Method and device for configuring a control unit for controlling multiple domains, in particular in a motor vehicle

Abstract

The invention relates to a computer-implemented method for creating a memory configuration for memory protection units (23) of a processor unit (2) having a plurality of processor cores (21), wherein the memory protection units (23) are each assigned to the processor cores (21) and are designed to permit or restrict memory access to a memory section by the corresponding processor core (21) according to an access right, depending on the respective memory configuration, wherein the memory configuration assigns an MPU memory region with one or more memory sections to a start and an end address, a processor core (21), and an access right, comprising the following steps: - Providing an assignment of several virtual machines (VM1-VM4) to the processor cores (21); - Providing (S1) for each virtual machine (VM1-VM4) or each processor core (21), memory sections with a memory section ID and an associated access right; - Combinatorial (S2) optimization with the aim of allocating a number of MPU memory regions as the memory configuration for each of the processor cores (21) that does not exceed a predetermined maximum number, wherein the MPU memory regions have one or more memory section IDs that are assigned to a contiguous address range; and - Implementing (S3) the corresponding memory configuration in the memory protection units (23).

Description

Technical area

[0001] The invention relates to the configuration of control units, in particular control units with a microprocessor or microcontroller with multiple processor cores, which are designed for the control and operation of multiple domains, particularly in a motor vehicle. The invention further relates to the allocation of memory areas to the individual processor cores from the perspective of access protection to memory areas for safeguarding safety-critical functions. Technical background

[0002] To control various domains in a vehicle, such as battery systems, chassis, driver assistance systems, transmissions, and the like, via a single control unit, a processor unit comprising a microcontroller or microprocessor with multiple cores can be used. To separate the control of the individual domains from each other, the processor unit can be partitioned so that domain operation can be ensured independently and in parallel, without the control functions of different domains interfering with each other.

[0003] The partitions correspond to virtualizations, so that each domain can be operated independently of the others using its own virtual machine. However, with ECUs, it is also important to consider that not only the distribution of processor cores among the individual virtual machines, but also the allocation of memory and peripheral units, such as general timer modules, communication modules, A / D converters, and the like, must be partitioned.

[0004] Generally, applications with different Automotive Safety Integrity Levels (ASIL) or different safety levels on the same processor unit ensure freedom from interference between the applications. Therefore, the processor unit is partitioned so that each virtual machine runs on one or more processor cores reserved exclusively for that virtual machine. Furthermore, each virtual machine can have exclusive or shared access to memory areas, as well as to peripheral resources or peripherals.

[0005] Hardware-based virtualization is particularly suitable for the use of control units for safety-critical domain functions, in which a specific hardware unit is responsible for the virtualization, e.g., a network-on-chip firewall, a peripheral bridge firewall, and a memory protection unit (MPU) as the core MPU. Disclosure of the invention

[0006] According to the invention, a method for creating a configuration for a memory protection unit (MPU) according to claim 1 as well as a device and a control unit according to the independent claims are provided.

[0007] Further embodiments are specified in the dependent claims.

[0008] According to a first aspect, a computer-implemented method for creating a memory configuration for memory protection units of a processor unit with multiple processor cores, wherein the memory protection units are each assigned to the processor cores and are designed to allow or restrict memory access to a memory section by the corresponding processor core according to an access right depending on the respective memory configuration, wherein the memory configuration assigns an MPU memory region with one or more memory sections to a start and an end address, a processor core, and an access right, comprising the following steps: - Providing an assignment of multiple virtual machines to the processor cores; - Providing, for each virtual machine or processor core, memory slices with a memory slice ID and an associated access right; - Combinatorial optimization with the aim of allocating a number of MPU memory regions to each of the processor cores as a memory configuration that does not exceed a predetermined maximum number, wherein the MPU memory regions have one or more memory section IDs that are assigned to a contiguous address range; and - Implementing the memory configurations in the memory protection units.

[0009] The memory protection unit enables or disables (allows or blocks) memory access to an MPU memory region by a corresponding processor core of a processor unit, each with different protection levels and access rights. Each processor core is assigned its own memory protection unit. The protection levels are divided into a hypervisor level, a supervisor level, and a user level. The hypervisor level defines the general access rights of the various virtual machines to the various memory segments. The access rights define execution access (EXECUTE), read / write access (READ / WRITE), read-only access (READ-ONLY), or access blocking. Each MPU memory region is defined by an ID, size, and a list of one or more memory sections.

[0010] The memory sections belonging to an MPU memory region for a processor core have consecutive addresses, so that the MPU memory region can be defined by a contiguous address range with a start and end address and is assigned to the same configuration parameter that determines the access right, such as read / write, execute and the like, and in particular can additionally specify memory attributes, such as memory type, cache setting, etc.

[0011] However, the number of possible MPU memory regions that can be defined for each processor core is limited in conventional memory protection units. For example, in known processor units, this number is 24 for each protection level. The number of required MPU memory regions per processor core increases for cross-domain virtual machines if they exchange data with each other, which requires memory sections in a shared memory area. Shared memory sections can have different access rights for different virtual machines or processor cores. As the number of virtual machines and shared memory blocks increases, the number of MPU memory regions that must be defined per processor core also increases.

[0012] A memory section is defined as a section with a fixed memory size and specified access rights (as a default). A memory area corresponds to an area consisting of one or more memory sections. A memory block corresponds to an address range of physical memory, while the MPU memory region represents a configuration specification for the corresponding processor core.

[0013] The allocation of memory sections to the virtual machines and to the MPU memory regions is currently performed manually, and depending on the configuration, it may be difficult to determine a memory allocation such that the number of MPU memory regions per processor core does not exceed the defined maximum number of MPU memory regions.

[0014] The optimal memory allocation is even more difficult to find if optimal utilization of the various memory blocks of the control unit with the processor unit, in particular an optimized data access time or the fastest execution, are objectives.

[0015] A microprocessor or microcontroller has multiple memory blocks. The "fastest execution" objective ensures that the memory sections belonging to very fast or critical software functions are assigned to memory blocks called "TCM (tightly coupled memory). Access times are then shorter because these TCM memories are directly accessible to the respective processor core.

[0016] Access to local memory blocks in the same domain as the processor core is somewhat slower. Additionally, a processor core can also access one or more memory blocks locally assigned to another processor core. Access times are longer here because the data must be transported across two local domain networks and a system network. Access to system memory (RAM) is also not as fast as access to memory blocks in the same domain. System memory (RAM) is best suited for data exchange between virtual machines because it allows all processor cores to access the same speed.

[0017] It can be provided that the memory section ID is also assigned to a respective memory type, with different memory types having different non-contiguous address ranges, such as TCM, local cluster RAM, local cluster NVM, OVLY, and system memory. The above method makes it possible to automatically generate configurations for the memory protection units and to perform optimal memory allocation for memory blocks of the various memory types for processor units with multiple processor cores. The configuration is determined using a combinatorial optimization method, which can be performed, for example, based on a genetic algorithm.

[0018] The main goal of optimization is to generate a memory allocation that achieves a minimum number of MPU memory regions per processor core and achieves load balancing for the memory sections of the memory blocks. Load here refers to the percentage of memory used. Load balancing evaluates the difference in the percentage of memory used between two similar memory types. This applies in particular to shared memory. Shared memory sections are memory sections to which different virtual machines can have access rights (EXECUTE, READ / WRITE, READ-ONLY) across different processor cores, allowing the virtual machines to exchange data with each other.Memory blocks from one or more memory sections that can be configured for memory sharing can therefore be used either as a shared memory block or as a memory block exclusive to the virtual machine.

[0019] Without a limit on the number of MPU memory regions, each memory section could be considered and allocated individually in the configuration. However, since the number is limited, memory sections used for the same processor core and with the same access rights can be grouped into one MPU memory region for the processor core. The same memory sections can be allocated for a different processor core in multiple MPU memory regions (if the access rights are different).

[0020] Based on the required memory sections, defined by size and access rights for the various virtual machines, the optimization method can provide a configuration for each of the processor cores that ensures a minimum or minimized number of MPU memory regions for each processor core and, in particular, a homogeneous utilization for all memory blocks. In particular, configurations in which the number of MPU memory regions per processor core exceeds a predetermined maximum number are avoided.

[0021] The starting point for optimization is a specified number of virtual machines that are to be executed in the processor unit. One or more processor cores of the processor unit are assigned to the virtual machines. Furthermore, the required memory sections are defined for each of the virtual machines, including a memory section ID (to identify the memory section in the virtual machine), size, memory type (in particular, volatile, non-volatile, fast-access, and the like), attributes such as cache settings, execution parameters, and the like, and access rights. The address assignments to the memory sections are to be performed by the optimization process.

[0022] The optimization method, which can be based on genetic algorithms, for example, generates one or more memory assignments of the memory section IDs to specific memory addresses. A specific memory configuration is determined for the memory protection unit for each processor core, so that the memory section IDs, each with the same access rights, are assigned to consecutive address ranges, thus defining the contiguous address range of an MPU memory region. The memory configuration specifies the start and end addresses in the available memory, the access rights, and other configuration attributes, such as cache, execution parameters, and the like, for each defined MPU memory region.

[0023] Thus, for each virtual machine, MPU memory regions with one or more memory sections can be defined with respect to the assigned processor cores, each required for a specific function of the virtual machine. Each MPU memory region can be assigned a specific access right that is uniform for the memory sections it contains. Memory sections can thus be combined into an MPU memory region for a virtual machine if they have the same access rights for the respective virtual machine or processor core. Short description of the drawings

[0024] Embodiments are explained in more detail below with reference to the attached drawings. They show: Fig. 1 a schematic representation of a control unit with a microcontroller with multiple processor cores and multiple memory blocks having multiple memory types; and Fig. 2 is a flowchart illustrating a method for determining an optimized memory configuration for a memory protection unit; Fig. 3 an exemplary list of memory sections, with their sizes and their access rights for multiple processor cores; and Fig. 4 an assignment of the memory sections to MPU memory regions. Description of embodiments

[0025] Fig. 1 schematically shows a control unit 1 for controlling multiple domains D1-D4 in a vehicle, such as a battery system, a steering system, driver assistance, and the like. Each of the domains D1-D4 is operated using a software function implemented in a virtual machine VM1-VM4, which is executed in a processor unit 2 of the control unit 1. Each of the virtual machines VM1-VM4 exclusively uses one or more processor cores 21, which are permanently assigned to the virtual machine VM1-VM4. All processor cores 21 can access a memory 22 with an address. The memory 22 can have memory blocks 221 with different memory types, such as TCM, local cluster RAM, local cluster NVM, OVLY, and system memory, each having separate, independent address ranges.

[0026] Memory access by processor cores 21 is controlled by a respective memory protection unit (MPU) 23, which monitors access by processor cores 21 to memory sections of memory 22. Each memory section defines an address range with a start and end address. Access is controlled according to a memory configuration in memory protection units 23. The memory configuration specifies in the respective memory protection unit 23 which MPU memory regions from one or more memory sections can be accessed by the respective associated processor core 21 and with which access rights. For example, the following table shows the required memory sections and memory types along with the access rights (2 for read / write access, 1 for read-only access, 3 for execution access, 0 for no access) for each of the processor cores P1 to P4.The required memory sections are identified by their memory section ID. Fig. 3 shows an exemplary list of memory sections SA , with their sizes S and their access rights ZR for the cores K1 - K4.

[0027] In Fig. 2 is a flowchart illustrating the method for optimizing the memory configuration of the memory protection unit 23 in a control unit.

[0028] In step S1, a corresponding list of memory sections, generally defined by the system requirements for functions of the various domains or virtual machines VM1-VM4, is created for each processor core, along with the corresponding access rights. The list of memory sections is determined by memory section IDs, whereby the memory sections are not yet assigned to a specific address range.

[0029] The memory sections defined in this way can be combined in different sequences for a processor core into an MPU memory region and assigned to a consecutive, contiguous address range. The address range is then defined by a start and end address.

[0030] At the end of the optimization process, each of the memory sections must be assigned a specific address range in the memory with the correspondingly specified access right for each of the processor cores 21 via the memory configuration, as shown in Fig. 4 is shown as an example.

[0031] This makes it possible to generate 22 MPU memory regions by permuting the memory sections (IDs) for the various tasks of a processor core or virtual machine within the entire available address range of the memory, each of which can be assigned an address range with consecutive addresses.

[0032] In step S2, the memory section IDs of all memory sections are therefore assigned to specific address ranges using an optimization method, with the aim of resulting in the smallest possible number of MPU memory regions for each of the processor cores 21, each with one or more memory sections in consecutive address ranges with the same access rights.

[0033] Once the optimization process is complete, in step S3, the MPU memory regions in the memory configuration are assigned to a specific contiguous address range and the corresponding access right. These then form an entry in the memory configuration that specifies a specific address range in the memory with a specified access right for a processor core 21.

[0034] The combinatorial optimization method enables combinatorially different assignments of memory section IDs for the virtual machines or the processor cores 21 to memory sections, so that a number of MPU memory regions with a continuous address range can be created, which can be assigned to a common access right. The number of MPU memory regions for each processor core 21 is to be reduced in this way. For optimization, combinations are tried out and improved according to an optimization method, wherein a cost function of the optimization method minimizes the number of memory allocations of MPU memory regions for each processor core 21 with the constraint that the maximum number of memory allocations for each processor core 21 must not be exceeded. As a further constraint, load distribution can be considered, such as distributing the loads across different memory blocks and the like.

[0035] The optimization procedure can be based on a genetic algorithm that uses the mutation and crossover tools to generate candidates for a new generation of permutations for the mapping of memory slice IDs for the virtual machines and processor cores to memory slices, respectively. The candidates each correspond to a memory configuration for all processor cores. The candidates are evaluated according to their fitness using the cost function, and the candidates with the highest fitness are given priority for generating the next generation of candidates.

Claims

[1] Computer-implemented method for creating a memory configuration for memory protection units (23) of a processor unit (2) with a plurality of processor cores (21), wherein the memory protection units (23) are each assigned to the processor cores (21) and are designed to allow or restrict memory access to a memory section by the corresponding processor core (21) according to an access right depending on the respective memory configuration, wherein the memory configuration assigns an MPU memory region with one or more memory sections to a start and an end address, a processor core (21) and an access right, comprising the following steps: - Providing an assignment of several virtual machines (VM1-VM4) to the processor cores (21); - Providing (S1) for each virtual machine (VM1-VM4) or each processor core (21), memory sections with a memory section ID and an associated access right; - Combinatorial (S2) optimization with the aim of allocating a number of MPU memory regions as the memory configuration for each of the processor cores (21) that does not exceed a predetermined maximum number, wherein the MPU memory regions have one or more memory section IDs that are assigned to a contiguous address range; - Implementing (S3) the corresponding memory configuration in the memory protection units (23). [2] The method of claim 1, wherein the memory section ID is also associated with a memory type, wherein different memory types have different non-contiguous address ranges. [3] The method of claim 1 or 2, wherein the memory configuration specifies a memory section for a shared memory accessible by multiple processor cores (21) of different virtual machines (VM1-VM4) with the same or different access rights. [4] The method of any one of claims 1 to 3, wherein the memory configuration further associates an MPU memory region with a configuration parameter specifying a memory type and a cache setting. [5] Method according to one of claims 1 to 4, wherein the combinatorial optimization method comprises a genetic algorithm. [6] Method according to one of claims 1 to 5, wherein the optimization method provides as a constraint a homogeneous utilization for all memory blocks. [7] Device, in particular a data processing device, for carrying out one of the methods according to one of claims 1 to 6. [8] Computer program product comprising instructions which, when the program is executed by at least one data processing device, cause the device to carry out the steps of the method according to one of claims 1 to 6. [9] Machine-readable storage medium comprising instructions which, when executed by at least one data processing device, cause the device to carry out the steps of the method according to one of claims 1 to 6.

Images