Method for accessing data block stored in memory unit of computing unit

Abstract

The invention relates to a method for accessing a data block stored in a memory unit of a computing unit from a number of data blocks, comprising: activating (222) a secure operating mode of the computing unit (100); accessing (223) the data block in the secure mode of operation of the computing unit; when the access is a read access, reading data from the data block and then writing the data into the data block; when the access comprises write access, reading first data from the data block, removing the first data from a check value associated with the data block, writing second data into the data block, and adding the second data into the check value associated with the data block; and, checking (224) the check value associated with the data block. The invention also relates to a computing unit, a computer program and a machine-readable program medium.

Description

Technical Field

[0001] The invention relates to a method for accessing a data block from a number of data blocks stored in a memory unit of a computing unit, as well as to a computing unit and a computer program for carrying out the method. Background Art

[0002] In computing units, such as microcontrollers or systems on chips (SoCs), functionally safe implementation platforms (in English, for example, referred to as "safety islands", "vital modules", "safety backbones" or "safety execution platforms") can be implemented in order to implement software with the highest safety level in terms of operational safety or functional safety (English: "safety"). For example, in the automotive sector, this safety level can be ASIL-D, which is the highest safety requirement level for safety-related systems in motor vehicles according to the ISO 26262 safety standard or the ASIL (Automotive Safety Integrity Level) defined therein.

[0003] Such a functionally safe implementation platform can be realized, for example, by providing two identical processor cores and operating them in a so-called lockstep method, wherein the two cores execute the same process and mutually check the plausibility of their results and wherein an error signal can be output if a deviation is detected. The cores usually have independent clock trees and independent areas on the respective chip. For example, the program code can be stored in an embedded NOR flash memory and the data can be stored in an embedded static ROM memory.

[0004] However, such lockstep schemes with additional redundant processor cores are associated with high energy consumption and large space requirements. In addition, lockstep schemes cannot be implemented equally well in all processor types. For example, lockstep schemes are well suited for medium-performance cores, which are used, for example, to control motors or to control braking systems in vehicles. However, at higher performances, lockstep methods may generally scale poorly. High-performance cores can generally only be operated in parallel lockstep operation conditionally. NOR flash memory is also generally not scalable to nodes below 28nm and requires more area than NAND flash memory. Embedded static RAM can generally include no more than 10MiB (megabytes).

[0005] Therefore, functionally safe implementation platforms based on the lockstep principle are usually only suitable to a certain extent for systems with large program codes and large data volumes, as is the case, for example, in the course of automated driving. Summary of the invention

[0006] According to the invention, a method for accessing a data block from a number of data blocks stored in a memory unit of a computing unit, as well as a computing unit for executing the method and a computer program for executing the method are proposed. Advantageous embodiments are the subject of the following description.

[0007] The invention makes it possible to access data in a computing unit in a safe manner with respect to operational safety or functional safety (English: "safety"). When speaking of "safety" or "security" in the present context, this is to be understood in particular in the sense of operational safety or functional safety (English: "safety"), as opposed to information technology safety or information security (English: "security").

[0008] The memory unit of the computing unit is in particular a non-volatile memory unit, for example a (NAND) flash memory. Each of the certain number of data blocks has a predetermined or predeterminable number of bytes. It is particularly expedient if a check value is assigned to each of the certain number of data blocks and the certain number of data blocks are stored together with a corresponding number of check values ​​in the memory unit.

[0009] Within the scope of the method, the safe operating mode of the computing unit is activated or the computing unit is operated in the safe operating mode. For example, an activation instruction for activating the safe operating mode can be read and executed by a processor unit of the computing unit. In particular, the computing unit can thus switch from a normal conventional operating mode to a safe operating mode.

[0010] In the safe operating mode of the arithmetic unit, corresponding data blocks of the certain number of data blocks are accessed in a read and / or write manner.

[0011] When the access is a read access, the data are read from the data block and then written into the data block. In this case, the check value associated with the data block is preferably not changed. If the read data are falsified, for example while they are held in a register, this error is transferred to the data block by writing. This error can be detected by checking the check value.

[0012] When the access comprises a write access, the first data is read from the data block and the first data is removed from the check value associated with the data block. Thus, expediently, the check value is changed according to the first data. Furthermore, the second data is written to the data block and the second data is added to the check value associated with the data block. Thus, expediently, the check value is changed again according to the second data. By this change of the check value, the access to the data block can be expediently traced or tracked. When the access is a write access, the second data can, for example, be independent of the first data. When the access comprises a read and write access, the first data can, for example, be processed into the second data.

[0013] Furthermore, in the safety operating mode, the check values ​​associated with the data blocks are checked. It is particularly expedient that in the safety operating mode, each check value stored in the storage unit is checked, in particular at least once. For example, the respective check value can be checked during access to the respective data block. In particular, the individual check values ​​can also be performed independently of or in addition to access to the data block. For example, the check of the check values ​​can be performed in the safety operating mode as a separate routine or function, for example at a predetermined time or for a predetermined event or a predetermined instruction.

[0014] The invention is based on the idea that specific, selected data or data blocks are each provided with a check value so that these selected data can be accessed in a safe manner in a safe operating mode. By checking the check value, the individual data blocks can be checked expediently with respect to correctness and completeness, and errors in the individual data blocks or manipulations of the individual data blocks can be detected. Thus, in the safe operating mode, access to incorrect or manipulated data can be prevented. If an error is detected during the check value check, predetermined measures can be executed, for example, an error message can be issued, or an entry can be created in an error memory, or the system can also be stopped or transferred to a safe state if necessary.

[0015] In particular, the computing unit can also be operated in a normal normal operating mode, wherein in this normal operating mode, individual data blocks of the certain number of data blocks are also accessed in a read manner, but in particular independently of the corresponding check value of the individual data blocks, or without checking the check value of the individual data blocks. Thus, in this normal operating mode, in particular, data blocks can only be accessed in a normal, non-secure manner.

[0016] By checking the verification value, it is especially realized that in the safe operation mode, the access to the predetermined data block in the unsafe memory is performed in a safe manner, wherein, the common conventional storage unit that is not protected by a separate additional measure should be understood as an unsafe memory. Because the data blocks of a predetermined number can be accessed in a safe manner in the safe operation mode, these data blocks in the predetermined number of data blocks are also referred to as safe data or safe data blocks in this context. It is appropriate to store other data or data blocks of undetermined verification values ​​in the storage unit. Thus, such data blocks are not part of the data blocks of the predetermined number, and are also referred to as ordinary data or ordinary data blocks in this context. These ordinary data blocks can only be accessed in an ordinary, non-safe manner in the normal operation mode and in the safe operation mode.

[0017] By means of the safe operating mode, a functionally safe implementation platform (“safety island”, “critical module”, “safety backbone” or “safety execution platform”) can be implemented in a labor-saving, energy-saving and space-saving manner. In the safe operating mode, it is possible to implement the software at a high safety level or a maximum safety level (for example, at the highest safety requirement level ASIL-D according to the safety standard ISO 26262 in the automotive field). In order to implement the safe operating mode, in particular, no special hardware units are required; for example, conventional memory units and buses can be used. In addition, in particular, it is not necessary to implement error detection methods (English: “Error Detection Code”, EDC) or error correction methods (English: “Error Correcting Code”, ECC) in hardware. For example, a large external RAM memory can be used and connected to the processor unit via conventional standard interfaces (for example, via a JEDEC-LPDDR interface). In addition, for example, a conventional external NAND flash memory can be used to write program code and initialization data into the RAM memory. Purposely, the safe operating mode can be activated and deactivated at any time as required. In addition, the safe operating mode does not require an embedded NOR flash memory and an embedded static ROM memory in particular. Particularly advantageously, in the safe operating mode, errors in the data path, in the cache memory and in the data memory within the CPU of the computing unit can be detected without additional hardware. Mixed safe and unsafe accesses, statements and data can be provided using defined interfaces. Protection of a predefined number of data blocks can be implemented from the compiler to the CPU.

[0018] According to one embodiment, when the access includes a write access, the check value is written to the storage unit of the computing unit. Thus, the check value changed by removing the first data and adding the second data is stored in the storage unit together with the second data. The check value can be written to the storage unit, for example, during the write access, or it can also be written to the storage unit decoupled from the write access in time. In the latter case, the check value can, for example, be first temporarily stored in a cache memory of the computing unit. For example, when the cache memory is emptied, the check value can be changed accordingly and written to the storage unit.

[0019] According to one embodiment, a check value for a predetermined number of data blocks is determined or created or assigned. Each data block in these data blocks has a predetermined or pre-determined number of bytes. A separate, unique and clear check value is assigned to each individual data block in the predetermined number of data blocks. For example, the check value can be calculated according to a cyclic redundancy check (English: "Cyclic Redundancy Check", CRC). The corresponding determined check values ​​of the certain number of data blocks and each data block are stored in a storage unit of the computing unit. These steps of determining the check value and storing the data block and the check value in the storage unit are performed once, especially at a first time point, especially before the computing unit is put into operation or before the normal operation of the computing unit. Purposely, these steps are performed by means of a compiler during the compilation process. At a second time point occurring after the first time point, especially after the computing unit has been put into operation, especially during the running time of the computing unit, the data block can be accessed.

[0020] According to one embodiment, an identifier or attribute is added to the memory address of each data block in the certain number of data blocks, especially during the compilation process. It is appropriate to distinguish a predetermined number of safety data blocks from ordinary data blocks by these added identifiers. When the pointer points to the data at the corresponding memory address in the safe operation mode, it can be identified based on the memory address: whether the corresponding data is an ordinary data block or a safety data block. If the memory address has a corresponding identifier, the corresponding data block can be processed in a safe manner. For example, as a corresponding identifier, a special bit in the memory address can have a special value. It is appropriate to add the corresponding identifier to the virtual memory address of the corresponding data block. This virtual memory address is converted into a real physical memory address by a memory management unit (English: "Memory Management Unit", MMU), for example. In this way, there is no restriction on the layout of the physical memory in particular.

[0021] According to one embodiment, the certain number of data blocks is stored in at least one predetermined storage area of ​​a storage unit, the at least one predetermined storage area being at a first storage area address or starting from the first storage area address. The check value is stored in the at least one storage area, the at least one storage area being at a second storage area address or starting from the second storage area address. Preferably, the first data block of the certain number of data blocks is stored at the first storage area address in the storage area. Preferably, each additional data block is stored in the storage area with a corresponding offset from the first storage area address. Thus, the first storage area address particularly points to the first data block. Correspondingly, preferably, the second storage area address points to the first check value in the check value. Therefore, the safety data block is stored in the storage unit with a fixed scheme having two representative memory addresses. In this way, access to the data block and checking of the check value can be simply designed in the safety operating mode.

[0022] According to one embodiment, removing the first data from the check value associated with the data block comprises: determining a first characteristic value of the first data, in particular a hash value. Changing the check value according to the determined first characteristic value. For example, the first characteristic value may be subtracted from the check value.

[0023] According to one embodiment, adding the second data to the check value associated with the data block comprises determining a second characteristic value, in particular a hash value, of the second data and changing the check value according to the second characteristic value. For example, the second characteristic value may be added to the check value.

[0024] By such a change of the check value according to the first or second characteristic value, in particular each write access to the data block can be traced or tracked. Such a first or second characteristic value is in particular unique and unambiguous for the corresponding first or second data. For example, the first or second characteristic value can be determined separately for each byte of the corresponding first or second data.

[0025] According to one embodiment, in the safety operating mode, the corresponding data blocks are accessed by means of one or more instructions of different instruction categories. For example, each instruction can be assigned to a corresponding category by a corresponding preset value. In particular, such instructions of different instruction categories enable access to the safety data blocks in a safe manner in the safety operating mode.

[0026] With the help of a write instruction of the first instruction category, data can be written into one of the predetermined number of data blocks without changing the check value associated with the corresponding data block. In addition, with the help of this write instruction of the first instruction category, data can also be written into a normal data block (i.e., a data block that does not belong to the predetermined number of data blocks) to which a check value is not assigned. With the help of a read instruction of the first instruction category, data can be read from one of the predetermined number of data blocks without changing the check value associated with the corresponding data block. In addition, with the help of this read instruction, data can also be read from a normal data block that does not belong to the predetermined number of data blocks. These instructions of the first category can be, for example, conventional read and write instructions that are also used in the normal operating mode. With the help of these instructions, data blocks are accessed in particular independently of the check value.

[0027] By means of a write instruction of the second instruction class, data can be written into one of the predetermined number of data blocks without changing the check value associated with the respective data block. By means of a read instruction of the second instruction class, data are read from one of the predetermined number of data blocks and the check value associated with the respective data block is changed in a first manner. By means of the instructions of the second instruction class, in particular, a predetermined number of safety data blocks are accessed exclusively. If such an instruction of the second class points to a memory address of a normal data block, the instruction is not executed in particular.

[0028] By means of a write instruction of the third instruction class, data are written into one of the predetermined number of data blocks and a check value associated with the respective data block is changed in a second manner. By means of a read instruction of the third instruction class, data are read from one of the predetermined number of data blocks and a check value associated with the respective data block is changed in a third manner. By means of an instruction of the third instruction class, in particular exclusive access is given to a predetermined number of safety data blocks. In particular, such an instruction of the third class is not executed if it points to a memory address of a normal data block.

[0029] According to one embodiment, in the safe operating mode, according to a first time requirement, data are read and written when the access is a read access, and when the access includes a write access, the first data are read and the second data are written. According to a second time requirement, the check value is changed, i.e. the first data are removed from the check value associated with the data block and the second data are added to the check value associated with the data block. In particular, a processing sequence is created for correspondingly changing the check value and the processing sequence is processed according to the second time requirement. According to the first time requirement, the corresponding data is accessed as immediately as possible or as quickly as possible with a small or as small a delay as possible. According to the second time requirement, the check value is not necessarily changed immediately, but can also be processed with a delay if necessary. In particular, before checking the check value, the corresponding check value is changed according to the second time requirement.

[0030] According to one embodiment, when the access includes a write access, the check value associated with the data block is read, and the read check value is stored together with information about the corresponding data block in another storage unit, in particular in a volatile storage unit, in particular in a storage unit in a processor unit of a computing unit, in particular in a check value cache, in particular in a cache memory. Then, the check value stored in the volatile storage unit can be changed accordingly, that is, the first data is removed from the check value stored in the volatile storage unit and the second data is added to the data block stored in the volatile storage unit. The correspondingly changed check value can be written again from the volatile storage unit to the storage unit. For example, the check value can be stored in the volatile storage unit together with the memory address of the corresponding data block, the offset of the corresponding data block in the corresponding storage area of ​​the storage unit and the memory address of the check value as information about the corresponding data block. By storing the check value and the corresponding information, the check value can be processed in a simple and efficient manner according to the second time requirement.

[0031] According to one embodiment, in particular during the compilation process, a table is also created, which has the memory address of the first data block of the certain number of data blocks (for example, the virtual memory address of the first data block) and also has the memory address of the first check value (the first check value is in particular immediately after the last data block of the certain number of data blocks). In the safe operating mode, accessing any data block of the certain number of data blocks includes: checking whether the memory address of the corresponding data block to be accessed is stored in the table. If this is the case, the corresponding data block is accessed expediently. If the memory address is not stored in the table, then, for example, predetermined measures can be performed, for example, an error message can be output. If the corresponding check value is to be written to a volatile storage unit, then the table can also be used. For this purpose, it can be checked whether there is an entry for the corresponding data block in the table. If this is the case, a corresponding entry can be created in the volatile storage unit.

[0032] According to one embodiment, a check value associated with the data block is checked for the call of the check instruction. In particular, when such a check instruction is called, only a single check value is checked. The check instruction is expediently called repeatedly to check different check values ​​in sequence, in particular until all check values ​​have been checked. In particular, the repeated calling of the check instruction is performed within a predetermined error detection time. Thus, expediently, a check value check or integrity check is not performed every time the security data is accessed, but in particular is only performed once within a predetermined error detection tolerance interval by means of a corresponding check instruction.

[0033] According to one embodiment, the check values ​​associated with the data blocks are checked according to a predetermined frequency and / or according to a predetermined order. Thus, for example, it can be predetermined which of the data blocks is to be checked as the next data block. Furthermore, for example, individual data blocks can be checked more frequently than other data blocks if necessary. The corresponding frequency and order can be predetermined, for example, by a user.

[0034] According to one embodiment, the computing unit has a plurality of hardware and / or software units which can access the storage unit or the certain number of data blocks, the plurality of units being synchronized or process-synchronized with respect to read and write access to the certain number of data blocks. In this way, it is possible to prevent, in particular, the data of the corresponding data block from being changed during the checking of the corresponding check value.

[0035] According to one embodiment, the computing unit has a processor unit, which is based on the RISC-V instruction set architecture (English: "Instruction Set Architecture", ISA). An instruction set generally refers to the totality of machine instructions that can be implemented by a processor unit. The RISC-V instruction set architecture is based on the so-called RISC principle (English: "Reduced Instruction Set Computer", RISC), according to which the instruction set includes a small number of instructions, usually less than 100, which can be processed simply and quickly by the processor unit, thereby achieving a simplified processor design, a high processor clock (Prozessortaktung) and a fast implementation speed compared to the so-called CISC architecture (English: "Complex Instruction Set Computing", CISC), which provides an instruction set with a large number of instructions (more than 100), and the corresponding processor can implement complex processes through the CISC architecture, which is however related to a complex processor design. The RISC-V instruction set architecture is an open standard or "open source", and it is possible to change and expand the instruction set in a simple way. RISC-V processors or, in general, processors with a modifiable instruction set architecture are particularly suitable for implementing a safe operating mode, since the instructions required for implementing the safe operating mode (eg, read and write instructions of different instruction classes) can be integrated into the instruction set in a simple manner.

[0036] Particularly preferably, the method is suitable for application in the field of vehicles. The computing unit can be constructed in particular as a microcontroller or control device in a (motor) vehicle. For example, the method is particularly suitable for computing units with high-performance cores and systems with a large amount of program code and large amounts of data, such as those used for autonomous driving. The process implemented by the computing unit can include, for example, safety-critical functions, which are implemented for safe operation and control of the vehicle, such as in the process of motor control, in the process of driver assistance functions, or also in the process of autonomous driving. The safety or reliability and integrity of the control device can be improved by this method. In particular, the safety requirements in the field of (motor) vehicles can be met by this method, such as those specified in the ISO 26262 standard or in particular by the so-called "Automotive Safety Integrity Level" (ASIL) (the safety requirement level of safety-related systems in motor vehicles specified by ISO 26262).

[0037] The computing unit according to the invention, for example a control device of a motor vehicle, is configured, in particular in terms of programming, to carry out the method according to the invention.

[0038] The implementation of the method according to the invention in the form of a computer program or computer program product with a program code for executing all method steps is also advantageous, because this leads to particularly low costs, especially when the control device being implemented is also used for other tasks and therefore already exists. Finally, a machine-readable storage medium is provided, which has a computer program as described above stored thereon. Suitable storage media or data carriers for providing computer programs are especially magnetic storage, optical storage and electrical storage, such as hard disk drives, flash memory, EEPROM, DVD, etc. It is also possible to download programs via computer networks (the Internet, intranets, etc.). At this point, such downloading can be done wiredly or by cable or wirelessly (e.g., by WLAN networks, 3G, 4G, 5G or 6G connections, etc.).

[0039] Further advantages and embodiments of the invention are apparent from the description and the accompanying drawings.

[0040] The invention is schematically shown with reference to the embodiments in the drawings and is described below with reference to the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A computing unit is schematically shown which is provided for carrying out an embodiment of the method according to the invention.

[0042] Figure 2 An embodiment of the method according to the invention is schematically shown as a block diagram.

[0043] Figure 3 A memory unit of a computing unit is schematically shown, which is provided for carrying out an embodiment of the method according to the invention.

[0044] Figure 4 A memory unit of a computing unit is schematically shown, which is provided for carrying out an embodiment of the method according to the invention. DETAILED DESCRIPTION

[0045] exist Figure 1 Schematically shown in the figure and denoted by 100, a computing unit, which can be designed, for example, as a system on a chip (SoC). For example, SoC 100 can be provided for a motor vehicle and integrated into a control device of the vehicle, for example in order to implement safety-critical functions for the safe operation of the vehicle, for example in the process of motor control, in the process of driver assistance functions, in the process of automated driving, etc.

[0046] In order to ensure the safety and integrity of the control device, to implement the software at the highest safety level, and to meet the safety requirements of the (motor) vehicle field, in particular the ASIL-D safety requirement level according to the ISO 26262 standard, according to one embodiment of the method of the present invention, the SoC 100 can be operated in a safe operating mode, in which special data can be accessed safely. In this way, a functional safety implementation platform 110 ("safety island", "important module", "safety backbone" or "safety execution platform") is implemented in the SoC 100.

[0047] For the implementation platform 110 of functional safety or for the implementation of the safe operating mode, in the example shown, a processor unit 111, a cache logic unit 112 and a timer 113 are set. Purposefully (but not restrictively), the processor unit 111 can be a processor core based on the RISC-V instruction set architecture. Such a RISC-V processor 111 and a cache logic unit 112 are connected to a connection unit (English: "Interconnect") 120 of the SoC 100, for example, via a RAM and a cache memory 121, as a further element of the implementation platform 110 of functional safety. For example, a flash memory unit 140, such as a NAND flash memory, can be connected to the connection unit 120 via an interface 141, and a RAM storage unit 150, such as an LPDDR-RAM, can be connected to the connection unit via a RAM controller 151. The SoC 100 may also have one or more further processor cores 130 with associated RAM and a cache memory 131, which are connected to the connection unit 120. Furthermore, a memory unit 122 as a further element of the functionally safe implementation platform 110 for the boot process (Boot Flash Speicher) and a peripheral bus 160 can be connected to the connection unit 120. A large number of peripheral units can be connected to the peripheral bus 160, such as an analog-to-digital converter 161, a serial bus system 162 (Serial Peripheral Interface, SPI), a unit 163 for direct memory access (Direct Memory Access, DMA), a timer 164 and another fieldbus system 165 (e.g. Flexray fieldbus). It should be understood that fewer peripheral units or even additional peripheral units can also be provided, which is indicated by the reference numeral 166. Via the serial bus system 162, for example, an external monitoring unit 180 (English: Watchdog) can be connected for detecting and managing errors or faults of the SoC 100. In addition, the SoC 100 can have an error management unit 170 (English: Error Management Module, Error Management Module, EMM) for managing output error messages.

[0048] exist Figure 2 In the figure, an embodiment of the method according to the invention is shown as a schematic block diagram.

[0049] First, a compilation process 210 is performed by a compiler, during which executable code and data are generated and stored in the SoC 100. At a later point in time, the SoC 100 is put into operation and the data stored during the compilation process 210 can be accessed during runtime 220.

[0050] During compilation process 210 , in step 211 , check values ​​are respectively determined for a predetermined number N of data blocks, and in step 212 , the number of data blocks and the corresponding determined check values ​​are stored in a memory unit of SoC 100 , for example flash memory unit 140 .

[0051] In step 213, the identifier or attribute is added to the virtual memory address of each data block in the certain number of data blocks.

[0052] In step 214, a table is created, in which the memory addresses of the first data blocks in the certain number of data blocks are respectively stored, for example, virtual memory addresses are respectively stored. This table is also referred to as a safety data table hereinafter.

[0053] Because each data block is therefore protected by a check value, these data blocks in a predetermined number of data blocks are also referred to as secure data or secure data blocks. In addition, during the compilation process, additional data blocks may also be stored in the storage unit 140, for which no check value is determined. In this context, such data blocks are also referred to as normal data or normal data blocks. After being put into operation, the SoC 100 can operate in a normal operating mode and in a secure operating mode during its operating time 220. In the normal operating mode, normal data and secure data are accessed in the same normal manner. In the secure operating mode, normal data blocks are also accessed in this normal manner. In the secure operating mode, secure data blocks are accessed in another secure manner, in particular, with the aid of instructions of a special instruction class.

[0054] The determined check value is used in particular for detecting errors, but not for eliminating them. Without a correction function, the check value can be set in a very memory-efficient manner. For example, a number B can be used. check The check value of the single digit is used to protect the block N bytes of data. block In particular, it is a power of 2 and can be, for example, in the range between approximately 256 and 16384. blockThe smaller the value of , the faster the check of the corresponding check value can be performed, and the shorter the time that the corresponding data is blocked from other accesses can be. block The larger the value of , the lower the storage overhead of the check value, and the check value check can be performed less frequently. block Can be set by the user with compiler options.

[0055] In particular, the check value is invisible to the programmer and cannot be legally called. For the .data segment, the compiler can appropriately allocate the necessary space for the check value and automatically initialize it. At the beginning of runtime 220, these initialized data are copied from the read-only memory 140 to the write / read memory (e.g. 150) by the startup code. For the .bss segment (English: "Block Start by Signal", bss), this allocation is also appropriately implemented by the startup code. For heap and stack memory, this allocation is appropriately performed by the allocation function of the library at runtime.

[0056] By means of the added identification, the secure data can be distinguished from the normal data. If the corresponding virtual memory address has the corresponding identification, the corresponding data is processed securely in the secure operation mode. Normal data whose virtual memory address does not have such identification is accessed in the same conventional manner in both the secure operation mode and the normal operation mode.

[0057] For example, a special bit in the virtual memory address may have a special value as such an identification. For example, if the bit with the highest bit value (English: "Most Significant Bit", most significant bit, MSB) in the virtual memory address has a value of "0", it may be a normal data block. For example, if the MSB bit in the virtual memory address has a value of "1", it may be a secure data block, for example.

[0058] In addition, identifiers can also be added to a range of regions or segments, such as virtual memory addresses. For example, log2(N block ) LSBs (English: “Least Significant Bit”, LSB, the bit with the lowest bit value), since a security data block desirably always starts with a bit with N block The boundary of a block of bytes.

[0059] For example, the certain number of data blocks are stored in at least one predetermined storage area of ​​the storage unit 150, at a first storage area address A. block The check value is stored in the at least one storage area at the second storage area address A.check At or starting from the second storage area address.

[0060] Therefore, the first storage area address A block In particular, it points to the first data block among the N data blocks. check In particular, it refers to the first check value which in particular follows the last of the N data blocks.

[0061] Purposefully, a data block always consists of a block size N block This means that A block and A check log2(N block ) LSB bits are 0.

[0062] For the number of data blocks, this applies in particular:

[0063] N=(A check -A block )>>log2(N block )

[0064] In particular, the data blocks start with:

[0065] <Memory address>&~(N block -1)

[0066] The offset of the corresponding data block from the first memory address is given by:

[0067] (<memory address>-A block )

[0068] The check value associated with the corresponding data block is stored in particular in the following cases:

[0069] A check +((Memory Address - A block )>>(log2(N block )-log8(B check )))

[0070] For example, corresponding calculations can be implemented in hardware in a simple manner.

[0071] The individual secure data blocks may each be secure initialized data, secure uninitialized or non-initialized data, secure heap data or data in a heap data structure, or secure stack data or data of a stack data structure or a stack memory data structure.

[0072] The safe initialized data are located in particular in the .data segment. They take up space in the executable binary file. Since the virtual memory addresses of the safe data have corresponding special identifiers, they are placed in the additional segment in order to be able to meet the standard. The compiler initializes these safe data and their check values. The compiler also generates an entry for the safe data table.

[0073] Safe, uninitialized data is located in particular in the .bss segment. These data are particularly all zero and do not take up any space in the executable binary file. The startup code reserves space on the heap and initializes the check value. This storage space meets the standards for safe data, i.e. the corresponding virtual memory addresses each have a corresponding identifier. The addresses for accessing these data are generated by the compiler and moved to this area. The compiler can also generate fixed addresses, and the reserved area can be mapped to the existing physical memory via the memory management unit (English: "Memory Management Unit", MMU). The startup code also generates an entry for the safe data table.

[0074] The data of the heap data structure is reserved in the secure memory library, for example, at runtime 220 through a memory management call. For the secure operating mode, the compiler generates a call into the secure memory library, which provides the address to the secure data. For example, the secure memory library also reserves space for check values ​​and arranges the secure data in blocks. For the normal operating mode, the compiler generates a standard call in the standard memory library, which provides the address to the normal data without the check value. The secure memory library also updates the secure data table.

[0075] For example, safe stack data is processed the same as safe uninitialized data. The startup code, for example, reserves space on the heap and initializes a check value. This space meets the standard of safe data, that is, the corresponding virtual memory addresses have corresponding identifiers respectively. For example, the stack pointer is placed behind this space to work downward. Since safe stack data is especially safe uninitialized data, there is no need for entries in the safety data table. Any number of stacks with any size can be reoccupied at startup or at run time. When transitioning from the normal operating mode to the safe operating mode, the stack memory can be switched from normal data to safe data and vice versa when returning. This can be done by a safe memory library.

[0076] Therefore, the security data block is stored in one or more storage areas in the storage unit 150, and these storage areas respectively start at the first storage area address A block The data block at and ends at the second storage area address A checkEach of these secure storage areas is represented by an A block and A check A complete description is given and forms an entry in the Safety Data Sheet.

[0077] The size of the generated table (i.e. the number of secure storage areas) should be kept small. In particular, there is only one storage area in which all secure data is stored. The storage area is in particular large enough to record all data that may be requested at any time by a program implemented in SoC 100, for example several gigabytes. At startup, in particular only a small part of this area is equipped with physical memory. The rest is only reserved and may never be actually allocated. Ideally, the table can contain only a few entries and be located in processor unit 111. This allows very fast searches.

[0078] After the compilation process 210 has been completed and the SoC 100 has been put into operation, the SoC 100 first operates in a normal operating mode during its runtime 220 in step 221. In step 222, the safe operating mode is activated, for example by reading and executing an activation instruction.

[0079] In the safety operating mode, individual data blocks of the certain number of data blocks stored in the memory unit 150 are accessed in a read and / or write manner in step 223. In step 224, the check value stored in the memory unit 150 is checked.

[0080] If the access to the corresponding data block is a read access, the data is read from the data block and then written to the data block without changing the check value associated with the data block. If the access includes a write access, the first data is read from the data block and the first data is removed from the check value associated with the data block. In addition, the second data is written to the data block and the second data is added to the check value associated with the data block. If the access is a read and write access, the first data is processed into the second data, for example.

[0081] Therefore, if the access to the corresponding security data block includes a write access, the check value associated with the data block is changed. For this purpose, in particular a first characteristic value of the first data is determined, in particular a first hash value, and the check value associated with the data block is changed according to the first characteristic value. In particular, the first hash value is subtracted from the check value. Furthermore, in particular a second characteristic value of the second data is determined, in particular a second hash value, and the check value associated with the data block is changed according to the second characteristic value. In particular, the second hash value is added to the check value.

[0082] Access to the safety data blocks takes place in safety operating mode using instructions from different instruction classes.

[0083] According to the first time requirement, the corresponding data block can be accessed, in particular as immediately as possible or with a small or as small a delay as possible. In order to change the corresponding check value, a processing sequence can be created, which is processed according to the second time requirement.

[0084] For example, the corresponding check value can be initialized together with the corresponding data block. The initial value of the check value can be any value. When accessing the corresponding data block, the corresponding check value can be changed, for example, by subtracting the hash value of each byte from the check value when loading and adding the hash value of each byte to the check value when storing. In particular, the check value is never zero in practice, in particular not zero for data blocks with the value zero.

[0085] For example, the hash value is calculated for each byte individually and can be as long as B check For example, each hash value may include a corresponding offset (<memory address> - A block Without such address information, incorrect addressing can be ignored. The use of this offset in the corresponding memory area is particularly transparent to the MMU and can avoid problems that occur when assigning virtual addresses to physical addresses.

[0086] For example, a hash value is calculated for each byte and the address of the byte is used. In the case of longer words with 16, 32, 64, ... bits, the hash value of each byte can be calculated simultaneously with 2, 4, 8, ... hash units. The check value can be changed by means of their sum. Their sum can be added to the check value during a write access and subtracted from the check value during a read access.

[0087] The corresponding hash algorithm for determining the hash value is particularly configured such that the check value changes for more than 99% of all possible single-bit errors and multi-bit errors within the data block. This applies in particular to white noise, all 0s, all 1s and all regular patterns associated with data and / or addresses.

[0088] Since the offset yields a different value for each address, the corresponding hash value is expediently never zero. The hash value is in particular always explicitly initialized, even for all data blocks with the value zero.

[0089] In order to change the corresponding check value according to the corresponding characteristic value or hash value, the corresponding check value can be read from the storage unit 150 and stored in a check value cache, for example in the processor unit 111. In particular, the corresponding check value in the check value cache is stored together with information about the corresponding data block involved.

[0090] For example, the memory address of the associated data block can be stored as corresponding information in a check value cache, in particular in the absence of a low log2(N block ) bits. This address is the key to the check value cache to find the table entry. In addition, for example, the corresponding block is associated with the first storage area address A block The address offset with B check The current check value of the ones digit and the virtual address from which the check value was read and in which the changed check value is stored are saved as information in the check value cache.

[0091] When a cache entry is deleted, only the corresponding changed check value is stored in the storage unit 150. The rest of the entry will be lost and rebuilt when the corresponding check value is reloaded. For this purpose, the table generated in step 214 can be searched for an entry that matches the given valid data address. If nothing is found, this is an addressing error and, for example, an exception is triggered. This is an additional control mechanism that is expediently available in the safe operating mode. The found entry is used to calculate the data block address, the offset from the first block and the address of the check value. The corresponding check value is then loaded into the check value cache. Expediently, the table generated in step 214 is searched each time a check value cache entry is created.

[0092] A correspondingly large number of requests for changing the corresponding check values ​​can be generated by a large number of load and store accesses. In particular, there is no need to delay the corresponding load or store process until the corresponding check value has been determined. Depending on the first time requirement, the corresponding access can be performed as quickly as possible.

[0093] The corresponding check value should be changed accordingly according to the second time requirement, in particular until it is checked, so that in particular a lot of time can be provided for making the change. Therefore, all requests for changing the check value can be fed into the processing sequence as a separate processing path.

[0094] For example, a request for a check value can be put into a processing sequence. Then, during the processing, a corresponding hash value can be calculated for each byte. The corresponding check value can be loaded into the cache, if it is not already there, possibly after another cache entry has been stored; and can then be changed with the aid of the calculated hash value.

[0095] In particular, in the secure operating mode, new or extended instructions may be available compared to the normal operating mode. In particular, access to secure data involves instructions using the core's, in particular, extended load / store units. For example, all load and store instructions (in particular with the exception of atomic instructions) for signed and unsigned integers of any width, floating point numbers of any precision, vectors of any size, and any other data can use an additional variable, such as a hint value, which has, for example, three possible values. Through these three possible values, three instruction categories can be distinguished in particular. Purposefully, this hint value is only taken into account in the secure operating mode. In the normal operating mode, in particular, standard read or write instructions are always used.

[0096] If the hint variable is not assigned a specific value ("silent"), a first instruction class can be defined, for example. This first instruction class can include, in particular, standard read and write instructions ("silent load", "silent store"). With the help of a read or write instruction of this first instruction class, a secure data block can be accessed accordingly without changing its check value. In addition, normal data can also be accessed with the help of this read or write instruction.

[0097] The second instruction class can be defined, for example, by a first specific value of a hint variable (for example by the value "EXCL") and can, for example, relate to access only or exclusively to security data. In particular, with the help of a write instruction of the second instruction class ("EXCL store"), only a security data block is stored without changing its check value. In particular, with the help of a read instruction of the second instruction class ("EXCL load"), only a security data block is read and its corresponding check value is changed in a first way, for example by subtracting a hash value from the check value. If the corresponding memory address points to normal data, the instructions of this second instruction class do not lead to any action or are not implemented.

[0098] The third instruction class can be defined, for example, by a second specific value of the hint variable (for example, by the value "SAFE") and can also, for example, involve exclusive access to security data. In particular, with the help of write instructions of the third instruction class ("SAFE store"), only security data blocks are stored and their corresponding check values ​​are changed in a second manner, for example, by calculating a current hash value and adding this value to the check value in the cache. In particular, with the help of read instructions of the third instruction class ("SAFE load"), only security data blocks are read and their corresponding check values ​​are changed in a third manner, for example, by calculating a current hash value and subtracting this value from the check value in the cache.

[0099] The calculation of the hash value and the change of the check value can be performed in a delayed manner according to the second time requirement, while the next read or write instruction is already executed, so that the speed is not impaired.

[0100] In particular, the corresponding hint value can be integrated into all read and write instructions defined in the instruction set architecture. If this is not possible, for example because the code space is full, the instruction classes can also be defined in other ways, for example by means of prefix statements.

[0101] For example, a compiler for the safe operating mode can generate code from the following statements instead of simple read statements: Load data from memory 150 by means of a read instruction of the first instruction class ("silent load"); Use the data without changing it; Store the data in memory 150 by means of a write instruction of the second instruction class ("EXCL store"). In this case, the corresponding check value is not changed. If the data is falsified during loading and saving in the register, this error will be transmitted when it is finally stored in memory 150 by means of "EXCL store" and will be discovered when the corresponding check value is checked next time. In normal operating mode or when loading normal data, the "EXCL store" instruction does not cause any action.

[0102] For example, a compiler for the safe operating mode can generate code from the following statements instead of simple storage statements: load the first data by means of a read instruction of the second instruction class ("EXCL load"); store the second data by means of a write instruction of the third instruction class ("SAFE store"). The "EXCL load" instruction is particularly only used to subtract the hash value of the old value (i.e. the first hash value of the first data) from the check value, wherein the target register can be, for example, x0. The "SAFE store" instruction writes the new second data and adds its new hash value (i.e. the second hash value of the second data) to the check value. In the normal operating mode, the "EXCL load" instruction does not cause any action and the store works normally.

[0103] For example, when a value is to be loaded, changed and then stored again, a compiler for the safe operating mode can generate code from the following statements: load first data with the aid of a read instruction of a third instruction class ("SAFE load"); use and change the data, thereby generating second data in particular from the first data; store the changed second data with the aid of a write instruction of a third instruction class ("SAFE store").

[0104] In addition, further instructions can still be used in normal operating mode and in safe operating mode, respectively. For example, load and reserve instructions ("Load and Reserve") and conditional store instructions ("Store Conditional") can be used for deadlock-free synchronization of multiple bus masters. These instructions can also be used in safe operating mode. If these instructions address safety data, additional actions can be caused, for example. For example, a "reservation context" can be established by the load and reserve instructions in safe operating mode, which also contains the hash value of the loaded value. In safe operating mode, the hash value of the stored value minus the hash value in the reserve context can be added to the check value by the conditional store instruction.

[0105] In addition, atomic instructions, for example, can be used, by which access to data can be performed, while other processes cannot access these data during the access. For example, these atomic instructions in RISC-V ISA may include AMOSWAP, AMOADD, AMOAND, AMOOR, AMOXOR, AMOMAX, AMOMAXU, AMOMIN, AMOMINU (combination of prefix AMO with conventional commands SWAP, ADD, AND, etc.). All these instructions access data in an atomic, uninterrupted manner. In particular, these instructions can also be used in a safe operation mode. If these instructions address safe data in a safe operation mode, for example, the hash value of the stored value minus the hash value of the loaded value is added to the check value.

[0106] In addition, the check value can be loaded from the check value cache into the target register by means of a safe check value load instruction ("SAFLDCHK"). This SAFLDCHK instruction can be used, for example, in a stack memory for checking the check value and for debugging. If the corresponding check value is not present in the check value cache, it is loaded. If the check value cache is full, another check value is first stored.

[0107] In addition, the check value can be written from the source register into the check value cache by means of the safe check value write instruction ("SAFSTCHK"). This instruction can also be used, for example, in stack memory to check the check value and for debugging. If the corresponding check value is not present in the cache, it is loaded. If the check value cache is full, another check value is first stored.

[0108] Furthermore, all check values ​​or only certain check values ​​can be flushed from the check value cache into memory 150 by means of a refresh command.

[0109] For example, to initialize a new data block, i.e. when allocating a data block on the heap, the safe memory library can use the following instruction sequence: Create a check value cache entry and initialize the check value by means of the SAFSTCHK instruction; Store all data in the data block by means of the "SAFE Store" instruction. In particular, no gaps are left here.

[0110] A check command is called and executed to check individual test values ​​of the test values ​​stored in memory unit 150. The check command can be implemented as a separate routine or function, for example, using a check run function that can be implemented in a secure memory library.

[0111] Based on the safety data table, at each call of the check command or checksum run function, the data block is compared with its checksum value. If they do not match, the function returns an error and the caller can decide how to react to it.

[0112] Each call to the check instruction or the check run function will check a data block, that is, N block Bytes. N block The larger the value, the longer it can last. This is important because the data block and its checksum must not change during the execution of the check command, otherwise a false error will be returned. On systems with only one core, this may be caused by an interrupt (Interrupt or Unterbrechung). On multi-core systems, this may be caused by an interrupt or another core. It is the user's responsibility to avoid such conflicts.

[0113] Since each call of the check instruction checks only one data block, several calls are required before the entire safety data block has been checked. This occurs especially during the error detection time.

[0114] For example, the secure memory library can provide support functions and data, such as how often the check command should be called and which data block should be checked next. Thus, for example, the order and frequency according to which the individual check values ​​are checked can be predefined. In this way, for example, data blocks can be checked in a user-defined order or some data blocks can be checked more frequently than others. This can help the user to minimize access conflicts and optimize the system.

[0115] To check a data block or a check value, the check run function first reads the corresponding check value of the corresponding data block, for example using a normal read instruction. The function then iterates over the data block and reads it completely, for example using a "SAFE Load" instruction. Finally, the check value should correspond to the initial value (Init-Wert) of the check value. In order to be as fast as possible, the check run can be performed on a 32-bit architecture with a 32-bit "SAFE Load" instruction and on a 64-bit architecture with a 64-bit "SAFE Load" instruction.

[0116] When checking a check value, the data of the corresponding data block must not be changed. For this purpose, different hardware and / or software units of SoC 100, which can respectively access storage unit 150 or the security data blocks stored there, are synchronized or process-synchronized with respect to read and write access to the security data blocks.

[0117] For example, if two non-process-synchronized cores in the safe operating mode write different values ​​to the same address in the memory 150, the corresponding first memory access can be overwritten by the corresponding second memory access, and the corresponding check value reflects both memory accesses. Then, the error will be detected when the check value is checked next time.

[0118] A read access from a non-process-synchronized core may also lead to such an error if the corresponding read access ends with an "EXCL STORE" instruction. If another non-process-synchronized core changes the corresponding data block during this read access, this change may be lost but is included in the checksum. This will lead to an error the next time the checksum is checked.

[0119] Such errors can be avoided by synchronizing the processes of the corresponding units, for example by using mutexes or semaphore methods.

[0120] In step 225, the safe operation mode ends and the SoC 100 switches to the normal operation mode again. For example, the SoC 100 can switch to the normal operation mode for an interrupt instruction. When an interrupt instruction occurs, the CPU stores its context and switches to the normal operation mode, especially including the stack memory. After the interrupt, the context is restored.

[0121] exist Figure 3 The storage unit 150 of the SoC 100 is schematically shown in FIG. Figure 3 For example, a storage area 300 of the storage unit 150 is shown, in which three data blocks 311, 312, 313 and three associated check values ​​321, 322, 323 are stored. 331 represents the first storage area address Ablock , starting from which three data blocks 311, 312, and 313 are saved. 332 represents the second storage area address A check , from which the check values ​​321, 322, and 323 are saved and stored.

[0122] exist Figure 4 The memory unit 150 of the SoC 100 is also schematically shown. Figure 4 For example, a memory area 400 of the memory unit 150 is shown, in which a first memory area address A is block Starting from 431, secure initialized data 411, secure uninitialized data 412, secure stack data 413, 414, 415, secure heap data 416, and reserved, unused secure heap memory 417 are set. check Starting from 432 , the check values ​​421 of the initialized data 411 , the uninitialized data 412 , the stack data 413 , 414 , 415 , and the heap data 416 are saved. In addition, the storage space for the check value 422 is reserved for the unused heap memory 417 .

Claims

1. A method for accessing a data block stored in a storage unit (150) of a computing unit (100) from among a number of data blocks, the method comprising: activating (222) a safe operating mode of the computing unit (100); In the secure operating mode of the computing unit, accessing (223) the data block; When the access (223) is a read access, reading data from the data block and then writing the data to the data block; When the access (223) comprises a write access, reading first data from the data block, removing the first data from a check value associated with the data block, writing second data to the data block, and adding the second data to the check value associated with the data block; The check value associated with the data block is checked (224).

2. The method according to claim 1, further comprising: When the access (223) comprises a write access, the check value is written into the storage unit (150) of the calculation unit (100).

3. The method according to claim 1 or 2, further comprising: respectively determining (211) check values ​​for the certain number of data blocks; The certain number of data blocks and the corresponding determined check values ​​are stored (212) in the memory unit (150) of the calculation unit (100).

4. The method according to claim 3, further comprising: The identifier is added (213) to the memory address of each data block in the certain number of data blocks.

5. The method according to claim 3 or 4, wherein: Storing (212) the certain number of data blocks and the corresponding determined check values ​​in the storage unit of the computing unit comprises: storing the certain number of data blocks in at least one storage area of ​​the storage unit (150), the at least one storage area being at a first storage area address; The check value is stored in the at least one storage area of ​​the storage unit (150), the at least one storage area being at a second storage area address.

6. A method according to any one of the preceding claims, wherein: Removing the first data from a check value associated with the data block comprises: determining a first characteristic value of the first data, in particular a hash value; changing the check value associated with the data block in dependence on at least one determined first characteristic value; and / or Wherein, adding the second data to the check value associated with the data block comprises: determining a second characteristic value, in particular a hash value, of the second data; The check value associated with the data block is changed in dependence on at least one determined second characteristic value.

7. A method according to any one of the preceding claims, wherein: In the secure operating mode of the computing unit (100), the access (223) is performed by means of one or more of the following instructions of different instruction classes: a write instruction of the first instruction category, for writing data into a data block of the predetermined number of data blocks without changing a check value associated with the corresponding data block, or for writing data into a data block that does not belong to the predetermined number of data blocks; a read instruction of the first instruction category for reading data from a data block of the predetermined number of data blocks without changing a check value associated with the corresponding data block, or for reading data from a data block that does not belong to the predetermined number of data blocks; a write instruction of the second instruction category, for writing data into one of the predetermined number of data blocks without changing a check value associated with the corresponding data block; a read instruction of the second instruction category for reading data from one of the predetermined number of data blocks and for changing a check value associated with the corresponding data block in a first manner; a write instruction of a third instruction class for writing data into one of the predetermined number of data blocks and for changing a check value associated with the corresponding data block in a second manner; The read instruction of the third instruction class is used to read data from one of the predetermined number of data blocks and to change a check value associated with the corresponding data block in a third manner.

8. A method according to any one of the preceding claims, wherein: In the secure operation mode, according to a first time requirement, when the access is a read access, reading the data from the data block and writing the data into the data block, and, when the access includes a write access, reading the first data from the data block and writing the second data into the data block; and Wherein, in the secure operation mode, according to a second time requirement, when the access includes a write access, the first data is removed from a check value associated with the data block and the second data is added to the check value associated with the data block.

9. The method according to any one of the preceding claims, further comprising: When the access (223) comprises a write access, reading the check value associated with the data block; The read check value is stored together with information about the corresponding data block in another storage unit, in particular a volatile storage unit, in particular a storage unit in a processor unit (111) of the computing unit (100), in particular a check value cache, in particular a cache memory.

10. The method according to any one of the preceding claims, further comprising: Creating (214) a table having a memory address of a first data block of the number of data blocks and a memory address of a first check value, in particular immediately following a last data block of the number of data blocks; Wherein, in the safe operation mode, accessing (223) the data block comprises: A check is made to see whether the memory address of the corresponding data block is stored in the table.

11. A method according to any one of the preceding claims, wherein: The check value associated with the data block is checked (224) for the calling of the check command and / or according to a predefined frequency and / or according to a predefined sequence.

12. A method according to any one of the preceding claims, wherein: The computing unit (100) has a plurality of units capable of accessing the data block, wherein the access of the plurality of units to the data block is synchronized.

13. A computing unit, which is configured to execute all method steps of the method according to any of the preceding claims, the computing unit in particular comprising a processor unit (111) which is based on the RISC-V instruction set architecture. 14 . A computer program which, when executed on a computing unit, causes the computing unit to carry out all method steps of the method according to claim 1 .

15. A machine-readable storage medium having stored thereon the computer program according to claim 14.

Images