Self-checking method for memory protection unit

Abstract

The invention discloses a self-checking method for a memory protection unit. The self-checking method comprises the following steps: setting an original first interrupt configuration table as a second interrupt configuration table which can only respond to self-checking abnormal interrupt and does not respond to other interrupts; remapping the interrupt entry address from the original interrupt vector table to a test interrupt vector table; and executing the test case to perform self-inspection on the memory protection unit. According to the self-checking method for the memory protection unit, the memory protection unit is subjected to self-checking, so that the memory access permission is effectively controlled by the memory protection unit, and the problem of latent faults caused by failure of the memory protection unit is avoided.

Description

Technical Field

[0001] This application relates to the field of automotive chips, and more particularly to a self-testing method for a memory protection unit. Background Technology

[0002] The Memory Protection Unit (MPU) is typically integrated into the processor and is used to configure and enforce access control policies for specific memory address ranges. Access control policies include setting access permissions for a given address range to states such as No eXecute (NX), Read / Write, Read-Only, and No Access.

[0003] In existing technical solutions, the MPU is used to differentiate the permissions for accessing the same memory address range for different contexts (e.g., tasks running at different security levels). Specifically, the MPU registers can be dynamically reconfigured when the operating system switches tasks, allowing tasks with high security attributes to perform read and write operations on the target address range, while tasks with lower security levels are only granted read-only permissions.

[0004] However, existing technical solutions mainly focus on how to effectively utilize a functional MPU to implement memory access control, without considering the impact of MPU hardware unit failure (i.e., potential latent faults) on the reliability of the access control mechanism. Once the MPU malfunctions (such as failing to correctly execute the configured permission policy or completely stopping working), it may cause the preset memory isolation or protection mechanism to fail, resulting in serious security risks or system errors.

[0005] The statements herein provide only background information in relation to this invention and do not necessarily constitute prior art.

[0006] The statements herein provide only background information in relation to this invention and do not necessarily constitute prior art. Summary of the Invention

[0007] The purpose of this invention is to provide a self-testing method for a memory protection unit, which has the advantage of enabling the memory protection unit to perform self-testing.

[0008] To achieve the above objectives, the present invention provides a self-testing method for a memory protection unit, comprising the following steps:

[0009] S10. Set the original first interrupt configuration table to a second interrupt configuration table that can only respond to self-test exception interrupts and does not respond to other interrupts.

[0010] S20. Remap the interrupt entry address from the original interrupt vector table to the test interrupt vector table;

[0011] S30. Execute test cases to perform a self-test on the memory protection unit.

[0012] Optionally, after step S30, the method further includes step S40, which involves remapping the interrupt entry address from the test interrupt vector table back to the original interrupt vector table.

[0013] Optionally, before step S10, the method further includes step S01: saving the first interrupt configuration table; after step S40, the method further includes step S50: restoring the second interrupt configuration table to the original first interrupt configuration table.

[0014] Optionally, before step S30, the method further includes step S21: saving the existing memory protection unit configuration; after step S30, the method further includes step S31: restoring the saved memory protection unit configuration.

[0015] Optionally, the test case includes a first test case, in which the processor's access permissions to a certain address range are set to non-readable, non-writable, and executable. In the first test case, the code within that address range is executed, and the code executes normally.

[0016] Optionally, the test case further includes a second test case, in which the processor's access permission to a certain address segment is set to read, write, but not execute. When the code in the address segment is executed in the second test case, the processor enters the self-test exception interrupt, jumps to a custom processing function according to the test interrupt vector table, reads the exception status register inside the custom processing function, finds that the instruction access violation flag is set to 1, clears the fault and exits the interrupt.

[0017] Optionally, the test case further includes a third test case, in which the processor's access permission to a certain address range is set to read but not write and not execute, and the data can be successfully read when reading data in the address range in the third test case.

[0018] Optionally, the test case further includes a fourth test case, in which the processor's access permissions to a certain address range are set to be unreadable, unwritable, and unexecutable. In the fourth test case, when reading data in the address range, the processor enters the self-test exception interrupt, jumps to a custom processing function according to the test interrupt vector table, reads the exception status register inside the custom processing function, finds that the data access violation flag is set to 1, clears the fault, and exits the interrupt.

[0019] Optionally, the test case further includes a fifth test case, in which the processor's access permission to a certain address range is set to read, write, but not execute, and when data is written to that address range in the fifth test case, the data can be successfully written.

[0020] Optionally, the test case further includes a sixth test case, in which the processor's access permission to a certain address range is set to read-only, not write-only, and not execute-only. In the sixth test case, when writing data to the address range, the processor enters the self-test exception interrupt, jumps to a custom processing function according to the test interrupt vector table, reads the exception status register inside the custom processing function, finds that the data access violation flag is set to 1, clears the fault, and exits the interrupt.

[0021] In summary, compared with the prior art, the self-testing method for memory protection units provided by the present invention has the following beneficial effects:

[0022] The self-testing method for memory protection units in this application ensures that the memory protection unit's control over memory access permissions is effective by performing a self-test on the memory protection unit, thereby avoiding latent faults caused by the failure of the memory protection unit itself. Attached Figure Description

[0023] Figure 1 This is a flowchart of the self-test method used in the memory protection unit of this application.

[0024] Figure 2 This is a schematic diagram of test cases used for self-testing. Detailed Implementation

[0025] The self-testing method for a memory protection unit proposed in this invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. The advantages and features of this invention will become clearer from the following description. It should be noted that the accompanying drawings are in a very simplified form and use non-precise proportions, only used to facilitate and clearly illustrate the purpose of the embodiments of this invention. Please refer to the accompanying drawings to make the objectives, features, and advantages of this invention more apparent and understandable. It should be understood that the structures, proportions, sizes, etc., depicted in the accompanying drawings are only used to complement the content disclosed in the specification, for those skilled in the art to understand and read, and are not intended to limit the implementation conditions of this invention. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in the proportional relationships, or adjustments to the size, without affecting the effects and objectives achieved by this invention, should still fall within the scope of the technical content disclosed in this invention. The self-testing method for a memory protection unit proposed in this invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. The advantages and features of this invention will become clearer from the following description. It should be noted that the accompanying drawings are in a very simplified form and use non-precise proportions, only used to facilitate and clearly illustrate the purpose of the embodiments of this invention. To make the objectives, features, and advantages of this invention more apparent and understandable, please refer to the accompanying drawings. It should be understood that the structures, proportions, sizes, etc., depicted in the accompanying drawings are merely for illustrative purposes and to aid those skilled in the art in understanding and reading the invention. They are not intended to limit the implementation conditions of the invention and therefore have no substantial technical significance. Any modifications to the structure, changes in proportions, or adjustments to the size, without affecting the effects and objectives achieved by the invention, should still fall within the scope of the technical content disclosed in this invention.

[0026] like Figure 1 As shown, this application provides a self-testing method for a memory protection unit, the self-testing method including:

[0027] S01. Save the first interrupt configuration table. The first interrupt configuration table is an array of function pointers stored in memory during normal use. Each entry corresponds to the entry address of a specific interrupt or exception handling function. During the self-test of the memory protection unit, it is necessary to modify memory access rules, such as remapping memory regions. To avoid destroying the existing first interrupt configuration table during the self-test, the first interrupt configuration table is saved before the self-test so that it can be restored to the original first interrupt configuration table after the self-test is completed.

[0028] S10. Configure the original first interrupt configuration table to only respond to the self-test exception interrupt (i.e., the MemManage fault exception interrupt), and the second interrupt configuration table to not respond to other interrupts. In this step, to prevent other interrupts from interfering with the self-test process of the memory protection unit, a safe environment is created for the self-test process of the memory protection unit, preventing interruption by other programs and ensuring the reliability, accuracy, and recoverability of the memory protection unit's self-test.

[0029] S20. Remap the interrupt entry address from the original interrupt vector table to the test interrupt vector table. To avoid the system entering an infinite loop due to intentionally triggered Memmanage faults during the self-test, which could prevent subsequent tests from continuing, this step remaps the original interrupt vector table to a test interrupt vector table dedicated to the self-test. This ensures that during the self-test, when a memory protection unit malfunctions, the system will enter a pre-defined entry function. For example, in test interrupt vector table 1, the entry function for a memory protection unit malfunction is Memmanage fault1, and in test interrupt vector table 2, it is Memmanage fault2. When the interrupt entry address is in interrupt vector table 1, a memory protection unit malfunction will enter Memmanage fault1; when the interrupt entry address is in interrupt vector table 2, a memory protection unit malfunction will enter Memmanage fault2.

[0030] S21. Save the existing memory protection unit configuration. During the self-test, the memory protection unit configuration will be changed. Before the self-test, save the existing memory protection unit configuration in advance so that it can be restored to the memory protection unit configuration required for normal use after the self-test is completed, so as to avoid the normal use being affected by the change of memory protection unit configuration due to the self-test.

[0031] S30. Execute test cases to perform a self-test on the memory protection unit. For example... Figure 2 As shown, the test cases include six test cases in total, from the first test case to the sixth test case, which are used to test the reading, writing and execution functions respectively. If any of the six test cases does not perform as expected, the self-test fails, the test case and the whole method are terminated and an error is reported.

[0032] In the first test case, the processor's access permissions for a certain address range were set to non-readable, non-writable, and executable. In the first test case, the code within that address range was executed normally.

[0033] In the second test case, the processor's access permissions to a certain address range are set to read, write, but not execute. When the code in the address range is executed in the second test case, the processor enters a self-test exception interrupt. According to the test interrupt vector table, it jumps to the custom handling function. Inside the custom handling function, it reads the exception status register, finds that the instruction access violation flag is set to 1, clears the fault, and exits the interrupt.

[0034] In the third test case, the processor's access permissions for a certain address range are set to read but not write and not execute. When reading data within that address range in the third test case, the data can be read successfully.

[0035] In the fourth test case, the processor's access permissions to a certain address range are set to be unreadable, unwritable, and unexecutable. When reading data in this address range in the fourth test case, the processor enters a self-test exception interrupt. According to the test interrupt vector table, it jumps to a custom handling function. Inside the custom handling function, it reads the exception status register, finds that the data access violation flag is set to 1, clears the fault, and exits the interrupt.

[0036] In the fifth test case, the processor's access permissions for a certain address range are set to read, write, but not execute. When writing data to this address range in the fifth test case, the data can be written successfully.

[0037] In the sixth test case, the processor's access permissions for a certain address range are set to read-only, not write-only, and not execute-only. When writing data to this address range in the sixth test case, the processor enters a self-test exception interrupt. According to the test interrupt vector table, it jumps to a custom handler function. Inside the custom handler function, it reads the exception status register, finds that the data access violation flag is set to 1, clears the fault, and exits the interrupt.

[0038] After completing the six test cases, the normal operation of the memory protection unit is confirmed. Then, S31 is executed to restore the saved memory protection unit configuration, preventing changes made during the self-test from affecting subsequent normal use. Next, S40 is executed to remap the interrupt entry address from the test interrupt vector table to the original interrupt vector table, ensuring that errors during normal use can be reported through the original interrupt vector table, thus restoring the functional integrity of the memory protection unit. Finally, S50 is executed to restore the second interrupt configuration table to the original first interrupt configuration table, completely eliminating any remnants from the self-test and ensuring reliable operation of the memory protection unit.

[0039] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0040] In the description of this invention, it should be understood that the terms "center," "height," "thickness," "upper," "lower," "vertical," "horizontal," "top," "bottom," "inner," "outer," "axial," "radial," and "circumferential," etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. In the description of this invention, unless otherwise stated, "a plurality of" means two or more.

[0041] In the description of this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0042] In this invention, unless otherwise explicitly specified and limited, "above" or "below" the second feature can include direct contact between the first and second features, or contact between the first and second features through another feature between them. Furthermore, "above," "over," and "on top" of the second feature includes the first feature directly above or diagonally above the second feature, or simply indicates that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature includes the first feature directly below or diagonally below the second feature, or simply indicates that the first feature is at a lower horizontal level than the second feature.

[0043] Although the present invention has been described in detail through the preferred embodiments above, it should be understood that the above description should not be considered as a limitation of the present invention. Various modifications and substitutions to the present invention will be apparent to those skilled in the art after reading the above description. Therefore, the scope of protection of the present invention should be defined by the appended claims.

Claims

1. A self-testing method for a memory protection unit, characterized in that, The self-test method includes: S10. Set the original first interrupt configuration table to a second interrupt configuration table that can only respond to self-test exception interrupts and does not respond to other interrupts. S20. Remap the interrupt entry address from the original interrupt vector table to the test interrupt vector table; S30. Execute test cases to perform a self-test on the memory protection unit.

2. The self-testing method for a memory protection unit as described in claim 1, characterized in that, After step S30, the method further includes step S40, which involves remapping the interrupt entry address from the test interrupt vector table back to the original interrupt vector table.

3. The self-testing method for a memory protection unit as described in claim 2, characterized in that, Before step S10, the method further includes step S01: saving the first interrupt configuration table; after step S40, the method further includes step S50: restoring the second interrupt configuration table to the original first interrupt configuration table.

4. The self-testing method for a memory protection unit as described in claim 3, characterized in that, Before step S30, the method further includes step S21, saving the existing memory protection unit configuration; after step S30, the method further includes step S31, restoring the saved memory protection unit configuration.

5. The self-testing method for a memory protection unit as described in any one of claims 1-4, characterized in that, The test cases include a first test case, in which the processor's access permissions to a certain address range are set to be unreadable, unwritable, and executable. In the first test case, the code within that address range is executed, and the code executes normally.

6. The self-testing method for a memory protection unit as described in claim 5, characterized in that, The test case also includes a second test case, in which the processor's access permission to a certain address segment is set to read, write, but not execute. When the code in the address segment is executed in the second test case, the processor enters the self-test exception interrupt, jumps to a custom processing function according to the test interrupt vector table, reads the exception status register inside the custom processing function, finds that the instruction access violation flag is set to 1, clears the fault and exits the interrupt.

7. The self-testing method for a memory protection unit as described in claim 6, characterized in that, The test case also includes a third test case, in which the processor's access permissions to a certain address range are set to be readable but not writable and not executable. In the third test case, when reading data in the address range, the data can be read successfully.

8. The self-testing method for a memory protection unit as described in claim 7, characterized in that, The test case also includes a fourth test case, in which the processor's access permissions to a certain address range are set to be unreadable, unwritable, and unexecutable. In the fourth test case, when reading data in the address range, the processor enters the self-test exception interrupt, jumps to a custom processing function according to the test interrupt vector table, reads the exception status register inside the custom processing function, finds that the data access violation flag is set to 1, clears the fault, and exits the interrupt.

9. The self-testing method for a memory protection unit as described in claim 8, characterized in that, The test case also includes a fifth test case, in which the processor's access permission to a certain address range is set to read, write, but not execute. In the fifth test case, when data is written to this address range, the data can be successfully written.

10. The self-testing method for a memory protection unit as described in claim 9, characterized in that, The test case also includes a sixth test case, in which the processor's access permissions to a certain address range are set to be readable but not writable and not executable. In the sixth test case, when writing data to the address range, the processor enters the self-test exception interrupt, jumps to a custom processing function according to the test interrupt vector table, reads the exception status register inside the custom processing function, finds that the data access violation flag is set to 1, clears the fault and exits the interrupt.

Images