Patent Application
20230015027
This application claims the benefit of French Patent Application No. 2107717, filed on Jul. 16, 2021, which application is hereby incorporated herein by reference.
Embodiments and implementations relate to microcontroller or microprocessor integrated circuits, in particular the management of the access rights of software tasks executed by microcontrollers or microprocessors.
The access rights of the software tasks are typically provided for security reasons when a secure operating system schedules a task consuming a memory slice occupied by another task.
The task sequences being executed, having hierarchically higher access rights can use memory slices of task sequences having hierarchically lower access rights.
Memory is mapped only to prevent the tasks having lower access rights from accessing memory slices reserved for hierarchically higher access rights while tasks having higher access rights use those memory slices.
When these memory slices are “cacheable”, that is to say that it is possible to preload them into a cache memory which is an intermediate working memory with rapid access, before being used by the processor, it is conventionally necessary to empty the cache lines containing these memory slices in order to define new access rights for these memory slices.
Reference is made in this regard to
Indeed, in addition to the processor CPU and the memory protection unit MPU/MMU, a hardware firewall FWL monitors and protects the access to the different regions OS, Dat_A, Dat_B, Dat_C of the memory MEM. The firewall FWL further allows monitoring and protecting access to different memory regions by different devices driven by the executed tasks.
The firewall FWL can be dynamically programmed so as to follow the programming of the access rights Priv, NPriv of the executed tasks. This type of dynamic firewall allows in particular preventing the access to data Dat_A of the memory MEM relating to one of the tasks (for example the task Tsk_A, whose program code may be the property of a third party), by another task during its execution (for example the Tsk_B task whose program code can be the property of another third party).
In this state 110, only task B has been executed. The cache memory CCH only contains the code and the data of the Tsk_B task, and also the operating system OS.
Thus, the Tsk_A task is assigned a “non-privileged” access right NPriv, while the Tsk_B task is assigned a “privileged” access right Priv.
The memory protection unit MPU/MMU and the firewall FWL are reconfigured according to this change.
However, cache lines which contain information about task B are always marked with a “non-privileged” attribute NP in the cache memory.
In case of eviction of a cache line, that is to say when a line of the cache memory allocated to the previously active task Tsk_B is reallocated to the current active task Tsk_A, then the data contained in this line should be written in the region Dat_B of the memory MEM reserved for the previously active task Tsk_B.
However, the firewall FWL detects an illegal access and blocks the write access of the cache memory line having a (non-privileged) attribute NP since the access rights of the Tsk_B task have become privileged Priv during the execution of the task Tsk_A.
A current solution is to flush the cache memory CCH before each reconfiguration of the memory protection unit MPU/MMU and the firewall FWL, or else not to enable the use of the cache memory CCH for the memory regions MEM relating to certain tasks (for example the region Dat_B of the task Tsk_B).
This introduces performance degradations in both cases.
Another current solution is not to map exclusively the memory region MEM relating to a task (for example Tsk_B) with a higher level access right Priv, that is to say to leave, in state 120, a portion of the region Dat_B of memory MEM relating to the task Tsk_B with a lower level access right NPriv.
This introduces a degradation of the security of the isolation between the tasks.
Another current solution is to copy to a memory location having higher access rights P. The need to reconfigure the protection unit MPU/MMU and the firewall FWL, then to recopy the higher access memory P to the lower access right memory NP, when the task TSK_B becomes active again, is thus avoided.
On the one hand, this solution is only suitable in the case of a memory region shared between a secure task and a non-secure task. On the other hand, this solution has the drawback of using a greater space in memory, since it requires more copies in the memory. Increasing the memory size is problematic in terms of cost and space requirement.
Embodiments provide a technique for managing access rights of software tasks allowing improving the performance of the microcontroller, without degrading the security obtained by the access rights, and without introducing any cost or additional hardware space requirement.
According to one embodiment, a method is proposed for managing access rights of software tasks executed by a processing unit using a cache memory to contain execution data of said tasks in memory locations each having an attribute representative of the level of access right of the respective task. The method comprises, in the case of change in the access rights of at least one task, a right updating process implemented by the processing unit, comprising a change in the attributes of the locations of the cache memory containing execution data relating to said at least one task and a retention of the execution data contained in said locations of the cache memory.
For example, the access rights of the software tasks are defined by an access right management unit.
In other words, the process for updating access rights in the cache memory according to this aspect allows the data contained in the cache memory to be quickly made consistent with the corresponding access rights. Thus, it is not necessary to implement the conventional techniques of flushing the cache memory, to provide partial lower access rights, nor to implement multiple copy actions to adapt the cache memory to the scheduling tasks.
Consequently, the operation of the microcontroller is more efficient and reliable. Moreover, updating the access rights in the cache memory consumes few resources and has an economical energy consumption.
According to one embodiment, a firewall mechanism monitors an access to a memory containing data relating to the software tasks conditionally on the access rights of said software tasks, the method comprising, in the case of change in the access rights of at least one task, a change in the conditions of access to the data relating to said at least one task following said change in the access rights.
For example, the memory can be a memory external or internal to the microcontroller integrated circuit, of the random access memory type (RAM) or of the non-volatile type (such as a “Flash” memory).
This corresponds to a dynamic firewall mechanism allowing in particular protecting data of the memory MEM relating to a task, during the execution of another task.
The process for updating the access rights in the cache memory according to this aspect allows an optimal use of the dynamic firewall, the data contained in the cache memory not suffering the problem of illegal access to the memory in case of line eviction.
According to one embodiment, the access rights of the software tasks comprise a privileged level and a non-privileged level, such that a non-privileged level task cannot access privileged level data or functions.
The management of the privileged level and non-privileged level access rights allows in particular giving access and preventing access to sensitive functions of the microcontroller, for example functions of programming controls of the microcontroller, such as the configuration of the microcontroller at start-up (usually “boot”) or the programming of the access rights. Some hardware resources, such as stack registers, can be duplicated in the privileged and non-privileged domains, respectively.
According to one embodiment, the access rights of the software tasks comprise a secure level and a non-secure level, such that a non-secure level task cannot access data or functions respectively contained or implemented by a secure level hardware element.
Managing the secure level and non-secure level access rights generally corresponds to a physical separation of secure and non-secure hardware elements. The secure elements are generally provided to implement critical security functions, such as encryption/decryption accessing secret keys. Managing the access rights according to this aspect allows switching from one mode to another (secure mode and non-secure mode) more quickly, with fewer backups from the cache memory to another memory.
According to one embodiment, the right updating process further comprises a locking of the locations of the cache memory containing the execution data relating to said at least one task, before said change in the respective attributes, and an unlocking after said change in the attributes.
Locking the cache memory locations corresponds to a prohibition of changing these memory locations. Thus, even if no execution of another task changes the locations of the cache memory during the process, and even if the processing unit interrupts are deactivated during the process, the implementation of the process itself could lead to evictions of said memory locations, which are protected in this regard by the locking.
According to one embodiment, the right updating process further comprises a deactivation of the interrupts of the processing unit throughout the updating process.
Indeed, interrupts of the processing unit, which are typically tasks to be processed as a priority, could change and control evictions of the memory locations during the process. It is tolerable to deactivate the interrupts during the whole process, given its simplicity of implementation and therefore its speed of execution.
According to one embodiment, the right updating process can only be controlled by a task, executed by the processing unit, having a level of access right which is hierarchically higher than or equal to the level of access right represented by the changed attribute.
According to another embodiment, an integrated circuit, such as a microcontroller or a microprocessor is also proposed, including a processing unit configured to execute software tasks, a cache memory configured to contain execution data of said software tasks in memory locations each having an attribute representative of a level of access right of the respective task, and an access right management unit configured, in the case of change in the access rights of at least one task, to change the attributes of the locations of the cache memory containing execution data relating to said at least one task, and to retain the execution data contained in these locations of the cache memory.
According to one embodiment, the access right management unit is configured to define the access rights of the software tasks.
According to one embodiment, the integrated circuit is capable of cooperating with a firewall mechanism configured to monitor an access to a memory intended to contain data relating to the software tasks, conditionally on the access rights of said software tasks, the processing unit being configured, in the case of change in the access rights of at least one task, to change the conditions of access to the data relating to said at least one task of the firewall mechanism, following said change.
The memory and the firewall mechanism can be external or internal to the microcontroller/microprocessor integrated circuit, nevertheless, the processing unit is capable in both cases of changing (reprogramming) the conditions of access to the memory of said firewall mechanism.
According to one embodiment, the access rights of the software tasks comprise a privileged level and a non-privileged level, the access right management unit being configured such that a non-privileged level task cannot access privileged level data or functions.
According to one embodiment, secure level hardware elements and non-secure level hardware elements, in which the access rights of the software tasks comprise a secure level and a non-secure level, and the processing unit is configured such that a non-secure level task cannot access data or functions which are respectively contained or implemented by a secure level hardware element.
According to one embodiment, the access right management unit is further configured to lock the locations of the cache memory containing the execution data relating to said at least one task, before said change in the respective attributes, and to unlock them after said change in the attributes.
According to one embodiment, the access right management unit is further configured to deactivate the interrupts of the processing unit during the change in the attributes of the locations of the cache memory.
According to one embodiment, the processing unit is configured such that said change in the access rights of at least one task, can only be controlled by a task, executed by the processing unit, having a level of access right which is hierarchically higher than or equal to the level of access right represented by the changed attribute.
According to yet another embodiment, a process for updating at least one attribute representative of a level of access right of a content of a respective memory location of a cache memory is also proposed, comprising, at the request of a processing unit, a change in at least one attribute, without changing the content of the corresponding memory location.
According to yet further embodiments, a cache memory device is proposed, intended to be controlled by a processing unit, comprising memory locations configured to each have an attribute representative of a level of access right of the content of the respective memory location, the cache memory being capable, at the request of the processing unit, of performing a change in at least one attribute without changing the content of the corresponding memory location.
Other advantages and features of the invention will become apparent on examining the detailed description of embodiments and implementations, without limitation, and of the appended drawings, in which:
The microcontroller MCU includes a processing unit CPU, an access right management unit MPU/MMU, a cache memory CCH, as well as a memory MEM whose access from a bus BS is monitored and conditioned by a firewall mechanism FWL.
The processing unit CPU is configured to execute software tasks, for example, on the one hand, the execution of an operating system OS, and on the other hand, the execution of software applications Tsk_A, Tsk_B, Tsk_C which can by example be programs belonging to third parties providing services on the microcontroller MCU.
For reading
The processing unit CPU uses a cache memory CCH, which is a working memory used to store execution data of the tasks, such as intermediate data of calculations, of the internal variables, and also for example output data before transfer to a peripheral or to the memory MEM.
The cache memory CCH is materially close to the circuit of the processing unit CPU and is clocked by the processing unit CPU, providing optimum performance in this regard, but is usually limited in size.
The access right management unit MPU/MMU allows, at the request of the processing unit CPU, defining a level of access right Priv, NPriv, of the executed software tasks. The level of access right Priv, NPriv for each task is listed in the access right management unit MPU/MMU.
For example, the access right management unit MPU/MMU can be a memory protection unit “MPU”, typically suitable for relatively simple microcontrollers MCU. Alternatively, as illustrated in the example of
In this example, the access rights have a privileged level Priv or a non-privileged level NPriv, and allow in particular giving access or respectively preventing access to sensitive functions of the microcontroller MCU, for example functions of programming controls of the microcontroller, such as the configuration of the microcontroller at start-up (usually “boot”) or the programming of the access right management unit MPU/MMU. Some hardware resources, such as stack registers, can be duplicated in privileged and non-privileged domains, respectively.
In the cache memory CCH, the execution data of the tasks is stored in memory locations, each memory location being represented by a rectangular line of the cache memory CCH. Each location of the cache memory is dedicated with an attribute P, NP representative of the level of access right of the software task whose execution data is stored in the respective memory location.
The attributes P, NP of the locations of the cache memory CCH can for example be coded on one bit. The attribute P corresponds to the privileged level Priv of the access rights, while the attribute NP corresponds to the non-privileged level NPriv of the access rights.
Furthermore, the access rights Priv, NPriv condition the access to the memory MEM, through the effect of the firewall mechanism FWL.
The memory MEM is intended to contain data Dat_A, Dat_B, Dat_C, OS relating to the software tasks Tsk_A, Tsk_B, Tsk_C, OS, for example the program codes of the software tasks, or the execution data of said tasks. The memory MEM can be a memory external or internal to the integrated circuit of the microcontroller MCU, of the random access memory type “RAM” or of the non-volatile type, such as a “Flash” memory.
The firewall mechanism FWL is configured to monitor the access to the data Dat_A, Dat_B, Dat_C relating to the software tasks of the memory MEM, in a manner conditioned by the access rights of the tasks Tsk_A, Tsk_B, Tsk_C corresponding to said data. The access rights Priv, NPriv to the data of the memory MEM are the same as the access rights defined in the access right management unit MPU/MMU for corresponding tasks Tsk_A, Tsk_B, Tsk_C. The conditions of access in the memory are in particular provided such that a non-privileged level task NPriv cannot access privileged level data Priv.
In this regard, in the case of change in the access rights Priv, NPriv of at least one task, the firewall mechanism FWL is advantageously capable of changing the protection of access to the memory MEM in accordance with said change.
The management of the access rights is in particular provided such that a task of non-privileged level NPriv cannot access privileged level data or functions Priv.
In practice, the active task, that is to say the task Tsk_B in the state 210, is placed at the hierarchically lower access right level, that is to say the non-privileged level NPriv, while the non-active tasks, in the state 210 the tasks Tsk_A, Tsk_C, are placed at the hierarchically higher level, that is to say the privileged level. Thus, during its execution, the active task Tsk_B cannot access data Dat_A, Dat_C, OS of the memory MEM relating to another task Tsk_A, Tsk_C, OS.
Reference is now made to
In this example, the task Tsk_A has moved from the privileged level Priv to the non-privileged level NPriv, while the task Tsk_B has moved from the non-privileged level NPriv to the privileged level Priv. This may for example correspond to the case where the task Tsk_A has become active, for example following an interrupt received and processed by the processing unit CPU, or else due to execution priorities such as when the task Tsk_A requires a processing in real time.
Thus, the levels of access rights of the tasks have been changed in the Access right management unit MPU/MMU as well as the conditions of access to the memory which are monitored by the firewall FWL.
Furthermore, in the case of change in the access rights of the tasks Tsk_A, Tsk_B, the processing unit CPU is configured to change the attributes P, NP of the locations of the cache memory CCH containing the execution data relating to said changed tasks.
Only the attributes P, NP of the locations CCH of the cache memory are changed, the execution data contained in these memory locations is retained.
Thus, in the state 220, the attributes of the memory locations relating to the task Tsk_B correspond to the privileged level P, and could possibly be transferred to the memory MEM without being blocked by the firewall mechanism FW1 having the privileged condition Priv for the region Dat_B reserved for the task Tsk_B.
Reference is made in this regard to
The execution of the task Tsk_A generated execution data in locations of the cache memory CCH, represented by a thick line frame, with the attribute NP corresponding to the non-privileged level NPriv of the active task Tsk_A.
The use of the cache memory CCH can be done naturally and provide for an eviction FLSH (usually “flush”) of a memory location previously used by the previous task Tsk_B. Since the attribute of the memory location of the eviction FLSH has been made consistent with the firewall conditions FWL, the execution data contained in this memory location can be saved in the corresponding region Dat_B of the memory MEM.
Reference is now made to
In this example the task Tsk_B has returned to the non-privileged level NPriv, while the task Tsk_A has returned to the privileged level Priv. This may for example correspond to the case where the task Tsk_B has become active again, for example following the end of the processing of the task Tsk_A.
Thus, the levels of access rights Priv, NPriv of the changed tasks Tsk_A, Tsk_B have been changed in the access right management unit MPU/MMU as well as the conditions of access to the memory which are monitored by the firewall FWL, and as well as the attributes P, NP of the locations of the cache memory CCH containing execution data relating to said changed tasks Tsk_A, Tsk_B.
And advantageously, the execution data contained in the memory locations relating to the task Tsk_B which has been retained do not need to be reloaded from the memory MEM. A single memory location has been displaced to the memory MEM by cache line eviction FLSH (
During changes in the level of access rights to the states 220, 240 (
In other words, it is advantageously proposed to identify the locations of the cache memory CCH containing execution data relating to the tasks Tsk_A, Tsk_B whose access rights are changed, by using the identifier “ASID” relating to each of said tasks Tsk_A, Tsk_B. This identification thus effectively allow changing the attributes P, NP of said locations of the cache memory CCH and retaining the execution data contained in said locations of the cache memory CCH.
Moreover, only a task of the hierarchically higher access right level, in this example the privileged level Priv, can control a change in the access rights of the microcontroller MCU (or microprocessor), and in particular the change or the update of the attributes of the locations of the cache memory CCH.
In this example, the access rights of the software tasks comprise a secure level Sec and a non-secure level NSec. The secure Sec and non-secure NSec access rights correspond to a physical separation of the hardware elements of the microcontroller MCU of secure level and non-secure level. The secure level hardware elements are generally provided to implement critical security functions, such as encryptions and decryptions using secret keys.
A task of non-secure level NSec cannot access data or functions respectively contained or implemented by a secure level hardware element Sec.
In this example of a microcontroller MCU, the access right management unit SAU/MMU includes a security allocation unit “SAU” or, alternatively, a memory management unit “MMU”.
In practice, the memory protection units “MPU” (
The corresponding execution data is stored in locations of the cache memory CCH having the attributes S, NS corresponding to the access rights Sec, NSec of the respective tasks.
Thus, the levels of access rights of the tasks and memory region Dat_shrd have been changed in the access right management unit SAU/MMU as well as the conditions of access to the memory monitored by the firewall FWL, and as well as the attributes S, NS of the locations of the cache memory CCH containing execution data relating to said modified memory region Dat_shrd.
Consequently, from the state 320, the data relating to the shared data Dat_shrd contained in the cache memory locations CCH is not lost, on the one hand. On the other hand, in the case of eviction of at least one of these memory locations, the data of the cache memory CCH can be recorded in the dedicated region Dat_shrd of the memory MEM without being blocked by the firewall FWL, given that their attributes S have been changed and are aligned with the change in the conditions of the firewall FWL.
The access right management allows switching from one mode to another (secure mode and non-secure mode) more quickly, with less loading and reloading of data from the cache memory to the memory MEM.
Moreover, it will be noted that the microcontroller MCU can provide both secure Sec and non-secure NSec level access rights, as well as, for each secure and non-secure level hardware domain, of privileged Priv and non-privileged NPriv level access rights.
Thus, the example of
Moreover, in the examples described above in relation to
And moreover, herein again, only a task of the hierarchically higher access right level, in this example the secure level Sec, can control a change in the access rights of the microcontroller MCU (or microprocessor), and in particular the change or the update of the attributes of the cache memory locations CCH.
On the other hand, it will be noted that the description given above in relation to
Furthermore, there are external cache memory devices CCH, that is to say, not incorporated into the microcontroller or microprocessor integrated circuit.
Thus, the cache memory device CCH, which is intended to be controlled by a processing unit CPU, will also be considered in isolation, comprising memory locations configured to each have an attribute P, NP; S, NS representative of a level of access right Priv, NPriv; Sec, NSec of the contents of the respective memory location, the cache memory device CCH being capable, at the request of the processing unit CPU, of performing a change in at least one attribute P, NP; S, NS without changing the contents of the corresponding memory location.
The exemplary embodiments given above in relation to
The process 400 first comprises a step 402 of deactivating the interrupts of the processing unit CPU.
Thus, interrupts of the processing unit CPU which are received during the process 400, will not be processed as a priority. Consequently, the executions of the interrupts will not change the cache memory CCH, nor more particularly will not control evictions of the locations of the cache memory CCH during the process 400.
The process 400 further comprises a step 404 for locking the locations of the cache memory containing the execution data relating to the task(s) whose access rights are changed. The locking of the cache memory locations corresponds to a prohibition of changing these memory locations.
Then, the process 400 comprises a step 406 of changing the attributes P, NP; S, NS of the cache memory locations CCH, which contain execution data relating to said at least one task whose access rights are changed. The execution data contained in said cache memory locations is retained.
The firewall FWL and the access right management unit MPU/MMU are reprogrammed during a step 408.
The attributes of the cache memory locations CCH, the conditions of access to the memory MEM of the firewall FWL, and the access rights of the access right management unit MPU/MMU are then all aligned, that is to say, all consistent.
The cache memory locations CCH which are locked in step 404 can then be unlocked in step 410.
Locking 404 before changing 406 the attributes and unlocking 410 after changing the attributes allows guarding against possible evictions of cache memory locations CCH by the implementation of the process 400 itself.
Finally, the interrupts of the processing unit CPU are reactivated in a final step 412 of the process 400.
It is tolerable to deactivate the interrupts during the whole process 400, given the simplicity of implementation and therefore the speed of execution of said process 400.
While this invention has been described with reference to illustrative embodiments, this description is not intended to be construed in a limiting sense. Various modifications and combinations of the illustrative embodiments, as well as other embodiments of the invention, will be apparent to persons skilled in the art upon reference to the description. It is therefore intended that the appended claims encompass any such modifications or embodiments.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2107717 | Jul 2021 | FR | national |
