Method for selecting startup programs

Abstract

Method for selecting boot programs. This description relates to a method for selecting boot programs (init, boot1) each contained in two separate storage memories of a microprocessor (100), in which an option register (NoTZIsolation), read first during a reset of said microprocessor, conditions the selection of one of said boot programs. Figure for the abstract: Fig. 3

Description

Title of the invention: Method for selecting startup programs Technical field

[0001] The present description relates generally to methods for selecting startup programs in microprocessors, as well as to microprocessors implementing such methods. Prior art

[0002] Many electronic circuits such as microcontrollers including systems on chip (SOC) include an architecture which allows the level of security of the resources and memories which are used by the applications implemented in these circuits to be chosen.

[0003] However, some architectures do not allow, as a rule, to choose between several levels of security. Summary

[0004] There is a need to provide methods for enabling a choice between several levels of security in a circuit having an architecture that does not, as a rule, enable a choice between several levels of security.

[0005] One embodiment overcomes all or part of the drawbacks of the known methods.

[0006] One embodiment provides a method for selecting startup programs each contained in two separate storage memories of a microprocessor in which an option register read first during a reset of said microprocessor conditions the selection of one of said startup programs.

[0007] In one embodiment, a first boot program is contained in a user memory and a second boot program is contained in a system memory.

[0008] In one embodiment, upon initialization of the system, when said option register has a first value, the first startup program is selected.

[0009] In one embodiment, upon initialization of the system, when said option register has another value, the second startup program is selected.

[0010] In one embodiment, the first boot program, when selected, is configured to modify a value of a second register representative of the size of a prohibited access region of the system memory containing the second boot program, such that said second boot program is not accessible.

[0011] In one embodiment, the first boot program, when selected selected, is configured to modify a value of the second register representative of the size of a prohibited access region of the system memory containing the second boot program and a third boot program, such that said second and third boot programs are not accessible.

[0012] In one embodiment, the value of the second register can only be incremented.

[0013] In one embodiment, the modification of said value of the second register consists of an increase greater than one bit.

[0014] In one embodiment, at least one application is executable from user memory after the first startup program is selected.

[0015] In one embodiment, the first boot program, when selected, implements a configuration of the microprocessor to be in a secure mode where, when an unsecured transaction requires access to a secure resource of the microprocessor, then an error is returned.

[0016] In one embodiment, the first boot program, when selected, implements a configuration of the microprocessor to be in a secure mode where, when a secure transaction requires access to an unsecured resource of the microprocessor, then an error is returned.

[0017] In one embodiment, the first boot program, when selected, allows the implementation of a debug function authorized to access one or more regions of the memory corresponding to a value of the second register containing the second boot program and the third boot program.

[0018] In one embodiment, the user memory is a non-volatile memory or a RAM-type memory.

[0019] In one embodiment, several applications are executable from user memory after using the first startup program and each of these applications is in the same security mode.

[0020] One embodiment provides a microprocessor, comprising a system memory and a user memory, and configured to implement a method as described above. Brief description of the drawings

[0021] These characteristics and advantages, as well as others, will be explained in detail in the following description of particular embodiments given without limitation in relation to the attached figures among which:

[0022] [Fig.l] represents, very schematically and in the form of blocks, an example of an integrated circuit of the type to which the described embodiments apply;

[0023] [Fig.2] illustrates an embodiment of a method for selecting startup programs for the circuit of [Fig.l]; and

[0024] [Fig.3] illustrates another mode of implementation of a method for selecting startup programs of the circuit of [Fig.l]. Description of the embodiments

[0025] The same elements have been designated by the same references in the different figures. In particular, the structural and / or functional elements common to the different embodiments may have the same references and may have identical structural, dimensional and material properties.

[0026] For the sake of clarity, only the steps and elements useful for understanding the described embodiments have been shown and are detailed.

[0027] Unless otherwise specified, when referring to two elements connected to each other, this means directly connected without intermediate elements other than conductors, and when referring to two elements connected (in English "coupled") to each other, this means that these two elements can be connected or be connected by means of one or more other elements.

[0028] In the following description, when reference is made to absolute position qualifiers, such as the terms "front", "back", "top", "bottom", "left", "right", etc., or relative position qualifiers, such as the terms "above", "below", "upper", "lower", etc., or to orientation qualifiers, such as the terms "horizontal", "vertical", etc., reference is made unless otherwise specified to the orientation of the figures.

[0029] Unless otherwise specified, the expressions "about", "approximately", "substantially", and "of the order of" mean to within 10%, preferably to within 5%.

[0030] [Fig.l] represents, very schematically and in the form of blocks, an example of an electronic circuit 100 of the type to which the described embodiments apply.

[0031] The circuit 100 comprises a non-volatile memory 104 (FLASH MEMORY), for example of the FLASH memory type, capable of communicating, via a communication bus 114, with a non-volatile memory interface 106 (FLASH INTERFACE) configured to write or read data in and from the non-volatile memory 104. In one example, system programs and / or applications, such as startup programs, are implemented in the memory 104.

[0032] The circuit 100 further comprises, for example, a processing unit 110 (CPU) comprising one or more processors under control of instructions stored in a system instruction memory 112 (INSTR MEM). The instruction memory 112 is for example a volatile memory of the random access type (Random Access Memory, RAM). The processing unit 110 and the memory 112 communicate, for example, via a system bus 140 (data, address and control). The FLASH memory 104 is connected to the system bus 140 via the non-volatile memory interface 106 and via the bus 114. The device 100 further comprises an input / output interface 108 (FO interface) connected to the system bus 140 for communicating with the outside.

[0033] The circuit 100 further comprises, for example, another memory 120 (USER MEM) of non-volatile type or RAM type. This memory 120 is connected to the system bus 140 directly or via a memory interface (not shown) whose role is, for example, similar to the interface 106.

[0034] The device 100 may integrate other circuits implementing other functions (for example, one or more volatile and / or non-volatile memories, other processing units), symbolized by a block 116 (FCT) in [Fig.l]. Among these other circuits, the circuit 100 comprises for example a read-only or static memory 118 (ROM).

[0035] One or more startup programs of the circuit are for example transferred directly to the memory 104 during factory programming processes. The startup program(s) must not be modified once transferred to flash memory 104, except by resetting the circuit 100. To do this, provision is made to lock access to the area of ​​the flash memory containing the startup program so that it is impossible to access it without restarting. This is done for example by implementing a register (HDPL), for example monotonically increasing, the value of which is representative of the size of a prohibited access region of the memory containing the startup program(s), so that the startup program(s) is / are not accessible. For example, when the value of the HDPL register is 1, the startup program which is located in a region of the memory associated with the value 1 can be executed.After execution, the HDPL value is incremented to 2, which prohibits access to the boot program located in the memory region associated with the value 2. If a second boot program has been loaded into memory in sectors between HDPL 1 and HDPL2, then it can be executed and then the HDPL value is incremented to 3, which prohibits access to both boot programs located in the memory regions associated with the value 1 and 2. Applications are then, for example, implemented in the memory without having the same level of access restriction.

[0036] In certain architectures, such as those of the ARM® v8M or ARM® CORTEX® M33 type, by selecting an option during development, the resources or memories of the circuit but also certain programs can be partitioned with different security levels. This mechanism is called in these examples "Trustzone". A first level of security (secure in English) is for example implemented by establishing that, when an unsecured transaction requires access to a secure resource of the microprocessor, then an error is returned for example on bus 140 and when a secure transaction requires access to a non-secure resource of the microprocessor, then an error is also returned. The rest of the circuit and / or programs is then for example implemented with less strict security principles where for example programs having a security level lower than the first level can access only the non-secure resources and memories of the circuit 100.

[0037] In some architectures, such as those of the ARM® CORTEX® M85 type, there are no options to choose whether or not to partition the resources, memories and programs of the circuit with different security levels. In these architectures, only the high security level is made available. In other words, in these architectures, the "Trustzone" mechanism cannot be natively deactivated. There is therefore a basic isolation (called for example TZIsolation) between resources, memories or programs having the first security level and a less secure mode. This can pose problems for easily developing applications that do not require implementing security isolation, such as for example the "Trustzone" mechanism, or that simply do not even need to be secured.

[0038] The embodiments described provide for implementing a method for selecting startup programs each contained in two separate storage memories of the microprocessor in which an option register read first during a reset of said microprocessor conditions the selection of one of said startup programs.

[0039] This makes it possible to avoid, for example, the systematic implementation of a system for partitioning resources, memories or programs between several security levels. It is thus possible to obtain a single security level or to generate a single security level for all the resources, memories and programs used.

[0040] This also makes it possible to obtain a software solution that facilitates the development of applications that do not require a high level of security. Such a mode is, for example, known as "legacy".

[0041] Since there are no hardware modifications and no modifications to the code embedded natively on the circuit to implement the described embodiments, this does not introduce additional security vulnerabilities.

[0042] [Fig.2] illustrates an embodiment of a method for selecting startup programs for the circuit of [Fig.l].

[0043] In a first step 202 (START), the method starts. This step corresponds for example to a reset of the circuit 100.

[0044] In a second step 204 (Check NoTZIsolation register value), a register NoTZIsolation is read before any boot programs are executed. For example, if the value of the NoTZIsolation register=0, then step 206 (Launch bootl / 2 program) is executed, and if, for example, NoTZIsolation=l, then step 208 (Launch init function) is executed.

[0045] In step 206, a bootl startup program is implemented from a system memory of the circuit 100. The system memory is for example the FLASH memory 104 or the memory 112. This bootl startup program allows for example the implementation of a partition between the resources or memories of the circuit but also certain programs with different security levels as is the case for example for the “Trustzone” mode of the ARM® brand.

[0046] In step 208, another startup program, also called initialization function (init), is implemented from a user memory which is for example memory 120.

[0047] In one example, the initialization function init is configured to modify a value of the HDPL register representative of the size of the forbidden access region of the system memory containing the bootl startup program, so that the bootl startup program, and any other startup programs located just after in the system memory, are not accessible or executed before the implementation of the init startup program. When there is only the bootl startup program in the system memory, the modification of the value of the HDPL register, by the init initialization function, consists of an increase in the HDPL value by one bit, for example, to go from 1 to 2. The HDPL register being, for example, monotonically increasing, this allows the bootl startup program not to be implemented because its access is no longer possible.When there is, for example, a boot2 boot program in addition to the bootl boot program in the system memory, the modification of the value of the HDPL register, by the init initialization function, consists of an increase in the HDPL value greater than one bit. HDPL then goes for example from 1 to 3 which allows that none of the bootl and boot2 boot programs are implemented because their access is no longer possible. Only the init initialization function is implemented as a boot program which makes it possible to avoid, for example, the systematic implementation of a system for partitioning resources, memories or programs between several security levels.Using the init initialization function, it is possible to obtain a single security level or generate a single security level for all resources, memories and programs used by applications developed that use the init initialization function.

[0048] In one example, the init boot program, when selected, implements a configuration of the microprocessor to be in a safe mode. rization where, when a non-secure transaction requires access to a secure resource of the microprocessor, then an error is returned on the 140 bus for example.

[0049] In another example, when the init boot program is selected, it implements a configuration of the microprocessor to be in a secure mode where, when a secure transaction requires access to an unsecured resource of the microprocessor, then an error is returned.

[0050] [Fig.3] illustrates another mode of implementation of a method for selecting startup programs of the circuit of [Fig.l].

[0051] More particularly, the illustrated example describes the user memory, implemented for example by the memory 120, and the system memory, for example implemented with one of the memories 104 or 112.

[0052] In the example shown, two successive boot programs bootl and boot2 have been previously loaded into the system memory and the initialization function init is present in the user memory 120 or loaded during a reset of the circuit 100.

[0053] When resetting the circuit 100, and as in the example shown, the value of the NoTZIsolation register is read at 1 (NoTZIsolation=1) and this before the bootl and boot2 programs are implemented.

[0054] At the Reset reset, the processing unit 110 will start by executing, possibly by loading it beforehand, the initialization function init which is therefore first implemented. This function changes the value of the HDPL register from 1 to 3 to prevent the implementation, for example the execution, of the bootl and boot2 startup programs which could have established a partitioning in terms of security levels of the resources, memories and programs.

[0055] The initialization function init configures for example the circuit 100 in a security mode where the resources, application memories and programs have the same security level, that is to say without partitioning with several security levels.

[0056] One or more applications 320 (Appli NoTZIsolation) are then executed with the security level established by the init initialization function.

[0057] In one example, the initialization function init, when selected, allows the implementation of a debugging function authorized to access one or more regions of the user memory 120 and / or the system memory 104, 112. This debugging function may, for example, however be limited to applications on memory sectors corresponding to a value of the HDPL register greater than or equal to 2 if only bootl is present or greater than or equal to 3 if bootl and boot2 are present for example.

[0058] When, during the Reset of the circuit 100, the value of the NoTZL isolation register is read at 0 (NoTZIsolation=0), then the bootl and boot2 programs are implemented without the init initialization function being implemented.

[0059] Depending on the value of the NoTZIsolation register, different boot programs init, bootl / boot2 can therefore be executed. A different security architecture can therefore be proposed depending on this value read at Reset.

[0060] Various embodiments and variations have been described. Those skilled in the art will understand that certain features of these various embodiments and variations could be combined, and other variations will occur to those skilled in the art.

[0061] Finally, the practical implementation of the described embodiments and variants is within the reach of the person skilled in the art from the functional indications given above. In particular, as regards the user memory, the person skilled in the art can implement it for example in a dedicated region of the memory 104 which is different and isolated from the region dedicated to the bootl startup program. Furthermore, even if the described examples mention the modification of the HDPL register to implement the init initialization function without bootl and / or boot2 being implemented, the person skilled in the art will be able to implement any similar mechanism, making it possible to prevent the implementation of bootl / boot2 startup programs after the launch of the init initialization function.

Claims

Claims

1. Method for selecting startup programs (init, bootl) each contained in two separate storage memories of a microprocessor (100) in which an option register (NoTZIsolation) read first during a reset of said microprocessor conditions the selection of one of said startup programs.

2. The method of claim 1, wherein a first startup program (init) is contained in a user memory (120) and a second startup program (bootl) is contained in a system memory (104, 112).

3. Method according to claim 1 or 2, wherein at system initialization, when said option register (NoTZIsolation) has a first value (NoTZIsolation=1), the first startup program (init) is selected.

4. Method according to claim 3, wherein, at system initialization, when said option register (NoTZIsolation) has another value (NoTZIsolation=0), the second boot program (bootl) is selected.

5. The method of claim 3 or 4, wherein the first boot program (init), when selected, is configured to modify a value of a second register (HDPL) representative of the size of a prohibited access region of the system memory (104, 112) containing the second boot program (bootl), so that said second boot program (bootl) is not accessible.

6. The method of claim 5, wherein the first boot program (init), when selected, is configured to modify a value of the second register (HDPL) representative of the size of a prohibited access region of the system memory (104, 112) containing the second boot program (bootl) and a third boot program (boot2), such that said second and third boot programs (bootl, boot2) are not accessible.

7. A method according to claim 5 or 6, wherein said value of the second register (HDPL) can only be incremented.

8. Method according to claim 6 or 7, in which the modification of said value of the second register (HDPL) consists of an incre- mentation greater than one bit (HDPL1 to HDPL3).

9. Method according to any one of claims 2, or 3 to 8 in its dependency on claim 2, in which at least one application (Appli NoTZIsolation) is executable from the user memory (120) after the selection of the first startup program (init).

10. A method according to any one of claims 2, or 3 to 9 as dependent on claim 2, wherein the first startup program (init), when selected, implements a configuration of the microprocessor (100) to be in a secure mode where, when a non-secure transaction requires access to a secure resource of the microprocessor, then an error is returned.

11. A method according to any one of claims 2, or 3 to 10 as dependent on claim 2, wherein the first startup program (init), when selected, implements a configuration of the microprocessor (100) to be in a secure mode where, when a secure transaction requires access to an unsecured resource of the microprocessor (100), then an error is returned.

12. A method according to any one of claims 6 or 7 to 11 in its dependency on claim 6, wherein the first boot program (init), when selected, allows the implementation of a debugging function authorized to access one or more regions of the memory corresponding to a value of the second register (HDPL) containing the second boot program (bootl) and the third boot program (boot2).

13. A method according to any one of claims 2 to 12, wherein the user memory (120) is a non-volatile memory or a RAM type memory.

14. Method according to any one of claims 9 to 13 in its dependency on claim 9, in which several applications are executable from the user memory (120) after the use of the first startup program (init) and in which each of these applications is in the same security mode.

15. Microprocessor, comprising a system memory (104,112) and a user memory (120), and configured to implement the method according to any one of the preceding claims.

Images