Classifications

• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
  • G06F13/38—Information transfer, e.g. on bus
  • G06F13/42—Bus transfer protocol, e.g. handshake; Synchronisation
  • G06F13/4282—Bus transfer protocol, e.g. handshake; Synchronisation on a serial bus, e.g. I2C bus, SPI bus
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
  • G06F13/14—Handling requests for interconnection or transfer
  • G06F13/36—Handling requests for interconnection or transfer for access to common bus or bus system
  • G06F13/362—Handling requests for interconnection or transfer for access to common bus or bus system with centralised access control
  • G06F13/364—Handling requests for interconnection or transfer for access to common bus or bus system with centralised access control using independent requests or grants, e.g. using separated request and grant lines
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
  • G06F13/38—Information transfer, e.g. on bus
  • G06F13/40—Bus structure
  • G06F13/4004—Coupling between buses
  • G06F13/4022—Coupling between buses using switching circuits, e.g. switching matrix, connection or expansion network
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
  • G06F21/82—Protecting input, output or interconnection devices
  • G06F21/85—Protecting input, output or interconnection devices interconnection devices, e.g. bus-connected or in-line devices

Definitions

• the invention relates to the field of systems-on-chip often referred to as the English word System on chip or its abbreviation SoC.
• the invention relates more particularly to systems on a chip in which interconnections between modules are performed by internal computer buses and associated routing control means.
• Soc system-on-a-chip
• a Soc is a complete on-chip system that can include one or more processors, memory, interface peripherals, and / or other components required to perform a complex function.
• a Soc can also designate a mixed system comprising digital elements, analog elements, and analog / digital converters.
• FPGA-type SoCs generally have a hierarchical architecture: "master” modules perform read or write access requests to so-called “slave” modules.
• masters are processors or DMA controllers
• slaves are storage memories or network devices.
• Interconnections between masters and slaves are typically supported by internal computer buses compatible with one or more communication protocols.
• AMBA Advanced Microcontroller Bus Architecture
• AHB Advanced High-Performance Bus
• AXI Advanced Extensible Interface
• FIG. 1 represents a computer bus B providing interconnections between k master modules Mi, i e [1, / c] and n slave modules Sj, j e [l, n].
• This bus comprises k slave ports PSi, i e ll, k ⁇ on each of which is connected a master module, and n master ports PMj, j e l, nj, on each of which is connected a slave module.
• the bus is seen as a slave by each master module, and seen as a master by each slave module.
• data can be transmitted according to a specific communication protocol.
• the bus B comprises internal routing means, for example one or more switch stages represented in FIG. 1 by dashed arrows. These means ensure the routing of communications between a master and a slave, such as read or write access requests issued by a master to a slave.
• the bus B illustrated in FIG. 1 carries out all possible interconnections between one of the k masters and one of the n slaves, ie k * n interconnections.
• the slave S1 can for example receive requests issued by several masters, and be in shared access between them.
• Bus B also allows parallel access of masters if they access separate slaves by means of separate internal switches.
• the NIC-301 connector for ARM architecture is a black box that does not offer the possibility of prohibiting certain interconnections between its slave ports and its master ports.
• computer buses may be subject to failures generating erroneous switches which can then cause slowdowns in access to a slave or even their complete blockage.
• failures can for example be caused by transistors-type elements, sensitive to transient effects (Single Event Upset).
• the invention aims to exert a control of the communications between master modules and slave modules of a system-on-a-chip which transit by a computer bus so as to prevent unauthorized communications.
• the invention particularly relates to an access filtering method in a system on a chip comprising at least one master module, at least one slave module and a bus, the bus comprising at least one slave port, at least one port master and interconnection means between at least one of the slave port and at least one of the master port, the method being characterized in that it comprises the following steps implemented when an access request is routed from a master module connected to a slave port to a slave module connected to a master port:
• the interception step of the proposed filtering method is carried out downstream of the interconnection bus, as close as possible to the slave module.
• forbidden accesses of multiple origins can be avoided: not only prohibited accesses caused by a request incorrectly configured by the sending master module, but also forbidden accesses caused by routing errors internal to the interconnection bus.
• the invention therefore allows fine control of the interconnections on any commercially available AMBA computer bus, or any other bus adapted to perform interconnections between master modules and slave modules. Adapting a computer bus for the specific interconnection requirements of a system-on-a-chip is therefore not necessary, and thus reduces the costs of designing and manufacturing the system-on-a-chip.
• the proposed method may advantageously be supplemented by the following characteristics taken individually or combined when technically possible.
• the source information may include a unique identifier of the slave port through which the request passes.
• the source information may further include an identifier of the master module that issued the request. This makes it possible to identify with certainty the source of the request, and thus to operate filtering by master module.
• the source information can be formed by concatenating the identifier of the master module and the unique identifier of the slave port, so as to offer a finer filtering according to two criteria (source module and route followed), and a compact transport of these two criteria in the same source information, carried by a single request.
• the identifier of the master module may also be associated with a context of transmission of the request by the master module. This has the effect of offering a non-binary filtering criterion, and therefore more flexible, requests from the same master module. Some requests from this master module may be filtered, and some others from the same master module may not be filtered, depending on the associated broadcast context.
• the search step may be performed in two access control lists to the slave module, one containing information of sources authorized for reading and the other containing information of sources authorized for writing.
• the method according to the invention can advantageously be implemented in architectures comprising an AMBA type bus.
• the blocking step may comprise a zero positioning of a signal transmitted to the slave module, the signal being AWVALID if the query is a write request, or ARVALID if the request is a read request.
• the blocking step may comprise the zero positioning of an HSEL signal transmitted to the slave module) .
• the blocking step may include the zero positioning of a PSEL signal transmitted to the slave module.
• the method according to the invention may also comprise an additional step of sending an exception message to an interrupt controller after a blocking of the request.
• a message can notify the controller of the occurrence of a blockage, so that it can handle the blockage in the most appropriate manner.
• a device for controlling access to a slave module via an interconnection bus comprising storage means and data processing means for implementing the aforementioned filtering method.
• an assembly comprising at least one master module, at least one slave module, a bus providing interconnection between at least one of the master modules and at least one of the slave modules, and at least one access control device As mentioned above and connected to a bus master port and to one of the slave modules.
• FIG. 1 schematically represents a known on-chip system.
• FIG. 2 represents a sequence of signals of the AXI protocol transmitted during a reading.
• FIG. 3 represents a signal sequence of the AXI protocol transmitted during a write.
• FIG. 4 represents a step diagram of the filtering method according to the invention.
• FIG. 5 schematically shows a system-on-chip protected by a filter device according to the invention.
• the AXI protocol defines a single interface to describe the communications between a master module and a slave module, a master module and the slave port of a bus, or the master port of a bus and a slave module.
• This interface consists of five channels: two dedicated playback channels (one control channel and one data channel) and three write channels (a control channel, a data channel, and a response channel).
• the channels each transmit a set of signals unidirectionally.
• the read control channel transmits request signals from the master to the slave, while the read data channel then returns data carrying signals from the slave to the master.
• FIG. 2 illustrates, for example, a signal positioning sequence for reading a burst of data.
• FIG. 2 illustrates, for example, a signal positioning sequence for a burst reading according to the AXI protocol, carried out in four data transfers.
• the functions of the signals used are summarized in the table below:
• ARREADY Slave Indicates whether the slave is ready (1) or not (0) to accept a read address and associated control signals.
• RREADY Master Indicates whether the master is ready (1) or not (0) to receive read data.
• RVALID Slave Indicates whether the expected read data is ready for transfer (1) or not (0)
• a read transaction according to the AXI protocol comprises the following steps.
• the ACLK signal is synchronized to the clock of a master.
• the master sends the signal ARADDR containing a read address A of the slave to which it wishes to access reading.
• the master sets the signal ARVALID to signify to the recipient slave the validity of the address A.
• the slave confirms the availability of address A by positioning the ARREADY signal.
• the master then sets the RREADY signal to one to indicate to the slave that he is ready to read data.
• FIG. 2 illustrates a reading of four transfers D (A0), D (A1), D (A2) and D (A3).
• the RVALID signal is set to one by the slave to indicate to the master the validity of the data.
• the signal RLAST is set to one at the beginning of the last transfer D (A3).
• the reading illustrated in FIG. 2 is carried out in thirteen clock shots (between clock ticks T0 and T13).
• FIG. 3 shows an example of a signal positioning sequence for writing according to the AXI protocol also carried out in four data transfers.
• the functions of these signals are summarized in the table below:
• AWREADY Slave Indicates whether the slave is ready (1) or not (0) to accept a write address and associated control signals.
• WREADY Slave Indicates whether the slave is ready (1) or not (0) to receive write data.
• WVALID Master Indicates whether the write data is ready for transfer (1) or not (0) to the slave.
• a read transaction according to the AXI protocol comprises the following steps.
• the ACLK signal is synchronized to a source clock.
• a master transmits the AWADDR signal containing a write address A of the slave to which it wishes to access.
• the master sets the signal AWVALID to indicate to the receiving slave the validity of the address A.
• the slave confirms the availability of the address A by setting the signal AWREADY to one.
• the slave then sets the WREADY signal to one to indicate to the master that it is ready to receive data to write.
• FIG. 3 illustrates a burst of four transfers D (A0), D (A1), D (A2) and D (A3).
• the signal BREADY is set to one by the master to indicate that it is ready to receive a write result which will be transmitted at the end of the sequence.
• the signal WVALID is set to one by the master to signify to the slave the validity of the data to be written.
• the signal WLAST is set to one at the beginning of the last transfer.
• the slave then sets the BRESP signal to OKAY. This positioning is accompanied by a positioning of the signal BVALID to one during the duration of transmission of the OKAY value. The master finally repositions the BREADY signal to zero once this value is received.
• the writing illustrated in FIG. 3 is made in ten clock strokes (between the clock ticks T0 and T10).
• Each interface between an AMBA-compliant bus and a slave or master module can implement one of the AMBA family protocols.
• a system-on-a-chip comprising at least one master module M1, Mi, Mk, at least one slave module S1, Sj, Sn and a bus B.
• the bus B comprises interconnection means for communicating at least one slave module Sj with at least one module M1, Mi, Mk.
• the communication path between a master module Mi and a slave module Sj comprises at least two communication links: a first communication link between the master module Mi and a slave port PSi of the bus B, and a second communication link between a port master PMj of the bus B and the slave module Sj.
• the signals emitted by the secondary master module Mi pass through the slave port PSi, then are routed by the bus B to the master port PMj and are then transmitted to the slave module Sj connected to this master port PMj.
• the signals emitted by the slave module Sj destined for the secondary master Mi follow the same route in the opposite direction.
• a request is requested by a master module Mi and routed to a slave module Sj.
• a first step "CATCH" is to intercept at a point in the system information source INFO before the slave module Sj receives the request.
• INFO source information means information transported by one or more signals of the communication protocol used, which uniquely defines at least a portion of the route traveled between the source master module and the interception point.
• the source information INFO is searched for in at least one access control list Lj to the slave module Sj.
• This list Lj previously recorded contains source information authorized by the system to make accesses to the slave module Sj.
• the "CATCH" interception step is preferably performed as close as possible to the slave module Sj so as to obtain source information defining a longest possible portion of the road, preferably on the link between the master port PMj of bus B through which the request has passed and the slave module Sj.
• the INFO source information may include a unique port identifier IDPSi previously assigned to the slave port PSi through which the request has transited.
• IDPSi unique port identifier
• the INFO source information makes it possible to determine the routing performed by the bus from a slave port to a master port. It is therefore possible to detect routing errors caused by at least one of the crossed buses, and errors caused by a master module requesting unauthorized access to a slave module.
• the INFO source information may further include an IDMi identifier that identifies the master module Mi that issued the request. This makes it possible to identify with certainty the source of the request.
• the AXI protocol can be used on the communication link between the master port PMj and the slave module Sj.
• the identifier of the master module can then be detected by interception of the following signals transmitted by the master module to the slave module:
• the signal AWID on the control channel in the case of a write request
• the WID signal on the data channel in the case of a write request
• the ARID signal on the control channel in the case of a read request.
• a master may need to issue different types of requests to the same slave: for example, a processor may issue multiple read requests to a memory device, each request being handled in a specific process.
• an improvement of the method can consist in attaching to associate the identifier IDMi to a transmission context of the request sent by a master module Mi. This improvement makes it possible to perform additional discrimination among the requests coming from the same module master.
• This context can typically be a unique process identifier.
• source information INFO corresponds to the concatenation of the unique identifier IDPSi of the slave port Psi and the identifier IDMi characteristic of a type of request issued by the master module Mi.
• the search step "SEARCH” can furthermore be carried out in two distinct access lists LWj and LRj, the list LRj containing information of sources authorized to carry out read requests on the slave module Sj and the list LWj containing source information authorized to perform write requests on the slave module Sj. This optimization makes it possible in particular to reduce the duration of the search step.
• the "BLOCK" blocking step can be performed by modifying on the fly the positioning of at least one of the signals received from the master port PMj of the last bus traversed and of transmitting these repositioned signals to the slave module Sj so that the latter ignore the request originally issued by the master module Mi.
• the query is found in the list corresponding, all signals received from the master port are transmitted to the slave module without modification.
• the repositioned signals depend on the communication protocol chosen between the bus B and the slave module Sj.
• the AWVALID signal can be repositioned to zero if the request is a write request. This value of zero makes it possible to make the slave module Sj believe that no address is available on the write control channel, and thus to ignore the request.
• the ARVALID signal can be reset to zero if the request is a write request. This value makes it possible to make the slave module Sj believe that no address is available on the read control channel, and thus to ignore the request.
• the HSEL signal can be set to zero.
• the PSEL signal can be set to zero.
• the method comprises an additional step of sending "ERR" of an exception message EX to an interruption controller (not shown) of the system-on-a-chip, after the blocking step "BLOCK".
• This controller can for example be integrated with the master If having originated the blocked request, so that it can handle the blockage in the most appropriate manner.
• the invention also relates to a filter Fj, G [l, n] implementing the method described above.
• This filter can, optionally, be integrated in a bus, be part of a slave module, or be in the form of a standalone module placed on the link between a master port of a bus and a slave module , as illustrated in FIG.
• the filter comprises storage means for storing at least one access control list Lj, G [l, n], for example one or more memories, for example flash type, triplicated RAM or EEPROM.
• the storage size of these means is proportional to the encoding length of a source information, and the number of information sources allowed.
• Authorized source information contained in stored lists may be written only once before the system-on-a-chip provisioning, or dynamically reconfigured.
• the filter further comprises processing means for performing the various steps of the filtering method described.
• the invention also relates to an assembly illustrated in FIG. 4 comprising at least one master module Mi, ie [1, / c], at least one slave module Sj, I [l, n], a bus B conforming to the AMBA standard providing a interconnection between at least one of the master modules and at least one of the slave modules, and at least one filter Sj, jel, nJ as described above.
• the storage means of each filter Sj make it possible to store the two lists LRj and LWj already described.
• this set comprises as many positioned filters as slave modules, each filter being inserted between the bus B and each slave module, as illustrated in FIG. 4. Such a set is therefore entirely protected against any unauthorized request to any slave module. .
• the invention relates to a system-on-chip comprising at least one set as described above.

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Physics & Mathematics (AREA)
• General Engineering & Computer Science (AREA)
• General Physics & Mathematics (AREA)
• Computer Hardware Design (AREA)
• Mathematical Physics (AREA)
• Computer Security & Cryptography (AREA)
• Software Systems (AREA)
• Bus Control (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=48901080

Family Applications (1)

Country Status (5)

Families Citing this family (7)

Family Cites Families (21)

• 2013
  • 2013-03-06 FR FR1352016A patent/FR3003054B1/fr active Active
• 2014
  • 2014-03-05 WO PCT/EP2014/054273 patent/WO2014135591A1/fr not_active Ceased
  • 2014-03-05 EP EP14708032.9A patent/EP2965260A1/de not_active Withdrawn
  • 2014-03-05 US US14/772,059 patent/US20160019180A1/en not_active Abandoned
• 2015
  • 2015-09-02 IL IL241074A patent/IL241074A0/en unknown

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events