METHOD AND DEVICE FOR AID IN THE DEVELOPMENT OF EMBEDDED SOFTWARE

Abstract

A method of controlling memory access for an embedded computer program is proposed, in the development phase, the computer program being executed in a device comprising a memory unit (115), the memory unit comprising a useful data storage space (120) and a corresponding storage space for error detection codes or error correction codes (125), called error codes, the method comprising, storing a state indicator in a location of the error code storage space,the stored state indicator being independent of a useful data stored in a corresponding location of the useful data storage space and being representative of a state of the location of the useful data storage space and a detection of a memory access error in a location of the useful data storage space depending on a state indicator stored in a corresponding location of the error code storage space. Figure for the abstract: Fig. 1,

Description

Title of the invention: AID METHOD AND DEVICE IN THE DEVELOPMENT OF EMBEDDED SOFTWARE

[0001] Embodiments relate to the field of reliability and security of computer programs or software, in particular embedded software, and in particular the development of embedded software using programming languages ​​that are unreliable in terms of memory access.

[0002] Embedded software development is often a long and costly process, particularly since such software can be difficult to debug.

[0003] Commonly used programming languages, such as C and C++, are efficient and flexible, but they are unreliable with respect to memory access, whether writing or reading. Unreliable memory access poses problems because memory access errors can lead to unrecoverable computer crashes and / or security vulnerabilities.

[0004] Solutions addressing these issues, allowing a developer to control memory access and identify possible errors, consist of adding instructions, for example during compilation, in a code generation tool, or during disassembly and re-encoding steps, at particular locations in the software, to study the behavior of the latter and its memory accesses.

[0005] However, these solutions are often complex to implement and require a specific test environment generally using a sophisticated operating system. In addition, these solutions require significant resources in terms of computing power and memory.

[0006] There is therefore a need for a method and a device for controlling memory access during the development of embedded software.

[0007] According to one aspect, a method of controlling memory access for an embedded computer program is proposed, in the development phase, the computer program being executed in a device comprising at least one memory unit, said at least one memory unit comprising at least one storage space for useful data and a corresponding storage space for error detection codes or error correction codes, called error codes.

[0008] According to embodiments, the method comprises, - a storage of a status indicator in a location of said error code storage space, the stored status indicator being independent of a useful data item stored in a corresponding location of said useful data storage space and being representative of a state of said location of said useful data storage space and - detecting a memory access error in a location of said useful data storage space based on a status indicator stored in a corresponding location of said error code storage space.

[0009] Such a method makes it possible to facilitate the development of embedded software by simplifying the detection of memory access errors, without substantial modification of the embedded system or additional specific resources and without resorting to an advanced operating system.

[0010] According to embodiments, the method comprises a step of initializing said error code storage space, said initialization step comprising storing a status indicator in each location of said error code storage space, said status indicator stored in each of said locations being representative of a failure to allocate a corresponding location of said useful data storage space.

[0011] Such a method thus makes it possible to identify a location in the useful data storage space which has not been allocated and therefore to detect an access error linked to such a location.

[0012] According to embodiments, the method comprises a step of allocating, to said computer program, at least a portion of said useful data storage space, said allocation comprising a storage of a status indicator in each location of said error code storage space corresponding to the at least a portion of said useful data storage space, said status indicator stored in each of said locations of said error code storage space corresponding to the at least a portion of said useful data storage space being representative of an allocation of a corresponding location of said useful data storage space.

[0013] Such a method thus makes it possible to identify a location in the useful data storage space which has been allocated, but whose content has not been initialized, and therefore to detect an access error linked to such a location.

[0014] According to embodiments, the method further comprises a step of de-allocating at least a portion of said useful data storage space, said de-allocating comprising an update of a status indicator in each location of said error code storage space corresponding to the at least a portion of said useful data storage space to be de-allocated, said status indicator updated in each of said locations of said error code storage space corresponding to the at least a portion of said data storage space useful to be deallocated being representative of a failure to allocate a corresponding location of said useful data storage space.

[0015] Such a method thus makes it possible to identify a location in the useful data storage space which has not been allocated or which has been freed and therefore to detect an access error linked to such a location.

[0016] According to embodiments, the method further comprises a step of initializing a value stored in a location of said useful data storage space, said initialization of the stored value comprising a storage of a status indicator in a location of said error code storage space corresponding to said location of said useful data storage space whose value is initialized, said status indicator stored in a location of said error code storage space corresponding to said location of said useful data storage space whose value is initialized being representative of an initialization of a value of said useful data storage space.

[0017] Such a method thus makes it possible to identify a location in the useful data storage space which has been allocated and whose content has been initialized.

[0018] According to embodiments, said status indicator stored in a location of said error code storage space corresponding to said location of said payload storage space whose value is initialized comprises a plurality of elements, each element of said plurality being representative of an initialization state of a value encoded in a portion of said location of said payload storage space whose value is initialized.

[0019] Such a method can thus adapt to different data coding lengths in a location of the useful data storage space.

[0020] According to another aspect, there is provided a computer program comprising instructions for executing each of the steps of the method described above. The advantages provided by this computer program are similar to those discussed above.

[0021] Still according to another aspect, there is provided a memory controller for an embedded system provided with at least one memory unit comprising at least one useful data storage space and a corresponding storage space for error detection codes or error correction codes, called error codes. According to embodiments, the memory controller comprises a status indicator management module, the status indicator management module being configured to - store a status indicator in a location of said error code storage space, the stored status indicator being independent of a useful data item stored in a corresponding location of said useful data storage space and being representative of a state of said location of said useful data storage space and - detecting a memory access error in a location of said useful data storage space based on a status indicator stored in a corresponding location of said error code storage space.

[0022] Such a memory controller makes it possible to facilitate the development of embedded software by simplifying the detection of memory access errors, without substantial modification of the embedded system or additional specific resources and without resorting to an advanced operating system.

[0023] According to yet another aspect, there is provided an embedded system comprising a memory controller as described above. The advantages provided by this embedded system are similar to those discussed above.

[0024] According to embodiments, the embedded system further comprises an error management module for detecting and / or correcting data reading errors, the embedded system further comprising a selection module for selecting the status indicator management module in a development mode and selecting the error management module in an operating mode.

[0025] Other advantages and characteristics will appear on examining the detailed description of embodiments and implementations, which are in no way limiting, and the appended drawings in which:

[0026] [Fig.l];

[0027] [Fig.2];

[0028] [Fig.3] ;

[0029] [Fig.4] ;

[0030] [Fig.5] illustrate embodiments.

[0031] According to embodiments, a status is associated with each location of at least at least a portion of a memory unit of an embedded system, during a development or testing phase of a computer program or software. This status may indicate, in particular, whether the location has been allocated and / or whether the location has been initialized. It makes it possible to identify erroneous memory accesses, for example, memory accesses to a location that has not been allocated or initialized. These locations may, in particular, be memory locations for data or instructions. They may or may not be dynamically allocated.

[0032] Still according to embodiments, the status is stored in a location of the memory of the embedded system which is used, when the software is executed in an operating mode, to store error correction codes (ECC, Error Correction Code in English terminology) or error detection codes (EDC, Error Detection Code in English terminology). Such codes, also called redundancy data, are generally stored in 7 bits to detect and / or correct errors in 32-bit words.

[0033] [Fig.l] schematically illustrates a part of an embedded system 100. As illustrated, the embedded system 100 comprises in particular a microprocessor 105, a memory controller 110 and at least one memory unit 115 itself comprising a first part 120 for storing useful data or instructions (payload in English terminology), for example coded on 32 bits, and a second part 125 for storing error correction codes or error detection codes, called error codes hereinafter, for example coded on 7 bits.

[0034] The memory controller 110 here comprises a standard redundancy management module 130 having in particular the purpose of calculating an error code when writing data to memory and of detecting and / or correcting an error when reading data. The memory controller 110 also comprises a status indicator management module 135 for controlling the storage of a status indicator, accessing a previously stored status indicator and interpreting an accessed status indicator. According to the example illustrated, the memory controller 110 further comprises a selection module 140 for selecting the standard redundancy management module 130 or the status indicator management module 135, for example depending on a mode of use of the embedded system.

[0035] In an operating mode, the selection module 140 selects the standard redundancy management module 130 to calculate and store an error code when writing data to memory and to detect and / or correct an error in data accessed in memory. In a development mode, the selection module 140 selects the state indicator management module 135 to store, in a location of the second part 125 of the memory unit 115, data characterizing a state of a corresponding location of the first part 120 of the memory unit 115, to access such data characterizing a state and to detect an anomaly in accessing a location of the first part 120 of the memory unit 115, for example if this location has not been allocated or has not been initialized.

[0036] [Fig.2] illustrates an example of steps for controlling access to at least a portion of a memory unit, in a mode of developing software in an embedded system such as that illustrated in [Fig.l].

[0037] According to this example, a first step (step 200) has the purpose of initializing a second part of a memory unit used to store data representative of a state of a first part of a memory unit. According to embodiments, each location of the second part of the memory unit is used to store data representative of a state, called a state indicator, of a corresponding location of the first part of the memory unit. The second part of the memory unit is for example that used to store error codes in an operating mode of the embedded system. The first and second parts are for example parts 120 and 125 of [Fig.l], respectively. The part of the memory unit used to store data representative of a state of another part of a memory unit is for example initialized with the value zero signifying that the corresponding locations of the other part of the memory unit have not been allocated to an application.

[0038] The operating mode of the embedded system is determined in a following step (step 205). This step can be implemented when launching an application, for example an application under development or a tested application, when launching a module of this application or when receiving a memory access command originating, directly or indirectly, from this application. If the operating mode is an operating mode, the memory is accessed in a standard manner (step 210). If, on the contrary, the operating mode is a development or testing mode of embedded software, a following step has the purpose of determining the nature of a received command to be processed.

[0039] If the received command is a memory allocation command (step 215), for instructions or data, an amount of memory of a part of a memory unit, for example the memory part 120 in [Fig.l], defined according to the received command, is allocated (step 220), in a standard manner. Furthermore, during this step, a status indicator representing the status of each allocated location is stored in a location corresponding to the allocated location, for example in a memory location used, in operating mode, to store an error code, as described previously. A status indicator representing an allocated state is for example coded on one bit, the value zero indicating an unallocated location and the value one indicating an allocated location. Other values ​​can be used.This can be the fifth bit of the status indicator which corresponds to the error code normally stored in the memory used, in operating mode, to store an error code (b[4]=l after allocation).

[0040] If the received command is a memory release command (step 225), also called memory deallocation, the address(es) of the memory locations to be deallocated are obtained. The address(es) obtained are then used to retrieve the status indicator(s) in the corresponding location(s) (step 230), for example in the memory portion 125 in [Fig.l].

[0041] A test is then performed to determine whether the memory location(s) to be deallocated have been previously allocated (step 235). According to embodiments, the value of the retrieved state flag(s) is used to determine whether the memory location(s) to be deallocated have been previously allocated. According to the previous example, if the value of the fifth bit of the status flag is one, the corresponding location has been allocated, and if it is zero, it has not been allocated.

[0042] If the memory location(s) to be deallocated have been previously allocated, a memory quantity of a portion of a memory unit, for example the memory portion 120 in [Fig.l], defined according to the received command, is deallocated (step 240), in a standard manner. Furthermore, during this step, the state indicator associated with each deallocated location, stored in a location corresponding to the deallocated location, for example in a memory location used, in operating mode, to store an error code, is modified to represent the new state (unallocated). As described previously, a data item representative of an unallocated state (location not yet allocated or previously allocated, but freed) is for example coded on a bit, the value zero indicating an unallocated location and the value one indicating an allocated location.Again, other values ​​can be used and it can be the fifth bit of the status indicator which corresponds to the error code normally stored in the memory used, in operating mode, to store an error code (b[4]=0 after deallocation. .

[0043] Conversely, if the memory location(s) to be deallocated have not been previously allocated or have been deallocated since their last allocation (e.g., if the value of the fifth bit of the status indicator is equal to zero), an error is detected (step 245). According to embodiments, an interrupt is generated to indicate the error. Still according to embodiments, an indication relating to the error is transmitted, for example to indicate an attempt to deallocate an unallocated location.

[0044] If the received command is a memory access command to write one or more data (step 250) to one or more locations of a memory unit, for example the memory portion 120 in [Fig.l], the address(es) of these locations are obtained. The obtained address(es) are then used to retrieve the status indicator(s) in the corresponding location(s) (step 255), for example in the memory portion 125 in [Fig.l].

[0045] A test is then performed to determine whether the memory location(s) in which one or more data items are to be written have been allocated (step 260). According to embodiments, the value of the retrieved state flag(s) is used to determine whether the memory location(s) in which one or more data items are to be written have been allocated. According to the previous example, if the value of the fifth bit of the status flag is equal to one, the corresponding location has been allocated and if it is equal to zero, it has not been allocated.

[0046] If the memory location(s) in which one or more data items are to be written have been allocated, the data item(s) are written (step 265). Furthermore, the value of the retrieved state flag(s) is changed, in the location(s) corresponding to the location(s) in which the data item(s) are written, to indicate that data have been written and that, consequently, the value stored in this or these locations has been initialized. As described with reference to [Fig. 4], a data item representative of an initialized state is for example coded on 4 bits, each bit being associated with a byte, the value zero indicating an uninitialized location and the value one indicating an initialized location.This can be the first four bits of the status indicator which corresponds to the error code normally stored in the memory used, in operating mode, to store an error code (b[0-3]=1 after initialization of the four bytes).

[0047] If the memory location(s) to which one or more data items are to be written have not been allocated (e.g., if the value of the fifth bit of the status indicator is equal to zero), an error is detected (step 270). According to embodiments, an interrupt is generated to indicate the error. Also according to embodiments, an indication relating to the error is transmitted, for example to indicate an attempt to write data to an unallocated location.

[0048] If the received command is a memory access command to read one or more data (step 275) at one or more locations of a memory unit, for example the memory portion 120 in [Fig.l], the address(es) of these locations are obtained. The obtained address(es) are then used to retrieve the status indicator(s) in the corresponding location(s) (step 280), for example in the memory portion 125 in [Fig.l].

[0049] A test is then performed to determine whether the memory location(s) from which one or more data items are to be read have been allocated and initialized (step 285). According to embodiments, the value of the retrieved status indicator(s) is used to determine whether the memory location(s) from which one or more data items are to be read have been allocated and initialized. According to the preceding example and depending on the size and position of the data item(s) to be read, if the value of the first, second, third and / or fourth bit of the status indicator is equal to one, the corresponding location has been allocated and initialized.

[0050] If the memory location(s) from which one or more data are to be read have been allocated and initialized, the data are read (step 290). On the contrary, if the memory location(s) from which one or more data to be read have not been allocated and initialized, an error is detected (step 295). According to embodiments, an interrupt is generated to indicate the error. Also according to embodiments, an indication relating to the error is transmitted, for example to indicate an attempt to read data from an uninitialized location.

[0051] Depending on the implementation of the selection module, steps 220, 240, 245, 265, 270, 290 and 295 can loop to box 205 to take into account a possible change of mode or to boxes 215, 225, 250 and 275 (i.e., the “development” output of box 205) if there is no need to consider a change of mode.

[0052] According to embodiments, the steps illustrated in [Fig. 2] or some of these steps are implemented by the microprocessor 105 illustrated in [Fig. 1]. Still according to embodiments, these steps or some of these steps are implemented in a specific test environment. Still according to embodiments, some of these steps are implemented using hard-wired logic of the embedded system.

[0053] [Fig. 3] schematically illustrates a memory unit 300 of an embedded system, comprising a first portion 305 configured to store useful data or instructions and a second portion 310 configured to store error correcting codes or error detecting codes (error codes). As illustrated, the contents of the memory unit 300 vary over time. For illustration purposes, location 305-i contains valid data or instruction between times Tk and Tk+A, but does not contain valid data or instruction before time Tk (e.g. if the address has not been allocated or initialized) and after time Tk+A (e.g. if the address has been freed). Similarly, the contents of the memory unit 300 vary in space.Still for illustration purposes, addresses M to M+D contain valid data or instructions between times Tk and Tk+A, but the addresses preceding address M and following address M+D do not contain valid data or instructions.

[0054] In one operating mode, the software executed in the embedded system comprising the memory unit 300 uses the part 305 to write and read useful data or instructions. The embedded system further comprises a redundancy mechanism, comprising error detection and correction modules, using the part 310 to detect and / or correct stored data or instructions that are erroneous. Thus, when data or an instruction is stored in the part 305 of the memory unit 300, for example at the address 305-i, the redundancy mechanism calculates an error code that is stored in a corresponding location of the part 310, here the location 310-i. When a data or an instruction is to be obtained from the part 305 of the memory unit 300, for example at address 305-i, the redundancy mechanism calculates an error code from the data or instruction stored at this location and compares it with the error code previously calculated and stored in the corresponding location of the part 310, here location 310-i. If the error codes are identical, the data or instruction obtained is transmitted to the software. Otherwise, it is corrected before being transmitted or, if it cannot be corrected, an error signal is transmitted to the software.

[0055] In a development mode, the redundancy mechanism is deactivated in favor of a memory unit state control mechanism, which uses the locations provided for storing error codes to store state indicators of the corresponding locations in the memory used to store useful data or instructions, as described with reference to [Fig. 2], in order to detect possible memory access errors. When a data item or an instruction must be written in the part 305 of the memory unit 300 or read, for example at the address 305-i, the state control mechanism checks that the state of this location is compatible with the requested operation. By way of illustration, it is considered here that the value of the state stored in the location 310-i indicates that the location 305-i has been allocated and initialized. Consequently, a data item can be read or written to this location.Still for the purpose of illustration, it is considered here that the value of the state stored in location 310-j indicates that location 305-j has been allocated but has not been initialized. Therefore, data cannot be read from this location, but can be written. Still for the purpose of illustration, it is considered that the value of the state stored in location 310-m indicates that location 305-m has not been allocated and, a fortiori, has not been initialized. Therefore, data can neither be read nor written to this location.

[0056] Figures 4 and 5 illustrate an example of coding a value of a state indicator, representative of a state of a location of a memory unit used to store useful data or instructions. According to the illustrated example, each location of a memory unit used to store useful data or instructions makes it possible to store a 32-bit word. Each location can therefore be used to store one 32-bit useful data or instruction, store two 16-bit useful data or instructions, store four 8-bit useful data or instructions, etc.

[0057] The state of a location is here characterized by 5 bits, one bit characterizing the allocated or unallocated state of the location and four bits each characterizing the initialized or uninitialized state of each of the four bytes of the 32-bit word that can be stored at this location.

[0058] According to the example illustrated in [Fig.4], a location of a memory unit used to store useful data or instructions stores a word 400 of 32 bits. The corresponding location, in a part of a memory unit normally used to store error codes, is used to store a status indicator, for example on 5 bits, each of the first 4 bits (b[0] to b[3]) corresponding to the indication according to which each of the 4 bytes of the 32-bit word has been initialized or not, respectively, and the fifth bit (b[4]) corresponding to the indication according to which the location of the 32-bit word has been allocated or not.

[0059] According to this example, if a location has not been allocated, the status is 00000, if the location has been allocated but not initialized, the status is 10000, and if the location has been allocated and initialized, the status is 11111. Other encodings may be used. For illustration, bits b[1] to b[3] may be ignored or used for other purposes.

[0060] According to the example illustrated in [Fig.5], a location of a memory unit used to store useful data or instructions stores two words 500 and 505 of 16 bits each. Again, the corresponding location, in a part of a memory unit, normally used to store error codes, is used to store a status indicator, here on 5 bits, each of the first 4 bits (b[0] to b[3]) corresponding to the indication according to which each of the 4 bytes of the 32-bit word has been initialized or not, respectively, and the fifth bit (b[4]) corresponding to the indication according to which the location of the 32-bit word has been allocated or not.

[0061] According to this example, if a location has not been allocated, the status is 00000, if the location has been allocated but not initialized, the status is 10000, if the location has been allocated, but only one of the data or instructions is initialized, the status is 10011 or 11100 and if the location has been allocated and both data or instructions have been initialized, the status is 11111. Again, other encodings can be used. For illustration, bits b[1] and b[3] can be ignored or used for other purposes.

[0062] Similarly, when a 32-bit word is used to store four 8-bit data or instructions, each of the four bits of the status indicator can be used to indicate whether the value of the corresponding data or instruction has been initialized.

[0063] It is observed here that if, according to the previous examples, the locations of the memory unit allow 32-bit words to be stored, the method described previously is not limited to this size.

Claims

Claims

1. Method for controlling memory access for an embedded computer program, in the development phase, the computer program being executed in a device comprising at least one memory unit (115), said at least one memory unit comprising at least one useful data storage space (120) and a corresponding storage space for error detector codes or error corrector codes (125), called error codes, the method comprising, - a storage (200, 220, 240, 265) of a state indicator in a location of said error code storage space, the stored state indicator being independent of a useful data item stored in a corresponding location of said useful data storage space and being representative of a state of said location of said useful data storage space and - a detection (235, 260,285) of a memory access error in a location of said useful data storage space as a function of a status indicator stored in a corresponding location of said error code storage space.,

2. The method of claim 1, comprising a step of initializing (200) said error code storage space, said initializing step comprising storing a status indicator in each location of said error code storage space, said status indicator stored in each of said locations being representative of a failure to allocate a corresponding location of said payload storage space.

3. A method according to claim 1 or claim 2, further comprising a step of allocating (220), to said computer program, at least a portion of said payload storage space, said allocation comprising storing a status indicator in each location of said error code storage space corresponding to the at least a portion of said payload storage space, said status indicator stored in each of said locations of said code storage space errors corresponding to at least a portion of said payload storage space being representative of an allocation of a corresponding location of said payload storage space.

4. The method of any one of claims 1 to 3, further comprising a step of de-allocating (240) at least a portion of said payload storage space, said de-allocating comprising updating a status indicator in each location of said error code storage space corresponding to the at least a portion of said payload storage space to be de-allocated, said updated status indicator in each of said locations of said error code storage space corresponding to the at least a portion of said payload storage space to be de-allocated being representative of a failure to allocate a corresponding location of said payload storage space.

5. The method of any one of claims 1 to 4, further comprising a step of initializing (265) a value stored in a location of said payload storage space, said initializing the stored value comprising storing a status indicator in a location of said error code storage space corresponding to said location of said payload storage space whose value is initialized, said status indicator stored in a location of said error code storage space corresponding to said location of said payload storage space whose value is initialized being representative of an initialization of a value of said payload storage space.

6. The method of claim 5, wherein said status indicator stored in a location of said error code storage space corresponding to said location of said payload storage space whose value is initialized comprises a plurality of elements, each element of said plurality being representative of an initialization state of a value encoded in a portion of said location of said payload storage space whose value is initialized.

7. A computer program comprising instructions for executing each of the steps of the method described in claims 1 to 6 when implemented in a computing unit.

8. Memory controller (110) for an embedded system (100) provided with at least one memory unit comprising at least one useful data storage space (120) and a corresponding storage space for error detector codes or error corrector codes (125), called error codes, the memory controller comprising a status indicator management module, the status indicator management module being configured to - store a status indicator in a location of said error code storage space,the stored state indicator being independent of a useful data stored in a corresponding location of said useful data storage space and being representative of a state of said location of said useful data storage space and - detecting a memory access error in a location of said useful data storage space as a function of a state indicator stored in a corresponding location of said error code storage space.,

9. An embedded system (100) comprising a memory controller according to claim 8.

10. The embedded system of claim 9, further comprising an error handling module for detecting and / or correcting data reading errors, the embedded system further comprising a selection module for selecting the status indicator handling module in a development mode and selecting the error handling module in an operating mode.

Images