Multi-core vehicle gauge safety chip core subsystem, method and chip

Abstract

The invention relates to a multi-core vehicle gauge security chip core subsystem, a method and a chip, a TCMSMPU is integrated in the multi-core vehicle gauge security chip core subsystem, the TCMSMPU is adopted to monitor the access of a CPU core in the multi-core vehicle gauge security chip core subsystem to DTCM memories of other CPU cores, and interception is carried out when the CPU core illegally accesses the DTCM memories of other CPU cores, so that the safety of the multi-core vehicle gauge security chip core subsystem is ensured. According to the method, the state of errors can be inquired by accessing the register of the TCMSMPU through the APB bus, so that the data security of accessing different DTCM intervals by the CPU through the DTCM bus is greatly improved, and the time sequence of accessing the DTCM storage by the CPU core is not influenced, so that the access authority of accessing the DTCM storage of a non-own module by other CPUs in a multi-core system of the vehicle gauge security chip is correct.

Description

Technical Field

[0001] The present invention belongs to the technical field of chip verification and relates to a core subsystem, method and chip of a multi-core automotive safety chip. Background Art

[0002] With the continuous development of automotive electronic technology, modern cars integrate more and more electronic control units (ECUs). These ECUs not only improve vehicle performance and comfort, but also put forward higher requirements for vehicle safety. As the core component of automotive electronic systems, automotive safety chips must have extremely high reliability and safety. Among them, functional safety has become a key indicator in the design of automotive safety chips, which is used to ensure that the system can operate safely or shut down safely under fault conditions. Storage is one of the important components of the chip. The security of storage largely determines the security of the chip, especially in multi-core systems. Storage security is particularly important.

[0003] DTCM (Data Tightly Coupled Memory) storage is used to store data in automotive safety chips. In a multi-core system with split-lock (a CPU function that is mainly used to support atomic memory access across cache lines), two CPU cores (such as CPU0 and CPU1) can be used as redundancy to check whether the accessed data is correct, while other CPU cores do not have redundant logic to determine whether the access is correct when accessing DTCM storage of non-self-modules. If an incorrect access is made, it is easy to cause data errors, causing the automotive safety chip to fail to work properly. Therefore, how to ensure that the access rights of other CPUs in the multi-core system of automotive safety chips to access DTCM storage of non-self-modules are correct to improve the safety of vehicle operation is one of the important technical issues that need to be solved when designing automotive safety chips. Summary of the invention

[0004] In response to the problems existing in the above-mentioned traditional technologies, the present invention proposes a multi-core automotive safety chip core subsystem, a DTCM access protection method for the core subsystem of a multi-core automotive safety chip, and a multi-core automotive safety chip, which can effectively monitor the CPU core's access to the DTCM storage of other CPU cores to ensure that the access rights of other CPUs in the multi-core system of the automotive safety chip to access the DTCM storage of non-self-modules are correct.

[0005] In order to achieve the above objectives, the embodiments of the present invention adopt the following technical solutions: On the one hand, a multi-core automotive safety chip core subsystem is provided, including TCM_SMPU, multiple CPU cores and DTCM storage corresponding to each CPU core. When any CPU core accesses the DTCM storage corresponding to other CPU cores through the DTCM bus, any CPU core selects one way to access the corresponding DTCM storage or another way to access the DTCM storage corresponding to other CPU cores through a multiplexer in the corresponding DTCM storage; TCM_SMPU includes a detection module and a register module. The detection module is used to monitor the DTCM bus, monitor whether the CPU core's access to the DTCM storage corresponding to other CPU cores is illegal, and intercept and alarm when illegal access occurs. The register module is used to store APB configuration information and record error status information when illegal access occurs; the monitoring scope of the detection module can include the access address, read and write, and privileged user permissions.

[0006] On the other hand, a DTCM access protection method for a multi-core automotive safety chip core subsystem is also provided, which is applied to a multi-core automotive safety chip core subsystem, wherein the multi-core automotive safety chip core subsystem includes a TCM_SMPU, multiple CPU cores, and a DTCM storage corresponding to each CPU core. When any CPU core accesses the DTCM storage corresponding to other CPU cores through a DTCM bus, any CPU core selects one way to access the corresponding DTCM storage or another way to access the DTCM storage corresponding to other CPU cores through a multiplexer in the corresponding DTCM storage; TCM_SMPU includes a detection module and a register module. The detection module is used to monitor the DTCM bus, monitor whether the CPU core's access to the DTCM storage corresponding to other CPU cores is illegal, and intercept and alarm when illegal access occurs. The register module is used to store APB configuration information and record error status information when illegal access occurs; the monitoring scope of the detection module may include the access address, read and write, and privileged user permissions; The above-mentioned multi-core automotive safety chip core subsystem DTCM access protection method includes the following steps: After configuring the registers of TCM_SMPU, enable TCM_SMPU; Through TCM_SMPU, the CPU core is monitored to see if the access to the DTCM storage corresponding to other CPU cores is illegal, and an interception alarm is issued when illegal access occurs; By accessing the register that records the error status in TCM_SMPU, query the access error that occurred.

[0007] On the other hand, a multi-core automotive-grade safety chip is provided, comprising the multi-core automotive-grade safety chip core subsystem mentioned above.

[0008] One of the above technical solutions has the following advantages and beneficial effects: The above-mentioned multi-core automotive safety chip core subsystem, method and chip integrate TCM_SMPU in the multi-core automotive safety chip core subsystem, use TCM_SMPU to monitor the CPU core in the multi-core automotive safety chip core subsystem accessing the DTCM storage of other CPU cores, and intercept when the CPU core illegally accesses the DTCM storage of other CPU cores. The register of TCM_SMPU can be accessed through the APB bus to query the error status, thereby greatly improving the data security of the CPU accessing different DTCM intervals through the DTCM bus, and will not affect the timing of the CPU core accessing the DTCM storage, so as to ensure that the access rights of other CPUs in the multi-core system of the automotive safety chip to access the DTCM storage of non-self-modules are correct. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the conventional technology, the drawings required for use in the embodiments or the conventional technology descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0010] Figure 1 This is a structural block diagram of a core subsystem of a multi-core automotive safety chip in one embodiment; Figure 2 A schematic diagram of the module structure and interface of TCM_SMPU in one embodiment; Figure 3 The figure is a flow chart of a method for access protection of the DTCM core subsystem of a multi-core automotive safety chip in one embodiment. DETAILED DESCRIPTION

[0011] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with the accompanying drawings and Examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those generally understood by those skilled in the art of the present invention. The terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0012] It should be noted that the reference to "embodiment" in this article means that the specific features, structures or characteristics described in conjunction with the embodiment may be included in at least one embodiment of the present invention. The presentation of this phrase at various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It will be appreciated by those skilled in the art that the embodiments described herein may be combined with other embodiments. The term "and / or" used in the specification of the present invention and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0013] The following will describe the implementation of the present invention in detail with reference to the accompanying drawings in the embodiment diagram of the present invention.

[0014] In one embodiment, Figure 1 As shown, a multi-core automotive safety chip core subsystem is provided, including TCM_SMPU, multiple CPU cores and DTCM storage corresponding to each CPU core. When any CPU core accesses the DTCM storage corresponding to other CPU cores through the DTCM bus, any CPU core selects one way to access the corresponding DTCM storage or another way to access the DTCM storage corresponding to other CPU cores through the multiplexer in the corresponding DTCM storage. TCM_SMPU includes a detection module and a register module. The detection module is used to monitor the DTCM bus, monitor whether the CPU core's access to the DTCM storage corresponding to other CPU cores is illegal, and intercept and alarm when illegal access occurs. The register module is used to store APB configuration information and record error status information during illegal access. The monitoring range of the detection module may include access addresses, read and write, and privileged user permissions.

[0015] It can be understood that the traditional SMPU (System Memory Protection Unit) storage protection monitors the interface of the AXI (Advanced eXtensible Interface) bus and the AHB (Advanced High-performance Bus) bus accessing storage or AHB to storage, and cannot effectively monitor and intercept when the CPU core directly accesses the DTCM storage of other CPU cores through the DTCM bus. Therefore, the technical means adopted in this embodiment are used to greatly improve the security of the CPU accessing the DTCM storage data, and will not affect the timing of the CPU core accessing the DTCM storage. Among them, the module diagram of TCM (Tightly Coupled Memory)_SMPU is shown in Figure 2As shown, it includes a detection module and a register module. The detection module is used to monitor the DTCM bus and monitor whether the CPU's access to the DTCM storage is illegal. The monitoring range can include the access address, read and write, and privileged user permissions. If an illegal operation occurs, an interception alarm is issued. The register module is used to store APB configuration information and record error status information when the CPU illegally accesses.

[0016] Specifically, the system can configure the registers of TCM_SMPU through the APB slave interface, such as configuring the address range, read / write (logic), and privileged user permissions of the DTCM storage of the CPU core to access non-self-modules, and turning on TCM_SMPU to enable TCM_SMPU to start working. The CPU core normally accesses its DTCM storage through the DTCM bus. After TCM_SMPU is enabled, TCM_SMPU will judge the access address, read / write, and permissions of the CPU core to the DTCM storage, and intercept and alarm if illegal access occurs.

[0017] The above-mentioned multi-core automotive safety chip core subsystem integrates TCM_SMPU in the multi-core automotive safety chip core subsystem, and uses TCM_SMPU to monitor the CPU core in the multi-core automotive safety chip core subsystem accessing the DTCM storage of other CPU cores, and intercepts when the CPU core illegally accesses the DTCM storage of other CPU cores. The register of TCM_SMPU can be accessed through the APB bus to query the error status, thereby greatly improving the data security of the CPU accessing different DTCM intervals through the DTCM bus, and will not affect the timing of the CPU core accessing the DTCM storage, so as to ensure that the access rights of other CPUs in the multi-core system of the automotive safety chip to access the DTCM storage of non-self-modules are correct.

[0018] In one embodiment, the TCM_SMPU further includes an APB interface and a DTCM interface, wherein the APB interface is used to configure or query the register information of the TCM_SMPU. The DTCM interface is a DTCM interface for a CPU core to access the DTCM storage corresponding to other CPU cores, and is used to receive access information of the CPU core to the DTCM storage corresponding to other CPU cores.

[0019] It is understandable that Figure 2 As shown, TCM_SMPU is also configured with APB (slave) interface and DTCM interface. The APB slave interface is used to configure or query the register information of TCM_SMPU. The DTCM interface is the DTCM interface for the CPU core to access the DTCM storage, and is used for TCM_SMPU to receive the access information of the CPU core to the DTCM storage.

[0020] In one embodiment, a cyclic redundancy check (CRC) is integrated inside the TCM_SMPU to determine the logic redundancy, and is used to monitor the internal registers and detection modules of the TCM_SMPU.

[0021] It is understandable that Figure 2 As shown in the figure, the TCM_SMPU internal integrated CRC judgment logic redundancy can provide monitoring outputs for the internal registers and detection modules of the TCM_SMPU, such as CRC error alarm, to detect or verify possible errors that may occur after data transmission or storage of the TCM_SMPU internal registers, thereby further improving the data security of the system. tcm_smpu_top represents the top level of the TCM_SMPU module (including detection modules and register modules, etc.).

[0022] In one embodiment, in order to more intuitively demonstrate the core subsystem of the multi-core automotive safety chip, taking three cores as an example, the core subsystem (core_subsystem) of the multi-core automotive safety chip integrates three CPU cores. The position of TCM_SMPU in the system is as follows: Figure 1 As shown, CPU0 (core 0) and CPU1 (core 1) are used for split-lock, and these two CPU cores can make redundant judgments when accessing DTCM storage; while CPU2 (core 2) is a separate CPU core. When CPU2 accesses DTCM storage, it first makes a MUX (Multiplexer) selection inside the tcm wrapper (TCM package). One way is to access its own DTCM2 storage, and the other way is to access the DTCM0 / 1 storage of sub_core0 / 1. When accessing the DTCM0 / 1 storage of sub_core0 / 1, the external TCM_SMPU will judge the access initiated by CPU2 to determine whether the access address, read and write, and privileged user permissions of the access are legal. Among them, sub_core0 is the subsystem corresponding to CPU0, sub_core1 is the subsystem corresponding to CPU1, and sub_core2 is the subsystem corresponding to CPU2. Sub_core includes CPU cores and DTCM modules.

[0023] TCM_SMPU includes DTCM bus, APB bus (corresponding to APB interface), detection module and register (configuration) module, among which xh_smpu_int_err is monitoring alarm output, xh_smpu_crc_err is CRC error alarm output in register configuration module, and xh_smpu_bak_err is redundant alarm output of TCM_SMPU internal monitoring logic. After integrating TCM_SMPU in the core subsystem, register configuration of TCM_SMPU is required, including configuring the address space of DTCM storage in sub_core0 / 1 for CPU2 core to access, and configuring privileged user rights for CPU2 core to access. After these configurations are completed, configure TCM_SMPU to enable, so that TCM_SMPU will monitor the DTCM storage in sub_core0 / 1 for CPU2 core to access.

[0024] After the access interception alarm is triggered in the register of TCM_SMPU, the system can access the error status register through the APB interface of TCM_SMPU to query the access error. The register of TCM_SMPU records the DTCM interface (such as DOTCM or D1TCM) of the CPU2 core where the access error occurs, the access address, read or write logic, privileged user permissions or corresponding user operations, etc.

[0025] In this way, based on the DTCM access protection method in the multi-core automotive safety chip of the aforementioned TCM_SMPU, the data security of the CPU accessing different DTCM storage intervals through the DTCM bus is improved in the core subsystem of the multi-core automotive safety chip, and interception and alarm are promptly performed when the CPU accesses illegally. Then, the registers of TCM_SMPU can be accessed through the APB bus to query the status of the access error.

[0026] In one embodiment, a DTCM access protection method for a core subsystem of a multi-core automotive safety chip is provided, which is applied to a core subsystem of a multi-core automotive safety chip, and the core subsystem of the multi-core automotive safety chip includes a TCM_SMPU, multiple CPU cores, and DTCM storage corresponding to each CPU core. When any CPU core accesses the DTCM storage corresponding to other CPU cores through the DTCM bus, any CPU core selects one way to access the corresponding DTCM storage or another way to access the DTCM storage corresponding to other CPU cores through the multiplexer in the corresponding DTCM storage. TCM_SMPU includes a detection module and a register module. The detection module is used to monitor the DTCM bus, monitor whether the CPU core's access to the DTCM storage corresponding to other CPU cores is illegal, and intercept and alarm when illegal access occurs. The register module is used to store APB configuration information and record error status information during illegal access; the monitoring range of the detection module may include the access address, read and write, and privileged user permissions.

[0027] like Figure 3 As shown, the above-mentioned multi-core automotive safety chip core subsystem DTCM access protection method may include the following processing steps S10 to S14: S10, configure TCM_SMPU register and then enable TCM_SMPU; S12, monitor whether the CPU core's access to the DTCM storage corresponding to other CPU cores is illegal through TCM_SMPU, and intercept and alarm when illegal access occurs; S14, query the access error that occurred by accessing the register that records the error status in TCM_SMPU.

[0028] The above-mentioned DTCM access protection method for the core subsystem of the multi-core automotive safety chip integrates TCM_SMPU in the core subsystem of the multi-core automotive safety chip, and uses TCM_SMPU to monitor the CPU core in the core subsystem of the multi-core automotive safety chip to access the DTCM storage of other CPU cores, and intercepts it when the CPU core illegally accesses the DTCM storage of other CPU cores. The register of TCM_SMPU can be accessed through the APB bus to query the error status, thereby greatly improving the data security of the CPU accessing different DTCM intervals through the DTCM bus, and will not affect the timing of the CPU core accessing the DTCM storage, so as to ensure that the access rights of other CPUs in the multi-core system of the automotive safety chip to access the DTCM storage of non-self-modules are correct.

[0029] In one embodiment, TCM_SMPU also includes an APB interface and a DTCM interface. The APB interface is used to configure or query the register information of TCM_SMPU. The DTCM interface is a DTCM interface for the CPU core to access the DTCM storage corresponding to other CPU cores, and is used to receive access information of the CPU core to the DTCM storage corresponding to other CPU cores.

[0030] In one embodiment, the TCM_SMPU internally integrates CRC judgment logic redundancy to monitor the internal registers and detection modules of the TCM_SMPU.

[0031] For the specific limitations of the DTCM access protection method of the core subsystem of the multi-core automotive safety chip, please refer to the corresponding limitations of the core subsystem of the multi-core automotive safety chip in the above text, and will not be repeated here.

[0032] It should be understood that although Figure 2 and Figure 3 The steps in the method are shown in sequence as indicated by the arrows, but the steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of the steps, and the steps can be executed in other orders. Figure 2 and Figure 3 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequentially, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0033] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus dynamic random access memory (RambusDRAM, referred to as RDRAM) and interface dynamic random access memory (DRDRAM).

[0034] In one embodiment, a multi-core automotive-grade safety chip is also provided, including the multi-core automotive-grade safety chip core subsystem mentioned above.

[0035] It can be understood that the multi-core automotive safety chip is equipped with the multi-core automotive safety chip core subsystem recorded in any of the above embodiments, so that the data security performance of the chip can be improved by means of the DTCM storage access monitoring mechanism inside the multi-core automotive safety chip core subsystem. Those skilled in the art can understand that the multi-core automotive safety chip itself can also include other necessary chip components in addition to the multi-core automotive safety chip core subsystem, and the specific understanding can be made by referring to the inherent structure of various types of multi-core automotive safety chips in the art.

[0036] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0037] The above embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of protection of the invention. It should be pointed out that, for those of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the attached claims.

Claims

1. A multi-core automotive safety chip core subsystem, characterized in that: It includes TCM_SMPU, multiple CPU cores and DTCM storage corresponding to each CPU core. When any of the CPU cores accesses the DTCM storage corresponding to other CPU cores through the DTCM bus, any of the CPU cores selects one way to access the corresponding DTCM storage or another way to access the DTCM storage corresponding to other CPU cores through a multiplexer in the corresponding DTCM storage; TCM_SMPU includes a detection module and a register module. The detection module is used to monitor the DTCM bus, monitor whether the CPU core's access to the DTCM storage corresponding to other CPU cores is illegal, and intercept and alarm when illegal access occurs. The register module is used to store APB configuration information and record error status information when illegal access occurs; the monitoring scope of the detection module may include access addresses, read and write, and privileged user permissions.

2. The multi-core automotive safety chip core subsystem according to claim 1 is characterized in that: The TCM_SMPU also includes an APB interface and a DTCM interface. The APB interface is used to configure or query the register information of the TCM_SMPU. The DTCM interface is a DTCM interface for the CPU core to access the DTCM storage corresponding to other CPU cores, and is used to receive access information of the CPU core to the DTCM storage corresponding to other CPU cores.

3. The multi-core automotive safety chip core subsystem according to claim 1 or 2, characterized in that: The TCM_SMPU has an internal integrated CRC judgment logic redundancy, which is used to monitor the internal registers of the TCM_SMPU and the detection module.

4. A multi-core automotive safety chip core subsystem DTCM access protection method, characterized in that: Applied to a multi-core automotive safety chip core subsystem, the multi-core automotive safety chip core subsystem includes TCM_SMPU, multiple CPU cores and DTCM storage corresponding to each CPU core. When any of the CPU cores accesses the DTCM storage corresponding to other CPU cores through the DTCM bus, any of the CPU cores selects one way to access the corresponding DTCM storage or another way to access the DTCM storage corresponding to other CPU cores through a multiplexer in the corresponding DTCM storage; TCM_SMPU includes a detection module and a register module. The detection module is used to monitor the DTCM bus, monitor whether the CPU core's access to the DTCM storage corresponding to other CPU cores is illegal, and intercept and alarm when illegal access occurs. The register module is used to store APB configuration information and record error status information when illegal access occurs; the monitoring scope of the detection module may include access address, read and write, and privileged user permissions; The multi-core automotive safety chip core subsystem DTCM access protection method comprises the following steps: After configuring the register of the TCM_SMPU, configure the TCM_SMPU to enable; Monitor whether the CPU core's access to the DTCM storage corresponding to other CPU cores is illegal through the TCM_SMPU, and intercept and alarm when illegal access occurs; The access error that occurred is queried by accessing the register recording the error status in the TCM_SMPU.

5. The multi-core automotive safety chip core subsystem DTCM access protection method according to claim 4 is characterized in that: The TCM_SMPU also includes an APB interface and a DTCM interface. The APB interface is used to configure or query the register information of the TCM_SMPU. The DTCM interface is a DTCM interface for the CPU core to access the DTCM storage corresponding to other CPU cores, and is used to receive access information of the CPU core to the DTCM storage corresponding to other CPU cores.

6. The multi-core automotive safety chip core subsystem DTCM access protection method according to claim 4 or 5 is characterized in that: The TCM_SMPU has an internal integrated CRC judgment logic redundancy, which is used to monitor the internal registers of the TCM_SMPU and the detection module.

7. A multi-core automotive safety chip, characterized in that: It includes the multi-core automotive safety chip core subsystem as described in any one of claims 1 to 3.

Images