Method for monitoring the execution of a portion of program code and corresponding system-on-a-chip
The method addresses intrusive and latency-introducing issues in program execution monitoring by using a monitoring unit to track execution time within nominal ranges, ensuring robust and precise control of program code segments during startup and critical phases.
Patent Information
- Authority / Receiving Office
- FR · FR
- Patent Type
- Patents
- Current Assignee / Owner
- STMICROELECTRONICS (GRAND OUEST) SAS
- Filing Date
- 2022-04-26
- Publication Date
- 2026-04-17
Smart Images
Figure 00000022_0000 
Figure 00000023_0000 
Figure 00000023_0001
Abstract
Description
Title of the invention: Method for monitoring the execution of a portion of program code and corresponding system-on-a-chip
[0001] Embodiments and implementation methods relate to techniques for monitoring the execution of program code, for example, the execution of code contained in a memory address range by a processing unit of a system-on-chip.
[0002] Program execution monitoring techniques can serve a security purpose, in order to detect attempts to compromise secrets, typically employing fault injection techniques. When a fault is injected into a system, instructions are modified or not executed, but the processing unit continues to execute subsequent instructions in the code. This leads to uncontrolled operation and, under certain conditions, allows access to sensitive or secret information.In particular, these conditions may be just after startup, when the code is not fully initialized and operating system protections (such as memory access rights management mechanisms) are not in place; or during a critical operation, for example an operation with a maximum access right level, such as access rights scheduling operations or execution context changes (for example between secure and insecure contexts).
[0003] Program execution monitoring techniques can also serve a safety, or reliability, purpose, in order to detect malfunctions in program execution. Typically, coding rules are implemented in the program design to perform checks at strategic stages.
[0004] Conventional fault-injection techniques, such as flow control coding, function call duplication, function check actions uncorrelated with other functions, or the introduction of random loops to complicate fault injection reproduction, have the significant drawback of being highly intrusive in program code development, not applicable at startup, and introducing latency in the execution of critical program sections. Furthermore, some of these techniques can be countered by fault injections in unexpected parts of the program and by multiple fault injection techniques (which may exist only in theory but could be implemented in practice).
[0005] Thus there is a need, from a security and safety perspective, to propose techniques for monitoring the execution of a program code (or at least a selected part of the code), which are not or only slightly restrictive on the development of the monitored program code, which do not introduce latency or very little latency, which are applicable at the beginning of startup, and which do not allow or allow very little countermeasures to their actions.
[0006] According to one aspect, a monitoring method is proposed in this regard, implemented by a monitoring unit, for the execution of a selected portion of program code stored in a range of memory addresses between a start address and an end address, implemented by a processing unit using a program counter pointing to the address of an instruction executed by the processing unit (usually called a "program counter" in English). The monitoring method comprises: - a start of a timer when the program counter points to the starting address of said selected portion of code; - a comparison of the current program counter values with a set of target addresses specific to said selected code portion including the end address of said selected code portion; - a stop of the timing when the program counter points to the end address of said selected portion of code; - the generation of an error signal if the timing duration is outside a nominal duration range specific to the selected code segment.
[0007] In practice, timing corresponds, for example, to counting the number of clock signal cycles between the execution of the start address and the end address. The clock signal can, for example, in a simple case, be the clock signal that sets the execution time for the processing unit. By timing the number of cycles, it is possible to control the number of instructions executed. Indeed, each instruction costs a certain number of cycles, which can be defined for each processing unit architecture, and, for example, also for the peripheral architecture of the processing unit within a system-on-a-chip.Thus, the nominal duration range specific to the selected code segment corresponds to a successful execution, that is, without malfunction or uncontrolled operation, of the instructions associated with that code segment.
[0008] Furthermore, the monitoring unit uses only a reading of the program counter and knowledge of the nominal duration range specific to the selected code segment, and thus acts independently of code execution. Consequently, the method in this respect is perfectly suited, in particular, for an application at the beginning of startup, before the code is fully initialized. program and corresponding software protections. Furthermore, implementing the process in this respect does not impose any constraints on the writing of the monitored program code, and does not introduce any latency in the execution of the program code.
[0009] The monitoring unit can advantageously be configured in hardware to implement monitoring, and therefore in a way that is virtually impossible to corrupt or modify.
[0010] According to one embodiment, said selected code portion includes at least one function for calling, respectively, at least one second program code portion stored in a second memory address range between a second start address and a second end address, and the target address set specific to said selected code portion includes said at least one second start address, the monitoring method further comprising a call integration procedure when the program counter points to said second start address, the call integration procedure comprising: — a suspension of the timing; — a memorization of the suspended timing value; and — a resumption of the suspended timing, from the recorded value, when the program counter points to said second end address.
[0011] Consequently, the monitoring method is compatible with call functions that may be non-systematic and therefore not completely predictable during program development. The call integration procedure thus makes it possible to precisely control the number of instructions executed by the selected code segment, without being skewed by unforeseen instructions arising from the call.
[0012] Advantageously, the call integration procedure further includes, with the second code portion selected: - the starting step of another timing; - the step of comparing the current values of the program counter with another set of target addresses specific to said second portion of code selected; - the stopping stage of this other timing; - the error signal generation step with another range of nominal durations specific to said second selected code portion; and - where applicable, the procedure for integrating another call.
[0013] Thus, the monitoring method takes into account independently the implementation time of the first selected portion of code and the implementation time of a second selected portion of code called by the execution of the first portion of code, allowing more precise control of the number of instructions executed by each of the selected portions of code.
[0014] According to one embodiment, the nominal duration range is defined specifically for each portion of code as a function of a number of clock cycles of a nominal execution by the processing unit, and a delay caused by instruction retrieval from memory.
[0015] Indeed, as mentioned previously, each instruction in the selected portion of code takes a certain number of cycles to be executed depending on the architecture of the system-on-chip incorporating the processing unit, but also taking into account the time taken to retrieve instructions from a memory containing said instructions, again depending on the architecture and the actual performance of the system-on-chip.
[0016] According to one embodiment, the nominal duration range is automatically adjusted according to the activity of the processing unit communicated by at least one of the following parameters: the frequency of a clock signal timing the execution of the processing unit; an instruction admission event in cache memory; a data admission event in cache memory; a data eviction event in cache memory; a waiting state of the processing unit.
[0017] Thus, the monitoring process automatically adapts the range of nominal durations according to the actual performance in the context of a given execution, based on information signals communicated by the processing unit.
[0018] According to one embodiment, the timing is timed by a clock signal distinct from a clock signal timing the execution of the processing unit.
[0019] The monitoring unit can indeed be clocked by an independent clock signal, for example in order to always be clocked at an operational frequency for its configuration, even if the frequency of the clock signal clocking the processing unit is changed.
[0020] According to one implementation method, the selected portion of program code belongs to a start-up phase of execution by the processing unit, before access rights management protection mechanisms are effective, or belongs to a critical phase of execution by the processing unit having the most permissive access right.
[0021] According to another aspect, a method for manufacturing a system-on-chip adapted to implement the monitoring method as defined above is also proposed, comprising designing the program code including said selected portion of program code, then manufacturing the processing unit and the monitoring unit hardware configured in a manner adapted to the designed program code, and then recording the program code in a memory of the system-on-chip.
[0022] According to another aspect, a system-on-a-chip is also proposed comprising a processing unit configured to execute a portion of program code selected and stored in a memory address range, between a start address and an end address, and to generate a program counter pointing to the address of an executed instruction, and a monitoring unit configured to monitor the execution of the selected portion of program code, the monitoring unit comprising: - a comparator circuit configured to compare current program counter values with a set of target addresses specific to said selected code portion, including the end address of said selected code portion; - a counter circuit configured to start timing when the program counter points to the start address of said selected code portion and to stop timing when the program counter points to the end address of said selected code portion; - a decision circuit configured to generate an error signal if the timing duration is outside a nominal duration range specific to said selected portion of code.
[0023] According to one embodiment, said selected code portion comprises at least one function calling, respectively, at least one second program code portion stored in a second memory address range between a second start address and a second end address, and the target address set specific to said selected code portion comprises said at least one second start address, the monitoring unit, to accommodate the call, being configured to: — suspend said timing with the counter circuit; — to memorize the value of the suspended time; and — resume said suspended timing from the value recorded with the counter circuit when the program counter points to said second end address.
[0024] According to one embodiment, the monitoring unit, to take into account the call, is configured to set the comparator circuit, the counter circuit and the decision circuit, with the second code portion selected, and with a set of target addresses and a nominal duration range specific to the second code portion.
[0025] According to one embodiment, the decision circuit includes a record of a nominal duration range defined specifically for each portion of code as a function of a number of clock cycles of a nominal execution by the processing unit, and a delay caused by instruction retrieval from memory.
[0026] According to one embodiment, the decision circuit is configured to automatically adjust the nominal duration range according to the activity of the processing unit communicated by at least one of the following parameters: the frequency of a clock signal timing the execution of the processing unit; an instruction admission event in a cache memory; a data admission event in a cache memory; a data eviction event in a cache memory; a waiting state of the processing unit.
[0027] According to one embodiment, a clock generator is configured to generate a suitable clock signal to time the execution of the processing unit, the counter circuit being configured to generate a separate clock signal to time the timing.
[0028] According to one embodiment, an access rights management circuit is configured to operate an access rights management protection mechanism for instructions executed by the processing unit, the monitoring unit being configured to monitor the selected portion of program code belonging to a start-up phase of execution by the processing unit, before the access rights management protection mechanisms are operational, or belonging to a critical phase of execution by the processing unit having the most permissive access right.
[0029] Other advantages and features of the invention will become apparent upon examination of the detailed description of embodiments and implementations, which are by no means limiting, and the accompanying drawings, in which:
[0030] [Fig.1] ;
[0031] [Fig.2A] ;
[0032] [Fig.2B] ;
[0033] [Fig.2C] ;
[0034] [Fig.3A] ;
[0035] [Fig.3B];
[0036] [Fig.3C] ;
[0037] [Fig.3D] ;
[0038] [Fig.3E];
[0039] [Fig.3F] ;
[0040] [Fig.3G] illustrate embodiments and implementations of the invention.
[0041] Figure 1 illustrates an example of a system-on-a-chip (SOC) comprising a CPU configured to execute program code stored in MEM memory. The execution of the CPU is clocked by a clk clock signal generated by a PLL clock generator, for example, of the phase-locked loop type, dedicated to the CPU. The CPU is configured to use a PC program counter (usually called a "program counter" or sometimes an "instruction pointer") pointing to the address of the instruction executed by the CPU. The terms "pointer" and "Pointer" is used in its usual technical meanings, that is, a pointer of information is a computer object containing the address of the memory location that contains the information, and the verb to point means to designate information by the address of the memory location that contains the information.
[0042] The system-on-chip (SOC) may or may not be equipped with a cache memory device (CCH), for example, depending on the desired performance of the CPU and the SOC. The SOC advantageously includes an MMU / MPU access management circuit configured, in conjunction with the CPU, to implement an access rights management protection mechanism for instructions executed by the CPU. The MMU / MPU access rights management circuit may, for example, include a memory management unit (usually called a "memory management unit"), or alternatively, a memory protection unit (usually called a "memory protection unit") and optionally a secure attribution unit (usually called a "secure attribution unit").
[0043] The system on chip further comprises an SRV monitoring unit configured to monitor the execution of at least a portion of the selected program code (for example the Rst portion of [Fig.2A]) and stored in a memory address range (AddRst), i.e. between a start address and an end address.
[0044] The SRV monitoring unit is advantageously configured to monitor a portion of Rst code belonging to a CPU processing unit startup phase, such as the Rst reset phase described below in relation to [Fig. 2A], particularly before the access rights management protection mechanisms are operational. Also advantageously, the SRV monitoring unit is configured to monitor a portion of Rst code belonging to a critical operation performed by the processing unit with the most permissive access right, such as a configuration or context switching phase across different access right levels, for example, configurations of access rights assignments to memory regions (usually "mapping / unmapping"), cache flushing or invalidation operations between secure and insecure contexts.
[0045] For example, the SRV monitoring unit can be hardware-configured, that is, configured "hard-coded" (usually "hardware" in English), in a way that is suitable for the program code, in particular the program code for the system startup phase. Thus, the fabrication of the system-on-a-chip (SOC) includes, on the one hand, a design of the program code Intr, Rst, ProtSet, ProtChck, ClkSet, ClkEnLp ([Fig.2A]) including said portion of selected program code Rst. Then on the other hand the fabrication of the CPU processing unit and the SRV monitoring unit thus materially configured, and then a recording of the designed program code in the MEM memory of the system on chip SOC.
[0046] That being said, the SRV monitoring unit advantageously includes INTF_REG interface registers, adapted to receive Config configuration commands in order to reconfigure the SRV monitoring unit or to complete the configuration for new code areas.
[0047] For monitoring said portion of code Rst, the SRV monitoring unit includes a comparator circuit CMP, adapted to condition the implementation of the monitoring according to the address pointed to by the program counter PC; a counter circuit CNT, adapted to time the execution time of the monitored portion of program code; and a decision circuit DSC, adapted to generate an error signal Err if the timing does not correspond to a normal execution of the program code.
[0048] The comparator circuit CMP is configured to compare current program counter (PC) values, communicated by the CPU, with a set of target addresses TRGT specific to the selected code segment Rst, including the end address of the selected code segment e{Rst] ([Fig. 2B]). The sets of target addresses TRGT for each monitored code segment are, for example, contained in a register.
[0049] The CNT counter circuit is configured to start timing when the PC program counter points to the start address of said selected code portion s{Rst] ([Fig.2B]) and to stop timing when the PC program counter points to the end address of said selected code portion e{Rst] ( [Fig.2B]).
[0050] Timing corresponds, for example, in practice to counting the number of cycles of a clock signal between the execution of the start address and the end address. The clock signal used to time the CNT counter can, for example, be the clk clock signal intended for the CPU processing unit, or it can come from an internal ClkGen clock generator of the SRV monitoring unit configured to generate a separate clock signal.
[0051] The DSC decision circuit is configured to generate the error signal Err if the time measured by the timing device is outside a nominal time range NmnlRng specific to the selected code segment. The nominal time range NmnlRng advantageously takes into account the architecture and actual performance of the system-on-chip (SOC), for example, depending on the presence or absence of a cache memory device (CCH).
[0052] By counting the number of clock cycles elapsed between the start address and the end address, it is thus possible to control the number of instructions executed in the selected portion of code. Indeed, each instruction is executed over a certain number of cycles, known during the development of the program code, which may depend on the architecture of the system-on-chip (SoC) and the CPU processing unit.
[0053] The nominal duration range NmnlRng is thus specifically defined for each code segment as a function of the number of clock cycles of a nominal execution by the CPU processing unit. By "nominal execution" is meant a successful execution of this code segment, as intended in the program code design, that is to say, without any missing, additional, or different instructions than those intended, for example, in particular without malfunctions and especially without fault injection.
[0054] The nominal duration range NmnlRng specific to each selected code segment can also advantageously take into account the actual performance of the system-on-chip (SOC), in particular a delay caused by fetching FTCH instructions from MEM memory. Indeed, the time taken to fetch instructions from the MEM memory containing said instructions can depend on the architecture of the system-on-chip (SOC), for example, on the size of the MEM memory, the communication protocol used with the memory, the memory technology ("EEPROM", "Flash", "resistive memory", etc.), or whether the memory is internal or external to the CPU processing unit or even external to the system-on-chip (SOC).
[0055] Furthermore, the DCS decision circuit is advantageously configured to automatically adjust the nominal execution time range NmnlRng according to the CPU activity. CPU activity can depend on an operating mode, such as sleep mode, power-saving mode, or performance mode, but also on the availability of CCH cache memory locations, or even on a CPU standby state, for example, due to a conflict with another device on a shared memory access bus. Thus, CPU activity cannot be anticipated during program code development, but the effects of these different activity conditions on the nominal execution time of the selected code portion are known.Furthermore, these different conditions can be communicated to the SRV monitoring unit via signals generated by the CPU processing unit, in order to automatically adjust the nominal duration range NmnlRng to the actual conditions.
[0056] The activity of the CPU processing unit can be communicated to the SRV monitoring unit by at least one of the following parameters: the FreqSel frequency of the a clk clock signal timing the execution of the processing unit; an instruction admission event in a Cch_I cache memory, so that a future fetch of this instruction will be faster in terms of clock cycles; a data admission event in a Cch_D cache memory, so that a future fetch of this data will be faster in terms of clock cycles; a data eviction event in a Cch_Evct cache memory, so that a future fetch of this data will be slower in terms of clock cycles; a STALL wait state of the processing unit, during which the current instruction is not executed.
[0057] In practice, the CNT counter circuit and the DCS decision circuit can be combined into a single up-counter circuit initialized to a starting value corresponding to the number of clock cycles clk of the CPU processing unit, in the slowest case (for example, in the absence of cache memory). A proportionality factor can be applied to the starting value to account for the difference between the FreqSel frequency of the clk clock signal clocking the CPU processing unit and the frequency of the clock signal clocking the CNT count.
[0058] At each clock cycle, the count value is decremented. In the event of an instruction being admitted to cache memory Cch_I, the count value is reduced by an amount corresponding to the gain, in number of clock cycles, for retrieving the instruction from cache memory. In the event of a data being admitted to cache memory Cch_D, the count value is reduced by an amount corresponding to the gain, in number of clock cycles, for retrieving the data from cache memory. In the event of a data being evicted from cache memory Cch_Evct, the count value is increased by an amount corresponding to the loss, in number of clock cycles, for retrieving the data from MEM memory.
[0059] When the value of the count is equal to zero, the error signal Err is generated.
[0060] When the PC program counter points to the end address "e" and the count value is equal to zero, the Err error signal is not generated; whereas when the PC program counter points to the end address "e", and the count value is greater than zero, the Err error signal is generated.
[0061] Alternatively, when the PC program counter points to the end address "e" and the count value is between zero and a tolerance threshold, the Err error signal is not generated; whereas when the PC program counter points to the end address "e", and the count value is greater than said tolerance threshold, the Err error signal is generated.
[0062] On the other hand, the monitoring unit can take into account possible call functions, in the selected portion of program code, to another portion of Program code. Indeed, the execution of a calling function results in the execution of program code contained outside the AddRst memory address range ([Fig. 2A]), in a way that is not necessarily predictable. This could potentially skew the count of instructions in a nominal execution (NmnlRng) compared to the measured timing. This is also the case for executions resulting from interrupts ([Fig. 2A]), which can occur at any time during the execution of a given portion of code and are typically unpredictable.
[0063] Reference is made in this regard to figures 2A, 2B and 2C.
[0064] Fig. 2A schematically illustrates a mapping (usually "mapping" in English, or "mapping" according to a common anglicism in French) of the MEM memory containing the program code, and containing in particular the selected program code portion Rst, as well as other code portions that can be called by CLL calling functions.
[0065] The selected portion of code is, for example, a reset procedure (usually "reset" in English) Rst, typically implemented during the early stages of booting or restarting the system on chip SOC.
[0066] The reset code portion Rst is stored in a memory address range AddRst located between a start address "s" and an end address "e".
[0067] In this example, the reset code portion Rst can call CLL: a protection setting code portion ProtSet stored in another memory address range AddProtSet between a start address "s" and an end address "e"; a protection checking code portion ProtChck stored in another memory address range AddProtChck between a start address "s" and an end address "e"; and a clock modification code portion ClkSet, for example to change the frequency of the CPU processing unit's clk clock signal, stored in another memory address range AddClkSet between a start address "s" and an end address "e".
[0068] The clock modification code portion ClkSet can, in turn, call CLL{ClkEnLp] a clock activation loop code portion, stored in another memory address range AddClkEnLp between a start address "s" and an end address "e".
[0069] Finally, all code portions Rst, ProtSet, ProtChck, ClkSet, ClkEnLp can call an Intr interrupt, for example a "Tick" interrupt used to provide real-time information, stored in another memory address range Addlntr between a start address "s" and an end address "e". Furthermore, the handling of the Intr interrupt can include a context switch CntxSw before and after its execution, for example, to go from a secure context to an insecure context, and then back to the secure context from the insecure context. secure. CntxSw context switching operations can be included in the monitoring performed by the SRV monitoring unit or possibly not if these operations are otherwise protected by other reliable mechanisms.
[0070] The start and end addresses are all referenced respectively as "s" and "e" but are of course different from one address range to another.
[0071] Reference is now made to [Fig.2B].
[0072] An incoming call integration procedure is advantageously implemented to precisely control the number of instructions executed by the first selected code segment Rst, without being skewed by instructions originating from the incoming call. Furthermore, the incoming call integration procedure allows for precise control of the number of instructions executed by a second code segment called, for example, ClkSet, as the selected code segment.
[0073] When the PC program counter points to one of said second start addresses "s", the call integration procedure includes a suspension of the timing of the execution of the selected code portion; a memorization of the value of the suspended timing; and a resumption of the suspended timing from the recorded value, when the PC program counter points to the corresponding second end address "e", that is, when the execution of the called code portion is completed, no error is detected, and the execution of the selected code portion resumes.
[0074] In this regard, the set of target addresses TRGT{Rst] specific to the selected reset code portion Rst includes, in addition to the end address of the selected code portion e{Rst], "second" start addresses s{Intr], s{ProtSet], s{ProtChck], s{ClkSet} of code portions that can be called Intr, ProtSet, ProtChck, ClkSet, during the execution of the reset code portion Rst.
[0075] Thus, for example in the execution of the initialization code portion Rst, when the CLL{ClkSet] call of the second clock modification code portion ClkSet is made, the program counter PC points to the second start address s{ClkSet} of this second code portion and the timing of the reset code portion Rst is suspended so that its current value is maintained in the counter or recorded.
[0076] The second portion of code called, that is to say the ClkSet clock modification portion of code, is executed and can also be controlled by the monitoring method implemented by the SRV monitoring unit.
[0077] Reference is made in this regard to [Fig.2C].
[0078] The second clock modification code portion ClkSet is executed, and, with the clock modification code portion ClkSet selected, the monitoring method is implemented in the same way as described above. previously related to [Fig. 1], with the following steps: - a start of another timing when the PC program counter points to the start address of said portion of clock modification code s{ClkSet}; - a continuous comparison of the current values of the PC program counter with a set of target addresses specific to the second clock modification code portion TRGT{ClkSet} comprising the end address of said clock modification code portion e{ClkSet}, as well as the possible start addresses s{Intr}, s{ClkEnLp} of the other Intr, ClkEnLp code portions, which can be called CLL by the clock modification code portion ClkSet; - a possible call integration procedure as described in relation to figures 2B and 2C; - a stop of this other timing when the PC program counter points to the end address of the clock modification code portion e{ ClkSet}; and - a generation of the error signal Err if the duration of this other timing is outside a nominal duration range NmnlRng specific to the second code portion ClkSet.
[0079] After the end address of the clock modification code portion e{ ClkSet}, the program counter points to the return address of the first reset code portion Rst, and the monitoring process resumes for the first reset code portion Rst, from the suspended timing count and with in particular with the target address set TRGT{Rst} and the nominal duration range NmnlRng specific to the reset code portion Rst.
[0080] Therefore, since the monitoring method is applied independently to the first selected code portion Rst and to the second code portion called ClkSet, the control of the quantity of instructions executed is more precise for each of the selected code portions Rst, ClkSet.
[0081] Figures 3A to 3G illustrate examples of implementing the execution of the program code described above in relation to Figures 2A to 2C, in a time-domain representation where time advances from left to right. Although the start and end addresses of code segments are marked respectively by "s" and "e", the start and end points of the execution of each code segment "X" will be denoted "s{X}" and "e{X}".
[0082] Fig. 3A illustrates an example of correct execution of the reset code portion and its calls.
[0083] The monitoring process begins when the instruction located at the start address s{Rst} of the reset code portion Rst is executed.
[0084] The clock modification code portion ClkSet is called and starts at the mark s{ClkSet}, monitoring of the reset program Rst is suspended and the monitoring process is implemented for the execution of the ClkSet clock modification code.
[0085] The clock activation loop code portion ClkEnLp is called and begins at the mark s{ClkEnLp}, monitoring of the clock modification program ClkSet is suspended, and the monitoring process is implemented for the clock activation loop ClkEnLp. The clock activation loop code portion ClkEnLp has no call function and terminates at the end mark e{ClkEnLp}. If the timed duration in the monitoring of the clock activation loop code portion ClkEnLp is within the respective nominal duration range NmnlRng, then the error signal Err is not generated.
[0086] Monitoring resumes for the clock modification code portion ClkSet, executed up to the end mark e{ClkSet}, and the error signal Err is not generated if the timed duration is located within the respective nominal duration range NmnlRng.
[0087] Execution and monitoring of the reset code portion Rst resume.
[0088] The protection verification code portion ProtChck is called and begins at the mark s{ProtChck}, monitoring of the reset program Rst is suspended, and the monitoring process is implemented for the execution of the protection verification ProtChck. The protection verification code portion ProtChck has no call function and continues until the end mark e{ProtChck}. The error signal Err is not generated if the timed duration is within the respective nominal duration range NmnlRng.
[0089] Execution and monitoring of the Rst reset code portion resume.
[0090] The portion of code for setting up ProtSet protections is called and begins At the s{ProtSet} mark, monitoring of the reset program Rst is suspended, and the monitoring process is implemented for the execution of the ProtSet protection implementation. The ProtSet protection implementation code portion has no call function and continues until the end mark e{ProtSet}. The Err error signal is not generated if the timed duration falls within the respective nominal duration range NmnlRng.
[0091] Execution and monitoring of the reset code portion Rst resume.
[0092] The interrupt code portion Intr is called and begins at the mark s{Intr}, monitoring of the reset program Rst is suspended, and the monitoring process is implemented for the execution of the interrupt Intr. The interrupt code portion Intr has no call function and continues until the end mark e{Intr}. The error signal Err is not generated if the timed duration is within the respective nominal duration range NmnlRng.
[0093] Execution and monitoring of the Rst reset code portion resume, up to the end mark e{Rst}, and the error signal Err is not generated if the cumulative timed duration is located within the respective nominal duration range NmnlRng.
[0094] Figure 3B illustrates another example of correct execution of the reset code portion and its calls, in which the ClkEnLp clock activation loop code portion is repeated several times in series. This can be the case in practice, for example, when setting up a phase-locked loop.
[0095] Since the method for monitoring the execution of the ClkSet code that called the ClkEnLp clock activation loop is suspended during successive executions of the ClkEnLp clock activation loop, the repetition of this code portion does not affect the monitoring of other code portions. Furthermore, each execution of the ClkEnLp clock activation loop is monitored independently of the others in the series, between each marker s{ClkEnLp} and e{ClkEnLp], and thus the number of repetitions in the series is not constrained in advance.
[0096] Fig. 3C illustrates an example of incorrect execution of the Rst reset code portion and its calls.
[0097] In this example, the code portions are executed correctly, within the respective nominal duration ranges NmnlRng, until the resumption of the execution of the reset code Rst after the end e{ProtChck] of the ProtChck protection verification code portion.
[0098] Indeed, in this example, the execution of the reset code portion Rst terminates at this point, which prematurely stops the timing of the monitoring process for this code portion Rst. In this case, the timing duration is less than the respective nominal duration range NmnlRng, and the error signal Err is generated.
[0099] Fig. 3D illustrates another example of incorrect execution of the Rst reset code portion and its calls.
[0100] In this example, the code portions are executed correctly, within the respective nominal duration ranges NmnlRng, until the resumption of the execution of the reset code Rst after the end e{ ProtChck] of the protection verification code portion ProtChck.
[0101] Indeed, in this example, the execution of the reset code portion Rst does not terminate normally and continues longer than expected. Consequently, the timing reaches a value exceeding the respective nominal duration range NmnlRng, and the error signal Err is generated.
[0102] Fig. 3E illustrates another example of incorrect execution of the Rst reset code portion and its calls.
[0103] In this example, the execution of the interrupt code portion Intr does not terminate normally and continues longer than expected. As a result, the timing reaches a value exceeding the respective nominal duration range NmnlRng, and the error signal Err is generated.
[0104] Fig. 3F illustrates another example of incorrect execution of the Rst reset code portion and its calls.
[0105] In this example, the execution of the portion of code that verifies the ProtChck protections does not complete normally and continues for longer than expected. As a result, the timing reaches a value exceeding the respective nominal duration range NmnlRng, and the error signal Err is generated.
[0106] Fig. 3G illustrates another example of incorrect execution of the Rst reset code portion and its calls.
[0107] In this example, it is the execution of the portion of the protection setting-up code ProtSet which terminates e{Rst] ahead of schedule, which stops the timing at a value below the respective nominal duration range NmnlRng, and the error signal Err is generated.
Claims
Demands
1. Method of manufacturing a system on chip (SOC) adapted to implement a monitoring method implemented by a monitoring unit (SRV), of an execution of a selected portion of program code (Rst) and stored in a range of memory addresses (AddRst) between a start address (s) and an end address (e), implemented by a processing unit (CPU) using a program counter (PC) pointing to the address of an instruction executed by the processing unit, the monitoring method comprising: - starting a timing (CNT) when the program counter (PC) points to the start address of said selected portion of code (s{Rst}); - a comparison (CMP) of the current program counter (PC) values with a set of target addresses specific to said selected code portion (TRGT{Rst}) including the end address of said selected code portion (e{Rst}); - a stop of the timing (CNT) when the program counter (PC) points to the end address of said selected code portion (e{Rst}); - generation of an error signal (Err) if the timing duration is outside a nominal duration range (NmnlRng) specific to said selected code portion (Rst); the process of manufacturing the system on chip (SOC) comprising designing the program code (Intr, Rst, ProtSet, ProtChck, ClkSet, ClkEnLp) including said selected portion of program code (Rst), then manufacturing the processing unit (CPU) and the monitoring unit (SRV) hardware configured to suit the designed program code (Intr, ..., ClkEnLp), then recording the program code into a memory (MEM) of the system on chip (SOC).
2. A method according to claim 1, wherein said selected code portion (Rst) comprises at least one calling function (CLL{ClkSet}) of, respectively, at least one second program code portion (ClkSet) stored in a second memory address range (AddClkSet) between a second start address (s) and a second end address (e), and the target address set specific to said selected code portion (TRGT{Rst}) comprises said at least one second start address (s{ClkSet}), the method monitoring further comprising a call integration procedure when the program counter (PC) points to said second start address (s{ClkSet}), the call integration procedure comprising: — a suspension of the timing (CNT); — a storage of the suspended timing value; and — a resumption of the suspended timing (CNT) from the stored value when the program counter (PC) points to said second end address (e).
3. A method according to claim 2, wherein the call integration procedure further comprises, with the second code portion selected (ClkSet): - the step of starting another timing (CNT); - the step of comparing (CMP) the current program counter (PC) values with another set of target addresses specific to said second selected code portion (TRGT{ClkSet}); - the step of stopping this other timing (CNT); - the step of generating the error signal (Err) with another nominal duration range (NmnlRng) specific to said second selected code portion (ClkSet); and - where applicable, the procedure for integrating another call (CLL{ClkEnLp}).
4. A method according to any one of the preceding claims, wherein the nominal duration range (NmnlRng) is defined specifically for each code portion (Rst, ClkSet) as a function of a number of clock cycles of a nominal execution by the processing unit (CPU), and a delay caused by instruction fetching from memory (FTCH).
5. A method according to any one of the preceding claims, wherein the nominal duration range (NmnlRng) is automatically adjusted according to the activity of the processing unit (CPU) communicated by at least one of the following parameters: the frequency of a clock signal (FreqSel) timing the execution of the processing unit; an instruction admission event into cache memory (Cch_I); a data admission event into cache memory (Cch_D); a data eviction event into cache memory (Cch_Evct); a standby state of the processing unit (STALL).
6. A method according to any one of the preceding claims, wherein the timing (CNT) is timed by a separate clock signal (ClkGen) of a clock signal (clk) timing the execution of the processing unit (CPU).
7. A method according to any one of the preceding claims, wherein the selected program code portion (Rst) belongs to a startup phase of execution by the processing unit (CPU), before access rights management (MMU / MPU) protection mechanisms are effective, or belongs to a critical phase of execution by the processing unit having the most permissive access right.
8. System on chip (SOC) comprising a processing unit (CPU) configured to execute a selected portion of program code (Rst) stored in a memory address range (AddRst), between a start address (s) and an end address (e), and to generate a program counter (PC) pointing to the address of an executed instruction, and a monitoring unit (SRV) configured in hardware to monitor the execution of the selected portion of program code (Rst), the monitoring unit (SRV) comprising: - a comparator circuit (CMP) configured to compare current values of the program counter (PC) with a set of target addresses (TRGT) specific to said selected portion of code (Rst) comprising the end address of said selected portion of code (e{Rst});- a counter circuit (CNT) configured to start timing when the program counter (PC) points to the start address of said selected code portion (s{Rst}) and to stop timing when the program counter (PC) points to the end address of said selected code portion (e{Rst}); - a decision circuit (DSC) configured to generate an error signal (Err) if the timing duration is outside a nominal duration range (NmnlRng) specific to said selected code portion.
9. System-on-chip according to claim 8, wherein said selected code portion (Rst) comprises at least one call function (CLL) of, respectively, at least one second program code portion (ClkSet) stored in a second memory address range (AddClkSet) between a second start address (s) and a second end address (e), and the target address set (TRGT{Rst}) specific to said selected code portion comprises said at least one second start address (s{ClkSet}), the watchdog unit (SRV), to accommodate the call (CLL), being configured to: — suspend said timing with the counter circuit (CNT); — store the value of the suspended timing; and — resume said suspended timing from the value recorded with the counter circuit (CNT) when the program counter (PC) points to said second end address (e).
10. System on chip according to claim 9, wherein the monitoring unit (SRV), to take into account the call (CLL), is configured to parameterize the comparator circuit (CMP), the counter circuit (CNT) and the decision circuit (DCS), with the second code portion (ClkSet) selected, and with a set of target addresses (TRGT{ ClkSet}) and a nominal duration range (NmnlRng) specific to the second code portion (ClkSet).
11. System on chip according to any one of claims 8 to 10, wherein the decision circuit (DCS) includes a record of a nominal duration range (NmnlRng) defined specifically for each portion of code (Rst; ClkSet) as a function of a number of clock cycles of a nominal execution by the processing unit (CPU), and a delay caused by instruction fetching from memory (FTCH).
12. System on chip according to any one of claims 8 to 11, wherein the decision circuit (DCS) is configured to automatically adjust the nominal duration range (NmnlRng) as a function of the processing unit (CPU) activity communicated by at least one of the following parameters: the frequency of a clock signal (FreqSel) timing the execution of the processing unit; an instruction admission event into a cache memory (Cch_I); a data admission event into a cache memory (Cch_D); a data eviction event into a cache memory (Cch_Evct); a processing unit standby state (STALL).
13. System on chip according to any one of claims 8 to 12, wherein a clock generator (PLL) is configured to generate a clock signal suitable for timing the execution of the processing unit (CPU), the counter circuit (CNT) being configured to generate a separate clock signal for timing the timing (ClkGen).
14. System-on-chip according to any one of claims 8 to 13, wherein an access rights management circuit (MMU / MPU) is configured to operate an access rights management protection mechanism for instructions executed by the processing unit (CPU), the super- surveillance (SRV) being configured to monitor the selected portion of program code (Rst) belonging to a startup phase of execution by the processing unit (CPU), before the access rights management protection mechanisms are operational, or belonging to a critical phase of execution by the processing unit with the most permissive access right.