Memory protection unit with secure delegation
A memory protection unit (MPU) configuration request may be received, where the MPU configuration request may include a memory protection rule. A first entry in a first MPU circuit may be determined which matches the memory protection rule. A compliance result may be determined based on checking if the memory protection rule complies with the first entry. The memory protection rule may be written in a second MPU circuit based on the compliance result.
1. A method, comprising:
receiving a memory protection unit (MPU) configuration request, wherein the MPU configuration request includes a memory protection rule;
determining a first entry in a first MPU circuit which matches the memory protection rule;
determining a compliance result based on checking if the memory protection rule complies with the first entry; and
writing the memory protection rule in a second MPU circuit based on the compliance result.
2. The method of claim 1 , wherein the second MPU circuit is the same as the first MPU circuit.
3. The method of claim 1 , further comprising generating an error signal in response to determining that no entry in the first MPU circuit matches the memory protection rule.
4. The method of claim 1 , further comprising generating an error signal when the compliance result indicates that the memory protection rule does not comply with the first entry.
5. The method of claim 1 , wherein the memory protection rule includes a first memory region and a first access permission.
6. The method of claim 5 , wherein the memory protection rule complies with the first entry when the first access permission is at least as restrictive as a second access permission associated with the first entry.
7. The method of claim 5 , wherein the first entry in the first MPU circuit matches the memory protection rule when the first memory region is within a second memory region associated with the first entry.
8. A circuit, comprising:
an interface to receive a memory protection unit (MPU) configuration request, wherein the MPU configuration request includes a memory protection rule;
a first circuit to determine a first entry in a first set of entries which matches the memory protection rule;
a second circuit to determine a compliance result based on checking if the memory protection rule complies with the first entry; and
a third circuit to store the memory protection rule in a second set of entries based on the compliance result.
9. The circuit of claim 8 , wherein the second set of entries is the same as the first set of entries.
10. The circuit of claim 8 , wherein the first circuit generates an error signal in response to determining that no entry in the first set of entries matches the memory protection rule.
11. The circuit of claim 8 , wherein the second circuit generates an error signal when the compliance result indicates that the memory protection rule does not comply with the first entry.
12. The circuit of claim 8 , wherein the memory protection rule includes a first memory region and a first access permission.
13. The circuit of claim 12 , wherein the memory protection rule complies with the first entry when the first access permission is at least as restrictive as a second access permission associated with the first entry.
14. The circuit of claim 8 , wherein the first entry matches the memory protection rule when a first memory region associated with the memory protection rule is within a second memory region associated with the first entry.
15. A non-transitory computer-readable medium comprising stored instructions, which when executed by a processor, cause the processor to generate a digital representation of a circuit, the circuit comprising:
an interface to receive a memory protection unit (MPU) configuration request, wherein the MPU configuration request includes a memory protection rule, and wherein the memory protection rule includes a first memory region and a first access permission;
a first circuit to determine a first entry in a first set of entries which matches the memory protection rule;
a second circuit to determine a compliance result based on checking if the memory protection rule complies with the first entry; and
a third circuit to store the memory protection rule in a second set of entries based on the compliance result.
16. The non-transitory computer-readable medium of claim 15 , wherein the second set of entries is the same as the first set of entries.
17. The non-transitory computer-readable medium of claim 15 , wherein the first circuit generates an error signal in response to determining that no entry in the first set of entries matches the memory protection rule.
18. The non-transitory computer-readable medium of claim 15 , wherein the second circuit generates an error signal when the compliance result indicates that the memory protection rule does not comply with the first entry.
19. The non-transitory computer-readable medium of claim 15 , wherein the memory protection rule complies with the first entry when the first access permission is at least as restrictive as a second access permission associated with the first entry.
20. The non-transitory computer-readable medium of claim 15 , wherein the first entry matches the memory protection rule when the first memory region associated with the memory protection rule is within a second memory region associated with the first entry.