A method for protecting memory access in an MCU

Abstract

The application discloses an MCU memory access protection method and relates to the technical field of digital data processing, wherein when a safety task applies for a RAM space, a memory management program writes the starting address, the region length and the release flag of the target RAM region into a record storage area which can still be read after reset to form an effective memory record before delivering the target RAM region; when the safety task returns the target RAM region, the memory management program cleans the target RAM region according to the effective memory record and checks the cleaning result; when the MCU is reset and started, the starting code reads the effective memory record and establishes a temporary free link list according to a preset RAM layout; the RAM region with the unreleased release flag is deleted from the temporary free link list and written into a to-be-cleaned link list; and the safety RAM region which is not cleaned after abnormal reset can be prevented from being redistributed by a common task, so that the data security in the reset recovery process is improved.

Description

Technical Field

[0001] This invention relates to the field of electronic digital data processing technology, specifically to a method for protecting MCU memory access. Background Technology

[0002] As embedded electronic digital data processing systems are increasingly used in vehicle gateways and domain controllers, MCUs need to manage RAM allocation for both security tasks and regular tasks simultaneously. When an MCU reset interrupts the security task release process, how to rebuild the regular free list based on the memory usage state before the reset and prevent the uncleaned security RAM area from being reallocated by regular tasks has become a key issue in memory access protection.

[0003] Existing MCU memory protection methods mainly focus on RAM cleanup during runtime access control or normal task exit. However, when rebuilding the free list after an abnormal reset, the system often cannot maintain the RAM area occupancy status of the safe task before the reset, which may cause the safe RAM that has not yet been cleaned to be included in the normal allocable range. If all RAM is cleaned up to avoid this risk, it will increase the reset recovery overhead. Therefore, a memory access protection method is needed that modifies the free list based on the readable record during the reset startup phase. Summary of the Invention

[0004] To address the shortcomings of existing technologies, the technical solution of this invention is as follows:

[0005] A method for protecting MCU memory access includes the following steps:

[0006] S1. When the security task requests RAM space, the memory management program selects a target RAM region from the ordinary free list. Before delivering the target RAM region, the memory management program writes the starting address, region length, and release flag of the target RAM region into a record storage area that can still be read after reset, forming a corresponding valid memory record. The release flag is set to "not released". After writing is completed, the memory management program deletes the list entry of the target RAM region from the ordinary free list and delivers the target RAM region to the security task.

[0007] S2. When the security task returns the target RAM area, the memory management program cleans up the target RAM area according to the valid memory record and verifies the cleanup result. After the verification is passed, the memory management program changes the release flag to "released" and writes the linked list item of the target RAM area back to the ordinary free linked list.

[0008] S3. When the MCU is reset and started, the startup code reads the valid memory records in the record storage area and establishes a temporary free list according to the preset RAM layout;

[0009] S4. The startup code modifies the temporary free list according to the effective memory record, deletes the RAM area corresponding to the effective memory record whose release flag is not released from the temporary free list and writes it into the cleanup list, and hands the processed temporary free list as a normal free list to the memory management program.

[0010] S5. The memory management program cleans up the RAM area in the list to be cleaned and verifies the cleanup result. After the verification is successful, the memory management program changes the corresponding release flag to "released" and writes the list item of the corresponding RAM area back to the ordinary free list.

[0011] Furthermore, in S1, the memory management program first writes the starting address, region length, and unreleased release flag of the target RAM region into the record storage area;

[0012] Then read the written content in the record storage area, and delete the list entry of the target RAM area from the ordinary free list only when the read start address, area length and release flag are consistent with the target RAM area to be delivered;

[0013] If the effective memory record writing fails, the memory management program retains the linked list entry in the ordinary free linked list corresponding to the target RAM region;

[0014] And cancel the delivery of the target RAM region to the security task.

[0015] Furthermore, in S1, the list item in the ordinary free list includes the list item starting address and the list item region length;

[0016] When the address range of the target RAM region falls within the address range of a linked list item, and the target RAM region does not cover the entire address range of the linked list item, the memory management program splits the linked list item according to the starting address and region length of the target RAM region;

[0017] The address ranges assigned to the security task are written to the valid memory record, while the address ranges not assigned to the security task are retained in the ordinary free list.

[0018] Furthermore, in S2, the memory management program writes a preset cleanup value to the target RAM region according to the starting address and region length in the effective memory record, and reads the data in the target RAM region after the writing is completed;

[0019] When the read data matches the preset cleanup value, the cleanup result of the target RAM area is determined to have passed the verification.

[0020] Before the cleanup result passes verification, the release flag remains unreleased, and the linked list entries of the target RAM region are not written back to the ordinary free linked list.

[0021] Furthermore, in S3, the startup code reads the available RAM range for a normal task from a preset RAM layout, the available RAM range for a normal task including a starting address and a region length;

[0022] The startup code establishes at least one initial linked list item based on the available RAM range of the normal task, and forms the temporary free linked list from the initial linked list item;

[0023] Before the effective memory record is read completely and the temporary free list is formed, the startup code does not enable memory allocation for normal tasks.

[0024] Furthermore, in S4, the startup code determines the RAM region corresponding to the valid memory record whose release flag is not released as the address segment to be excluded, and determines the linked list item in the temporary free linked list as the linked list address segment;

[0025] The startup code determines the address relationship between the address segment to be excluded and the linked list address segment based on the starting address and region length of the address segment to be excluded, as well as the starting address and region length of the linked list address segment. The address relationship includes no overlap, complete coverage, end coverage, and intermediate coverage.

[0026] Furthermore, in S4, when the address relationship is non-overlapping, the startup code retains the linked list item corresponding to the linked list address segment;

[0027] When the address relationship is a complete overwrite, the startup code deletes the linked list item corresponding to the linked list address segment from the temporary free linked list, and writes the starting address and region length of the linked list address segment into the linked list to be cleaned.

[0028] Furthermore, in S4, when the address relationship is end-over, the startup code will write the address segment covered by the address segment to be excluded into the cleanup list;

[0029] The starting address or region length of the linked list item corresponding to the linked list address segment is adjusted so that the adjusted linked list item corresponds only to the address segment not covered by the address segment to be excluded.

[0030] Furthermore, in S4, when the address relationship is intermediate overlay, the startup code splits the linked list item corresponding to the linked list address segment into a front linked list item and a back linked list item;

[0031] The front and back linked list entries are retained in the temporary free linked list, and the address range between the front and back linked list entries is written into the list to be cleaned up.

[0032] Furthermore, in S5, the memory management program cleans up the corresponding RAM region based on the starting address and region length in the list to be cleaned;

[0033] After the cleanup result passes the verification, the memory management program generates a new linked list entry based on the starting address and length of the current RAM region, and writes the new linked list entry into the ordinary free linked list.

[0034] If the new linked list entry is contiguous with the address of an adjacent linked list entry in the ordinary free linked list, the memory management program merges the new linked list entry with the adjacent linked list entry.

[0035] If the cleanup result fails the verification, the current RAM region will remain in the cleanup list.

[0036] The beneficial effects of this invention are as follows:

[0037] 1. By forming a valid memory record that can be read after reset when the RAM area is obtained in the security task, and correcting the ordinary free list according to the valid memory record during the MCU reset startup phase, the RAM area with the release flag not being released will not participate in the ordinary task allocation before the cleanup verification is passed. This solves the problem in the prior art that after the abnormal reset interrupts the security task release process, the uncleaned security RAM area may be re-included in the ordinary allocable range. Attached Figure Description

[0038] Figure 1 This is a flowchart of the MCU memory access protection method of the present invention;

[0039] Figure 2 This is a schematic diagram of the MCU memory access protection system of the present invention. Detailed Implementation

[0040] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0041] It should be noted that the specific values, address ranges, task names, and test data in the embodiments are only used to illustrate the implementation methods and technical effects of the present invention, and do not constitute a limitation on the scope of protection of the present invention; without departing from the concept of the present invention, those skilled in the art can make adaptive adjustments according to the MCU model, RAM layout, record storage area type, and vehicle controller application scenario.

[0042] Example 1

[0043] Please see Figure 1 and Figure 2 This invention provides a method for protecting MCU memory access, comprising the following steps:

[0044] S1. When the security task requests RAM space, the memory management program selects a target RAM region from the ordinary free list. Before delivering the target RAM region, the memory management program writes the starting address, region length, and release flag of the target RAM region into a record storage area that can still be read after reset, forming a corresponding valid memory record. The release flag is set to "not released". After writing is completed, the memory management program deletes the list entry of the target RAM region from the ordinary free list and delivers the target RAM region to the security task.

[0045] S2. When the security task returns the target RAM area, the memory management program cleans up the target RAM area according to the valid memory record and verifies the cleanup result. After the verification is passed, the memory management program changes the release flag to "released" and writes the linked list item of the target RAM area back to the ordinary free linked list.

[0046] S3. When the MCU is reset and started, the startup code reads the valid memory records in the record storage area and establishes a temporary free list according to the preset RAM layout;

[0047] S4. The startup code modifies the temporary free list according to the effective memory record, deletes the RAM area corresponding to the effective memory record whose release flag is not released from the temporary free list and writes it into the cleanup list, and hands the processed temporary free list as a normal free list to the memory management program.

[0048] S5. The memory management program cleans up the RAM area in the list to be cleaned and verifies the cleanup result. After the verification is successful, the memory management program changes the corresponding release flag to "released" and writes the list item of the corresponding RAM area back to the ordinary free list.

[0049] In this embodiment, an MCU memory access protection method is applied to an on-board gateway controller. The on-board gateway controller is used to connect a diagnostic interface, a body control domain, a power control domain, and a communication gateway. It performs security tasks and normal tasks during diagnostic unlocking, CANFD message authentication, and OTA security verification. The security tasks include diagnostic unlocking tasks, message authentication tasks, and OTA security verification tasks. The normal tasks include CAN message forwarding tasks, fault log tasks, and communication caching tasks.

[0050] The vehicle gateway controller uses an automotive-grade 32-bit MCU with 256KB of on-chip RAM. 0x20004000 to 0x2002BFFF is configured as a dynamically available RAM region. In subsequent address processing examples, 0x20010000 to 0x20017FFF serves as an example of the RAM range available for normal tasks. Other dynamic RAM address ranges can be used to create corresponding ordinary free list entries according to the same rules. The memory management program manages this RAM region through the ordinary free list. Each entry in the ordinary free list includes the starting address of the list entry, the length of the list entry region, and a pointer to the next list entry.

[0051] The recording storage area uses one page of the MCU's on-chip Flash, or it can use EEPROM, backup RAM or power-down retainable RAM. The recording storage area can still be read by the startup code after MCU software reset, watchdog reset, abnormal reset or low-power wake-up reset.

[0052] The record storage area does not store keys, random numbers, authentication data, or the message content itself. Each valid memory record in the record storage area stores at least the starting address, area length, release flag, record sequence number, record check value, and write completion flag.

[0053] When the startup code reads a valid memory record, it first verifies the starting address, region length, release flag, and record sequence number based on the record check value, and then determines whether the write completion flag is in a completed state.

[0054] When multiple valid memory records that pass verification exist in the same RAM area, the startup code selects the valid memory record with the largest record number as the processing basis, and treats the valid memory record with the smaller record number as a historical record.

[0055] When the record storage area is a Flash record area, the memory management program writes valid memory records in an append-only manner. After writing the starting address, area length, release flag, record sequence number, and record check value, it writes the write completion flag. When the current Flash record page is full, the memory management program migrates the latest release status of the record with the largest record sequence number in each RAM area to a spare record page. After the spare record page passes the check, the old record page is erased to reduce the reliability risks caused by the inability to continue recording when the page is full and frequent erasure and writing.

[0056] When it is necessary to change the release flag from not released to released, the memory management program updates the release status of the corresponding RAM area to released. When the record storage area supports in-situ rewriting, the release status update can be achieved by rewriting the release flag. When the record storage area is a Flash record area, the memory management program does not require in-situ rewriting of the original valid memory record, but appends a release record with a larger record number to the record storage area so that the startup code can determine the latest release status based on the record number.

[0057] When a vehicle enters the diagnostic unlocking process, the diagnostic unlocking task, as a security task, requests RAM space from the memory management program. The memory management program selects a target RAM region with a starting address of 0x20011800 and a region length of 2048B from the ordinary free list. Before delivering the target RAM region, the program writes the starting address of 0x20011800, the region length of 2048B, and the unreleased release flag into the record storage area, forming a valid memory record corresponding to the target RAM region.

[0058] Before responding to a diagnostic unlock task's RAM space request, the memory management program enters a memory allocation critical section and suspends calls to the memory allocation interface by normal tasks and interrupt service routines within that critical section.

[0059] After the valid memory record is written, the memory management program removes the list entry corresponding to the target RAM region from the ordinary free list and delivers the target RAM region to the diagnostic unlocking task. The diagnostic unlocking task temporarily stores the intermediate value of the seed key calculation, the random number of the secure session, and the authentication status data in the target RAM region.

[0060] When the target RAM region occupies only a portion of the address range of a list item in the ordinary free list, the memory management program does not directly delete the entire list item. Instead, it splits the list item according to the starting address and length of the target RAM region. The address range delivered to the diagnostic unlock task is removed from the ordinary free list, while the address range not delivered remains in the ordinary free list to avoid excessive reduction of the RAM available to the ordinary task when the security task requests a small amount of RAM space.

[0061] When the diagnostic unlocking task is completed normally and the target RAM area is returned, the memory management program reads the starting address and area length in the valid memory record and performs data cleanup on the RAM area from 0x20011800 to 0x20011FFF. In this embodiment, the data cleanup adopts the method of writing a preset cleanup value, which is 0x00. It can also be set to 0xFF, fixed byte mode or multiple rounds of alternating write values ​​according to the security level.

[0062] Before performing data cleanup on the target RAM region, the memory management program stops the DMA channels that can access the target RAM region and confirms that no ordinary task holds an access handle to the target RAM region.

[0063] The memory management program uses a volatile pointer or an equivalent non-optimizable write interface to write a preset cleanup value to prevent the compiler from deleting the cleanup write optimization.

[0064] After the cleanup is complete, the memory management program reads the data in the target RAM area and compares the read-back data with the preset cleanup value. When the read-back data matches the preset cleanup value, the memory management program determines that the cleanup result passes the verification, updates the release status of the target RAM area to "released", generates a linked list entry based on the starting address 0x20011800 and the area length 2048B, and then writes the linked list entry back to the ordinary free linked list. When the record storage area uses the Flash record area, the release status update is achieved by appending a release record with a larger record sequence number.

[0065] After the cleanup is complete, the memory management program reads the data in the target RAM area and compares the read-back data with the preset cleanup value. When the read-back data is consistent with the preset cleanup value, the memory management program determines that the cleanup result passes the verification, changes the release flag in the valid memory record from not released to released, generates a linked list item based on the starting address 0x20011800 and the area length 2048B, and then writes the linked list item back to the ordinary free linked list.

[0066] After the cleanup is complete, the memory management program executes data synchronization barriers and instruction synchronization barriers, and performs cache cleanup or write buffer refresh on the target RAM area when the MCU enables cache or write buffer.

[0067] If the read-back data is inconsistent with the preset cleanup value, the memory management program keeps the release flag set to not released and does not write the linked list entry of the target RAM area back to the normal free linked list. Through this process, the safe task returning the RAM area is not directly equivalent to the RAM area becoming reallocatable. Only after the cleanup result passes the verification will the RAM area re-enter the scope of normal task allocation.

[0068] If the target RAM area is not returned after the diagnostic unlocking task obtains it, and the vehicle gateway controller resets the MCU due to watchdog timeout, the valid memory record in the storage area can still be read by the startup code, and the release flag in the valid memory record is still not released.

[0069] When the MCU is reset and started, the startup code first reads the valid memory records in the record storage area, and then establishes a temporary free list according to the preset RAM layout. The preset RAM layout can be determined by the linker script, the startup configuration table, or the RAM address range pre-configured in the firmware. The list entries in the temporary free list also include the starting address of the list entry and the length of the list entry area.

[0070] The cleanup list and the temporary free list are established in the private RAM area of ​​the startup code. The private RAM area of ​​the startup code is reserved by the linker script and is not within the RAM range available to ordinary tasks, the address range pointed to by the temporary free list, or the cleanup range pointed to by the cleanup list.

[0071] After checking the valid memory records, the startup code found that the release flag for the RAM region with a starting address of 0x20011800 and a region length of 2048B was still not released. Therefore, the RAM region was deleted from the temporary free list, and the starting address of 0x20011800 and the region length of 2048B were written to the cleanup list.

[0072] In a specific address processing example, the RAM address range that a normal task can request in the preset RAM layout includes a first normal task available RAM range and a second normal task available RAM range. The first normal task available RAM range is 0x20010000 to 0x20012FFF, and the second normal task available RAM range is 0x20014000 to 0x20017FFF. Among them, 0x20013000 to 0x20013FFF is a private buffer or fixed communication buffer for the startup code and is not written to the temporary free list. The startup code establishes a temporary free list based on the above two normal task available RAM ranges. The temporary free list includes a first list item and a second list item. The starting address of the first list item is 0x20010000 and the region length is 0x3000. The starting address of the second list item is 0x20014000 and the region length is 0x4000.

[0073] If the starting address of the first valid memory record in the record storage area is 0x20011800, the region length is 0x0800, and the release flag is not released, then the startup code determines that the address range to be excluded is 0x20011800 to 0x20011FFF, which is located in the middle of the first linked list item. The startup code splits the first linked list item into a front linked list item and a back linked list item. The starting address of the front linked list item is 0x20010000, the region length is 0x1800, and the starting address of the back linked list item is 0x20012000, the region length is 0x1000. Then, 0x20011800 to 0x20011FFF is written into the cleanup linked list.

[0074] If the starting address of the second valid memory record in the record storage area is 0x20014000, the region length is 0x1000, and the release flag is not released, then the startup code determines that the address segment to be excluded is located at the front of the second linked list item; the startup code adjusts the starting address of the second linked list item to 0x20015000, adjusts the region length of the second linked list item to 0x3000, and writes 0x20014000 to 0x20014FFF into the list to be cleaned.

[0075] If the starting address of the third valid memory record in the record storage area is 0x20017000, the region length is 0x1000, and the release flag is released, then the startup code will not write this address range into the cleanup list, and will retain the allocatable state of this address range in the temporary free list.

[0076] After the above processing, the RAM address ranges retained in the temporary free list include 0x20010000 to 0x200117FF, 0x20012000 to 0x20012FFF, and 0x20015000 to 0x20017FFF; the RAM address ranges stored in the list to be cleaned include 0x20011800 to 0x20011FFF and 0x20014000 to 0x20014FFF.

[0077] After the startup code hands over the processed temporary free list to the memory management program as a regular free list, ordinary tasks can only request RAM from the address ranges 0x20010000 to 0x200117FF, 0x20012000 to 0x20012FFF, and 0x20015000 to 0x20017FFF, but cannot request RAM from the address ranges 0x20011800 to 0x20011FFF and 0x20014000 to 0x20014FFF in the list to be cleared.

[0078] In this embodiment, ordinary tasks request RAM space through the memory management program, and the startup code does not provide ordinary tasks with an interface to directly access the RAM area in the list to be cleaned before the cleanup verification is passed.

[0079] When the MCU has an MPU, the startup code sets the non-readable and non-writable permissions for the uncleaned RAM area according to the cleanup list, and removes the corresponding MPU access restriction after the memory management program confirms the cleanup result.

[0080] When the MCU does not have an MPU, this method is used to restrict ordinary tasks from obtaining allocation paths for uncleaned RAM areas through the memory management program. Ordinary tasks run in a trusted runtime environment and access RAM through address handles provided by the memory management program. In this case, this method does not replace the hardware read / write permission isolation provided by the MPU.

[0081] When there are multiple valid memory records in the record storage area, the startup code reads the valid memory records one by one; for records whose release flag is already released, the startup code does not delete the corresponding RAM area from the temporary free list; for records whose release flag is not released, the startup code modifies the temporary free list according to the starting address and the area length, and writes the corresponding address range into the list to be cleaned.

[0082] If the address ranges corresponding to multiple unreleased records are adjacent or overlap, the startup code first sorts them by starting address, then merges the adjacent or overlapping address ranges, then corrects the temporary free list, and writes the record number of each valid memory record participating in the merger into the source record number set of the same cleanup list item.

[0083] Through the source record sequence number set, the merged address range in the list to be cleaned corresponds to multiple valid memory records in the record storage area, and the address range in the list to be cleaned does not overlap with the address range in the ordinary free list.

[0084] The memory management program then reads the list to be cleaned and performs data cleanup on the corresponding RAM region after reset according to the starting address and region length in the list. If the cleanup result passes the verification, the memory management program changes the release flag of one or more valid memory records in the record storage area to "released" according to the source record sequence number set of the list item to be cleaned, generates a list item according to the starting address and region length of the corresponding RAM region, and then writes the list item back to the ordinary free list.

[0085] If the cleanup result fails the verification, the memory management program keeps the release flag in the corresponding valid memory record as not released and keeps the corresponding RAM area in the cleanup list; this RAM area will not enter the normal free list, nor will it be obtained by normal tasks through memory allocation.

[0086] In the event of an anomaly, if the starting address or region length of a valid memory record read by the startup code exceeds the preset RAM layout, the startup code marks the record as an anomaly and prohibits the address range corresponding to the record from entering the normal free list.

[0087] If the release flag, write completion flag, or record check value cannot be recognized, the startup code treats it as an unreleased state.

[0088] If multiple records exist in the same RAM area, the startup code selects the valid memory record with the largest sequence number and the record check value that passes the check as the processing basis, and treats the other records as historical records.

[0089] If the self-test of the recording storage area fails or the recording storage area cannot be confirmed to be retained after a reset, the startup code does not directly open the RAM range available for normal tasks. Instead, it enters a conservative recovery process and performs cleanup and verification on the RAM range available for normal tasks.

[0090] This embodiment can solve the problem that when the vehicle gateway controller is in the process of diagnosis and unlocking, message authentication or OTA security verification, the security task release process is interrupted by MCU reset, resulting in the uncleared RAM area re-entering the normal free list.

[0091] This embodiment simultaneously considers both the safety of preventing the reallocation of uncleaned RAM areas during the reset and recovery process and the utilization rate of RAM resources.

[0092] Example 2

[0093] Please refer to Figure 1 and Figure 2 Specifically: Based on the vehicle gateway controller in Embodiment 1, this paper further explains how the effective memory record is confirmed to be written before the target RAM area is delivered when the security task requests RAM space, and how the memory management program splits the list item and keeps the effective memory record consistent with the actual delivery address range when the target RAM area only occupies part of the address range of a list item in the ordinary free list.

[0094] In this embodiment, the security task of the vehicle gateway controller is a diagnostic unlocking task, while the ordinary tasks are CAN message forwarding and fault logging tasks. The ordinary free list includes a list item A, with a starting address of 0x20010000 and a length of 0x4000. Therefore, the allocatable RAM address range corresponding to list item A is from 0x20010000 to 0x20013FFF. The diagnostic unlocking task requests RAM space of length 0x0800. The memory management program selects a target RAM region from list item A according to a preset allocation strategy. The starting address of the target RAM region is 0x20011800, the region length is 0x0800, and the corresponding address range is from 0x20011800 to 0x20011FFF.

[0095] The memory management program sets a memory allocation lock before selecting a target RAM region. The memory allocation lock covers the entire process of target RAM region selection, valid memory record writing confirmation, ordinary free list splitting, and target RAM region delivery.

[0096] Before the target RAM region is delivered to the diagnostic unlocking task, the memory management program first writes the starting address 0x20011800, region length 0x0800, release flag, record number, record check value, and write completion flag of the target RAM region to the record storage area. The release flag is written as not released, and the write completion flag is written as completed after the starting address, region length, release flag, record number, and record check value are all written.

[0097] The record check value is calculated based on the starting address, region length, release flag, and record sequence number. The startup code and memory management program use the record check value to identify half-written records or corrupted records.

[0098] When the recording storage area uses on-chip Flash recording pages, the recording storage area uses the method of appending to free recording slots to save new valid memory records, and the order of the records is indicated by the record sequence number. When the number of free recording slots is lower than a preset threshold, the memory management program copies the latest valid memory record of each RAM area to the spare recording page, and then marks the spare recording page as the current recording page, so as to avoid the inability to record new target RAM areas after the recording page is full.

[0099] This record does not store the key content, authentication random number, or message data of the diagnostic unlock task processing; it only stores the address information, release status, and record validity information used to identify the target RAM area after reset.

[0100] After the write operation is complete, the memory management program immediately reads the newly written content from the record storage area and compares the read starting address, region length, and release flag with the target RAM region to be delivered. If the read starting address is 0x20011800, the region length is 0x0800, and the release flag is not released, then the valid memory record write is confirmed. Only after the write confirmation is successful can the memory management program continue processing the ordinary free list and deliver the target RAM region to the diagnostic unlock task. This process ensures that the target RAM region has a valid memory record that can be traced after reset before it is actually used by the security task, thus avoiding the "security task has used RAM, but there is no corresponding record in the record storage area" scenario.

[0101] If any of the read starting address, region length, or release flags are inconsistent with the target RAM region to be delivered, or if the record write fails due to erase / write busy, checksum error, power failure, or unavailable record slots, the memory management program determines that the valid memory record write has failed. In this case, the memory management program does not remove list item A from the ordinary free list, nor does it deliver the target RAM region to the diagnostic unlock task. The diagnostic unlock task may receive a request failure status, or the memory management program may reselect another RAM region and re-execute the record write confirmation. In this way, even if a short-term anomaly occurs in the record storage region, there will be no unrecorded security task RAM region occupied.

[0102] Once the valid memory record write is confirmed, the memory management program needs to remove the target RAM region from the ordinary free list. Since the target RAM region 0x20011800 to 0x20011FFF is only located in the middle of list item A and does not cover the entire address range of list item A, directly deleting the entire list item A would cause RAM regions 0x20010000 to 0x200117FF and 0x20012000 to 0x20013FFF, which were not used by the diagnostic unlock task, to also be unable to be requested by ordinary tasks, resulting in an unnecessary reduction in available RAM space.

[0103] Therefore, the memory management program splits linked list item A according to the starting address and length of the target RAM region. Specifically, the address range 0x20010000 to 0x200117FF before the target RAM region forms the front linked list item A1, with the starting address of the linked list item A1 being 0x20010000 and the length of the linked list item region being 0x1800; the address range 0x20012000 to 0x20013FFF after the target RAM region forms the back linked list item A2, with the starting address of the linked list item A2 being 0x20012000 and the length of the linked list item region being 0x2000; the target RAM region 0x20011800 to 0x20011FFF is no longer retained in the ordinary free linked list and is delivered for use by the diagnostic unlocking task.

[0104] After the splitting is complete, the front list item A1 and the back list item A2 are retained in the ordinary free list. The target RAM region obtained by the diagnostic unlocking task is consistent with the starting address and region length in the valid memory record. Therefore, when the MCU is reset subsequently, the startup code can accurately identify the address range 0x20011800 to 0x20011FFF, which is occupied by the security task and whose release flag is not released, based on the valid memory record in the record storage area, and will not misjudge the security-independent RAM region corresponding to the front list item A1 or the back list item A2 as the region to be cleared.

[0105] In another boundary case, if the target RAM region selected by the memory management program is located at the front of a linked list item (e.g., the starting address of the linked list item is 0x20010000, the length of the linked list item is 0x4000, and the target RAM region is from 0x20010000 to 0x200107FF), then the memory management program can adjust the starting address of the original linked list item to 0x20010800 and adjust the length of the region to 0x3800. If the target RAM region is located at the back of a linked list item (e.g., the target RAM region is from 0x20013800 to 0x20013FFF), then the memory management program can keep the starting address of the linked list item at 0x20010000 and adjust the length of the region to 0x3800. If the target RAM region completely covers a linked list item, then the memory management program directly deletes that linked list item. Through these boundary rules, the ordinary free list can only move items out of the address range actually delivered to the security task, rather than expanding the range to be moved out.

[0106] Example 3

[0107] Please refer to Figure 1 and Figure 2Specifically: Based on the vehicle gateway controllers of Embodiments 1 and 2, this paper further explains how the memory management program performs data cleanup and cleanup result verification based on the valid memory records when the security task returns the target RAM area, and releases the target RAM area after the cleanup result passes the verification.

[0108] In this embodiment, the security task is a diagnostic unlocking task. The target RAM area is used to temporarily store intermediate values ​​for seed key calculation, random numbers for secure sessions, and authentication status data. Before allocation, the target RAM area has been formed into a valid memory record according to Embodiment 2. The valid memory record includes a starting address, a region length, and a release flag, wherein the starting address is 0x20011800, the region length is 0x0800, and the release flag is not released.

[0109] When the diagnostic unlocking task completes the diagnostic unlocking process and returns the target RAM region to the memory management program, the memory management program does not directly write the target RAM region back to the ordinary free list. Instead, it first reads the starting address and region length in the valid memory record and uses 0x20011800 to 0x20011FFF as the scope of this cleanup.

[0110] In this embodiment, the memory management program performs data cleanup on the cleanup range according to the 32-bit word width writing method, with a preset cleanup value of 0x00000000. The memory management program starts from the starting address 0x20011800 and writes 4 bytes each time until it covers the entire address range corresponding to the length of the covered area 0x0800.

[0111] Before writing the preset cleanup value, the memory management program disables or suspends DMA transfers that can write to the target RAM region and prevents ordinary tasks from obtaining the address handle of the target RAM region.

[0112] The memory management program executes writes to the target RAM region using a volatile pointer or a dedicated cleanup function, which is configured not to be optimized away by the compiler.

[0113] In other embodiments, the preset cleanup value can also be 0xFFFFFFFF, fixed byte mode, alternating byte mode, or a cleanup value determined by security configuration parameters; as long as the cleanup value can be written to the target RAM area and can be used as a comparison benchmark in subsequent verification, it can be used in the cleanup process of this embodiment.

[0114] After the write operation is completed, the memory management program performs a readback check on the target RAM region. Specifically, the memory management program reads the data from 0x20011800 to 0x20011FFF in the same address order as the write order, and compares the 32 bits of data read each time with the preset cleanup value 0x00000000.

[0115] After the write operation is complete, the memory management program executes a data synchronization barrier before readback verification, and performs cache cleanup or invalidation on the target RAM area when the MCU enables data cache.

[0116] If all read data within the target RAM area matches the preset cleanup value, the memory management program determines that the cleanup result has passed the verification; if any read data does not match the preset cleanup value, the memory management program determines that the cleanup result has failed the verification.

[0117] For example, if the data read by the memory management program from 0x20011800, 0x20011804, 0x20011808 up to 0x20011FFC is all 0x00000000, then the cleanup result passes the verification; if the data read from 0x20011920 is 0x6A3C1208, it means that there is still undone data in the target RAM area, and the cleanup result fails the verification.

[0118] Before the cleanup result is verified, the release flag in the valid memory record remains unreleased, and the linked list entry of the target RAM region is not written back to the ordinary free linked list; therefore, even if the security task has initiated the return operation, the target RAM region will not be obtained by the ordinary task through memory allocation as long as the cleanup result has not been confirmed.

[0119] After the cleanup result passes verification, the memory management program updates the release status of the target RAM region to "released" and generates a linked list entry for the target RAM region based on the starting address and region length in the valid memory record. When the record storage area uses Flash record pages, the release status update is achieved by appending a release record with a larger record number. The starting address of the linked list entry is 0x20011800, and the region length of the linked list entry is 0x0800.

[0120] Subsequently, the memory management program writes the linked list entries of the target RAM region back to the normal free linked list, making the target RAM region available for request by normal or secure tasks again.

[0121] If the cleanup result fails the verification, the memory management program does not change the release flag in the valid memory record, nor does it generate a free list entry for the target RAM region; the target RAM region remains in an unreleased state, and can be cleaned again, trigger a security alarm, or wait for a reset before the startup code processes it based on the valid memory record.

[0122] This embodiment also discloses a boundary processing method: when the length of the target RAM region is not an integer multiple of the write word width, the memory management program first writes and verifies the main address range according to the full word width, and then performs byte-by-byte write and read-back verification on the remaining bytes; this can avoid the tail bytes not being cleaned up due to uneven region length boundaries.

[0123] This embodiment also discloses another boundary handling method: when an interruption, watchdog reset or software reset occurs during the cleanup process, since the release flag has not yet been changed to released, the MCU reset startup code can still read the valid memory record and remove the target RAM area from the temporary free list according to the unreleased state, thereby avoiding the target RAM area from entering the normal free list after the cleanup process is interrupted.

[0124] Through the above process, the safe task of returning the target RAM area does not directly lead to the reallocation of the target RAM area. Only after the target RAM area has completed data cleanup and the cleanup result has passed the verification will the linked list items of the target RAM area be written back to the ordinary free linked list.

[0125] This embodiment can solve the problem that when the vehicle gateway controller finishes a diagnostic unlocking task, message authentication task, or OTA security verification task, the target RAM area is not cleared and is reassigned to a normal task. At the same time, this embodiment also provides a record basis for recovery after the clearing process is interrupted by MCU reset, so that the release status can accurately indicate whether the target RAM area has been safely released.

[0126] Example 4

[0127] Please refer to Figure 1 and Figure 2 Specifically, based on Embodiments 1 and 3, this embodiment further explains the process of establishing a temporary free list in the startup code during the MCU reset startup phase. This embodiment is still applied to the vehicle gateway controller. The types of security tasks and normal tasks, the setting method of the record storage area, and the fields of the effective memory record can be referred to Embodiments 1 and 3, and will not be repeated here.

[0128] After a watchdog reset, software reset, or abnormal reset occurs on the MCU, the startup code first enters the startup initialization phase. During this phase, normal tasks have not yet run, and the memory allocation interface for normal tasks is closed. The startup code first reads records from the record storage area. Each record includes at least a start address, region length, release flag, record sequence number, record checksum, and write completion flag. The startup code only determines records whose checksums pass verification and whose write completion flag is in a completed state as valid memory records. The start address and region length are used to determine the RAM address range previously occupied by the security task, and the release flag is used to determine whether the RAM address range has been cleared and released.

[0129] During the startup initialization phase, the startup code uses a private RAM area to store temporary free lists and lists to be cleaned up. The private RAM area is not configured as part of the RAM range available to normal tasks.

[0130] After reading the valid memory record, the startup code reads the preset RAM layout. The preset RAM layout can be given by the linker script, the startup configuration table, or RAM configuration items in the firmware. Its contents include at least the starting address and region length of the RAM range available to the normal task. For example, if the preset RAM layout configures the RAM range available to the normal task to be from 0x20010000 to 0x20017FFF, then the startup code will create an initial linked list entry based on this range. The starting address of this initial linked list entry is 0x20010000, and the region length is 0x8000.

[0131] When there are multiple non-contiguous RAM ranges available for normal tasks in the preset RAM layout, the startup code creates an initial linked list entry for each RAM range and connects these initial linked list entries in ascending address order to form a temporary free linked list. For example, if the first RAM range is 0x20010000 to 0x20017FFF and the second RAM range is 0x2001C000 to 0x20023FFF, the startup code creates two initial linked list entries, which together form a temporary free linked list.

[0132] When establishing the temporary free list, the startup code can also perform boundary checks on the preset RAM layout. If a RAM range exceeds the actual RAM address range of the MCU, the startup code will not write the excess portion into the temporary free list. If the available RAM ranges of two ordinary tasks are adjacent, the startup code can merge the two RAM ranges into a single initial list entry. Through this process, the temporary free list can accurately represent the theoretically available RAM address range for ordinary tasks.

[0133] Before the valid memory record is read completely and the temporary free list is formed and corrected according to the unreleased records, the startup code does not enable memory allocation for ordinary tasks. In other words, the temporary free list will not be used by the memory manager to respond to RAM requests from ordinary tasks before it is fully established; even if the temporary free list has been initially established, it will not be made available for allocation to ordinary tasks until the valid memory record has been read completely or corrected.

[0134] Before the cleanup list is formed, the startup code does not call the normal task scheduling entry point, nor does it open the initialization interface for normal tasks to directly access the available RAM range of normal tasks.

[0135] In a specific example, a valid memory record is read from the memory storage area. This record starts at address 0x20011800, has a region length of 0x0800, and is marked as not released. The startup code first reads this valid memory record and then creates a temporary free list with a starting address of 0x20010000 and a region length of 0x8000 according to the preset RAM layout. Before handing this temporary free list over to the memory management program, the startup code continues to execute the subsequent list correction process, excluding the RAM region corresponding to 0x20011800 to 0x20011FFF from the temporary free list. Only after this processing is completed does the startup code hand over the processed list to the memory management program as a regular free list.

[0136] The purpose of this embodiment is to ensure that RAM allocation for ordinary tasks does not occur before the effective memory record is read and the temporary free list is established, thereby preventing ordinary tasks from obtaining RAM address ranges that have not yet been corrected according to the effective memory record in the early stages of reset recovery, and providing an executable data basis for subsequently excluding unreleased RAM areas based on the release flag.

[0137] Example 5

[0138] Please refer to Figure 1 and Figure 2 Specifically, based on the vehicle gateway controllers of Examples 1 to 4, this paper further explains how, after the MCU is reset and started, the startup code modifies the temporary free list according to the effective memory record and writes the RAM areas marked as not released into the list to be cleaned.

[0139] In this embodiment, the startup code has read the valid memory records in the record storage area according to Embodiment 4, and established a temporary free list according to the preset RAM layout. The valid memory record includes a starting address, region length, release flag, record sequence number, record check value, and write completion flag. Each item in the temporary free list includes the starting address and region length of the item. The startup code uses valid memory records with the release flag set to "not released," the record check value verified, and the write completion flag set to "completed" as the basis for list modification.

[0140] The startup code first identifies the RAM regions corresponding to valid memory records whose release flags are not yet set as the exclusion address segments. The starting address of the exclusion address segment is equal to the starting address within the valid memory record, and the ending address is determined by the starting address and the region length. For example, if the starting address of a valid memory record is 0x20011800 and the region length is 0x0800, then the exclusion address segment is from 0x20011800 to 0x20011FFF.

[0141] The startup code then defines each item in the temporary free list as a linked list address segment. The starting address of the linked list address segment is equal to the starting address of the linked list item itself, and the ending address is determined by the starting address of the linked list item and the length of the linked list item's region. For example, if the starting address of a linked list item is 0x20010000 and the length of the linked list item's region is 0x3000, then the linked list address segment corresponding to that linked list item is from 0x20010000 to 0x20012FFF.

[0142] The startup code checks the address relationship between the address segment to be excluded and the linked list address segment item by item. Address relationships include no overlap, complete coverage, end coverage, and middle coverage. No overlap means the address segment to be excluded and the linked list address segment have no address intersection. Complete coverage means the address segment to be excluded covers the entire address range of the linked list address segment. End coverage means the address segment to be excluded covers the beginning or end of the linked list address segment, but not the entire address range. Middle coverage means the address segment to be excluded is located in the middle of the linked list address segment, so that there are uncovered address ranges on both sides of the address segment to be excluded.

[0143] When there is no address overlap, the startup code does not adjust the linked list entry corresponding to the linked list address segment, and the linked list entry remains in the temporary free linked list. For example, if the address segment to be excluded is 0x20011800 to 0x20011FFF, and the linked list address segment is 0x20014000 to 0x20017FFF, and there is no address overlap, then the startup code retains the linked list entry.

[0144] When the address relationship is a complete overwrite, the startup code deletes the linked list entry corresponding to the linked list address segment from the temporary free linked list, and writes the starting address and region length of the linked list address segment into the cleanup linked list. For example, if the address segment to be excluded is 0x20011800 to 0x20011FFF, and the linked list address segment is also 0x20011800 to 0x20011FFF, then the startup code deletes the linked list entry and writes the starting address 0x20011800 and region length 0x0800 into the cleanup linked list.

[0145] When the address relationship is end-overlay, the startup code writes the address range covered by the address segment to be excluded into the cleanup list and adjusts the starting address or region length of the list item so that the adjusted list item corresponds only to the uncovered address range. If the address segment to be excluded covers the front end of the list address segment, for example, if the list address segment is 0x20011800 to 0x20012FFF and the address segment to be excluded is 0x20011800 to 0x20011FFF, then the startup code writes 0x20011800 to 0x20011FFF into the cleanup list, adjusts the starting address of the list item to 0x20012000, and adjusts the region length to 0x1000. If the address range to be excluded covers the end of the linked list address range, for example, if the linked list address range is 0x20010000 to 0x20011FFF and the address range to be excluded is 0x20011800 to 0x20011FFF, then the startup code will write 0x20011800 to 0x20011FFF into the linked list to be cleaned, keep the starting address of the linked list item at 0x20010000, and adjust the region length to 0x1800.

[0146] When the address relationship is intermediate overwrite, the startup code splits the linked list entries corresponding to the linked list address segment into a front linked list entry and a back linked list entry. The front linked list entry corresponds to the address range before the address range to be excluded, and the back linked list entry corresponds to the address range after the address range to be excluded. The address range to be excluded is written into the cleanup linked list. For example, if the linked list address range is 0x20010000 to 0x20012FFF, and the address range to be excluded is 0x20011800 to 0x20011FFF, then the startup code generates a front linked list entry and a back linked list entry. The starting address of the front linked list entry is 0x20010000, and the region length is 0x1800. The starting address of the back linked list entry is 0x20012000, and the region length is 0x1000. The cleanup linked list is written with a starting address of 0x20011800 and a region length of 0x0800.

[0147] In a complete example, the temporary free list includes a first list item, a second list item, and a third list item. The first list item corresponds to 0x20010000 to 0x20012FFF. The second list item corresponds to 0x20014000 to 0x20017FFF. The third list item corresponds to 0x20019000 to 0x2001BFFF. 0x20013000 to 0x20013FFF and 0x20018000 to 0x20018FFF are reserved address ranges in the preset RAM layout that are not dynamically allocated for normal tasks, and therefore do not belong to the temporary free list. There are two valid memory records in the record storage area whose release flag is not yet released. The first valid memory record corresponds to 0x20011800 to 0x20011FFF. The second valid memory record corresponds to 0x20014000 to 0x20014FFF.

[0148] When the startup code processes the first valid memory record, it determines that the address segment to be excluded is located in the middle of the first linked list item. Therefore, it splits the first linked list item into a front linked list item and a back linked list item, and writes 0x20011800 to 0x20011FFF into the cleanup linked list. When the startup code processes the second valid memory record, it determines that the address segment to be excluded is located at the front of the second linked list item. Therefore, it adjusts the starting address of the second linked list item to 0x20015000, adjusts the region length to 0x3000, and writes 0x20014000 to 0x20014FFF into the cleanup linked list. The third linked list item does not overlap with either of the two address segments to be excluded, so the third linked list item remains unchanged.

[0149] After processing, the address ranges retained in the temporary free list include 0x20010000 to 0x200117FF, 0x20012000 to 0x20012FFF, 0x20015000 to 0x20017FFF, and 0x20019000 to 0x2001BFFF. The address ranges in the list to be cleaned include 0x20011800 to 0x20011FFF and 0x20014000 to 0x20014FFF. Therefore, the address ranges in the list to be cleaned do not overlap with the address ranges in the processed temporary free list.

[0150] If multiple valid memory records with unreleased flags exist in the record storage area, the startup code can process them sequentially from low to high starting addresses. If two address segments to be excluded are adjacent or overlap, the startup code first merges the adjacent or overlapping address segments into a single contiguous segment, then performs address relationship checks on the temporary free list, and writes the record sequence numbers of the valid memory records participating in the merger into the source record sequence number set of the merged list item to be cleaned. This process avoids the same RAM address range being repeatedly written to the list to be cleaned, and also avoids overlapping list items in the temporary free list.

[0151] If the starting address or length of a valid memory record exceeds the range of RAM available to ordinary tasks as defined by the default RAM layout, the startup code can mark the record as an abnormal record. The startup code does not add the address range corresponding to the abnormal record to the temporary free list. If the release flag cannot be recognized, the startup code treats it as not released. This conservative approach prevents ordinary tasks from acquiring RAM regions that have not yet been confirmed as safely released due to record abnormalities.

[0152] After the startup code completes the check of all valid memory records, it hands over the processed temporary free list to the memory management program as a regular free list. Regular tasks can only request RAM space from this regular free list. RAM regions in the list to be cleaned are not included in the RAM allocation for regular tasks until the cleanup verification passes.

[0153] When the MCU has an MPU, the startup code configures the RAM areas in the list to be cleared to be non-readable and non-writable by ordinary tasks while delivering the ordinary free list.

[0154] When the MCU does not have an MPU, the startup code only provides the RAM address handle returned by the memory management program to the ordinary task. This method restricts the ordinary task to obtain the RAM area in the list to be cleaned through the memory allocation path. If the ordinary task can bypass the memory management program and directly read and write RAM at absolute address, it still needs to rely on a trusted runtime environment, compilation isolation or other system-level constraints.

[0155] The purpose of this embodiment is that the startup code does not perform indiscriminate cleanup of all RAM after reset, nor does it simply delete the entire free list entry. Instead, it performs address-level correction on the temporary free list based on the address segments to be excluded determined by the valid memory records. This correction allows RAM address segments with the release flag not yet released to enter the cleanup list, while ensuring that RAM address segments not covered by the address segments to be excluded remain available for allocation by normal tasks.

[0156] Through the above processing, even if the MCU is reset during diagnostic unlocking, message authentication, or OTA security verification, the vehicle gateway controller can exclude RAM address segments that have not yet been released by security tasks before the normal task runs. This reduces the risk of normal tasks regaining sensitive RAM remnants and reduces the loss of available RAM caused by the isolation of the entire RAM segment.

[0157] Example 6

[0158] Please refer to Figure 1 and Figure 2 Specifically, based on the vehicle gateway controllers of Examples 1 to 5, this paper further explains how the memory management program handles the RAM area in the list to be cleaned and reclaims the corresponding RAM area to the ordinary free list after the cleanup verification is passed.

[0159] In this embodiment, the startup code has completed the modification of the temporary free list according to Embodiment 5, and written the RAM address segments with the release flag not set to be released into the cleanup list. Each item in the cleanup list includes the starting address of the RAM region to be cleaned, the region length, and a set of source record numbers. The set of source record numbers stores the record numbers of one or more valid memory records corresponding to the RAM region to be cleaned.

[0160] After the memory management program takes over the ordinary free list, it does not directly open up the RAM area in the list to be cleaned to ordinary tasks. Instead, it first reads the list item by item. For each item, the memory management program determines the scope of the current RAM area to be cleaned based on its starting address and region length.

[0161] For example, the list to be cleaned contains a first cleanup item with a starting address of 0x20011800, a region length of 0x0800, and a corresponding RAM address range of 0x20011800 to 0x20011FFF. The list also contains a second cleanup item with a starting address of 0x20014000, a region length of 0x1000, and a corresponding RAM address range of 0x20014000 to 0x20014FFF.

[0162] When the memory management program processes the first cleanup item, it first writes a preset cleanup value to the corresponding RAM region according to the starting address 0x20011800 and the region length 0x0800. In one implementation, the preset cleanup value is 0x00000000, and the write granularity is 32 bits. The memory management program starts from 0x20011800 and writes 4 bytes at a time until the write address reaches 0x20011FFC.

[0163] After the write operation is complete, the memory management program performs a readback check on the same RAM region. Specifically, the memory management program reads data from 0x20011800 to 0x20011FFF in the same address order as the write operation, and compares each 32-bit data read with 0x00000000. If all read data matches the preset cleanup value, the cleanup result of the RAM region corresponding to the first cleanup item is deemed to have passed the check.

[0164] In another implementation, the preset cleanup value can also be 0xFFFFFFFF, a fixed byte mode, or a multi-round alternating write value. For RAM regions whose length is not an integer multiple of the write granularity, the memory management program first processes the main address range at the complete write granularity, and then performs byte-by-byte write and readback verification on the remaining bytes to avoid missing tail bytes.

[0165] After the RAM region cleanup result corresponding to the first cleanup item passes verification, the memory management program updates the release status of one or more valid memory records in the record storage area to "released" based on the source record sequence number set in the first cleanup item. When the record storage area uses Flash record pages, the release status update is achieved by appending a release record with a larger record sequence number. Subsequently, the memory management program generates a new linked list item based on the starting address 0x20011800 and the region length 0x0800 in the first cleanup item. The address range of the new linked list item is from 0x20011800 to 0x20011FFF.

[0166] Before writing a new linked list item to the ordinary free linked list, the memory management program searches for a linked list item adjacent to the new linked list item in the ordinary free linked list. If the end address of an existing linked list item is consecutive to the start address of the new linked list item, or if the end address of the new linked list item is consecutive to the start address of an existing linked list item, then the new linked list item is determined to be consecutive to the address of that existing linked list item.

[0167] For example, in the processing result of Example 5, the normal free list already retains the front and back list entries. The front list entries correspond to 0x20010000 to 0x200117FF, and the back list entries correspond to 0x20012000 to 0x20012FFF. The new list entries generated after the first cleanup item passes the verification correspond to 0x20011800 to 0x20011FFF. Since the end address 0x200117FF of the front list entry is continuous with the start address 0x20011800 of the new list entry, and the end address 0x20011FFF of the new list entry is continuous with the start address 0x20012000 of the back list entry, the memory management program merges the front list entry, the new list entry, and the back list entry into one list entry. The starting address of the merged linked list item is 0x20010000, the region length is 0x3000, and the corresponding address range is from 0x20010000 to 0x20012FFF.

[0168] If the new linked list entry is contiguous only to the address of the preceding linked list entry, the memory management program merges the new linked list entry into the preceding linked list entry and extends the region length of the preceding linked list entry. If the new linked list entry is contiguous only to the address of the following linked list entry, the memory management program adjusts the starting address of the following linked list entry to the starting address of the new linked list entry and increases the region length accordingly. If the new linked list entry is not contiguous with any adjacent linked list entries in the ordinary free linked list, the memory management program inserts the new linked list entry into the ordinary free linked list according to address order.

[0169] After the memory management program completes the write-back or merging of linked list items, it removes the first cleanup item from the list to be cleaned up. At this point, the RAM area corresponding to the first cleanup item has completed cleanup, verification, release flag update, and reclamation of the ordinary free linked list. Ordinary tasks can then re-allocate this RAM area through the memory management program.

[0170] The memory management program continues processing the second cleanup item. Assuming the RAM address range corresponding to the second cleanup item is 0x20014000 to 0x20014FFF, the memory management program also performs cleanup and readback verification according to the starting address and region length. If the cleanup result passes the verification, the memory management program updates the release status of one or more corresponding valid memory records in the record storage area to "released" based on the source record sequence number set in the second cleanup item, and generates a new linked list entry based on 0x20014000 and 0x1000.

[0171] If a neighboring list item with a starting address of 0x20015000 and a region length of 0x3000 exists in the ordinary free list, then the address range corresponding to this list item is 0x20015000 to 0x20017FFF. Since the new list item generated by the second cleanup item corresponds to 0x20014000 to 0x20014FFF, and the two addresses are contiguous, the memory management program merges the new list item with the neighboring list item, forming a list item with a starting address of 0x20014000 and a region length of 0x4000.

[0172] In another case where a normal free list already includes two adjacent linked list items, 0x20010000 to 0x20013FFF and 0x20015000 to 0x20017FFF, the new linked list item 0x20014000 to 0x20014FFF generated by the second cleanup item can be merged with the two linked list items simultaneously, ultimately forming a continuous linked list item corresponding to 0x20010000 to 0x20017FFF.

[0173] If the cleanup result of an item to be cleaned up fails the verification, the memory management program will not write the RAM area corresponding to that item to be cleaned up into the ordinary free list. The release flag in the corresponding valid memory record will remain as not released, and the item to be cleaned up will continue to be retained in the cleanup list.

[0174] For example, if the memory management program performs cleanup on the address range 0x20016000 to 0x200167FF, and the data read back from address 0x20016220 is not the preset cleanup value, then the cleanup result is deemed to have failed the verification. In this case, no ordinary free list entry is generated for 0x20016000 to 0x200167FF, nor is it merged with any adjacent list entry. This address range remains in the cleanup list, and ordinary tasks cannot request this RAM region through the memory management program.

[0175] For RAM regions that fail the cleanup check, the memory management program can retry the cleanup when the vehicle controller load is low, or it can record the fault status or trigger a safety diagnostic event. Regardless of the subsequent processing method used, if the cleanup result fails the check, the RAM region will not be added to the normal free list.

[0176] When there are multiple cleanup items in the list to be cleaned up, the memory management program can process them in ascending address order or in the order of record generation. If multiple cleanup items are adjacent and all pass the cleanup check, the memory management program can perform a unified merging after generating the list items to reduce the number of list items in the ordinary free list and improve the efficiency of subsequent RAM allocation.

[0177] In one boundary case, if the starting address or region length in the list to be cleaned exceeds the preset RAM layout, the memory management program will not generate a normal free list entry for that item and may mark it as an abnormal cleanup item. This process prevents abnormal records from causing illegal addresses to enter the normal free list.

[0178] In another boundary case, if a RAM region in the list to be cleared overlaps with a list entry in the ordinary free list, the memory management program can first refuse to write that RAM region back to the ordinary free list and trigger a list consistency check. This process can prevent duplicate address ranges from appearing in the ordinary free list.

[0179] In another boundary case, if the RAM region in the list to be cleaned overlaps with the private RAM region of the startup code, the memory management program refuses to clean up the list item to be cleaned and triggers the startup data structure exception handling.

[0180] Through the above process, the RAM regions in the list to be cleaned will not automatically revert to normal allocatable space after the startup code completes the list correction; instead, they must undergo cleanup and verification. Only after the cleanup result passes verification will the memory management program generate a linked list entry based on the starting address and region length, and write it back to the normal free linked list. If the address of an entry is contiguous with that of an adjacent linked list entry, the memory management program will also merge the linked list entries to reduce linked list fragmentation.

[0181] This embodiment addresses the issue of how to safely reclaim RAM areas removed after MCU reset during diagnostic unlocking, message authentication, or OTA security verification processes in vehicle gateway controllers. By clearing and writing back to the normal free list after successful verification, and by retaining the RAM in the pending list when clearing fails, this embodiment avoids both the possibility of the uncleaned RAM areas being reclaimed by normal tasks and the waste of RAM resources caused by long-term isolation.

[0182] The starting address, region length, preset cleanup value, record storage area page management method, and linked list merging method described above are only for illustrating the specific implementation of this embodiment. Without departing from the concept of this invention, those skilled in the art can make adaptive adjustments based on MCU bus width, RAM layout, record storage area lifespan, linked list structure, and vehicle controller safety level requirements.

[0183] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention.

Claims

1. A method for protecting MCU memory access, characterized in that: Includes the following steps: S1. When a security task requests RAM space, the memory management program selects the target RAM region from the ordinary free list. Before delivering the target RAM region, the memory management program writes the starting address, region length, and release flag of the target RAM region into a record storage area that can still be read after reset, forming a corresponding valid memory record, wherein the release flag is not released; After the write operation is completed, the memory management program removes the target RAM region from the ordinary free list and delivers the target RAM region to the security task. S2. When the security task returns the target RAM area, the memory management program cleans up the target RAM area according to the valid memory record and verifies the cleanup result. After the verification is passed, the memory management program changes the release flag to "released" and writes the linked list item of the target RAM area back to the ordinary free linked list. S3. When the MCU is reset and started, the startup code reads the valid memory records in the record storage area and establishes a temporary free list according to the preset RAM layout; S4. The startup code modifies the temporary free list according to the effective memory record, deletes the RAM area corresponding to the effective memory record whose release flag is not released from the temporary free list and writes it into the cleanup list, and hands the processed temporary free list as a normal free list to the memory management program. S5. The memory management program cleans up the RAM area in the list to be cleaned and verifies the cleanup result; After the verification is successful, the memory management program will change the corresponding release flag to "released" and write the linked list entry of the corresponding RAM area back to the ordinary free linked list.

2. The MCU memory access protection method according to claim 1, characterized in that: In S1, the memory management program first writes the starting address, region length, and unreleased release flag of the target RAM region into the record storage area; Then read the written content in the record storage area, and delete the list entry of the target RAM area from the ordinary free list only when the read start address, area length and release flag are consistent with the target RAM area to be delivered; If the effective memory record writing fails, the memory management program retains the linked list entry in the ordinary free linked list corresponding to the target RAM region; And cancel the delivery of the target RAM region to the security task.

3. The MCU memory access protection method according to claim 1, characterized in that: In S1, the linked list entries in the ordinary free linked list include the starting address of the linked list entry and the length of the linked list entry region; When the address range of the target RAM region falls within the address range of a linked list item, and the target RAM region does not cover the entire address range of the linked list item, the memory management program splits the linked list item according to the starting address and region length of the target RAM region; The address ranges assigned to the security task are written to the valid memory record, while the address ranges not assigned to the security task are retained in the ordinary free list.

4. The MCU memory access protection method according to claim 1, characterized in that: In S2, the memory management program writes a preset cleanup value to the target RAM region according to the starting address and region length in the effective memory record, and reads the data in the target RAM region after the writing is completed; When the read data matches the preset cleanup value, the cleanup result of the target RAM area is determined to have passed the verification. Before the cleanup result passes verification, the release flag remains unreleased, and the linked list entries of the target RAM region are not written back to the ordinary free linked list.

5. The MCU memory access protection method according to claim 1, characterized in that: In S3, the startup code reads the available RAM range for a normal task from a preset RAM layout, the available RAM range for a normal task including the starting address and the region length; The startup code establishes at least one initial linked list item based on the available RAM range of the normal task, and forms the temporary free linked list from the initial linked list item; Before the effective memory record is read completely and the temporary free list is formed, the startup code does not enable memory allocation for normal tasks.

6. The MCU memory access protection method according to claim 1, characterized in that: In S4, the startup code identifies the RAM region corresponding to the valid memory record whose release flag is not released as the address segment to be excluded, and identifies the linked list item in the temporary free linked list as the linked list address segment; The startup code determines the address relationship between the address segment to be excluded and the linked list address segment based on the starting address and region length of the address segment to be excluded, as well as the starting address and region length of the linked list address segment. The address relationship includes no overlap, complete coverage, end coverage, and intermediate coverage.

7. The MCU memory access protection method according to claim 6, characterized in that: In S4, when the address relationship is non-overlapping, the startup code retains the linked list item corresponding to the linked list address segment; When the address relationship is a complete overwrite, the startup code deletes the linked list item corresponding to the linked list address segment from the temporary free linked list, and writes the starting address and region length of the linked list address segment into the linked list to be cleaned.

8. The MCU memory access protection method according to claim 6, characterized in that: In S4, when the address relationship is end-over, the startup code will write the address segment covered by the address segment to be excluded into the cleanup list; The starting address or region length of the linked list item corresponding to the linked list address segment is adjusted so that the adjusted linked list item corresponds only to the address segment not covered by the address segment to be excluded.

9. The MCU memory access protection method according to claim 6, characterized in that: In S4, when the address relationship is intermediate overlay, the startup code splits the linked list item corresponding to the linked list address segment into a front linked list item and a back linked list item. The front and back linked list entries are retained in the temporary free linked list, and the address range between the front and back linked list entries is written into the list to be cleaned up.

10. The MCU memory access protection method according to claim 1, characterized in that: In S5, the memory management program cleans up the corresponding RAM region according to the starting address and region length in the list to be cleaned; After the cleanup result passes the verification, the memory management program generates a new linked list entry based on the starting address and length of the current RAM region, and writes the new linked list entry into the ordinary free linked list. If the new linked list entry is contiguous with the address of an adjacent linked list entry in the ordinary free linked list, the memory management program merges the new linked list entry with the adjacent linked list entry. If the cleanup result fails the verification, the current RAM region will remain in the cleanup list.

Images