Integrity checking

Abstract

An apparatus has processing circuitry for executing instructions. The processing circuitry has: a measurement circuit responsive to one or more instructions requiring a measurement to be performed to calculate a result of the measurement; and an approximation circuit responsive to the one or more instructions to calculate an approximation result of the calculation independently of the calculation circuit. The processing circuitry also has integrity check circuitry that performs an integrity check by comparing a result of the measurement performed by the measurement circuitry with an approximation result of the measurement performed by the approximation circuitry. An integrity check circuit detects an error in the processing circuit if it is determined that a difference between the measured result and the measured approximation result is greater than a deviation threshold.

Description

Background Art

[0001] The present technology relates to the field of data processing, and more specifically, to integrity checking.

[0002] Faults may occur in a processor, affecting the operation of the processor. Such faults may be attributed to one or more of several possible factors, such as, for example, manufacturing problems, system aging, or defects in hardware or software design. If not addressed, these faults may cause errors when the processor performs calculations. In some cases, such faults may only occur in a non-deterministic manner, where the same calculation is performed on the same processor or core, resulting in an erroneous result in one instance but not in another instance. While some faults in the processing circuits result in easily identifiable errors, some faults result in valid but erroneous results produced by the calculations, making the detection of these faults more difficult. Cores that exhibit such behavior may be referred to as "mercury cores."

[0003] “Cores that don't count”, Peter H. Hochschild et al., 2021, 18th Hot Symposium on Operating Systems (HotOS2021), describes some known instances of such mercury cores that cause intermittent failures. Summary of the invention

[0004] In one example arrangement, an apparatus is provided, comprising: processing circuitry for executing instructions; wherein the processing circuitry comprises: a calculation circuitry responsive to one or more instructions requesting the performance of a calculation to calculate a result of the calculation; an approximation circuitry responsive to the one or more instructions to calculate an approximate result of the calculation independently of the calculation circuitry; and an integrity check circuitry configured to perform an integrity check by: comparing a result of the calculation performed by the calculation circuitry with an approximate result of the calculation performed by the approximation circuitry; and detecting an error in the processing circuitry in response to determining that a difference between the result of the calculation and the approximate result of the calculation is greater than a deviation threshold.

[0005] In another example arrangement, a method is provided, the method comprising: executing instructions by a processing circuit; calculating a result of the calculation in response to one or more instructions requesting the calculation to be performed; calculating an approximate result of the calculation independently of the calculation in response to the one or more instructions; and performing an integrity check by the following steps: comparing the result of the calculation with the approximate result of the calculation; and detecting an error in the processing circuit in response to determining that the difference between the result of the calculation and the approximate result of the calculation is greater than a deviation threshold.

[0006] In still another example arrangement, a computer program for controlling a host data processing device to provide an instruction execution environment is provided, the computer program comprising: a processing program logic for executing instructions; wherein the processing program logic comprises: a calculation program logic, the calculation program logic responds to one or more instructions requiring the execution of a calculation to calculate a result of the calculation; an approximation program logic, the approximation program logic responds to the one or more instructions to calculate an approximate result of the calculation independently of the calculation program logic; and an integrity check program logic, the integrity check program logic being configured to perform an integrity check by: comparing a result of a calculation performed by the calculation program logic with an approximate result of a calculation performed by the approximation program logic; and detecting an error in the processing program logic in response to determining that a difference between the result of the calculation and the approximate result of the calculation is greater than a deviation threshold. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Additional aspects, features, and advantages of the present technology will be apparent from the following description of examples read in conjunction with the accompanying drawings, in which:

[0008] Figure 1 An example of a data processing apparatus is schematically illustrated;

[0009] Figure 2 Schematically illustrates a processing circuit provided with an integrity checking circuit;

[0010] Figure 3 shows an example entry of the measurement result history information;

[0011] Figure 4 An example of program code suitable for invoking an integrity check is shown;

[0012] Figure 5 Another example of program code suitable for invoking an integrity check is shown;

[0013] Figure 6 is a flow chart illustrating the operation of an integrity check; and

[0014] Figure 7 A simulator implementation to which the present technology may be applied is illustrated. DETAILED DESCRIPTION

[0015] Before discussing the examples with reference to the figures, the following description of the examples is provided.

[0016] As described above, intermittent faults in the mercury core can cause errors in the calculations performed by the processing circuitry in a number of possible ways. For example, intermittent faults can cause:

[0017] Data encrypted on a mercury core can only be decrypted by that core;

[0018] ●Data is destroyed during replication;

[0019] ● Violation of locking semantics; and

[0020] ●Calculation errors, such as causing int(1.1^53) to return 0 while int(1.1^52) correctly returns 142.

[0021] The present technology provides a device for detecting intermittent faults and in particular for detecting intermittent faults that lead to computational errors. The detection of such faults may also be referred to as integrity checking.

[0022] One possible approach to being able to detect intermittent faults in processing circuits involves redundant execution of the application, i.e. running the code two or more times and comparing the results obtained. However, such an approach involves a large amount of overhead to be executed and is particularly expensive since each measurement must be repeated.

[0023] Another possible way to detect faults is to provide duplicate computation logic, for example, by providing two cores operating in parallel (known as dual-core lock-step) to perform the same workload and comparing the outputs of these cores at each cycle. However, this approach is expensive in terms of required area and power, since an entire additional core needs to be provided along with the circuitry required to compare the results of the two cores.

[0024] The inventors have realised that in many cases, in order to check the integrity of a particular calculation, an exact value is not required to compare with a result obtained by a calculation circuit that has performed the calculation. Instead, it may be sufficient to calculate an approximate result of the calculation and compare the approximate result with the result obtained by the calculation circuit. If a fault has caused an error in the calculation that causes a sufficient deviation in the result, the approximate result will be sufficiently different from the obtained result that it can be determined that an error has occurred or may have occurred. On the other hand, even if the approximate result differs from the result obtained by the calculation circuit, if the difference is a relatively small amount, this may indicate that the calculation may have produced a correct result.

[0025] Thus, there is no need to provide duplicate calculation logic (such as a separate core), instead the apparatus has an approximation circuit that is capable of obtaining an approximate result using less power and / or area than would be required to independently calculate another exact result. The approximate result may also be calculated in parallel with the result obtained by the calculation circuit, thereby providing a more efficient integrity checking process than would be possible if the same circuit were used to repeat the calculation one or more times.

[0026] According to the technology described herein, there is thus provided an apparatus comprising a processing circuit for executing instructions. The processing circuit may include a central processing unit (CPU) or a graphics processing unit (GPU) or portions thereof. In particular, the processing circuit may include an arithmetic logic unit (ALU) or a floating point unit (FPU) as may be found in a CPU or GPU. The processing circuit has a calculation circuit that responds to one or more instructions requiring the performance of a calculation. For example, the calculation circuit may be a logic unit of an ALU or FPU configured to perform a particular type of calculation. When the processing circuit executes an instruction requiring the performance of such a type of calculation, the calculation circuit performs the calculation to calculate a result of the calculation.

[0027] However, a fault in the measurement circuitry may result in erroneous measurement results being produced. In some cases, the fault may not be as obvious as the measurement circuitry failing to produce a result at all, but may instead cause the measurement circuitry to provide an incorrect but valid measurement result. Such a fault may be intermittent in that it causes the measurement result to be erroneous in some cases or at some times, but in other cases or at other times, even when the conditions under which the measurement is performed are the same.

[0028] Therefore, in order to check the integrity of the estimation circuit itself and determine whether the estimation result is likely to be accurate, an approximation circuit and an integrity check circuit are provided. The approximation circuit is arranged to independently estimate an approximate result of the estimation, which can be compared with the result obtained by the estimation circuit. This can be done simultaneously with the estimation performed by the estimation circuit to reduce the performance impact of performing the check.

[0029] Once the measured result from the measurement circuit and the approximate result from the approximation circuit are available, the integrity check circuit performs an integrity check by comparing the result with the approximate result. Based on the difference between the approximate result and the measured result, the integrity check circuit can determine whether there is an error in the processing circuit. This determination of whether there is an error utilizes a deviation threshold that indicates the expected or tolerable difference between the approximate result and the result from the measurement circuit. Since the approximate result is not accurately measured, it is expected that there will be some deviation between the approximate result and the result from the measurement circuit even if the processing circuit is operating correctly. Therefore, the deviation threshold provides a way to determine whether the deviation is sufficient to determine that an error has been detected. Therefore, although a small deviation between the measured result from the measurement circuit and the approximate result can be attributed to the inaccuracy of the approximation, if the measurement circuit produces a result that is significantly different from the expected result determined by the approximation, this can indicate that there is a fault in the measurement circuit (or in fact in the approximation circuit).

[0030] In response to detecting an error, the integrity check circuit may be arranged to take a number of possible actions. For example, the integrity check circuit may indicate that an error has been detected by raising an exception or saving a particular value in a register to indicate that an error has been detected. This may be used, for example, to indicate to software that an error has been detected and therefore the result of a calculation may be erroneous, or to help detect mercury cores that are prone to intermittent failures so that these cores can be replaced. Additionally or alternatively, the integrity check circuit may cause the calculation to be repeated.

[0031] In some examples, an integrity check may be initiated based on an integrity check initiation instruction, thereby allowing the integrity check to be controlled using software. That is, a programmer or compiler may include an integrity check initiation instruction in the program code so that execution of the integrity check initiation instruction by the processing circuit causes the integrity check to be performed.

[0032] This may be achieved using an integrity check initiation instruction in conjunction with an integrity check termination instruction. Where the integrity check initiation instruction is followed by one or more instructions that cause the calculation circuitry to perform the calculations, execution of the integrity check initiation instruction causes the approximation circuitry to calculate approximate results of the calculations. The processing circuitry then responds to execution of the integrity check termination instruction, which signals the end of the sequence of instructions to perform the integrity check, such that the integrity check circuitry is then called to perform the integrity check and compare the results obtained by the calculation circuitry and the approximation circuitry.

[0033] For the calculation circuit, the location of the operand on which the calculation is based may be specified by the instruction to be executed. For example, a particular form of the instruction may indicate a register in which the operand is stored, or may indicate a register containing an address in memory from which the operand is obtained. It should be understood that the operand can be indicated in other ways, such as using an offset or encoded in the instruction itself.

[0034] The approximation circuitry may determine the location of operands to be operated on according to the same instructions as described above. However, in some examples, the integrity check initiation instruction specifies one or more registers containing operands to be operated on by the calculation represented by the subsequent instruction. In this case, the approximation circuitry is configured to obtain the one or more operands from the one or more specified registers. This approach allows the operands to be located in any of a plurality of registers that may be provided within the device, thereby providing flexibility as to where the operands may be stored prior to invoking the integrity check mechanism.

[0035] However, in some examples, to avoid the need to specify registers in the integrity check initiation instruction, one or more operands on which the approximate circuit is to operate may be predetermined, such as by definition as an architectural behavior. Thus, in response to the integrity check initiation instruction, the approximate circuit may obtain the operands from the predetermined registers.

[0036] In some cases, the approximation circuit may be suitable only for approximating the results of certain types of measurements supported by the measurement circuit. For other types of calculations supported by the measurement circuit, the approximation circuit may be unable to determine the approximation result, or may be unable to determine the approximation result with sufficient accuracy to enable the integrity check to be performed using the approximation circuit, due to the nature of the measurement and / or the configuration of the approximation circuit.

[0037] In this case, the approximation circuit may be additionally provided with an approximation suitability checking circuit to determine whether a particular calculation is suitable for approximation by the approximation circuit. Based on determining whether a particular calculation is suitable for approximation, the approximation suitability checking circuit is configured to allow or prevent, respectively, the integrity check on the particular calculation.

[0038] The approximation suitability checking circuitry may be configured to determine whether a particular measure is suitable for approximation based on a number of possible factors.In some examples, the approximation suitability checking circuitry utilizes more than one different mechanism to determine whether a measure is suitable for approximation.

[0039] One such method involves determining that a particular measure is suitable for approximation based on determining that the measure involves evaluating a function that is mathematically smooth at the point at which it is evaluated. The function being mathematically smooth at the point means that the function can be differentiated at the point and the derivative evaluated. For example, where the measure involves raising one operand to the power of another operand, the function being evaluated will be smooth and the function can be differentiated.

[0040] In determining whether a particular measure is suitable for approximation, the approximation suitability checking circuit may also consider the behavior of the derivative of the function being evaluated, so that only measures involving functions whose evaluated derivatives do not change too quickly are found suitable for approximation.

[0041] In some cases, the function being evaluated will correspond directly to the instruction being executed (e.g., where the function includes addition, an addition instruction may be provided); however, in some cases, the function will correspond to several instructions (e.g., if the instruction set architecture does not provide a multiplication instruction, the function may correspond to one or more addition and branch instructions).

[0042] This approximation suitability condition may be used, for example, where the approximation circuit relies on the derivative of a function to determine the approximation result.

[0043] In some examples, the approximation suitability checking circuit is configured to use at least one of a neural network, a random forest, and a decision tree to determine whether a particular measurement is suitable for approximation by the approximation circuit. These structures can be trained to identify functions for which the approximation circuit will be able to reliably produce approximation results. These structures can be trained based on observations of measurement circuits and / or approximation circuits for various functions evaluated using the device, or these structures can be pre-trained before being deployed in the device so that the device is provided with an already trained model to be used by the neural network, random forest, or decision tree.

[0044] Another method for identifying whether a computation is suitable for approximation by an approximation circuit involves identifying the computation as suitable for approximation based on a determination that the computation corresponds to an operation from a predetermined list of operations. For example, the approximation suitability checking circuit may be provided with indications of certain operations (which may correspond to particular instructions or sequences of instructions) that are known to be suitable for approximation using the approximation circuit. Where the computation corresponds to such operations, the approximation suitability checking circuit may therefore determine that the computation is suitable for approximation.

[0045] The approximation circuit itself can use various techniques to calculate the approximation result. For example, a neural network can be used to determine the approximation result. However, in some examples, the approximation circuit maintains and utilizes the measurement result history information based on previous measurements that have been calculated by the measurement circuit. In this way, the approximation circuit can utilize the results from the measurement circuit and base the calculation of the approximation result on these previous results. In this case, the approximation circuit refers to the measurement result history information to calculate the calculated approximation result.

[0046] The measurement result history information may include an indication of previous results as calculated by the measurement circuitry and gradient information indicating how an operation to be evaluated to perform the measurement varies depending on the inputs to the operation. The operation may be a mathematical function, or may involve more than one sub-operation, such that the operation requires one or more functions to be evaluated as part of the measurement. Thus, the gradient information may reflect the dependency of the entire operation (including the functions of the sub-operations that form the operation) on the inputs to the operation.

[0047] To calculate an approximate result for a particular calculation, the approximation circuit may be configured to use the corresponding previous result and gradient information to estimate the result of the calculation with the input to be used. For example, the approximation may select a previous result obtained using an input similar to the input used for the calculation to be approximated, and then identify a gradient indicating how the result of the calculation will change as the input changes. This may then be used to derive an approximate result for the calculation.

[0048] This provides a fast and efficient way to determine an approximate value of a measured result, which can be compared to a result provided by the measurement circuit. If the result from the measurement circuit differs from the approximate result by more than a deviation threshold, this can be taken as an indication that an error has occurred, which error may be the result of a fault in the processing circuit.

[0049] The calculation result history information may be populated by the approximation circuit based on observations from the calculation circuit. Specifically, the approximation circuit may respond to the calculation circuit calculating the result of a given calculation to update the calculation result history based on the result of the given calculation as calculated by the calculation circuit. For example, the approximation circuit may store the result of the given calculation and the inputs that led to the result. Based on the result and other results previously obtained for the calculation, the approximation circuit may also calculate and store new gradient information to be used in calculating the approximation result.

[0050] In some examples, the measurement result history information is updated each time a measurement is performed using the measurement circuit; however, in some examples, the update may be performed only for measurements that perform integrity checks.

[0051] The deviation threshold can be obtained in several possible ways. For example, the deviation threshold can be set in a system register so that the integrity check circuit can obtain the deviation threshold from the system register. Therefore, the deviation threshold to be used can be modified by changing the value stored in the register.

[0052] In some examples, the approximation circuit and determining the approximation result also determine a confidence level associated with the approximation. In the case of using a history of measured results for approximation, the confidence level can be determined, for example, based on the difference between one or more inputs for which there is an entry in the history of measured results and one or more inputs on which the measurement is based. Regardless of how the confidence level is established, the confidence level can be used to determine the deviation threshold to be used, so that the deviation threshold is smaller when the confidence level is higher.

[0053] Where an integrity check initiation instruction and an integrity check termination instruction are used to control the integrity check process, at least one of the integrity check initiation instruction and the integrity check termination instruction may specify a specific deviation threshold, wherein the processing circuit responds to execution of the instruction so that the integrity check circuit uses the specific deviation threshold.

[0054] Specific examples will now be described with reference to the accompanying drawings.

[0055] Figure 1An example of a data processing device 2 in which the techniques described herein may be applied is schematically illustrated. The device 2 has processing circuitry 4 in the form of a processing pipeline 4 comprising a plurality of pipeline stages. In this example, the pipeline stages include: a fetch stage 6 for fetching instructions from an instruction cache 8; a decode stage 10 for decoding the fetched program instructions to generate micro-operations to be processed by the remaining stages of the pipeline; an issue stage 12 for checking whether operands required for a micro-operation are available in a register file 14 and issuing the micro-operation for execution once the operands required for a given micro-operation are available; an execute stage 16 for executing a data processing operation corresponding to the micro-operation by processing operands read from the register file 14 to generate a result value; and a write-back stage 18 for writing the results of the processing back to the register file 14. It should be understood that this is only one example of a possible pipeline architecture and that other systems may have additional stages or different stage configurations. For example, in an out-of-order processor, an additional register renaming stage may be included for mapping architectural registers specified by program instructions or micro-operations to physical register designators identifying physical registers in register file 14 .

[0056] The execution stage 16 includes a plurality of processing units for performing different categories of processing operations. For example, the execution units may include: an arithmetic / logic unit (ALU) 20 for performing arithmetic or logical operations; a floating point unit (FPU) 22 for performing operations on floating point values; a branch unit 24 for evaluating the results of a branch operation and adjusting a program counter representing a current execution point accordingly; and a load / store unit 28 for performing load / store operations to access data in a memory system 8, 30, 32, 34. In this example, the memory system includes a level 1 data cache 30, a level 1 instruction cache 8, a shared level 2 cache 32, and a main system memory 34. It should be understood that this is only one example of a possible memory hierarchy, and other cache arrangements may also be provided. The specific type of processing units 20 to 28 shown in the execution stage 16 is only one example, and other specific implementations may have a different set of processing units or may include multiple instances of the same type of processing unit so that multiple micro-operations of the same type can be processed in parallel. It should be understood that Figure 1 This is only a simplified representation of some components of a possible processor pipeline architecture, and the processor may include many other elements that are not illustrated for the sake of brevity, such as branch prediction mechanisms or address translation or memory management mechanisms.

[0057] The device 2 may have one or more faults, for example due to manufacturing or aging problems of the system. In particular, the processor may have one or more intermittent faults, which occur only from time to time and cause errors in the calculations performed by the device 2.

[0058] Figure 2 The processing circuit 4 is schematically illustrated as being provided with an integrity checking circuit 50 for checking the result of the calculation performed by the calculation circuit 40. The calculation circuit 40 may correspond, for example, to Figure 1 2 or FPU 22 or elements thereof. The calculation circuit 40 responds to instructions executed by the processing circuit 4 requesting the performance of a calculation to calculate one or more results of the calculation. A fault in the processing circuit 4 may cause the calculation circuit 40 to provide an incorrect result as the result of the calculation. This type of error may be difficult to detect because the result may appear to be valid, with the only indication of an error being that the result is incorrect.

[0059] Therefore, an integrity check circuit 50 is provided to check the result produced by the estimation circuit 40. Rather than having the estimation circuit 40 repeat an estimation to check the correctness of the estimation just performed or providing a replica circuit capable of performing parallel calculations of the results and comparing those results, the integrity check circuit 50 is provided with an approximation circuit 60 which is arranged to estimate an approximate result of the estimation which can be compared with the result estimated by the estimation circuit 40 as shown in comparison 64. As the approximation circuit 60 is not expected to produce an exact result of the estimation, when comparing 64 the approximation result with the result from the estimation circuit 40, a deviation threshold is used so that if the difference between the result from the estimation circuit 40 and the approximation exceeds the deviation threshold, an error is indicated, which may indicate a fault that has been detected in the processing circuit 4.

[0060] If the difference is greater than a certain value, the difference may be considered to exceed the deviation threshold, or if the difference is greater than or equal to a certain value, the difference may be considered to exceed the deviation threshold.

[0061] like Figure 2As shown, while various mechanisms may be provided to calculate approximate results, the approximation circuit 60 maintains measured result history information 62 based on previous results calculated by the measurement circuit 40. The measured result history information 62 may then be used by the approximation circuit 60 to calculate the approximate result. For example, based on previous results of a measurement involving similar operations with similar operands, the approximation circuit 60 may determine the approximate result based on that the approximate result will be similar to the previous result. The measured result history information 62 may also include or be used to calculate gradient information, which indicates how the operation to be evaluated to perform the measurement changes depending on the input of the operation. Based on the gradient information, the approximation circuit 60 may interpret the difference between the operands used in the previous measurement and the operands for which the approximation result is to be performed.

[0062] The approximation circuit 60 is arranged to update the measurement result history information 62 based on the results of the measurement circuit 40. In some cases, the integrity check circuit 50 is not called to perform an integrity check on each measurement performed by the measurement circuit 40. In this case, the approximation circuit 60 may update the measurement result history information 62 when the measurement is performed even if the integrity check is not performed. However, in order to avoid filling the measurement result history information 62 with result information for which the integrity check is not performed, in some examples, the approximation circuit 60 is configured to update the measurement result history information 62 only when the integrity check is called.

[0063] Since the historical information of the calculation result 62 is Figure 2 The results of the calculation circuit 40 in the example are filled, so the approximation circuit 60 is trained during the use of the device 2, so that it can experience a "warm-up" period, during which the calculation result history information 62 is filled and the accuracy of the approximation performed by the approximation circuit 60 during this period increases.

[0064] In some cases, approximation circuit 60 may not be suitable for approximating all of the calculations that may be performed by calculation circuit 40. Therefore, approximation suitability check circuit 52 is provided to determine for which calculations approximation circuit 60 will be able to provide a reliable approximation of the results.

[0065] Additionally, in the event that integrity check circuit 50 is invoked for a measurement that is determined by approximation suitability check circuit 52 to be unsuitable for approximation, approximation suitability check circuit 52 may suppress integrity check operations for the measurement. On the other hand, in the event that approximation suitability check circuit 52 determines that the measurement can be approximated by approximation circuit 60, approximation suitability check circuit 52 allows integrity check operations to be performed.

[0066] The determination as to whether a particular calculation can be accurately approximated can be performed in a variety of ways. For example, the approximation suitability check circuit 52 may operate based on the smoothness detection 54 and may be configured to determine whether the calculation involves evaluating a function that is mathematically smooth at the point at which it is evaluated. The smoothness of the function may enable the calculation of a gradient and, therefore, the calculation result to be dependent on changes in the input. Therefore, in the case where the calculation involves evaluating a smooth function, the approximation circuit 60 may be able to use nearby results from the calculation result history information 62 and the gradient information to determine the approximation result.

[0067] However, in some examples, the approximation suitability checking circuitry 52 utilizes a list of suitable operations 56, so that if the computation consists of suitable operations for approximation, the approximation suitability checking circuitry 52 will allow the result to be approximated by the approximation circuitry 60. In some examples, the approximation suitability checking circuitry 52 utilizes a neural network, random forest, or decision tree 58. These structures may be trained in situ using data observed from the operation of the processing circuitry 4, or may be provided already trained such that the neural network / random forest / decision tree is already able to classify the computation to be performed as suitable for approximation or otherwise processing.

[0068] Figure 3 An example entry 70 of measurement result history information is shown. Entry 70 represents a single previous calculation performed by measurement circuitry 40 and may be used by approximation circuitry 60 to calculate an approximate result of yet another measurement. Entry 70 includes an operation identifier (ID) 72 to identify the particular form of the operation whose result entry 70 represents. Entry 70 also includes an indication of one or more inputs 74 used as operands in the operation represented by entry 70. Entry 76 then indicates one or more results 76 produced by the measurement and gradient information 78 indicating how the result of the operation varies depending on the input. The gradient information 78 may be calculated, for example, based on the difference in inputs and results of two previous measurements performed using the operation.

[0069] Figure 4 An example of program code suitable for invoking an integrity check is shown. Figure 4 A function for evaluating power is illustrated. Figure 4 The left side of shows the function signature, and Figure 4 The right side of represents the instructions that will be executed by the processing circuitry to perform the function.

[0070] like Figure 4As shown, the function begins with an integrity check initiation instruction, the START_IC instruction. The START_IC instruction indicates to the processing circuit 4 that an integrity check operation is to be performed on the calculation performed by the following instruction. The START_IC instruction may also indicate an identifier (ID) of a particular element of the integrity check circuit 50 that is arranged to perform an integrity check on the element of the calculation circuit 40 that processes the calculation. The START_IC instruction also identifies the number of independent variables of the calculation to be subjected to the integrity check. In this case, there are two independent variables x and y.

[0071] The integrity checking circuit 40 may be arranged to obtain the arguments from predetermined registers (eg, from the first two general purpose registers in the register file 14), or the START_IC instruction may indicate the location of the arguments in some examples.

[0072] Once the start of the measurement to be subject to the integrity check has been indicated using the START_IC instruction, the following instructions (not shown) are used to cause the processing circuit 4 and in particular the measurement circuit 40 to perform the measurement. In order to indicate to the integrity check circuit 50 that the measurement to be subject to the integrity check operation has been completed, an integrity check termination instruction, END_IC instruction, is provided. In response to the integrity check termination instruction, the integrity check circuit 50 is configured to perform a comparison 64 between the result from the measurement circuit 40 and the approximate result.

[0073] Thus, a programmer or compiler may indicate that integrity checking is to be performed on a particular computation and the range of instructions representing that computation.

[0074] Figure 5 Another example of program code suitable for invoking an integrity check is shown. Figure 5 In the example, Figure 5 As shown on the left, the calculation of dividing a by b has two results - a quotient and a remainder. Therefore, in this example, the instruction to calculate the quotient is subject to a separate integrity check operation from the instruction for calculating the remainder. This can be done in Figure 5 , which shows a first integrity check initiation instruction with a first identifier id1 and a first integrity check termination instruction placed around the instruction for calculating the quotient, followed by a second integrity check initiation instruction with a second identifier id2 and a second integrity check termination instruction placed around the instruction for calculating the remainder. In this way, the calculation of both results is subjected to an integrity check operation to detect any fault that causes an error during the calculation of either of these results.

[0075] Figure 6 FIG. 1 is a flow chart showing the operation of the integrity check. Figure 6As illustrated, at step 602, it is determined whether an integrity check is to be performed. This determination may be made based on whether an integrity check initiation instruction indicating that an integrity check is to be performed has been received. Additionally, at step 602, it may be determined whether the measurement to be performed is suitable for approximation. Thus, if the measurement is not suitable for approximation, then the integrity check will not be performed on the measurement.

[0076] If an integrity check is to be performed, the measurement circuit 40 continues to measure the result at step 606. At 604, the approximation circuit 60 also measures the approximation result. The results are then compared at step 608, where it is determined whether the difference between the result and the approximation result exceeds a deviation threshold. If the difference does not exceed the threshold, the measurement is considered to have passed the integrity check. At this point, the measured results can be used to populate the measurement result history information 62.

[0077] On the other hand, if the difference between the result and the approximate result does exceed the deviation threshold, integrity checking circuit 50 determines at step 610 that an error has occurred.

[0078] For example, an error may be indicated by writing a value to a register in register file 14 or by raising an exception. The error may indicate a fault in processing circuit 4 and may therefore be used as the basis for a decision to replace processing circuit 4 or otherwise compensate for the fault. However, because the determination of errors is made on an approximate basis, the determination of a single error may not be sufficient to conclusively determine that a fault exists, and instead the presence of a fault may only be determined if repeated errors are detected by integrity checking circuit 50.

[0079] Figure 7The simulator that can be used is illustrated. Although the previously described embodiments implement the present invention in terms of the apparatus and method for operating the specific processing hardware supporting the technology involved, an instruction execution environment according to the embodiments described herein can also be provided, which is implemented by using a computer program. Such computer programs are generally referred to as simulators, to a certain extent because such computer programs provide a specific implementation based on software of the hardware architecture. The types of simulator computer programs include emulators, virtual machines, models and binary converters, which include dynamic binary converters. Typically, the simulator is specifically implemented and can be run on a host processor 714 that supports the simulator program 704, optionally running a host operating system 712. In some arrangements, there may be multiple simulation layers between the hardware and the provided instruction execution environment and / or a plurality of different instruction execution environments provided on the same host processor. Historically, a powerful processor is required to provide a simulator that is executed at a reasonable speed, but this method may be reasonable in certain circumstances, such as when it is desired to run another processor local code for compatibility or reuse reasons. For example, the simulator is specifically implemented to provide additional functionality that is not supported by the host processor hardware to the instruction execution environment, or to provide an instruction execution environment that is generally associated with different hardware architectures. An overview of simulation is given in: "Some Efficient Architecture Simulation Techniques", Robert Bedichek, Winter 1990 USENIX Conference, pp. 53-63.

[0080] To the extent that embodiments have been previously described with reference to specific hardware constructs or features, in simulated embodiments, equivalent functionality may be provided by suitable software constructs or features. For example, specific circuits may be implemented as computer program logic in simulated embodiments. Similarly, memory hardware such as registers or cache memory may be implemented as software data structures in simulated embodiments. One or more of the hardware elements referenced in the previously described embodiments are present in an arrangement on host hardware (e.g., host processor 714), and some simulated embodiments may utilize host hardware where appropriate.

[0081] The simulator program 704 may be stored on a computer-readable storage medium (which may be a non-transitory medium), and provides a program interface (instruction execution environment) to the target code 702 (which may include an application, an operating system, and a hypervisor), which is the same as the interface of the hardware architecture modeled by the simulator program 704. Specifically, the simulator program 704 includes simulator code to provide a processing program logic 706, a calculation program logic 708, and an approximation program logic 710 corresponding to the processing circuit 4, the calculation circuit 40, and the approximation circuit 60, respectively. Therefore, the program instructions of the target code 702 (including the above-mentioned integrity check initiation instruction and integrity check termination instruction) can be executed from within the instruction execution environment using the simulator program 704, so that the host computer 714 that does not actually have the hardware features of the above-mentioned device 2 can simulate these features.

[0082] Thus, a mechanism has been described for quickly and efficiently checking the results of a calculation performed by processing circuitry 4 which avoids the need to replicate the entire calculation logic or perform the calculation multiple times. Integrity checking operations may also be selectively employed, with instructions provided to indicate to processing circuitry 4 whether an integrity checking operation is to be performed.

Claims

1. A device, comprising: A processing circuit, the processing circuit is used to execute instructions; The processing circuit comprises: A calculation circuit, the calculation circuit responding to one or more instructions requesting the execution of a calculation to calculate a result of the calculation; an approximation circuit responsive to the one or more instructions to calculate an approximate result of the calculation independently of the calculation circuit; and An integrity check circuit is configured to perform an integrity check by: comparing the result of the measurement performed by the measurement circuit with the approximation result of the measurement performed by the approximation circuit; and In response to determining that a difference between the result of the calculation and the approximate result of the calculation is greater than a deviation threshold, an error in the processing circuit is detected.

2. The device according to claim 1, wherein: The processing circuit is responsive to execution of an integrity check initiation instruction so that the approximation circuit begins calculating the approximation result with respect to one or more instructions after the integrity check initiation instruction; and The processing circuitry is responsive to execution of an integrity check termination instruction to cause the integrity check circuitry to perform the integrity check.

3. The device according to claim 2, wherein: The calculation operates on one or more operands; The integrity check initiation instruction specifies one or more registers; and The approximation circuit is configured to obtain the one or more operands from the one or more designated registers.

4. The device according to claim 1 or claim 2, wherein: The calculation operates on one or more operands; and The approximation circuit is configured to obtain the one or more operands from one or more predetermined registers.

5. An apparatus according to any preceding claim, wherein: The approximation circuit includes an approximation suitability checking circuit configured to determine whether a particular measurement is suitable for approximation by the approximation circuit and to only allow the integrity check to be performed with respect to the particular measurement in response to determining that the particular measurement is suitable for approximation by the approximation circuit.

6. The device according to claim 5, wherein: The approximation suitability checking circuit is configured to determine that the particular measure is suitable for approximation based on determining that the measure includes evaluating a function that is mathematically smooth at the point at which it is evaluated.

7. The device according to claim 5 or claim 6, wherein: The approximation suitability checking circuit is configured to use at least one of a neural network, a random forest, and a decision tree to determine whether a particular measure is suitable for approximation by the approximation circuit.

8. The device according to any one of claims 5 to 7, wherein: The approximation suitability checking circuit is configured to identify the measurement as suitable for approximation by the approximation circuit in response to determining that the measurement corresponds to an operation from a predetermined list of operations.

9. An apparatus according to any preceding claim, wherein the approximation circuit is configured to: maintaining measurement result history information based on previous measurement results calculated by the measurement circuit; and The approximate result of the calculation is calculated with reference to the calculation result history information.

10. The device according to claim 9, wherein the historical information of the measurement result comprises: an indication of the previous measurement result calculated by the measurement circuit; and Gradient information indicating how an operation to be evaluated to perform the calculation changes according to an input to the operation.

11. The device according to claim 10, wherein: The approximation circuit is configured to calculate the approximate result of the calculation based on a corresponding previous result of the previous results and the gradient information from the calculated result history information.

12. The device according to any one of claims 9 to 11, wherein: The approximation circuit is responsive to the estimation circuit calculating a result of a given estimation to update the estimation result history information based on the result of the given estimation.

13. The apparatus according to claim 12, wherein updating the measurement result history comprises: storing said result of said given measurement; Calculating new gradient information based on the result of the given calculation and the previous result; as well as The new gradient information is stored.

14. An apparatus according to any preceding claim, wherein: The evaluation circuit is an arithmetic logic unit (ALU) or a part of an ALU.

15. The device according to any one of claims 1 to 13, wherein: The calculation circuit is a floating point unit (FPU) or a part of the FPU.

16. An apparatus according to any preceding claim, wherein: The integrity checking circuit is configured to obtain the deviation threshold from a system register.

17. The device according to any one of claims 1 to 15, wherein: The approximation circuit is configured to determine a confidence level associated with the approximation; and The deviation threshold is based on the confidence level.

18. Apparatus according to claim 2 or any one of claims 3 to 15 when dependent on claim 2, wherein: The processing circuit is responsive to execution of at least one of the integrity check initiation instruction and the integrity check termination instruction that specifies a particular deviation threshold, such that the integrity check circuit uses the particular deviation threshold as the deviation threshold.

19. A method comprising: executing instructions by processing circuitry; Calculating a result of the calculation in response to one or more instructions to perform the calculation; responsive to the one or more instructions to calculate an approximate result of the calculation independently of the calculation; as well as Perform a sanity check by following these steps: comparing the result of the measurement with the approximate result of the measurement; as well as In response to determining that a difference between the result of the calculation and the approximate result of the calculation is greater than a deviation threshold, an error in the processing circuit is detected.

20. A computer program for controlling a host data processing device to provide an instruction execution environment, the computer program comprising: Processor logic for executing instructions; The processing logic includes: calculation program logic, the calculation program logic responding to one or more instructions to perform a calculation to calculate a result of the calculation; approximation program logic responsive to the one or more instructions to compute an approximate result of the computation independently of the computation program logic; and Integrity checker logic configured to perform an integrity check by: comparing the result of the calculation performed by the calculation program logic to the approximation result of the calculation performed by the approximation program logic; and In response to determining that a difference between the result of the calculation and the approximate result of the calculation is greater than a deviation threshold, an error in the processing program logic is detected.

Images