set of memory protection rules (i.e., the memory address and the access command do not violate the set of memory protection rules). If the memory address and the access command comply with the set of memory protection rules, the MPU 104 may allow the processing device 102 to execute the access command on the memory address in the memory 106. On the other hand, if the memory address and the access command violate at least one memory protection rule, the MPU 104 may not allow the processing device 102 to execute the access command on the memory address in the memory 106, and may generate an interrupt that may be transmitted to the processing device 102.

[0022] Figure 1B Circuitry for secure delegation is shown according to some embodiments described herein.

[0023] Circuit 150 can communicate with processing devices ( Figure 1B ) and can communicate with the memory (not shown) using the output bus 154. Figure 1B 154). The circuit 150 may communicate with the memory protection rule set via the output bus 154 (e.g., during the operation phase, if the memory access request complies with the memory protection rule set, the circuit 150 may provide the memory access request to the memory via the output bus 154). The circuit 150 may include an MPU 160 to store the memory protection rule set. The circuit 150 may include a compliance circuit device 158, which may be used to configure the MPU 160 with the memory protection rule set during the configuration phase. The MPU 160 may be used to enforce the memory protection rule set during the operation phase. Specifically, the processing device may provide the memory protection rule to the circuit 150 using the input bus 152 during the configuration phase. If the compliance circuit device 158 determines that the memory protection rule does not increase the currently allocated amount of memory resources and / or access to the memory resources, the circuit 150 may store the memory protection rule in the MPU 160. On the other hand, if compliance circuitry 158 determines that the memory protection rule increases the amount of currently allocated memory resources and / or access to the memory resources, compliance circuitry 158 may generate an error condition (which may be communicated to the processing device using interrupt 156 ).

[0024] Figure 2AA process for MPU configuration utilizing secure delegation is shown according to some embodiments described herein.

[0025] A configuration request may be received, wherein the configuration request may include a memory protection rule, and wherein the memory protection rule may include a first memory region and a first access permission (at 202).

[0026] An MPU entry that matches the memory protection rule may be determined (at 204). Each MPU entry may store a memory region and access permissions. A memory protection rule may match an MPU entry if a first memory region associated with the memory protection rule is within a second memory region associated with an MPU entry. For example, assume that the lower limit and upper limit of the first memory region associated with the memory protection rule are L1 and U1, respectively, and the lower limit and upper limit of the second memory region associated with the MPU entry are L2 and U2, respectively. In this scenario, if L1 ≥ L2 and U1 ≤ U2, then it may be determined that the first memory region associated with the memory protection rule is within the second memory region associated with the MPU entry.

[0027] If a matching MPU entry is found (the "yes" branch from 206), a determination may be made as to whether the memory protection rules are in compliance with the matching MPU entry at 208. On the other hand, if no matching MPU entry is found (the "no" branch from 206), the configuration request may be denied and an error may be reported at 214.

[0028] If the first access permission associated with the memory protection rule is at least as restrictive as the second access permission associated with the matching MPU entry, then the memory protection rule can be matched with the matching MPU entry. For example, assume that the first access permission associated with the memory protection rule is read-write permission, and the second access permission associated with the matching MPU entry is read-only permission. Because the first access permission allows additional write permission, the first access permission is not as restrictive as the second access permission. In this scenario, it can be determined that the memory protection rule does not match the matching MPU entry.

[0029] If the memory protection rule matches the matching MPU entry (the "yes" branch from 210), the matching MPU entry may be replaced with the memory protection rule at 212. Specifically, the first memory region and the first access permission associated with the memory protection rule may be written to the matching MPU entry. On the other hand, if the memory protection rule does not match the matching MPU entry (the "no" branch from 210), the configuration request may be rejected and an error may be reported at 214.

[0030] Figure 2B Circuitry for an MPU configuration utilizing secure delegation is shown, according to some embodiments described herein.

[0031] Circuit 250 may implement Figure 2A The process shown in FIG. 2 may include a compliance circuit 264 and an MPU 270. A configuration request may be received, wherein the configuration request includes a memory protection rule, and wherein the memory protection rule includes a memory region 256 and an access permission 254. The memory region 256 may be provided to a read select interface of the MPU 270. The MPU 270 may store N MPU entries ( Figure 2B 2. The MPU 270 may determine an MPU entry in the MPU 270 that matches the memory region 256 (i.e., a matching entry 258). The MPU 270 may also provide a matching entry identifier (ID) 260 to a write select interface of the MPU 270. In some embodiments described herein, the MPU 270 may use content addressable memory to store the MPU entries.

[0032] The access rights 254 and the matching entry 258 may be provided to the compliance circuitry 264, which may determine whether the access rights 254 are at least as restrictive as the access rights associated with the matching entry 258. If the access rights 254 are less restrictive than the access rights associated with the matching entry 258, the compliance circuitry 264 may report a configuration error 252. If the access rights 254 are at least as restrictive as the access rights associated with the matching entry 258, the compliance circuitry 264 may determine that the configuration request is compliant and provide a write enable signal 262 to the write select interface of the MPU 270, which may cause the memory region 256 and the access rights 254 to be written at the matching entry ID 260 in the MPU 270.

[0033] Some embodiments described herein (e.g., Figure 2A-2B The embodiment shown) may use a single MPU, and the number of entries configured in the MPU may not increase beyond the number of entries preloaded by the delegator.

[0034] Some embodiments described herein may use two MPUs, for example, MPUs MPU_1 and MPU_2. The delegator can configure memory regions and access permissions in MPU_1, and the delegatee can configure memory regions and access permissions in MPU_2. Dual-MPU embodiments may provide more flexibility than single-MPU embodiments because the number of entries in MPU_2 can be different from the number of entries in MPU_1. Specifically, MPU_2 may have more entries than MPU_1.

[0035] Figure 3A Another process for MPU configuration utilizing secure delegation is shown in accordance with some embodiments described herein.

[0036] A configuration request may be received, wherein the configuration request may include a memory protection rule, and wherein the memory protection rule may include a first memory region and a first access permission (at 302).

[0037] A first MPU entry in a first MPU that matches the memory protection rule may be determined (at 304).

[0038] If a matching MPU entry is found in the first MPU (the "yes" branch from 306), a determination may be made as to whether the memory protection rules are in compliance with the matching MPU entry at 308. On the other hand, if a matching MPU entry is not found in the first MPU (the "no" branch from 306), the configuration request may be denied and an error may be reported at 314.

[0039] If the memory protection rule matches the matching MPU entry (the "yes" branch from 310), the memory protection rule can be written to the second MPU entry in the second MPU (at 312). Specifically, the second MPU entry in the second MPU can store the second memory region and the second access rights associated with the memory protection rule. On the other hand, if the memory protection rule does not match the matching MPU entry (the "no" branch from 310), the configuration request can be denied and an error can be reported (at 314).

[0040] Figure 3B Another circuit for an MPU configuration utilizing secure delegation is shown according to some embodiments described herein.

[0041] Circuit 350 may implement Figure 3A The process shown in FIG. 3 may include compliance circuit 364 and MPUs MPU_1 and MPU_2. MPU_1 may store M MPU entries ( Figure 3B MPU_1 entry #0 to MPU_1 entry #M-1), and MPU_2 can store N MPU entries ( Figure 3B In some embodiments described herein, MPUs MPU_1 and MPU_2 may use content addressable memory to store MPU entries.

[0042] A configuration request may be received, wherein the configuration request includes a memory protection rule, and wherein the memory protection rule includes a memory region 356 and access permissions 354. An MPU entry ID 360 may also be received, and the MPU entry ID 360 may indicate an entry in MPU_2 to which the memory protection rule is desired to be written. The memory region 356 may be provided to a read select interface of MPU_1. MPU_1 may determine an MPU entry in MPU_1 that matches the memory region 356 (i.e., a matching entry 358).

[0043] Compliance circuitry 364 may determine whether access permissions 354 are at least as restrictive as the access permissions associated with matching entry 358. If access permissions 354 are less restrictive than the access permissions associated with matching entry 358, compliance circuitry 364 may report configuration error 352. If access permissions 354 are at least as restrictive as the access permissions associated with matching entry 358, compliance circuitry 364 may determine that the configuration request is compliant and provide a write enable signal 362 to the write select interface of MPU_2, which may cause memory region 356 and access permissions 354 to be written to MPU entry ID 360 in MPU_2.

[0044] Some embodiments described herein may be characterized by a circuit that may include: (1) an interface to receive an MPU configuration request, wherein the MPU configuration request may include a memory protection rule; (2) a first circuit to determine a first entry in a first set of entries that matches the memory protection rule; (3) a second circuit to determine a compliance result based on checking whether the memory protection rule complies with the first entry; and (4) a third circuit to store the memory protection rule in a second set of entries based on the compliance result.

[0045] In some embodiments described herein, the second set of entries may be the same as the first set of entries.

[0046] In some embodiments described herein, the first circuit may generate an error signal in response to determining that no entry in the first set of entries matches the memory protection rule.

[0047] In some embodiments described herein, the second circuit may generate an error signal when the compliance result indicates that the memory protection rule does not comply with the first entry.

[0048] In some embodiments described herein, a memory protection rule may include a first memory region and a first access permission.

[0049] In some embodiments described herein, a memory protection rule may comply with a first entry when the first access permission is at least as restrictive as a second access permission associated with the first entry.

[0050] In some embodiments described herein, a first entry may match a memory protection rule when a first memory region associated with the memory protection rule is within a second memory region associated with the first entry.

[0051] Figure 4 A set 400 of example processes for converting and verifying design data and instructions representing an integrated circuit during the design, verification, and manufacture of an article of manufacture such as an integrated circuit is shown. Each of these processes can be structured and implemented as multiple modules or operations. The term "EDA" stands for the term "Electronic Design Automation." These processes begin by creating a product concept 410 using information provided by a designer, where the information is converted to create an article of manufacture using a set 412 of EDA processes. When the design is finally completed, the design is tape-out 434, at which point the artwork (e.g., geometric pattern) of the integrated circuit is sent to a fabrication facility to produce a mask set, which is then used to manufacture the integrated circuit. After tape-out, semiconductor die are manufactured 436, and packaging and assembly processes 438 are performed to produce a finished integrated circuit 440.

[0052] The specification of a circuit or electronic structure can range from low-level transistor material layout to a high-level description language. High-level representations can be used to design circuits and systems using a hardware description language (HDL) such as VHDL, Verilog, SystemVerilog, SystemC, MyHDL, or OpenVera. The HDL description can be converted into a logic-level register transfer level (RTL) description, a gate-level description, a layout-level description, or a mask-level description. Each lower level of representation described in more detail adds more useful detail to the design description, for example, more detail for the modules that comprise the description. The lower-level representations described in more detail can be computer-generated, obtained from a design library, or created by another design automation process. An example of a specification language for specifying a lower-level representation language that is described in more detail is SPICE (Simulation Program for Integrated Circuits) for detailed descriptions of circuits with many analog components. The description of each level can be made usable by the corresponding system for that layer (for example, a formal verification system). The design process can use Figure 4 The sequence shown and the described process can be implemented by an EDA product (or EDA system).

[0053] During system design 414, the functionality of the integrated circuit to be manufactured is specified. The design can be optimized for desired characteristics such as power consumption, performance, area (physical area and / or line of code area), cost reduction, etc. At this stage, the design can be divided into different types of modules or elements.

[0054] During logic design and functional verification 416, modules or components in a circuit are specified in one or more descriptive languages ​​and the functional accuracy of the specifications is checked. For example, the components of a circuit can be verified to generate outputs that match the specifications of the circuit or system being designed. Functional verification can use simulators and other programs such as test bench generators, static HDL checkers, and formal verifiers. In some embodiments, specialized component systems called "emulators" or "prototyping systems" are used to accelerate functional verification.

[0055] During synthesis and design for test 418, the HDL code is converted into a netlist. In some embodiments, the netlist can be a graph structure, where the edges of the graph structure represent the elements of the circuit, and where the nodes of the graph structure represent how these elements are interconnected. Both the HDL code and the netlist are layered artifacts that EDA products can use to verify that the integrated circuit performs according to the specified design during manufacture. The netlist can be optimized for the target semiconductor manufacturing technology. Additionally, the manufactured integrated circuit can be tested to verify that the integrated circuit meets the specification requirements.

[0056] During netlist verification 420, the netlist is checked for compliance with timing constraints and consistency with the HDL code. During design planning 422, the overall floor plan of the integrated circuit is constructed, and timing and top-level routing are analyzed.

[0057] During layout or physical implementation 424, physical placement (positioning of circuit elements such as transistors or capacitors) and routing (connecting circuit elements through multiple conductors) are performed, and selection of cells in the library can be performed to implement specific logic functions. As used herein, the term "cell" can specify a collection of transistors, other elements, and interconnections that provide Boolean logic functions (e.g., AND, OR, NOT, XOR) or storage functions (such as flip-flops or latches). As used herein, a circuit "block" can refer to two or more cells. Both cells and circuit blocks can be referred to as modules or elements and can be implemented as both physical structures and simulations. Parameters such as size are specified for the selected cell (based on a "standard cell") and made accessible in a database for use by EDA products.

[0058] During analysis and extraction 426, circuit functionality is verified at the layout level, which allows for refinement of the layout design. During physical verification 428, the layout design is checked to ensure that manufacturing constraints (such as DRC (design rule checking) constraints, electrical constraints, and lithography constraints) are correct and that the circuit functionality matches the HDL design specifications. During resolution enhancement 430, the layout geometry is transformed to improve the fabrication of the circuit design.

[0059] During tape-out, data is created for the production of lithographic masks (after applying lithographic enhancements, if appropriate).During mask data preparation 432, the "tape-out" data is used to generate lithographic masks that are used to produce fabricated integrated circuits.

[0060] Computer systems (such as Figure 5 The storage subsystem of the computer system 500) can be used to store programs and data structures that are used by some or all of the EDA products described herein and by products used to develop units of the library and physical and logical designs that use the library.

[0061] Figure 5 An example machine is shown as a computer system 500 within which a set of instructions, for causing the machine to perform any one or more of the methodologies discussed herein, may be executed. In alternative embodiments, the machine may be connected (e.g., using a network) to other machines in a LAN, an intranet, an extranet, and / or the Internet. The machine may operate in the capacity of a server or a client machine in a client-server network environment, as a peer machine in a peer-to-peer (or distributed) network environment, or as a server or a client machine in a cloud computing infrastructure or environment.

[0062] The machine may be a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a cellular phone, a web appliance, a server, a network router, a switch or a bridge, or any machine capable of executing (sequentially or otherwise) a set of instructions that specify actions to be taken by the machine. Furthermore, while a single machine is shown, the term "machine" should also be construed to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein.

[0063] The example computer system 500 includes a processing device 502, a main memory 504 (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) such as synchronous DRAM (SDRAM)), a static memory 506 (e.g., flash memory, static random access memory (SRAM), etc.), and a data storage device 518 that communicate with each other via a bus 530.

[0064] The processing device 502 represents one or more processors, such as a microprocessor, a central processing unit, or the like. More specifically, the processing device may be a complex instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, or a processor that implements other instruction sets, or a processor that implements a combination of instruction sets. The processing device 502 may also be one or more special-purpose processing devices, such as an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), a network processor, or the like. The processing device 502 may be configured to execute instructions 526 for performing the operations and steps described herein.

[0065] The computer system 500 may also include a network interface device 508 for communicating over a network 520. The computer system 500 may also include a video display unit 510 (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)), an alphanumeric input device 512 (e.g., a keyboard), a cursor control device 514 (e.g., a mouse), a graphics processing unit 522, a signal generating device 516 (e.g., a speaker), a graphics processing unit 522, a video processing unit 528, and an audio processing unit 532.

[0066] The data storage device 518 may include a machine-readable storage medium 524 (also referred to as a non-transitory computer-readable medium) having stored thereon one or more sets of instructions 526 or software embodying any one or more of the methods or functionality described herein. During execution of the instructions 526 by the computer system 500, the instructions 526 may also reside completely or at least partially within the main memory 504 and / or the processing device 502, which also constitute machine-readable storage media.

[0067] In some embodiments, the instructions 526 include instructions for implementing functions corresponding to the present disclosure. Although the machine-readable storage medium 524 is shown as a single medium in the example embodiments, the term "machine-readable storage medium" should be understood to include a single medium or multiple media (e.g., a centralized or distributed database, and / or associated caches and servers) that store one or more sets of instructions. The term "machine-readable storage medium" should also be understood to include any medium that can store or encode a set of instructions to be executed by a machine and cause the machine and processing device 502 to perform any one or more methods of the present disclosure. Accordingly, the term "machine-readable storage medium" should be understood to include, but is not limited to, solid-state memory, optical media, and magnetic media.

[0068] Some portions of the foregoing detailed description have been presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm may be a sequence of operations leading to a desired result. These operations require physical manipulations of physical quantities. Such quantities may take the form of electrical or magnetic signals capable of being stored, combined, compared, and otherwise manipulated. Such signals may be referred to as bits, values, elements, symbols, characters, terms, numbers, etc.

[0069] It should be remembered, however, that all of these terms and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless otherwise indicated, as will be apparent from this disclosure, it should be understood that throughout this specification certain terms refer to actions and processes of computer systems or similar electronic computing devices that manipulate data represented as physical (electronic) quantities within the computer system's registers and memories and transform them into other data similarly represented as physical quantities within the computer system's memories or registers or other such information storage devices.

[0070] The present disclosure also relates to an apparatus for performing the operations herein. The apparatus may be specially constructed for the intended purpose, or it may comprise a computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program may be stored in a computer-readable storage medium, such as, but not limited to, any type of disk (including floppy disks, optical disks, CD-ROMs (Compact Disk ROMs), and magneto-optical disks), read-only memory (ROM), random access memory (RAM), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), magnetic or optical cards, or any type of medium suitable for storing electronic instructions, each coupled to a computer system bus.

[0071] The algorithms and displays presented herein are not inherently related to any particular computer or other device. Various other systems may be used in conjunction with the programs taught herein, or it may prove convenient to construct more specialized devices to perform the methods. Additionally, the present disclosure is not described with reference to any particular programming language. It should be understood that various programming languages ​​may be used to implement the teachings of the present disclosure described herein.

[0072] The present disclosure may be provided as a computer program product or software, which may include a machine-readable medium having instructions stored thereon, which may be used to program a computer system (or other electronic device) to perform a process according to the present disclosure. A machine-readable medium includes any mechanism for storing information in a form readable by a machine (e.g., a computer). For example, a machine-readable (e.g., computer-readable) medium includes a machine (e.g., computer) readable storage medium, such as a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage medium, an optical storage medium, a flash memory device, etc.

[0073] In the foregoing disclosure, the embodiments of the present disclosure have been described with reference to their specific example embodiments. It will be apparent that various modifications may be made thereto without departing from the broader spirit and scope of the embodiments of the present disclosure as set forth in the following claims. Where the present disclosure relates to some elements in the singular, more than one element may be depicted in the figures, and identical elements may be labeled with the same numerals. Accordingly, the present disclosure and the accompanying drawings should be regarded as illustrative, not restrictive.

Claims

1. A method comprising: receiving a memory protection unit (MPU) configuration request, wherein the MPU configuration request includes a memory protection rule; determining a first entry in a first MPU circuit that matches the memory protection rule; determining a compliance result based on checking whether the memory protection rule complies with the first entry; as well as Based on the compliance result, the memory protection rule is written into the second MPU circuit.

2. The method of claim 1, wherein the second MPU circuit is identical to the first MPU circuit.

3. The method according to claim 1, further comprising: An error signal is generated in response to determining that there is no entry in the first MPU circuit that matches the memory protection rule.

4. The method according to claim 1, further comprising: When the compliance result indicates that the memory protection rule does not comply with the first entry, an error signal is generated. The method of claim 1 , wherein the memory protection rule comprises a first memory region and a first access permission. 6 . The method of claim 5 , wherein the memory protection rule complies with the first entry when the first access permission is at least as restrictive as a second access permission associated with the first entry.

7. The method of claim 5, wherein the first entry in the first MPU circuit matches the memory protection rule when the first memory region is within a second memory region associated with the first entry.

8. A circuit comprising: An interface for receiving a memory protection unit (MPU) configuration request, wherein the MPU configuration request includes a memory protection rule; a first circuit configured to determine a first entry in a first set of entries that matches the memory protection rule; a second circuit configured to determine a compliance result based on checking whether the memory protection rule complies with the first entry; as well as A third circuit is configured to store the memory protection rule in a second entry set based on the compliance result.

9. The circuit of claim 8, wherein the second set of entries is identical to the first set of entries.

10. The circuit of claim 8, wherein the first circuit generates an error signal in response to determining that no entry in the first set of entries matches the memory protection rule. 11 . The circuit of claim 8 , wherein the second circuit generates an error signal when the compliance result indicates that the memory protection rule does not comply with the first entry. 12 . The circuit of claim 8 , wherein the memory protection rule comprises a first memory region and a first access permission.

13. The circuit of claim 12, wherein the memory protection rule complies with the first entry when the first access permission is at least as restrictive as a second access permission associated with the first entry.

14. The circuit of claim 8, wherein the first entry matches the memory protection rule when a first memory region associated with the memory protection rule is within a second memory region associated with the first entry.

15. A non-transitory computer-readable medium comprising stored instructions that, when executed by a processor, cause the processor to generate a digital representation of a circuit, the circuit comprising: An interface for receiving a memory protection unit (MPU) configuration request, wherein the MPU configuration request includes a memory protection rule, and wherein the memory protection rule includes a first memory region and a first access permission; a first circuit configured to determine a first entry in a first set of entries that matches the memory protection rule; a second circuit configured to determine a compliance result based on checking whether the memory protection rule complies with the first entry; as well as A third circuit is configured to store the memory protection rule in a second entry set based on the compliance result.

16. The non-transitory computer-readable medium of claim 15, wherein the second set of entries is the same as the first set of entries. 17 . The non-transitory computer-readable medium of claim 15 , wherein the first circuit generates an error signal in response to determining that no entry in the first set of entries matches the memory protection rule. 18 . The non-transitory computer-readable medium of claim 15 , wherein the second circuit generates an error signal when the compliance result indicates that the memory protection rule does not comply with the first entry.

19. The non-transitory computer-readable medium of claim 15, wherein the memory protection rule complies with the first entry when the first access permission is at least as restrictive as a second access permission associated with the first entry.

20. The non-transitory computer-readable medium of claim 15, wherein the first entry matches the memory protection rule when the first memory region associated with the memory protection rule is within a second memory region associated with the first entry.

Images